How to Root Sony Xperia Tablet S 3G

Labels: Sony, Xperia Tablet S 3G

Posted by Unknown at 1:49 PM

I Rooted my New SONY XPERIA TABLET S SGPT121US ICS 4.0.3







Guide to Root your Xperia Tablet S

!! ATTENTION: I am not responsible if you brick or damage your device, use at your OWN RISK!!

Files you need:

All in one Xperia Tablet root.zip

OR

ADB Tools
SonyTabletICS-2.zip
Superuser-3.1.3-arm-signed.zip
VpnFaker.apk (Attachment)

ATTENTION: For those who are not using the US firmware, the attached VpnFaker.apk may not be suitable for your tablet.
Please follow these steps(click me) to resign the VpnFaker.apk. Thanks to WonderEkin

***Pls Execute the command line by line***

Unzip those files into a dir, Open cmd console, cd to that dir

Run the following command and press Restore on your tablet

adb restore settings.ab

Check the result

adb shell ls -ld /data/data/com.android.settings/a
 drwxrwxrwx system system    a

And continue, ignore the "rm -r a" permission denied error

adb shell
 cd /data/data/com.android.settings
 rm -r a
 while : ; do ln -s /data a/file99; done

While the loop is running, open another cmd console and run

adb restore settings.ab

Once the restore process is completed, you can press CTRL+C on the 1st cmd console to break the loop

Check the /data permission

adb shell ls -ld /data
 drwxrwxrwx system system    data

Then continue

adb push busybox /data/local/tmp
adb push rootkit.tar.gz /data/local/tmp
adb push Superuser.apk /data/local/tmp
adb push su /data/local/tmp
adb shell
 cd /data/local/tmp
 chmod 755 busybox
 ./busybox tar zxf rootkit.tar.gz
 exit

Push the resigned VpnFaker.apk(resign by ZipSigner 2) and update the timestamp

adb push VpnFaker.apk /data/local/tmp
adb shell
 touch -t 1346025600 /data/local/tmp/VpnFaker.apk
 exit

Now, replace the VpnDialogs (ignore "cp: can't open 'system/xxxxxxx': Permission denied" while you execute "/data/local/tmp/busybox cp -r system system2")

adb shell
 cd /data
 /data/local/tmp/busybox cp -r system system2
 /data/local/tmp/busybox find system2 -type f -exec chmod 666 {} \;
 /data/local/tmp/busybox find system2 -type d -exec chmod 777 {} \;
 mv system system-
 mv system2 system

 mv app app-
 mkdir app
 mv /data/local/tmp/VpnFaker.apk /data/app

Make sure the datatime is 2012/08/27 00:00

TZ=0 ls -l /data/app
  -rw-r--r-- shell shell 198580 2012-08-27 00:00 VpnFaker.apk

Generate the packages.xml

/data/local/tmp/busybox sed -f /data/local/tmp/packages.xml.sed system-/packages.xml > system/packages.xml

And double check the result

/data/local/tmp/busybox grep vpndialogs system/packages.xml
  <updated-package name="com.android.vpndialogs" codepath="/system/app/VpnDialogs.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="136f14be668" it="136f14be668" ut="136f14be668" version="15" shareduserid="1000">
  <package name="com.android.vpndialogs" codepath="/data/app/VpnFaker.apk" nativelibrarypath="/data/data/com.android.vpndialogs/lib" flags="1" ft="1396560b400" it="1396560b400" ut="1396560b400" version="45" shareduserid="1000">

Exit adb shell and reboot, you should see something like "Android is updating" during startup.

exit
 adb reboot

Start the injected Terminal Emulator

adb shell am start -n com.android.vpndialogs/.Term

In Terminal Emulator

id
You should see the uid is 1000(system)

Still in the Terminal Emulator, ignore the script error

/data/local/tmp/onload.sh
/data/local/tmp/onload2.sh
Now back to the cmd console
Code:
adb shell
 /dev/sh
 id

Check the uid is 2000(shell)

And

 chown 0.0 /data/local/tmp/_su
 chmod 6755 /data/local/tmp/_su
 /data/local/tmp/_su
 id

Check the root access uid 0(root)

Backup /system (you may just skip it)

dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/system.ext4 bs=128K

Copy su & Superuser.apk to /system

/data/local/tmp/busybox mount -o rw,remount /system
 /data/local/tmp/busybox cp /data/local/tmp/_su /system/xbin
 chown 0.0 /system/xbin/_su
 chmod 6755 /system/xbin/_su
 /data/local/tmp/busybox cp /data/local/tmp/su /system/xbin
 chown 0.0 /system/xbin/su
 chmod 6755 /system/xbin/su
 /data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app
 /data/local/tmp/busybox mount -o ro,remount /system
 sync
 exit

Check the /system _su is working or not

 _su
 id

Should be uid 0(root)

And move the original /data/app & /data/system back (the original steps will keep the VpnFaker.apk, but i skip it)

 cd /data
 mv app app2
 mv app- app
 mv system system2
 mv system- system
 exit
 exit

Reboot your tab

adb reboot

Now, your Sony Xperia Tablet S ICS 4.0.3 should be rooted.