Tablet S 4.0.3 r1a rooted - Sony Tablet S

Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12
The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.
UPDATE:
A semi automatic script can be found at here.
Files you need:
adb tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)
For those who are no using the US firmware, the attached VpnFaker.apk may not suitable for your tablet.
Please follow this steps(click me) to resign the VpnFaker.apk. Thanks.
***Pls Execute the command line by line***
Unzip those files into a dir, Open cmd console, cd to that dir
Run the following command and press Restore on your tablet
Code:
adb restore settings.ab
Check the result
Code:
adb shell ls -ld /data/data/com.android.settings/a
[I][COLOR="DarkGreen"]drwxrwxrwx system system a[/COLOR][/I]
And continue, ignore the "rm -r a" permission denied error
Code:
adb shell
cd /data/data/com.android.settings
rm -r a
while : ; do ln -s /data a/file99; done
While the loop is running, open another cmd console and run
Code:
adb restore settings.ab
Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop
Check the /data permission
Code:
adb shell ls -ld /data
[I][COLOR="DarkGreen"]drwxrwxrwx system system data[/COLOR][/I]
Then continue
Code:
adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
cd /data/local/tmp
chmod 755 busybox
./busybox tar zxf rootkit.tar.gz
exit
Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp
Code:
adb push VpnFaker.apk /data/local/tmp
adb shell
touch -t 1346025600 /data/local/tmp/VpnFaker.apk
exit
Now, replace the VpnDialogs, ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2"
Code:
adb shell
cd /data
/data/local/tmp/busybox cp -r system system2
[COLOR="DarkGreen"]#Pls ignore "cp: can't open 'system/xxxxxxx': Permission denied"[/COLOR]
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
mv app app-
mkdir app
mv /data/local/tmp/VpnFaker.apk /data/app
Make sure the datatime is 2012/08/27 00:00
Code:
TZ=0 ls -l /data/app
[I][COLOR="DarkGreen"]-rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk[/COLOR][/I]
Generate the packages.xml
Code:
/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml
And double check the result
Code:
/data/local/tmp/busybox grep vpndialogs system/packages.xml
[I][COLOR="DarkGreen"]<updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
<package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">[/COLOR][/I]
Exit adb shell and reboot, you should see something like "Android is updating" during startup.
Code:
exit
adb reboot
Start the injected Terminal Emulator
Code:
adb shell am start -n com.android.vpndialogs/.Term
Unlock your tabet, The Terminal Emulator should appeared. If not, post your "adb logcat".
Now, in the Terminal Emulator
Code:
id
You should see the uid is 1000(system)
Still in the Terminal Emulator, ignore the script error
Code:
/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
/dev/sh
id
Check the uid is 2000(shell)
And
Code:
chown 0.0 /data/local/tmp/_su
chmod 6755 /data/local/tmp/_su
/data/local/tmp/_su
id
Check the root access uid 0(root)
Backup /system (you may just skip it)
Code:
dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K
Copy su & Superuser.apk to /system
Code:
/data/local/tmp/busybox mount -o rw,remount /system
/data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
chown 0.0 /system/xbin/_su
chmod 6755 /system/xbin/_su
/data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
chown 0.0 /system/xbin/su
chmod 6755 /system/xbin/su
/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
/data/local/tmp/busybox mount -o ro,remount /system
sync
exit
Check the /system _su is working or not
Code:
_su
id
Should be uid 0(root)
And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)
Code:
cd /data
mv app app2
mv app- app
mv system system2
mv system- system
exit
exit
Now, you Tablet S should be rooted.

---

I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.

---

SWFlyerUK said:
I'm getting permission denied rm -r a... hopefully someone can make a batch file for this.
Click to expand...
Click to collapse
You may just skip that error.
You can't delete that folder actually, just fake the system.

---

WonderEkin said:
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12
The original steps(this link) was written in Japanese, I've just translate it into Eng. But sorry for my bad English.
Click to expand...
Click to collapse
Good job and thank you. You beat me to the finish line, I was also translating (slowly) the original Japanese post into English by tediously using [B]http://www.bing.com/translator/[/B] and [B]http://translate.google.com/[/B] as my translators.
For convenience, those who do this rooting method may also want to copy the ADB files adb.exe, AdbWinApi.dll, and AdbWinUsbApi.dll (or download and extract ADB_v1.0.29.zip) into the same directory where they put the rooting files SonyTabletICS-2.zip, Superuser-3.1.3-arm-signed.zip, and VpnFaker.apk.
Now I just need to get an unrooted Sony Tablet S to test this method on. Perhaps I will unrooted my granddaughter's tablet.

---

This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:
Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.

---

A couple questions,
Couldthis method brick my tablet, or is safe try it?
Would this work doing it on Ubuntu Linux?
Thanks in advance!

---

SWFlyerUK said:
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:
Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.
Click to expand...
Click to collapse
Same Problem here, what to do now?

---

WonderEkin said:
Thanks Yupandra2012, my Tablet S 4.0.3 r1a finally rooted.
Ref: http://forum.xda-developers.com/showpost.php?p=31408901&postcount=12
Now, you Tablet S should be rooted.
Click to expand...
Click to collapse
Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?

---

SWFlyerUK said:
This stopped working for me when I had to launch VpnDialogs, activity not found - also had permission denied which meant I couldn't go further, mkdir app said mkrdir not found:
Code:
/data/local/tmp/busybox cp -r system system2
= Permission Denied.
Click to expand...
Click to collapse
Can you post the full command log?

---

WonderEkin said:
Can you post the full command log?
Click to expand...
Click to collapse
Sure, i tried it two times: (for any reason i can't copy the full log, sry)
C:\STS>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|[email protected]:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied

---

daniel910821 said:
A couple questions,
Couldthis method brick my tablet, or is safe try it?
Would this work doing it on Ubuntu Linux?
Thanks in advance!
Click to expand...
Click to collapse
Modify /data won't brick the device, you can wipe it if /data really corrupted.
For /system, those steps should be harmless
If you have and for Linux, then yes, should works on Linux

---

I can't get the restore settings part to work. All the files are extracted to the same folder as adb any ideas
Sent from my Sony Tablet S using xda app-developers app

---

rrlu21 said:
Thanks a lot for your hard work.
Before I start this root, I want to confirm with you whether this root will wipe out my installed app data?
Click to expand...
Click to collapse
I'm not sure this root will keep the installed app or not, as i've wipe my tablet many times to test the VpnFaker.apk...
But the steps will rename the original app folder and rename it back in the final steps. Should be no data lost.

---

TomaHawk93 said:
Sure, i tried it two times: (for any reason i can't copy the full log, sry)
C:\STS>adb shell
[email protected]:/ $ cd /data
cd /data
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
1|[email protected]:/data $ /data/local/tmp/busybox find system2 -type f -exec chmod
666 {} \
d system2 -type f -exec chmod 666 {} \ <
> /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \
> mv system system-
mv system system-
find: -exec requires an argument
1|[email protected]:/data $ mv system2 system
mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 systemcd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
cp: can't create directory 'system2': Permission denied
Click to expand...
Click to collapse
Seeme you paste multi lines of command at one time, am I correct?
Those command should execute one by one.
You can simple wipe the device and redo again
or
Can you execute the following code in adb shell so that I can give you the fallback command?
Code:
ls -la /data

---

My brother has this tablet and I plan on attempting to root this evening...

---

[/COLOR]video tut maybe ?

---

Resign VpnFaker.apk
Hi
Do I have to resign the file VpnFaker.apk? If yes can someone explain hoe this is done.
I can do all commands until the replacement of the VpnDialogs. Then I get stuck with 'permission denied'.
Regards Paul

---

Can we use this method to may root Xperia tablet s on 4.0.3?

---

im stuck @ replace the VpnDialogs
i get Permission denied for all
c:\sony>adb shell
[email protected]:/ $ cd /data
/data/local/tmp/busybox cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
c
d /data
mv app app-
mkdir app
mv /data/local/tmp/VpnFaker.apk /data/app /data/local/tmp/busybox
cp -r system system2
/data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
/data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
mv system system-
mv system2 system
mv app app-
[email protected]:/data $ /data/local/tmp/busybox cp -r system system2
mkdir app
cp: can't create directory 'system2': Permission denied
d system2 -type f -exec chmod 666 {} \; <
find: system2: No such file or directory
d system2 -type d -exec chmod 777 {} \; <
find: system2: No such file or directory
1|[email protected]:/data $ mv system system-
failed on 'system' - Permission denied
255|[email protected]:/data $ mv system2 system
failed on 'system2' - No such file or directory
255|[email protected]:/data $
255|[email protected]:/data $ mv app app-
failed on 'app' - Permission denied
255|[email protected]:/data $ mkdir app
mkdir failed for app, File exists
255|[email protected]:

---

zorbakun said:
Can we use this method to may root Xperia tablet s on 4.0.3?
Click to expand...
Click to collapse
It says so in the first post and the thread title also referrs to 4.0.3 r1a