SHARP_android_rooting_tools ver.7.0: 22.06.2014
English translation by Cheeseus: 20.09.2014

This combined rootkit uses semi-automatic shell scripts and batch files.
The authors of this rootkit have performed these operations but you must realize that there is always a risk of failure.
So you assume all responsibility.
You can write in the dedicated thread in case of problems (* in Japanese).


* Thank you for your feedback in the dedicated thread (in Japanese). We found that for other models, the installation of VPNFaker does not work - depending on the timing. It may be better to run the script inside vpnfaker.sh line-by-line. Also, even if it fails, if you keep running it over and over, it may work finally.
* SH-06E owners: Because write protection is applied to the /system area, using this tool you may only acquire temporary root. Please use the dedicated SH-06E rootkit.
* Aquiring root privileges has been made possible using CVE-2013-6282 put_user_exploit. Please use with caution.
* Thanks to the efforts of Mr. fi01, unlocking the memory and acquiring root permissions can be done by automatically searching for the correct memory address in unlisted devices. It is therefore possible that this rootkit may work with SHARP devices that are not included in the list below.

-----Compatible models-----
SH-02E	build 02.00.02 (confirmed by shadowhacker27 on XDA)
SH-02E	build 02.00.03
SH-02E	build 02.00.04
SH-04E	build 01.00.02
SH-04E	build 01.00.03
SH-04E	build 01.00.04
SH-05E	build 01.00.05
SH-05E	build 01.00.06
SH-07E	build 01.00.03
SHL21	build 01.00.09
SHL21	build 01.01.02
SHL21	build 01.01.03
SH-09D	build 02.00.03
SBM203SH	build S0018
SBM203SH	build S0022
SBM203SH	build S0024
SH-08E		build ????????
SH-10D		build ????????

-----How to use-----
Run start.bat
To get root, execute the options 1 -> 2 -> 3 of the menu.

The batch file contains the following five options:

MENU
1.Temporary root: Acquires temp root. The su binary and busybox are placed in /system/xbin, SuperSU app is also installed. Modifying the contents of /system poses the risk of bricking your phone.
2. Enable root & unlock NAND and MIYABI: Unlocks MIYABI and mmc_protect, enables the su command. Please note that removing these locks is also possible directly from the phone. To do so, please run /data/local/tmp/onBoot.@* In Android 4.1, the su command is disabled if you do not unlock MIYABI first.
3. Install VpnFaker: Install VpnFaker in order to acquire permanent root.
4. Unroot: Restore your device to unrooted mode and delete the applications that were unstalled during rooting.
5. Recover from boot loop in case of failed VpnFaker installation: Attempt a recovery procedure in case of a boot loop caused by a faulty installation of VpnFaker. 


-----File list-----
/
readme.txt
start.bat

/files/adb
adb.exe
AdbWinApi.dll
AdbWinUdbApi.dll

/files/bat
doroot.bat
getroot.bat
menu.bat
recovery.bat
unroot.bat
vpnfaker.bat

/files/bin
busybox
fix_cve_2013_6282
get_essential_address
install_backdoor
run_autoexec
run_root_shell
su
unlock_lsm_miyabi
unlock_mmc_protect

/files/etc
device.db
SuperSU.apk
VpnFakerV2.tar.gz

/files/sh
autoexec.sh
getroot.sh
onBoot
recovery.sh
unroot.sh
vpnfaker.sh


-----File Reference-----
Erun_root_shell: Used to acquire temporary root
Einstall_backdoor: Patches the memory and prepares to unlock NAND and MIYABI.
Eunlock_lsm_miyabi: Unlocks MIYABI LSM
Eunlock_mmc_protect: Unlocks mmc_protect(NAND).
EVpnFaker: Disguises the terminal app. Runs the onBoot script with system (uid=1000) privileges on device start-up.
Eget_essential_address: Searches automatically for the address necessary for unlocking memory and acquiring root, and registers it into the DB.

-----Afterword-----
Special thanks to the authors of android_run_root_shell, backdoor_mmap_tools, VpnFaker - @fi01_is01 and @hiikezoe.
This rotkit uses parts of or the whole of the above files.
Reference has also been made to the SH-01D_102SH_root-tools_ICS batch file.
We once again wish to thank all people who have been involved in the creation of this rootkit.


-----Special Thanks-----
@fi01_is01
@hiikezoe
@goroh_kun
SH-02E,SH-09D,SH-06E root thread contributing members (Names omitted)


-----File sources-----
https://github.com/fi01/backdoor_mmap_tools
https://github.com/android-rooting-tools/android_run_root_shell
https://github.com/android-rooting-tools/android_get_essential_address
http://www1.axfc.net/uploader/so/2977572.zip

build (linux)
git clone --recursive https://github.com/android-rooting-tools/android_run_root_shell
cd android_run_root_shell
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

git clone --recursive https://github.com/android-rooting-tools/android_get_essential_address
cd android_get_essential_address
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

git clone --recursive https://github.com/fi01/backdoor_mmap_tools
cd backdoor_mmap_tools
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk

-----Change log-----
ver 1.0@Released under the name of SH-02E_SH-04E_SH-05E_root_tools
ver 2.0@Fixed a bug during the installation of VpnFaker
ver 3.0@Added SHL21 to the list of compatible models, updated binary
ver 4.0@Changed name to SHARP_android_rooting_tools@after adding SH-09D and SBM203SH
ver 5.0@Fixed bugs, improved script, added SH-07E
ver 6.0@Updated binary, added automatic address search, except for some models. Modified script to accommodate latest updates of ADB and the batch file.
ver 7.0@The previous upload expired, some updates to files

2014/06/22
-------------------------------------
ENGLISH TRANSLATION OF THIS README.TXT AND OF THE ROOTKIT: Cheeseus, 20.09.2014
PLEASE DO NOT DISTRIBUTE THIS ENGLISH VERSION OF THE ROOTKIT ON OTHER WEBSITES.
IT IS AVAILABLE TO DOWNLOAD FOR FREE FROM MY WEBSITE AND IT WILL ALWAYS BE!