12
Sep
nexusae0_moto-x-thiumb

Since Dan Rosenberg declared his intentions to stop publishing exploits for Motorola devices, fans of the OEM have been wondering if there will be much of a future within the modding community. While the distant future is still very foggy, Justin Case has come to the rescue with his own rooting method for Motorola's latest salvo of devices. His simple-to-use app roots the Moto X, Ultra, Mini, and Maxx.

I'm sure most of you are here to get your phone rooted, so let's go straight to the instructions. I will follow with a more in-depth explanation about how it works.

Disclaimer: Android Police isn't responsible for any harm to your device - proceed at your own risk.

Do not use these roots on any device for which they are not intended! They are only for the Moto X, Droid Maxx, Droid Mini, and Droid Ultra.

Instructions

  1. Download the rooting app for the Moto X here, or for the Maxx/Mini/Ultra here. Be careful to get the right variant for your phone.
  2. Install it by typing:
    'adb install -r motoroot.apk' (Note: filenames vary by device).
  3. Run the app on your device.
  4. Tap on the 'Setup' button and wait for the phone to reboot.
  5. Install SuperSU from the Play Store.
  6. Brag to your friends.

device-2013-09-12-185453device-2013-09-12-185312

By the time you've completed all of these steps, you should be rocking a fully rooted phone. Pretty simple, right? Well, the process of building the hack was a lot trickier, but Justin was kind enough to share some more details of how it works.

The Details

A few exploits were used to make this rooting method happen. Like most devices, the first step is to work around the bootloader, as it write protects the /system partition to prevent tampering.

Typically, nothing is really allowed to write to /system outside of the bootloader and recovery. To gain access, Justin crafted an app to take advantage of the second "Master Key" exploit, which uses the signing key of a trusted application but installs modified code to gain system-level privileges. See, those things can be used for good. It's worth noting, since Justin's method currently makes use of this exploit, which was fixed by Google for Android 4.3, this specific rooting method will cease to work if the firmware is updated to the most recent version of the OS.

Thanks to the first exploit, Justin's app can now run as system. At this stage, the software prepares some files and configuration changes to help elevate the app from being a system user to a root user. If you're following along with the instructions above, this is when the phone reboots and the app must be reinstalled.

At this stage, the app moves on to establishing a more permanent root. To begin with, a small ext4 system image is placed in /data/xbin.img and mounted over the /system/xbin folder. The new folder contains everything that originally existed in /system/xbin, but also adds the necessary su and busybox binaries. To keep root locked in on subsequent reboots, Justin has the app listen for BOOT_COMPLETE, then re-mounts the new /system/xbin image. Due to the way the file is stored, wiping data or uninstalling the app will require re-rooting the device. Justin has also included options to disable and re-enable root if necessary.

device-2013-09-12-185322

In Closing

Thanks to Dan's prior work and this contribution from Justin, virtually every major Motorola device can be rooted, and many of those can even be bootloader unlocked.

Unfortunately, this doesn't mean future devices - or even firmware updates - will enjoy the same treatment. So far, it appears that Motorola will remain fairly diligent about blocking most modding efforts, which may ultimately drive away anybody with the necessary skills. Ideally, Google's philosophy of openness will invade Motorola and unlockable bootloaders will become standard. Barring that, let's hope reasonable hacks keep emerging for some time.

Thanks Justin!

Cody Toombs
Cody is a Software Engineer and Writer with a mildly overwhelming obsession with smartphones and the mobile world. If he’s been pulled away from the computer for any length of time, you might find him talking about cocktails and movies, sometimes resulting in the consumption of both.

  • silver_arrow

    OTA update in 3...2..

    Can't let people who buy the phones use them as they wish.

    • merman1983

      They'll be all like "hey want 4.3 or root? olololol" and people will be all like "aw man" and then someone will be all like "4.3 rooted loooooool!"

      • BrianLipp

        hey, if rooting..."encourages" them to release updates faster, its not ALL bad

  • M. Clark

    Great! Nice find.

  • simp1istic

    YES YES YES. BYE BYE AT&T LOGO

  • Paul Hansen

    SQL fix for tethering still works. Will they never learn?

    • Ryan Nichols

      What do you mean? what's "SQL fix" ?

  • TY

    To all phone manufacturers/carriers providing slow updates AND locking down their phones: TAKE THAT!

  • PolarBear

    It seems like MotoRoot root those devices as easy as Gingerbreak (LG Optimus V).

  • Gnex

    After installing the .apk, rebooting and opening SuperSU, it prompts me to update the SU binary, which fails.

  • jcradio

    Works GREAT on my new DROID MAXX. However, after renaming a few apps from apk to bak they all get renamed back to their original name after reboot while still maintaining root. Any suggestions?

    • gsDroid

      Freeze them with Titanium Backup.

      • jcradio

        Thanks will give it a try. Never saw this happen before so I thought I will let the board know.

    • Bill

      When i try to install motoroot on my maxx it says app not installed?

  • Idon’t Know

    Problem with rooting the Moto x is it needs some updates to fix issues like the camera so rooting probably means you won't be able to install them.

  • CTT

    Soo, when can we get Google Wallet?

  • Gregory

    I really want to root my MotoX on ATT, but the PwnMyMoto doesn't install. Can anyone suggest another step?

    • rich.ultra

      Sa mm e shyt is happening to me.but I got moto. Droid ultra by Verizon.

    • SINIST3RZ1ON

      check the xda dev forms. Justin (Jcase) has you all covered.

  • Pawel Kostecki

    I had problem with these all complicated android root methods.I found better way, using simple tool which is rooting all devices automatically.Check how it works: http://www.youtube.com/watch?v=vW2SF3qYPeU
    I rooted my phones with this tool.

  • teknekana419 .

    awwww lol im on 4.4 :(

  • Secret

    App not installed?

  • Fred

    I'm looking to root a Verizon Droid Maxx running 4.2.2 on a Mac to prevent it from updating to KitKat 4.4. is there a solution on a Mac?

  • terry

    Help ! My Droid ultra won't install the app for rooting it. I made sure it is set to allow apps from unknown sources. Its running KitKat

  • poundpuppy420

    Can I root my Verizon droid ultra with this app?

  • poundpuppy420

    Running 4.4 on ultra. Can I root with this app