SHARP_android_rooting_tools ver.6.1 2014/01/06

This combined rootkit uses semi-automatic shell scripts and batch files.
The authors of this rootkit have performed these operations but you must realize that there is always a risk of failure.
So you assume all responsibility.
You can write in the dedicated thread in case of problems (* in Japanese).


* Thank you for your feedback in the dedicated thread (in Japanese). We found that for other models, the installation of VPNFaker does not work - depending on the timing. It may be better to run the script inside vpnfaker.sh line-by-line. Also, even if it fails, if you keep running it over and over, it may work finally.

* SH-06E owners: Because write protection is applied to the /system area, using this tool you may only acquire temporary root. Please use the dedicated SH-06E rootkit.

* Aquiring root privileges has been made possible using CVE-2013-6282 put_user_exploit. Please use with caution.

* Thanks to the efforts of Mr. fi01, unlocking the memory and acquiring root permissions can be done by automatically searching for the correct memory address in unlisted devices. It is therefore possible that this rootkit may work with SHARP devices that are not included in the list below.

----------- Compatible models -----------
SH-02E	build 02.00.03
SH-02E	build 02.00.04
SH-04E	build 01.00.02
SH-04E	build 01.00.03
SH-04E	build 01.00.04
SH-05E	build 01.00.05
SH-05E	build 01.00.06
SH-07E	build 01.00.03
SHL21	build 01.00.09
SHL21	build 01.01.02
SHL21	build 01.01.03
SH-09D	build 02.00.03
203SH	build S0018
203SH	build S0022
203SH	build S0024
SH-08E	build ????????
SH-10D	build ????????

----------- How to use -----------
Run start.bat.
To get root, execute the options 1 -> 2 -> 3 of the menu.

The batch file contains the following five options:

MENU
1. Temporary root: Acquires temp root. The su binary and busybox are placed in /system/xbin, SuperSU app is also installed. Modifying the contents of /system poses the risk of bricking your phone.
2. Enable root & unlock NAND and MIYABI: Unlocks MIYABI and mmc_protect, enables the su command. Please note that unlocking the phone is possible (????). In this case, please run /data/local/tmp/onBoot. * In Android 4.1, the su command is disabled if you do not unlock MIYABI first.
3. Install VpnFaker: Insall VpnFaker in order to acquire permanent root.
4. Unroot: Restore your device to unrooted mode and delete the applications that were unstalled during rooting.
5. Recover from boot loop in case of failed VpnFaker installation: Attempt a recovery procedure in case of a boot loop caused by a faulty installation of VpnFaker. 


j[
PDrootDFroot擾܂B̌suoCiAbusyboxoCi/system/xbinfBNgɐݒuASuperSUAvCXg[܂B/systemύX邽ߕ̊댯܂B
QDrootLnand,miyabi unlockFmiyabi,mmc_protectAbNAsuR}hLɂ܂BȂA[݂̂łAbN\łB̏ꍇ͒[G~[^Ȃǂ/data/local/tmp/onBootsĂB@Android 4.1ł́AmiyabiAbNȂsuR}h܂B
RDVpnFakerCXg[FVpnFakerCXg[Airoot擾܂B
SDunrootFrootAeAvƃt@C폜܂B
TDVpnFakersɂN[v̕FVpnFakersɋN[vꍇ̕s܂@androidW̃Jo[[hł͂܂


File list
/
readme.txt
start.bat

/files/adb
adb.exe
AdbWinApi.dll
AdbWinUdbApi.dll

/files/bat
doroot.bat
getroot.bat
menu.bat
recovery.bat
unroot.bat
vpnfaker.bat

/files//bin
busybox
fix_cve_2013_6282
get_essential_address
install_backdoor
run_autoexec
run_root_shell
su
unlock_lsm_miyabi
unlock_mmc_protect

/files//etc
device.db
SuperSU.apk
VpnFakerV2.tar.gz

/files/sh
autoexec.sh
getroot.sh
onBoot
recovery.sh
unroot.sh
vpnfaker.sh


----------- File Reference -----------
* run_root_shell: Used to acquire temporary root
* install_backdoor: Patches the memory and prepares to unlock NAND and MIYABI.
* unlock_lsm_miyabi: Unlocks MIYABI LSM
* unlock_mmc_protect: Unlocks mmc_protect(NAND).
* VpnFaker: Disguises the terminal app. Runs the onBoot script with system (uid=1000) privileges on device start-up.
* get_essential_address: Searches automatically for the address necessary for unlocking memory and acquiring root.
* root擾yуAbNɕKvȒ[̃AhXŌADB
ɓo^܂B

----------- Afterword -----------
Special thanks to the authors of android_run_root_shell, backdoor_mmap_tools, VpnFaker - @fi01_is01 and @hiikezoe.
This rotkit uses parts of or the whole of the above files.
Reference has also been made to the SH-01D_102SH_root-tools_ICS batch file.


----------- Special Thanks -----------
@fi01_is01
@hiikezoe
@goroh_kun
SH-02E,SH-09D,SH-06E root thread contributing members (Names omitted)


----------- File sources -----------
https://github.com/fi01/backdoor_mmap_tools
https://github.com/android-rooting-tools/android_run_root_shell
https://github.com/android-rooting-tools/android_get_essential_address
http://www1.axfc.net/uploader/so/2977572.zip

build (linux)
git clone --recursive https://github.com/android-rooting-tools/android_run_root_shell
cd android_run_root_shell
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

git clone --recursive https://github.com/android-rooting-tools/android_get_essential_address
cd android_get_essential_address
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

git clone --recursive https://github.com/fi01/backdoor_mmap_tools
cd backdoor_mmap_tools
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

----------- Change log -----------
ver 1.0@SH-02E_SH-04E_SH-05E_root_tools@Ƃăc[J
ver 2.0@VpnFakerCXg[̕sC
ver 3.0@SHL21Ή@ɒǉAoCiXV
ver 4.0@SHARP_android_rooting_tools@ɖ̕ύX@Ή@SH-09DASBM203SHǉ
ver 5.0@Ή@SH-07Eǉ@ꕔXNvg̏C@isɂ폜j
ver 6.0@oCiXV@AhXɂΉ@ȊO\ɁH@ob`t@CyуXNvgC adbŐVverɍXV

2014/01/06
-------------------------------------
ENGLISH TRANSLATION OF THIS README.TXT AND OF THE ROOTKIT: Tokyo_dom and Cheeseus, 17.01.2014
PLEASE DO NOT DISTRIBUTE THIS ENGLISH VERSION OF THE ROOTKIT ON OTHER WEBSITES.
IT IS AVAILABLE TO DOWNLOAD FOR FREE FROM MY WEBSITE AND IT WILL ALWAYS BE!