Why rooting Android depends on phone and manufacturer?

[spark]

Hi everybody
As the title says, Why rooting Android depends on phone and manufacturer?
If we assume that rooting is running an exploit to get root in an unmodified version of android, then having administrative privileges we remount /system as read-write to install the SU binary and superuser.apk package. This seems to be just OS dependent, or am i missing some thing?

[puddi]

well ofcrouse it's different for each manufacter. some require bootloader unlocking. take windows for instance, how the hell do you think we root it?

[spark]

Ok but if we take Samsung for example that ships mostly unlockable, why almost every model have a specific rooting procedure?
Does this mean that the "cryptographic signature verification" implemented on bootloader differs even within samsung models?





"EDIT: spelling mistake"

[techb]

You have to understand everything that happens on a computing device is hardware level. The physical chips used to store bootloaders and store memory are different. The registers on these chips are all set up different, bootloader gets loaded on different registers in RAM along with OS. The procedures to manipulate the registers for unlocking are specific to each chip. Fucking with one register location in one phone will be different on another, so if or when you mess with the wrong location you can corrupt the bootloader or OS and brick your device

[spark]

OK
Thank you guys for the quick response

[p_2001]

Htc.. Has hardware locked. Nand memory is locked. Well certain partitions...

Samsung.. The problem is the kernel. This kernels are protected.
For Samsung rooting is straight.. Instal new kernel.


Rooting isn't exactly an exploit.. It is just an enhancement.

We used exploits but now it is so mainstream..

Like htc provide an unlock key for a bootloader.
But voids warranty.


All in all rooting is difficult because to escalate privileges you need to somehow instalan application without the os running.

To do that you use a custom recovery and to do that you need to unlock boot loader.

The adb shell in Android sdk gives you root access from the pc. From which you install an a recovery, which in turn installs the su app to give root from phone.

The other way is to instal a custom ROM but that to requires an unlocked bootloader.

[spark]

The adb shell in Android sdk gives you root access from the pc. From which you install an a recovery, which in turn installs the su app to give root from phone.

If the adb shell is rooted, we can directly install the su app. But by default it is not and we need a work around like the RATC exploit  http://thesnkchrmr.wordpress.com/2011/03/24/rageagainstthecage (know it's too mainstream  but i am just beginning my investigation on rooting  )
is that correct?

[s3my0n]

You can root an android phone without running an exploit by copying busybox and su to android memory through Linux and changing permissions of those files to root.

[p_2001]

If the adb shell is rooted, we can directly install the su app. But by default it is not and we need a work around like the RATC exploit  http://thesnkchrmr.wordpress.com/2011/03/24/rageagainstthecage (know it's too mainstream  but i am just beginning my investigation on rooting  )
is that correct?

Actually for my htc... I unlocked the boot loader
And used the adb shell..
adb
Su
And it worked!
i don't know about other phones.
but using adb su is called temp root.

[spark]

You can root an android phone without running an exploit by copying busybox and su to android memory through Linux and changing permissions of those files to root.

You need to be already root to change permissions of other files to root.
And the exploit or whatever the trick is, aims to give you temporary administrative privileges to continue messing around with the system.

[Stackprotector]

There are different versions of one phone (mostly), ones with 4G, or only 3G. Some provider has its own overlay. As well as the manufacturer does (htc sense, touchwiz etc.). and providers can set their own locks etc.

[s3my0n]

You need to be already root to change permissions of other files to root.
And the exploit or whatever the trick is, aims to give you temporary administrative privileges to continue messing around with the system.

Since you are uploading files from Linux (your PC) to the android phone, the permissions are copied to the android. If you connect the android phone to your Linux PC, then you can change whatever data there is on the android, including the permissions of files etc.

[spark]

Since you are uploading files from Linux (your PC) to the android phone, the permissions are copied to the android.

No, consider for instance copying file with 4405 permissions (setuid flag on) to the android file system, and you will find that permissions have changed  (no setuid flag)..
Also the destination file is naturally not owned by the same user as the source file.
In fact you need to adjust permissions from a shell instance of your device.

[s3my0n]

No, consider for instance copying file with 4405 permissions (setuid flag on) to the android file system, and you will find that permissions have changed  (no setuid flag)..
Also the destination file is naturally not owned by the same user as the source file.
In fact you need to adjust permissions from a shell instance of your device.

Well, I have done it this way, so my phone is evidence that this method works.