联想乐檬k3note吧 关注：24,468贴子：603,553
我的lg手动root方法，仅供参考，很可能成砖，小白别乱弄哦1、从电子市场上下载：Terminal Emulator 和 Superuser
下载地址：market://details?id=jackpal.androidterm&referrer=utm_source=Androlib&utm_medium=Page&utm_campaign=Androlib Page
market://details?id=com.noshufou.android.su&referrer=utm_source=Androlib&utm_medium=Page&utm_campaign=Androlib Page
二维码分别是：[viewimg][viewimg]
2、下载rootkit.rar并解压 (792.75 KB 地址：http://cid-2cc1a09e123bda38.offi ... /Public/rootkit.rar)
3、手机开启 开发->调试 （Develop -> Debug）并用USB线连接；
4、在Windows开启命令行（按Windows键+R，输入CMD） 然后进入刚才解压的地方：cd /rootkit
5、复制一下命令到命令行窗口并执行：
adb push ratc /data/local/tmp/ratc
adb push busybox /data/local/tmp/busybox
adb push su /data/local/tmp/su
adb push rootme /data/local/tmp/rootme
adb shell
chmod 777 /data/local/tmp/*
6、如果最后有提示“Unable to chmod /data/local/tmp/Superuser.apk: Operation not permitted”，则表明之前你使用了一键root未成功的残留，可键入命令：
rm /data/local/tmp/Superuser.apk
7、再次使用命令
chmod 777 /data/local/tmp/*
8、在手机上开启Terminal Emulator（刚刚下载安装的），（注意此时命令提示符是$），键入如下命令：
cd /data/local/tmp
./ratc
9、使用返回键退出Terminal Emulator；
10、开启任何一个其他程序，然后使用返回键返回；
11、再次开启Terminal Emulator，注意，此时是以管理员权限开启的，（主义此时命令提示符是#，表示已经取得Root权限）
12、继续键入命令：
cd /data/local/tmp
./rootme
[备注，其实是执行了以下命令
#!/system/bin/sh
mount -o remount,rw /dev/block/mtdblock2 /system
./busybox cp su /system/bin/su
chmod 4755 /system/bin/su
reboot
]
13、手机自动重启，root完成。
下载地址：market://details?id=jackpal.androidterm&referrer=utm_source=Androlib&utm_medium=Page&utm_campaign=Androlib Page
market://details?id=com.noshufou.android.su&referrer=utm_source=Androlib&utm_medium=Page&utm_campaign=Androlib Page
二维码分别是：[viewimg][viewimg]
2、下载rootkit.rar并解压 (792.75 KB 地址：http://cid-2cc1a09e123bda38.offi ... /Public/rootkit.rar)
3、手机开启 开发->调试 （Develop -> Debug）并用USB线连接；
4、在Windows开启命令行（按Windows键+R，输入CMD） 然后进入刚才解压的地方：cd /rootkit
5、复制一下命令到命令行窗口并执行：
adb push ratc /data/local/tmp/ratc
adb push busybox /data/local/tmp/busybox
adb push su /data/local/tmp/su
adb push rootme /data/local/tmp/rootme
adb shell
chmod 777 /data/local/tmp/*
6、如果最后有提示“Unable to chmod /data/local/tmp/Superuser.apk: Operation not permitted”，则表明之前你使用了一键root未成功的残留，可键入命令：
rm /data/local/tmp/Superuser.apk
7、再次使用命令
chmod 777 /data/local/tmp/*
8、在手机上开启Terminal Emulator（刚刚下载安装的），（注意此时命令提示符是$），键入如下命令：
cd /data/local/tmp
./ratc
9、使用返回键退出Terminal Emulator；
10、开启任何一个其他程序，然后使用返回键返回；
11、再次开启Terminal Emulator，注意，此时是以管理员权限开启的，（主义此时命令提示符是#，表示已经取得Root权限）
12、继续键入命令：
cd /data/local/tmp
./rootme
[备注，其实是执行了以下命令
#!/system/bin/sh
mount -o remount,rw /dev/block/mtdblock2 /system
./busybox cp su /system/bin/su
chmod 4755 /system/bin/su
reboot
]
13、手机自动重启，root完成。
1. 工具分析
1.1 psneuter
源文件地址：https://github.com/tmzt/g2root-kmod/blob/master/scotty2/psneuter/psneuter.c
C代码
// psneuter.c, written by scotty2.
// neuter the android property service.
// ashmem allows us to restrict permissions for a page further, but not relax them.
// adb relies on the ability to read ro.secure to know whether to drop its privileges or not;
// if it can't read the ro.secure property (because perhaps it couldn't map the ashmem page... :)
// then it will come up as root under the assumption that ro.secure is off.
// this will have the unfortunate side effect of rendering any of the bionic userspace that relies on the property
// service and things like dns broken.
// thus, we will want to use this, see if we can fix the misc partition, and downgrade the firmware as a whole to something more root friendly.
1.1 psneuter
源文件地址：https://github.com/tmzt/g2root-kmod/blob/master/scotty2/psneuter/psneuter.c
C代码
// psneuter.c, written by scotty2.
// neuter the android property service.
// ashmem allows us to restrict permissions for a page further, but not relax them.
// adb relies on the ability to read ro.secure to know whether to drop its privileges or not;
// if it can't read the ro.secure property (because perhaps it couldn't map the ashmem page... :)
// then it will come up as root under the assumption that ro.secure is off.
// this will have the unfortunate side effect of rendering any of the bionic userspace that relies on the property
// service and things like dns broken.
// thus, we will want to use this, see if we can fix the misc partition, and downgrade the firmware as a whole to something more root friendly.
Fu
