Full guide to get permanent root on the Softbank Aquos 007sh mobile phone

[白い熊]

This is a complete guide to get permanent root access on 007sh. I put it together by assembling posts from this forum, most notably following tokyo_dom's and SuperSZ's advice and adding my experience with how it goes, since it is a very complicated hit-and-miss process. So I'm putting it here, so that it's well documented.

This is a DANGEROUS process, and can result in you bricking your phone, if you're not careful. If you're not experienced with flashing phones and hex editing, don't try, as you will mess up and be very unhappy.

If you brick your phone as a result of this guide, it's your problem, not mine, you have been warned. If unsure, don't try. I'm only publishing it here as documentation on steps I took to get root on my phone.

The procedure to get full root on your 007sh:

- You need a Windows (Duh...) PC for this, unfortunatelly no go on GNU/Linux.

- Download and unzip `Files to root and NANDUnlock 007SH.zip' from http://www.sendspace.com/file/df29k4
source: http://www.howardforums.com/showthre...1#post14838651

- Copy IS03rootsw134.apk and superuser.apk from the above file to the phone and install them.

- Install Sharp USB drivers from the above file found in the `007SH USB Drivers' directory.

- Connect the phone to the PC, it'll ask to locate phone drivers.

- Download and unzip usb_driver_SHARP_r5.6.zip from https://sh-dev.sharp.co.jp/android/modules/driver/

- These are the drivers, the prior step is asking for, so make the windows installation wizard search the location where you unzipped the above file. It'll find the drivers for the phone and install them.

- Download and unrar menu0526.rar from http://115.com/file/e7ckgg87

- From the menu0526 directory run menu0526.exe
It will and initialize temp root on the phone, afterwards it will ask you to press any key and show you a menu of actions. Hit `Q' to quit.

- From the menu directory in `Files to root and NANDUnlock 007SH' run menu.exe
It will say the phone already has temp root and then proceed to the menu. When asked confirm to install BusyBox and everything.
Then once in the menu, backup your recovery and boot partitions.

- Copy the backed up boot.img to the PC.

- Now as per: http://www.howardforums.com/showthre...2#post14833772

- On the phone, in Settings > About phone > Build version, determine whether your software version is 0038.

- If your software version is 0038, run 007sh0038.exe to modify the image. Can't comment on this, as my phone wasn't 0038 version, so had to edit the boot.img as follows.

- If your software version isn't 0038, then as per: http://www45.atwiki.jp/aquosphonesh12c/m/pages/28.html

1. Edit the boot.img with a hex editor and as per:
http://dl.dropbox.com/u/15357241/1.jpg
and
http://dl.dropbox.com/u/15357241/2.jpg
2. Find the string:
start ckpd..#service hdmid /system/bin/hdmid.# socket hdmid stream 0660 root system graphics.# disabled..#on property
change it to:
start ckpd..######################################.servi ce autoexec /data/local/autoexec.sh. oneshot.########on property
3. As per: http://ameblo.jp/zoe0226/entry-11219520727.html
Find the string:
002F73797374656D2F00
change it to:
00FFFFFFFFFFFFFFFF00
4. Find the string:
0073797374656D00
It is in the file twice. ONLY change the FIRST occurrence to:
00FFFFFFFFFFFF00

- Copy the edited boot.img to the `menu' directory where `menu.exe' is.

- If you disconnected the phone from the PC, you need to run the menu0526 etc. and then menu, as described above, steps. If you didn't disconnect, you still have the menu.exe running.

- From menu.exe's menu, choose flash to recovery, type in boot.img, it'll flash it to a recovery partition. This step is very recommended, as if you mess up in editing the boot.img and flash it to boot partition, YOU WILL BRICK YOUR PHONE.

- From the menu still choose boot from recovery.

- The phone will reboot, disconnect it from the PC after it starts booting.

- If it boots up fine, all's well, and you can flash to boot, if not, pull out the battery, and it will reboot properly, and you need find out where you messed up with editing the boot.img.

- If all's fine, repeat the steps with from starting menu0526.exe to running menu.exe above.

- Now select flash to boot, enter boot.img, then after flashing is finished reboot from boot.

- That's it, you have root on your phone.

- Now after every boot, you need to manually enable it via the IS03rootsw134 application.

If in the future you ever want to reset your phone to factory settings and reflash back, you need to do the following, it is CRITICAL, otherwise you'll BRICK your phone (it happened to me, so I know):

- If you froze any system apps whatsoever after getting root, you need to defrost all of them.
- Then you can reset to factory / reflash to your boot.img backup - same steps as in the guide above.

If you don't defrost the apps, your phone will not boot up, it'll get in a boot loop, so it is imperative to defrost everything, before resetting to factory from the phone's settings menu.

Other than that, all's fine and root works on the phone.

Good luck and enjoy.

[keitai-fan]

Well I am totally new to the wonderful world of Android.
So what is the advantage of the rooting?
I do not see any more advantage over the softwareunlock.
I can install/uninstall apps without root access.
Also I can redirect SMS/MMS/eMails/Push-Mail to any appropriate app I download without root rights, right?

I do not want to waste your effort at all.
But maybe I am too n00b on Android to see the bright enlightment in the sky. ;-)

[白い熊]

You need root to fully control the phone. E.g. backup/restore full apps with Titanium backup...

There's a lot of stock Japanese software installed, running all the time, you need root to block these apps from running...

To block ads in the device you need it. To restrict app permissions you need. And for about a million other things.

If you don't know about root access in GNU/Linux systems, you probably don't need it. To fully control the device, you'll find out it's a must...

[keitai-fan]

Thank you for the explanation.

What is a Titanium backup?
How do you access background processes (something like task manager in windows?)?

[NeuroticallyYou]

Thank you for the explanation.

What is a Titanium backup?
How do you access background processes (something like task manager in windows?)?

Titanium backup is an app to backup whatever aplications you have installed on the phone, you can access background process via system->applications , sort of like the task manager but Android really doesn't need one because whenever you close or leave an app it automatically use the memory used for that app on other processes leaving the app you used on a suspended state.

[白い熊]

Yeah, and on this phone specifically, it is good to be able to block some apps from running, as it has too little memory, and after you install a couple of apps, it halts to a crawl...

So with root, you can block stuff from running, or modify app permissions, when they can run etc. But you need to know what you're doing. Otherwise you'll brick the phone, and then only kokos will be able to help ya.

[keitai-fan]

Thank you both.

I would not want to do this alone.
At least not as long as I have so few knowledge about the Android system.

The softwareunlocked 007sh I have, has only a few apps installed.
I prefer clean systems, so they have max performance at what they do.
The apps I installed are what I need and not what I want to show off to somebody. :-P
When I looked at the pre-installed apps of a friends S III, I nearly puked.
I told him to uninstall everything he does not need and never used (he had a S II before).
Now it runs smoother andof course has fewer data exchange with 3G.
Nice win-win. :-)

[白い熊]

Oh yeah, if you only have a couple apps that you need, then it'll run fine.

For me the phone became basically unuseable afterbI installed my apps, like super slow, so for that you need to mess with the system.

I still can't believe BTW that they made this awesome phone with these incredible specs, and messed up big time by giving it so little RAM, so that basically any multitasking is impossible on it...

[NeuroticallyYou]

that and also keep in mind the bloatware installed uses data and memory constantly, yeah i will root it but read on how to do it, dont go and root it just because or you'll end up with a $500+ brick

[cheeseus]

For those interested, here you can find the latest rootkits for the 003SH, 005SH, 006SH and the 007SH. The most recent ones at the time of posting were created on 12th August and uploaded on 28th and 31st August. Please note that they are all in Japanese. When we find the time to make English translations, I will host the rootkits on my own server.

Japanese server here: http://chisa.dtdns.net/005sh/

[pogs24ever]

is this applicable to 003sh as well?