adbd not running as root despite "adb root" - Android Q&A, Help & Troubleshooting

I build my own boot image for the Tolino Vision HD e-book reader (firmware 12.2.0, Android 4.4.2) just to enable adb on it. This went fine by setting the following lines in default.prop:
Code:
ro.secure=0
ro.adb.secure=0
ro.debuggable=1
persist.sys.usb.config=mass_storage,adb
persist.service.adb.enable=1
persist.service.debuggable=1
I'm able to run "adb shell", but am denied access to most directories, including /data/ and /system/.
Running "adb root" does not fail, but adbd is afterwards not running as root:
Code:
$ adb shell
[email protected]_6sl:/ $ id
uid=2000(shell) gid=2000(shell)
[email protected]_6sl:/ $ ps |grep adb
shell 2115 1 4592 212 ffffffff 00000000 S /sbin/adbd
$ adb root
restarting adbd as root
$ adb shell
[email protected]_6sl:/ $ id
uid=2000(shell) gid=2000(shell)
[email protected]_6sl:/ $ ps|grep adb
shell 3027 1 4588 208 ffffffff 00000000 S /sbin/adbd
What could be the reason for this behavior? I read that ro.debuggable allows adbd to become root, but that doesn't seem to be the case for my device.
----
Attached is a boot image for the Tolino Vision 4 HD with "adb root" enabled.

The most probable explanation is that adbd has been compiled without ALLOW_ADBD_ROOT.

tolino shine 2 HD
Hello Christian, your image runs like 'Schmitz Katze' on my tolino shine 2 HD. Maybe you should mention the link to your 'Tagebuch' here, since it's a nice manual (in English) or even open a tolino section here on xda. Tolino FW reverse stuff belongs (my opinion) here and not to all the German forums like ALLESebook, e-reader-forum, and others (thanks to all the guys there, who helped me to understand my tolino a bit).
You could mention in your 'Tagebuch' the option to try your boot.img with 'fastboot boot boot.img'.
Just scrcpy isn't running. I guess because of the 'adb reverse failed' error.
Code:
D:\aosp\scrcpy-win64-v1.10>scrcpy
INFO: scrcpy 1.10 <https://github.com/Genymobile/scrcpy>
D:\aosp\scrcpy-win64-v1.10\scrcpy-serv...shed. 1.3 MB/s (22546 bytes in 0.017s)
adb.exe: error: closed
ERROR: "adb reverse" returned with value 1
WARN: 'adb reverse' failed, fallback to 'adb forward'271
I'm writing this post by scrcpy, PC and my Redmi.

I managed to manually patch adbd on the Toloni Vision 4 HD and build my own boot image.
The process is described in a blog post: Getting ADB root access on a Tolino, which also has a link to download the boot image.
With it, "adb root" works and I was able to get access to all the files on the device. (File is also attached to the first post in this thread)

Alternative firmware (for almost all Tolino models)
@cweiske
This might interest you
https://forum.alles-ebook.de/thread/7152-alternative-firmware-for-almost-all-models/?pageNo=2#post86941

i have that issue with minimal adb and fastboot
try using this ADB thread starter claims it's the newest ADB compiled
https://forum.xda-developers.com/android/general/tool-adb-fastboot-installer-tool-windows-t3999445
it might support "adb root" commands

Related

[Tutorial] x10mini Linux helpers

Hello
Like some other guys i use linux on my PC. If you want to change your x10mini via shell you can do it but its not very confortable.
I made a few tools so it's easier to use.
Note: This "tricks" are only usefol to you if you are a little advanced with linux and want to "work" with your x10i via shell. I tested it all on a Debian 64bit but think most parts are universal.
1. Putting adb to /etc/bin
First of all you should put the adb-binary in /etc/bin/ so you can access it like every other cmd. You can use the binary in my attached tar or the one from SDK. use "sudo cp adb /system/bin/adb" (if you have a system with sudo, eg debian & ubuntu)
2. adb: error insufficient permissions for device
If you plug in the phone and want to connect via "adb shell" it may says that you don't have permissions for device. There is a workaround:
- Create file /etc/udev/rules.d/51-android.rules
- Put the following in the file:
Code:
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0fce", ATTRS{idProduct}=="2137", MODE="0666"
- restart udev "sudo service udev restart" (again this is debian&ubuntu-only)
if you still got "insufficient permissions", i made a little shell-script "adb-fix-permissions" attached in tar-file
3. bash-completition for adb
Bash is really annoying whitout completion. That means you can just start to type a word, then press [tab] and bash complets it for you. For example you type "adb ki[tab]" and bash complets it to "adb kill server"
To get this you need "adb_completition" from my attached zip or from here. Put this file in /etc/bash_completion.d/ and you got it.
example command to copy it:
"sudo cp adb_completition /etc/bash_completion.d/adb_completition"
4. Some keys not work in adb shell
This is a known and annoying bug. Eg in nano text editor you cant use the [enter]-key. There is a (little unclean) workaround for it: start a telnet-service on the phone, forward ports via adb and connetc to your phone via telnet. You will need telnetd from the attached tar. And your phone needs to be rooted.
- Remount system writable:
Code:
adb remount
- Put telnetd on your phone
Code:
adb push telnetd /system/bin/telnetd
- Make it executable:
Code:
adb shell chmod +x /system/bin/telnetd
for usage i have a little made a little script (in attached tar) "adb-shell".
Or you can do it manual:
Code:
adb telnetd &
adb forward tcp:9999 tcp:23
telnet localhost 9999
.. to be continued...
if you have one, please share your linux-android-tricks with me
thanks

[Q] Read partitions without rooting

I'm trying to find an universal way to read userdata partition(dump partition) without rooting the device.
Assumption :
the device can be boot in fastboot mode
Possible ways :
1. Using fastboot
I've looked into fastboot.c, it taking usb as a usb_handle pointer. I'm trying to move from that point. Fastboot is mostly to write or erase, but I assumed if writing and erasing are possible, reading should be possible as well.
2. Using nvflash, tftp...
It won't be the solution, since it's chip dependent but using chip vendor's download tool to dump partitions.
Go for it!
How does using adb dumping from /dev/mmcblk0p1 sounds?
can I unmount mmcblk0p1, and mount back to readable position?
what device? more info please.
dd if=dev/mmcblk0p? of=data.img bs= 8096 is usually the easiest. (<--just an example)
also this may be helpful:
http://forum.xda-developers.com/showthread.php?t=1247908
chrisrotolo said:
what device? more info please.
dd if=dev/mmcblk0p? of=data.img bs= 8096 is usually the easiest. (<--just an example)
also this may be helpful:
http://forum.xda-developers.com/showthread.php?t=1247908
Click to expand...
Click to collapse
Thanks for the link. using dd command is the exact way I used to dump mmc block as root. Or can it be run under not-rooted phones?
Rooting depends on the kernel version of devices, so when I have to dump various phones, it's very cumbersome to root different kinds of devices and dump.
So I'm finding a way to walk around the problem by using fastboot or if possible adb.
I think fastboot is my best bet so far.
How about adb?
adb shell
df -h
kkiqq1208 said:
How about adb?
adb shell
df -h
Click to expand...
Click to collapse
df -h will only show usage of storage medias. Is there anyway I can read off the actual data?
As already mentioned, dd, but via ADB. I believe that it functions at a low enough level that you should be able to dump mmcblk0 without having to be rooted. If dd can't be directly accessed via adb, you could extract a busybox install from a rooted phone and set it up in your adb directory and then run it from there with busybox (in theory).
Волк said:
As already mentioned, dd, but via ADB. I believe that it functions at a low enough level that you should be able to dump mmcblk0 without having to be rooted. If dd can't be directly accessed via adb, you could extract a busybox install from a rooted phone and set it up in your adb directory and then run it from there with busybox (in theory).
Click to expand...
Click to collapse
Question.
Feels like i'm on the different page from you. If i run dd for /dev/mmcblk0 it does give me an error message saying "Access Denied" of couse mmcblk0 is owned by root. And busybox too(I haven;t tried this), it's just a set of linux commnads, I'm not sure how it can access a file(in this case, a device) which does not have its ownership.
Please correct me if I'm wrong.
Hi All,
There is a way to dump any partition to SD card partition on unrooted device vi ADB.
Paste this couple of lines into the terminal :
adb kill-server
adb wait-for-device
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
adb reboot
adb wait-for-device
adb shell "mount -wo remount rootfs /"
adb shell "rm /data/local.prop"
adb shell dd if=/dev/block/mmcblk0p1 of=/sdcard/mmcp1.dump
The phone may reboot many time after that, so make sure the file /data/local.prop is deleted after this operation. or execute this :
adb reboot
adb wait-for-device
adb shell "rm /data/local.prop"
adb reboot
hope that helps
__________________
HTC One X (SFR)
Wissam said:
Hi All,
There is a way to dump any partition to SD card partition on unrooted device vi ADB.
Paste this couple of lines into the terminal :
adb kill-server
adb wait-for-device
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
adb reboot
adb wait-for-device
adb shell "mount -wo remount rootfs /"
adb shell "rm /data/local.prop"
adb shell dd if=/dev/block/mmcblk0p1 of=/sdcard/mmcp1.dump
The phone may reboot many time after that, so make sure the file /data/local.prop is deleted after this operation. or execute this :
adb reboot
adb wait-for-device
adb shell "rm /data/local.prop"
adb reboot
hope that helps
__________________
HTC One X (SFR)
Click to expand...
Click to collapse
Has anyone verified if this works for reading partitions on a non-rooted phone?
This doesn't work on an unrooted, locked device.
Code:
C:\Windows\System32>adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
/system/bin/sh: can't create /data/local.prop: Permission denied
This did not work for my phone.
I got "permission denied" right after
adb shell "echo ro.kernel.qemu=1 > /data/local.prop"
Most of the above will only work on a rooted device with superuser.
The loop holes for shadow copies are mostly fixed since 6.0.
Partitions that can be accessed without root can be dumped with DD through ADB if ADB itself is supported and not internally limited to prevent just this.
Try
Code:
adb reboot recovery
adb root
adb shell
In my device, I can able to read those /data /dev without bootloader unlocking or root.
HemanthJabalpuri said:
Try
Code:
adb reboot recovery
adb root
adb shell
In my device, I can able to read those /data /dev without bootloader unlocking or root.
Click to expand...
Click to collapse
So, ... You are lucky. If I try these commands, I am getting "error: closed". And believe it or not, I have my bootloader UNlocked. It's a doomed chinese tablet, Allwinner 100 SOC.
observingman said:
So, ... You are lucky. If I try these commands, I am getting "error: closed". And believe it or not, I have my bootloader UNlocked. It's a doomed chinese tablet, Allwinner 100 SOC.
Click to expand...
Click to collapse
I found that it is common for many Realme devices to able to use `adb root` in recovery mode.
I have a Realme C12 which has Mediatek Helio G35 MT6765G SoC. So we can also able to `readback` partitions by using SP Flash Tool with the help of MTK-bypass.

[Q] adb shell prompt

Hey everyone I got a very technical question
I am trying to set a custom prompt for the shell on an android device running bourne shell (sh), I have suceeded in setting it for a login shell (sh -l) but I would like to make this default for non login like adb or ssh through connectbot @localhost. Normally on linux I could do this by editing /etc/profile but for some reason on my android sh does not read /etc/profile unless it is a login shell. I tried moving the sh binary and replacing the sh binary in /system/bin with a shell script that executes sh -l but I loose superuser access ( shell reports su command not found) so I moved sh back to /system/bin/sh. Does anyone have any Idea which file is read in by sh at launch?

[Q] adbd root with ro.secure=0

Hi,
adb root prompt me that it is unable on product builds. But I gave a try this way after Googling. Though adb deamon is not in root mode I have rooted my device with the help of saferoot. (Thanks saferoot)
adb shell su (now with root)
I mount rootfs / in read write mode.
I notice default.prop file and open it using vi. Value of ro.secure=1 and ro.debuggable=0.
I change those value as follow: ro.secure=0 and ro.debuggable=1
exit from shell and execute adb kill-server and adb start-server
But still adb root tells that it is unable on product builds.
Can I get adbd run as root in this way? what has I missed.
Many thanks,
iua

[Q] Lollipop: insert message into logcat/logd from adb shell?

Hi everyone, I searched around but couldn't find anything similar.
On KitKat, I regularly insert my own messages into kernel and logcat logs from adb shell, either typing manually or with a batch file, in the following fashion:
Code:
adb shell "echo 'whatever' >/dev/kmsg"
adb shell "echo '\06title\0whatever\0' > /dev/log/main"
However on Lollipop, system logs (logcat) no longer use /dev/log/ but rather with a new "logd" mechanism with socket connection to /dev/socket/logdw for writing. However, if I simply modify my command to
Code:
adb shell "echo '\06title\0whatever\0' > [B]/dev/socket/logdw[/B]"
it does not work, instead giving an error message:
Code:
/system/bin/sh: can't create /dev/socket/logdw: No such device or address
But it does exist:
Code:
adb shell ls -l /dev/socket/logd*
srw-rw-rw- logd logd 1969-12-31 17:40 logd
srw-rw-rw- logd logd 1969-12-31 17:40 logdr
s-w--w--w- logd logd 1969-12-31 17:40 logdw
I'm not a software guy so not sure what is special with a socket connection. Is there any chance of being able to write to logcat directly with adb shell command, or will I need either an app or a compiled executable?
Thanks!
Came across this somewhat dated post as I was researching for the same thing.
I found a solution on stackoverflow dot com/a/33260551
Note, my phone is running 5.1.1, and you need to be rooted.
Code:
$ su -c which log && su -c log -h
/system/bin/log
USAGE: log [-p priorityChar] [-t tag] message
priorityChar should be one of:
v,d,i,w,e

Categories

Resources