I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding?

I know it's high privileges, but how can that not be enabled through a regular terminal?

I'm trying to find a new exploit and want to look at old ones to figure it out.

  • what do you mean by "root method"? – schroeder May 17 '16 at 17:32
  • 2
    I think OP wants to understand how people find exploits in order to root an Android phone. – A. Darwin May 17 '16 at 17:52
  • Yes that's it @A.Darwin. By root method I mean the way that high privileges is achieved. – Bryan May 17 '16 at 17:55
  • I suspect that depending on the device, it's one of the following: OEM's own internal root access tools got leaked, OEM published root access tools for developers, or just plain old reverse engineering. – childofsoong May 17 '16 at 20:13
  • Ok that makes sense, I had just read here (thehackernews.com/2016/03/android-root-hack.html) that a flaw in snapdragon processors allowed root. I'm trying to figure out old methods, like TowelRoot so I can actually see the process. I know TowelRoot wraps it in an APK so it exploits the vulnerability without the user knowing what exactly is going on inside. I'm looking for an inside view of source code that depicts the method. – Bryan May 17 '16 at 22:49

Most older Android "root methods" are using kernel exploits or exploits for drivers or applications running as root. More hardened phones are often attacked by booting an purpose crafted image without security measures in place. Goal of both methods is to place a su binary on the device that allows the user to give access when needed, without any further checks (it might trigger a dialog to confirm root access or be totally silent). If a device ships with a su binary already it is replaced as the original binary will not grant root access to the user.

  • Ok so the su binary that is to be placed on the phone would be created from scratch? – Bryan Aug 31 '16 at 16:17
  • @Bryan it has to be a Version of su that is able to interact with Android and it's user the right way (display a dialog don't ask for root credentials etc.) – Jonas Köritz Aug 31 '16 at 16:49
  • Ok, what about root keys? Don't you need to crack those just to be able to build the binary file? – Bryan Aug 31 '16 at 23:48
  • What do you mean with "root Keys"? PKI has nothing to do with most rooting methods. – Jonas Köritz Sep 1 '16 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.