I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding?

I know it's high privileges, but how can that not be enabled through a regular terminal?

I'm trying to find a new exploit and want to look at old ones to figure it out.

  • what do you mean by "root method"?
    – schroeder
    Commented May 17, 2016 at 17:32
  • 2
    I think OP wants to understand how people find exploits in order to root an Android phone.
    – A. Darwin
    Commented May 17, 2016 at 17:52
  • Yes that's it @A.Darwin. By root method I mean the way that high privileges is achieved.
    – Bryan
    Commented May 17, 2016 at 17:55
  • I suspect that depending on the device, it's one of the following: OEM's own internal root access tools got leaked, OEM published root access tools for developers, or just plain old reverse engineering. Commented May 17, 2016 at 20:13
  • Ok that makes sense, I had just read here (thehackernews.com/2016/03/android-root-hack.html) that a flaw in snapdragon processors allowed root. I'm trying to figure out old methods, like TowelRoot so I can actually see the process. I know TowelRoot wraps it in an APK so it exploits the vulnerability without the user knowing what exactly is going on inside. I'm looking for an inside view of source code that depicts the method.
    – Bryan
    Commented May 17, 2016 at 22:49

1 Answer 1


Most older Android "root methods" are using kernel exploits or exploits for drivers or applications running as root. More hardened phones are often attacked by booting an purpose crafted image without security measures in place. Goal of both methods is to place a su binary on the device that allows the user to give access when needed, without any further checks (it might trigger a dialog to confirm root access or be totally silent). If a device ships with a su binary already it is replaced as the original binary will not grant root access to the user.

  • Ok so the su binary that is to be placed on the phone would be created from scratch?
    – Bryan
    Commented Aug 31, 2016 at 16:17
  • @Bryan it has to be a Version of su that is able to interact with Android and it's user the right way (display a dialog don't ask for root credentials etc.) Commented Aug 31, 2016 at 16:49
  • Ok, what about root keys? Don't you need to crack those just to be able to build the binary file?
    – Bryan
    Commented Aug 31, 2016 at 23:48
  • What do you mean with "root Keys"? PKI has nothing to do with most rooting methods. Commented Sep 1, 2016 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .