Or, how do I root my device without a rooter?
Rooting instructions for Android devices that I have seen are typically of the following form:
- Run Gingerbreak, click “root device”
- Observe that
Superuser.apkhas been magically installed, possibly along with
busyboxand other things, and enjoy your rooty goodness.
What I am wanting to know is this: how does the rooting actually happen? What does Gingerbreak do?
I understand the end result of rooting:
suis present and working
Superuser.apkis installed and controls access to
- Various utilities are present, provided by BusyBox (optional?)
I also think I understand the basic idea of how Gingerbreak gets started — it exploits some local privilege escalation vulnerability and uses its new-found powers to deploy Superuser and whatever else is necessary.
So, unless I am wrong in some of the understanding I laid out above, the core of thing I want to know is what the root installer does to deploy and activate Superuser. It seems that just putting
Superuser.apk in the right place wouldn't be enough — how does it get allowed root access? How does it get hooked up to moderate that access for other applications?
What does Gingerbreak do post-exploit to enable and secure root access?