Finally the race is over and some brave devs managed to get root on the tattoo and some were able to reproduce it on their own devices already. But notice: We are in an early stage of development, when writing this lines, it was only some hours ago the first root-shell on a tattoo was seen in the wild. There is no one-klick-get-root app at the moment and there is still much work to be done until we get custom roms.
I will try to keep track of the ongoing development and update this post periodically. I've you find a mistake or get something new, let us know but we can't give support to every linux-nob at this point of development!

Status
Last update: 21.02.2010 - 20:07 MEZ


Rooting
The tattoo was successfully rooted the first time on 19.02.2010 ( http://forum.xda-developers.com/showpost.p...97&postcount=93 ). It was reproduced by some other users already, there is some work to be done make the exploit work more easily.

It was done by porting this exploit http://www.milw0rm.com/exploits/8678 to the arm plattform and the tattoo. It uses a security hole in kernel 2.6.29 that wasn't patched in tattoos kernel. All began here on 10.2.2010 (the first post doesn't has to do anything with this): http://forum.xda-developers.com/showthread.php?t=631540
Kudos to zanfur, bftb0, mainfram3, HT123 and others (sorry if I forgot an important one).


Flashing custom roms
Nothing done jet.


Howto get root-privileges
I think it is save to follow but this is done at your own risk. Don't blame me if you Tattoo explodes, eats your hamster or make your girlfriend leave you.
Remember: We're in an early state of development, this is no Klick-an-Run-app, linux knowledge is needed.
Windows-Users can alternatively follow this guide and try little batch-program that does some small steps for you: http://forum.xda-developers.com/showpost.p...32&postcount=18


Download this to your PC and unzip: [attach]283569[/attach]
m6 is the binary, m5.c is the sourcecode you don't need to run this. Push m6 to your Tattoo using adb:


Start a shell:


Start the exploit in the shell:


Text will scroll by. While this is running, start to bring up and close some random apps via task manager on the tattoo. After a while the exploit should report success and come up with a root-shell. The promt should change from

to


Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again.

You did it, you should be root now!
Let's set some variables:


When you got your shell, check if you are really root:


You should get something like this:

uid=0(root) is important.

To get a root-shell more easily next time, we have to make su work.

Take this su binary and push it in your tatto: http://www.fileuploadx.de/45656


Remount /data without the nosuid-option


Change the owner to root and set the suid-bit



Now you don't have to run the exploit again, just open a normal shell and run

Now you should be root!
Attention: If you reboot your phone, you have to run the exploit and the mount command again because /data will be mounted nosuid again!

Thats it!

Some suggestions for going on. When you run mount, you will see that some partitions are mounted read-only and/or with the nosuid-option. You can change this by running:


Have a lot of fun!
-bm-