June 19, 2013, 04:13:24 PM

collapse

* Sponsors


* Hot Topics


* Facebook Like


* Sponsors


* Board Stats

  • stats Total Members: 1216
  • stats Total Posts: 6351
  • stats Total Topics: 979
  • stats Total Categories: 3
  • stats Total Boards: 17
  • stats Most Online: 126

Author Topic: yareftpt - yet another root exploit for TPT  (Read 41609 times)

S.Prime

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 926
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #165 on: April 26, 2012, 02:34:55 PM »
How do you have CWM if you are not rooted? Did you buy your tablet new or used? If you want to ckeck download Root Checker Basic from Google Play and see if you have root.
IT Service Professional - I Just Want A Device to Be Productive

beatstreetkid

  • Newbie
  • *
  • Posts: 12
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #166 on: April 26, 2012, 03:42:54 PM »
Rooted it after i bought it new.When it wouldn't read my sd card when making a bu i unrooted but didn't uninstall cwm first, hence the $ sign question. Right after unrooting an update dropped literally right after rebooting from unroot. Now when i tried a second time rooting in normal mode the mobility pops up requiring a log in.

This is where I am

C:\Android\android-sdk\platform-tools>adb shell
~ # "/system/bin/mkdir /data/local/pwn"
"/system/bin/mkdir /data/local/pwn"
/sbin/sh: /system/bin/mkdir /data/local/pwn: not found
~ # adb shell "/system/bin/mkdir /data/local/pwn"
adb shell "/system/bin/mkdir /data/local/pwn"
/sbin/sh: adb: not found
~ # exit
exit
« Last Edit: April 26, 2012, 06:36:11 PM by beatstreetkid »

S.Prime

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 926
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #167 on: April 26, 2012, 08:03:27 PM »
You have exceeded my level on this one, but I fear that MM has blocked you from rooting, so your next hope is an exploit in ICS. If any of our advanced users or opdecirkel has a suggestion they can add their suggestions.
IT Service Professional - I Just Want A Device to Be Productive

beatstreetkid

  • Newbie
  • *
  • Posts: 12
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #168 on: April 27, 2012, 09:01:35 AM »
Thank you for your help.

coyttl

  • Jr. Member
  • **
  • Posts: 97
  • Causing small squirrels to commit suicide!
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #169 on: April 28, 2012, 10:08:30 PM »
Rooted it after i bought it new.When it wouldn't read my sd card when making a bu i unrooted but didn't uninstall cwm first, hence the $ sign question. Right after unrooting an update dropped literally right after rebooting from unroot. Now when i tried a second time rooting in normal mode the mobility pops up requiring a log in.

This is where I am

C:\Android\android-sdk\platform-tools>adb shell
~ # "/system/bin/mkdir /data/local/pwn"
"/system/bin/mkdir /data/local/pwn"
/sbin/sh: /system/bin/mkdir /data/local/pwn: not found
~ # adb shell "/system/bin/mkdir /data/local/pwn"
adb shell "/system/bin/mkdir /data/local/pwn"
/sbin/sh: adb: not found
~ # exit
exit
Remove your quotes. Change the line from:
~ # "/system/bin/mkdir /data/local/pwn"
To:
~ # /system/bin/mkdir /data/local/pwn

When you have quotes like that, the shell is trying to treat teh WHOLE THING as a single command,
Y
Edit:
Your commands are all wrong. THe first one you're doing:
C:\Android\android-sdk\platform-tools>adb shell
~ # "/system/bin/mkdir /data/local/pwn"

Should be one line:
C:\Android\android-sdk\platform-tools>adb shell "/system/bin/mkdir /data/local/pwn"

Or, if you want to do it all in the shell, then:
C:\Android\android-sdk\platform-tools>adb shell
~ # /system/bin/mkdir /data/local/pwn

The second line is failing because you're trying to run an adb shell while IN the shell already.

Either the bat file was saved incorrectly, or your clipboard copy had word-wraps in it.

--Mike.

gaohan

  • Newbie
  • *
  • Posts: 39
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #170 on: April 30, 2012, 04:47:16 AM »
Dear all,

I am new here and pretty new to tablets and android. Since I live in China, I had no choice but to buy a Chinese version of the Thinkpad. The major problem I am encountering is that apparently, Lenovo in all its wisdom does not provide the Google Market on the Chinese versions, and the lenovo store only contains chinese apps, which are not very useful for a non-native Chinese speaker like me. Needsless to say, I am desparate for a rooting method. I have tried the other method, and now this one. I have read this topic from a to z a number of times, but unfortunately, no cigar.

My system:
Kernel version: 2.6.36.3
Build number: ThinkPadTablet_A310_02_0039_0089_SC
Machine type and model: 183823C

I am not clear on how to find the version for OTA, so I cannot provide it.

I have tried the procedure numerous times, including several factory resets. Everything runs without problems until after step 8 where I have to type adb shell "/cache/recovery/pwn/su". I keep getting as reply "Permission denied", and the command prompt remains at $. I am at a loss what to do next, but I really need root access. Any help would be greatly appreciated.

Sincerely,

Gao Han

S.Prime

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 926
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #171 on: April 30, 2012, 05:04:27 AM »
Welcome to the forum. There are several members of our forum from China that have had success with your version, hopefully they will be able to offer some help. Remember that if your TPT is not rootable at this point, there is a good chance that it will be after you get ICS, next month. If Lenovo lives up to their promise to have the OTA available in May.

Sent from my ThinkPad Tablet using Tapatalk 2
IT Service Professional - I Just Want A Device to Be Productive

gaohan

  • Newbie
  • *
  • Posts: 39
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #172 on: April 30, 2012, 05:14:11 AM »
Thanks for the encouragement!

BTW: the outputs as requested on the first page:
Output for "$ /system/bin/mount":

Code: [Select]
/system/bin/mount
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p7 /sectmp ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0

Output for "$ /system/bin/cat /system/etc/install-recovery.sh":

Code: [Select]
/system/bin/cat /system/etc/install-recovery.sh
/system/bin/chmod 777 /cache
/system/bin/mount -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/mount -oremount,rw -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/chmod 777 /cache/recovery
/system/bin/chown root /cache/recovery/pwn/su
/system/bin/chmod 4777 /cache/recovery/pwn/su
Disable battery discharge...
/system/bin/chmod 777 /cache
/system/bin/mount -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/mount -oremount,rw -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/chmod 777 /cache/recovery
/system/bin/chown root /cache/recovery/pwn/su
/system/bin/chmod 4777 /cache/recovery/pwn/su
Disable battery discharge...
/system/bin/chmod 777 /cache
/system/bin/mount -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/mount -oremount,rw -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/chmod 777 /cache/recovery
/system/bin/chown root /cache/recovery/pwn/su
/system/bin/chmod 4777 /cache/recovery/pwn/su
Disable battery discharge...

Output of "$ /system/bin/ls -l /cache"

Code: [Select]
/system/bin/ls -l /cache
drwx------ root     root              1970-01-01 08:00 lost+found
drwxrwxrwx root     root              2012-04-30 16:59 recovery

Output of "$ /system/bin/ls -l /cache/recovery"

Code: [Select]
/system/bin/ls -l /cache/recovery
-rw-r----- root     root         4641 2012-04-30 16:59 last_log
-rw-rw-rw- root     root         4641 2012-04-30 16:59 log

Ouptput of "$ /system/bin/ls -l /tmp/recovery.log"

Code: [Select]
/system/bin/ls -l /tmp/recovery.log
-rw-rw-rw- root     root         4641 2012-04-30 16:59 recovery.log

gaohan

  • Newbie
  • *
  • Posts: 39
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #173 on: April 30, 2012, 10:21:59 PM »
Dear all,

Still no luck. I did go over the script manually and I found this:
Code: [Select]
adb shell "echo \"/system/bin/chmod 777 /cache\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/mount -t ext4 /dev/block/mmcblk0p4 /cache\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/chmod 777 /cache\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/mount -oremount,rw -t ext4 /dev/block/mmcblk0p4 /cache\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/chmod 777 /cache\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/chmod 777 /cache/recovery\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/chown root /cache/recovery/pwn/su\" >> /tmp/recovery.log"
adb shell "echo \"/system/bin/chmod 4777 /cache/recovery/pwn/su\" >> /tmp/recovery.log"

Because it is all rerouted to /tmp/recovery.log I did not see any errors. I now did it without the rerouting, just let the output go to the screen and then I see:
unable to chmod /cache: Operation not permitted
mount: operation not permitted
Unable to chmod /cache: Operation not permitted
mount: operation not permitted
unable to chmod /cache: Operation not permitted
etc.

The log file that everything is written to: (i.e. adb shell "/system/bin/cat /tmp/recovery.log")
Code: [Select]
Starting recovery on Tue May  1 10:09:16 2012
can't open /dev/tty0: No such file or directory
framebuffer: fd 3 (1280 x 800)
recovery filesystem table
=========================
  0 /tmp ramdisk (null) (null) 0
  1 /recovery emmc /dev/block/mmcblk0p1 (null) 0
  2 /boot emmc /dev/block/mmcblk0p2 (null) 0
  3 /system ext4 /dev/block/mmcblk0p3 (null) 0
  4 /cache ext4 /dev/block/mmcblk0p4 (null) 0
  5 /misc emmc /dev/block/mmcblk0p5 (null) 0
  6 /staging emmc /dev/block/mmcblk0p8 (null) 0
  7 /data ext4 /dev/block/mmcblk0p10 (null) 0
  8 /sdcard vfat /dev/block/mmcblk1p1 (null) 0

Command: "/sbin/recovery"

ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=1
ro.build.id=ThinkPadTablet_A310_02
ro.build.display.id=ThinkPadTablet_A310_02_0039_0089_SC
ro.build.version.incremental=0039_0089_SC
ro.build.version.sdk=12
ro.build.version.codename=REL
ro.build.version.release=3.1
ro.build.date=Mon Mar  5 17:45:19 CST 2012
ro.build.date.utc=1330940719
ro.build.type=user
ro.build.user=build
ro.build.host=build-desktop
ro.build.tags=release-keys
ro.product.model=ThinkPad Tablet
ro.product.brand=Lenovo
ro.product.name=ThinkPadTablet
ro.product.device=Indigo
ro.product.board=ventana
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Lenovo
ro.product.locale.language=zh
ro.product.locale.region=CN
ro.wifi.channels=
ro.board.platform=tegra
ro.build.product=Indigo
ro.build.description=ventana-user 3.1 ThinkPadTablet_A310_02 0039_0089_SC release-keys
ro.build.fingerprint=Lenovo/ThinkPadTablet/Indigo:3.1/ThinkPadTablet_A310_02/0039_0089_SC:user/release-keys
ro.build.characteristics=tablet
ro.product.input.defaultpkg=
ro.opengles.version=131072
wifi.interface=wlan0
service.mtp.defult_lock=true
keyguard.no_require_sim=1
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.com.google.clientidbase=android-lenovo
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.factorytest=0
ro.serialno=MP08K7T
ro.machinetypeandmodel=183823C
ro.uuid=f042b7426dbc11e19f640008caa460c5
wifi.support.wapi=yes
ro.bootmode=unknown
ro.baseband=unknown
ro.carrier=wifi-only
ro.bootloader=unknown
ro.hardware=ventana
ro.revision=0
ro.crypto.fs_type=ext4
ro.crypto.fs_real_blkdev=/dev/block/mmcblk0p10
ro.crypto.fs_mnt_point=/data
ro.crypto.fs_flags=0x00000406
ro.crypto.state=unencrypted
persist.mouse.product_name=none
persist.ota.charging.=false
persist.ota.battery.=72
persist.sys.IMEid=com.android.inputmethod.latin/.LatinIME
persist.sys.IMEsubtypeId=-1
persist.sys.kcmPtr=0
persist.sys.profiler_ms=0
persist.mouse.sensitivity=1
persist.mouse.LButtonFunction=1
persist.mouse.RButtonFunction=2
persist.sys.language=en
persist.sys.country=US
persist.sys.localevar=
persist.sys.timezone=Asia/Shanghai
persist.device.provision=true
persist.ota.REC_FINISH=
persist.ota.UPDATE_READY_ONCE=
persist.ota.UPDATE_READY_DAILY=
init.svc.recovery=running
init.svc.adbd=running


-- Install /sdcard ...
Finding update package...
I:Update location: /tmp/sideload/package.zip
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1844 bytes; signature 1826 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
Installing update...
mount: failed to mount /dev/block/mmcblk0p3 at /system: Device or resource busy
script aborted: assert failed: file_getprop("/system/build.prop", "ro.build.fingerprint") == "Lenovo/Indigo/18382AU:3.1/
ThinkPadTablet_A310_02/0024_0052_US:user/release-keys" ||
       file_getprop("/system/build.prop", "ro.build.fingerprint") == "Lenovo/ThinkPadTablet/Indigo:3.1/ThinkPadTablet_A3
10_02/0024_0060_US:user/release-keys"
assert failed: file_getprop("/system/build.prop", "ro.build.fingerprint") == "Lenovo/Indigo/18382AU:3.1/ThinkPadTablet_A
310_02/0024_0052_US:user/release-keys" ||       file_getprop("/system/build.prop", "ro.build.fingerprint") == "Lenovo/Th
inkPadTablet/Indigo:3.1/ThinkPadTablet_A310_02/0024_0060_US:user/release-keys"
E:Error in /tmp/sideload/package.zip
(Status 7)
Installation aborted.
-- Wiping cache...
Formatting /cache...
Deleting delvik-cache...
Creating filesystem with parameters:
    Size: 943718400
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 7200
    Inode size: 256
    Journal blocks: 3600
    Label:
    Blocks: 230400
    Block groups: 8
    Reserved block group size: 63
Created filesystem with 11/57600 inodes and 7544/230400 blocks
Cache wipe complete.
/system/bin/chmod 777 /cache
/system/bin/mount -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/mount -oremount,rw -t ext4 /dev/block/mmcblk0p4 /cache
/system/bin/chmod 777 /cache
/system/bin/chmod 777 /cache/recovery
/system/bin/chown root /cache/recovery/pwn/su
/system/bin/chmod 4777 /cache/recovery/pwn/su

Any help much much appreciated...

Gao Han

coyttl

  • Jr. Member
  • **
  • Posts: 97
  • Causing small squirrels to commit suicide!
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #174 on: May 01, 2012, 01:46:03 PM »
Dear all,

Still no luck. I did go over the script manually and I found this:
Code: [Select]
adb shell "echo \"/system/bin/chmod 777 /cache\" >> /tmp/recovery.log"
[/quote]
I don't have a copy of the script in front of me - but remind me, is there ANY commands run on the device before the chmod 777 /cache?

--Me.

gaohan

  • Newbie
  • *
  • Posts: 39
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #175 on: May 01, 2012, 08:27:31 PM »
Hi Coyttl,

Thanks for thinking with me. Yes there is:

Code: [Select]
adb shell "/system/bin/mkdir /data/local/pwn"
adb shell "/system/bin/mkdir /data/local/pwn-bak"
adb shell "/system/bin/cat /system/etc/install-recovery.sh > /data/local/pwn-bak/install-recovery.sh.orig"

adb shell "/system/bin/mkdir /cache/recovery/pwn"
adb push su /cache/recovery/pwn 

And this seems to run without any errors. The mkdir 's  work for sure, as I know the directories are created. The push works to, becaue I can see the file being uploaded.

Once again, thanks!

Gao Han

coyttl

  • Jr. Member
  • **
  • Posts: 97
  • Causing small squirrels to commit suicide!
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #176 on: May 02, 2012, 10:08:27 AM »
Hi Coyttl,

Thanks for thinking with me. Yes there is:

Code: [Select]
adb shell "/system/bin/mkdir /data/local/pwn"
adb shell "/system/bin/mkdir /data/local/pwn-bak"
adb shell "/system/bin/cat /system/etc/install-recovery.sh > /data/local/pwn-bak/install-recovery.sh.orig"

adb shell "/system/bin/mkdir /cache/recovery/pwn"
adb push su /cache/recovery/pwn 
Hmm.. run these commends for me, and copy the output here:
Code: [Select]
adb shell
$ ls -l
Don't type the "$", it'll be there already.

The odd thing is, without root, *I* don't have access to my /cache directory either, so I can't run the "mkdir /cache/recovery/pwn" command either. At least, until I run su. So I may not be much help after this. :(

beatstreetkid

  • Newbie
  • *
  • Posts: 12
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #177 on: May 02, 2012, 01:13:38 PM »
Thx for your help. Went to directory where my su files were and the root took. Lovin life now.
One concern. When making a nandroid bu,  of m my stock r rom, when i get to "backing up data" it gets to a  point then says "error backing up data" any idea why? Could it be an issue with the stock rom? everything else is good.

coyttl

  • Jr. Member
  • **
  • Posts: 97
  • Causing small squirrels to commit suicide!
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #178 on: May 02, 2012, 01:32:54 PM »
I was able to make a nandroid fine, and I'm on stock. Are there any other messages given?

(I had trouble the first time, because my SD card had popped out of its slot. Once I removed and reinserted it, it worked fine.)

S.Prime

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 926
    • View Profile
Re: yareftpt - yet another root exploit for TPT
« Reply #179 on: May 02, 2012, 02:29:09 PM »
Also make sure you download the correct version of CMW for your tablet.

IT Service Professional - I Just Want a Device to be Productive
IT Service Professional - I Just Want A Device to Be Productive

 




SimplePortal 2.3.3 © 2008-2010, SimplePortal