.

Vulnerability/Exploit namerelease dateauthoreffect (root, unlock,...)noteslink

.

psneuterscotty2roothttps://github.com/tmzt/g2root-kmod/blob/master/scotty2/psneuter/psneuter.c

.

Exploid7/15/2010Stealthroothttp://c-skills.blogspot.com/2010/07/android-trickery.html

.

GingerBreak5/26/2011Stealthroothttp://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html

.

RageAgainstTheCageStealthroot

.

KillingInTheNameOfStealthroothttp://c-skills.blogspot.com/2011/01/adb-trickery-again.html

.

Zimperlich2/24/2011Stealthhttp://c-skills.blogspot.com/2011/02/zimperlich-sources.html

.

ZergrushRevolutionaryroothttps://github.com/revolutionary/zergRush/blob/master/zergRush.chttp://forum.xda-developers.com/showthread.php?t=1296916

.

TacorootjcaserootHTC Recovery symlink attack to local.prop from /data/recovery/something bliss found first, but was too slow!https://github.com/CunningLogic/TacoRoot

.

NachorootjcaserootAMI304 Magnetic Sensor, symlink to local.prop. https://github.com/CunningLogic/NachoRoot

.

BurritorootjcaserootTypo prevented app from sending a debugging intent, caused adb to run as roothttps://github.com/CunningLogic/BurritoRoot

.

Gorditarootjcaseinstall custom recovery or rootSimilar to Nachoroot, different path, AMI304 Magnetic Sensor, symlink to recovery mtd devicehttps://github.com/CunningLogic/GorditaRoot

.

EnchiladajcaserootSystem left r/w & Internal memory left as ext4? I think. Symlink attack from DCIM dir to install-recovery.shhttps://github.com/CunningLogic/Enchilada

.

ZTERoot (Avail)jcaseroot~70 rediculous intents left over from engineering. Stupid OEM.https://github.com/CunningLogic/ZTERoothttp://www.androidpolice.com/2012/01/11/developer-codes-left-in-retail-zte-avail-att-offer-quick-and-easy-root-access/

.

ZTERoot (Merrit)jcaserootSymlink attack from debugging/logging apphttp://forum.xda-developers.com/showthread.php?t=1714299

.

LG ICS RootjcaserootSymlink attackhttp://forum.xda-developers.com/showthread.php?t=1912277

.

DefyXT RootjcaserootUnprotected intent allowing various permission changes.http://forum.xda-developers.com/showthread.php?t=2031562

.

CyanidejcaserootDeftXT Root Loggerlancher changing permissions, system mounted r/whttps://github.com/CunningLogic/Cyanide

.

LG Optimus Logicjcaseroot

.

LG Optmus ElitejcaserootLG not verifying integrity of system partition when flashing through download mode. TOT images are patchable. Probably valid on all LG devices.http://www.androidpolice.com/2012/06/12/exclusive-how-to-root-the-virgin-mobile-lg-optimus-elite/

.

PantechjcaserootPantach does not verify integerty of system partition when flashing through download mode. PDL images are patchable.unpublished

.

HTC DNAjcaseenable unlockingBackupmanger sets /data 777, then symlink to mmbblk0p5 to change CID. Not root, but enables bootloader unlockhttp://forum.xda-developers.com/showthread.php?t=2011611

.

HTC One X AT&TjcaserootHTC Ready2go webapp triggering chmod 777 on file in world writable dir. Lasted whole 4 hours.http://www.androidpolice.com/2012/05/25/exclusive-how-to-root-the-att-htc-one-x-on-version-1-85-or-earlier/

.

Hisense Pulsecj_000rootro.debuggable=1 on initial firmware

.

Generic LG?rootro.debuggable=1 on some older LGsunpublished

.

LG ADB BackdoorGiantpunerootBackdoor, restarts adb as root with key

.

PootGiantpunerootQualcomm diag device

.

LitGiantpunerootLG Backlight

.

ZTE Backdoor"Anonymous"rootbinary spawned root shell, password protected.

.

HTC Eris 2.1 Rootwag3slav3install custom recoverysymlink attack from /data/local/something to recovery block device? XDA Forums

.

Droid 3 Root8/25/2011blissrootsymlink attack from /data/local/something to local.prophttp://vulnfactory.org/blog/2011/08/25/rooting-the-droid-3/

.

Motofail2/11/2012blissrootsymlink attack on /data/dontpanic and /data/loggerhttp://vulnfactory.org/public/motofail_windows.zip

.

XYZ2/17/2012blissrootsymlink attack on /pds/public/battd, /data/dontpanic, and /data/loggerhttp://vulnfactory.org/public/xyz_windows.zip

.

LG Spectrum Root2/19/2012blissrootsymlink attack on /data/gpscfg/gps_env.confhttp://vulnfactory.org/public/spectrum_root_windows.zip

.

Megatron2/26/2012blissrootsymlink attack on com.ti.fmrxapphttp://vulnfactory.org/blog/2012/02/26/rooting-the-lg-thrill-optimus-3d/

.

LG Esteem Root2/15/2012blissrootsymlink attack on /data/bootlogo/bootlogopidhttp://vulnfactory.org/public/LG_Esteem_Root_v2_Windows.zip

.

Razr's Edge6/21/2012blissrootsymlink attack on /data/local/12mhttp://vulnfactory.org/public/razrs_edge_windows.zip

.

Razr Blade1/15/2013blissrootsymlink attack on /data/dontpanic, overwriting SmartActions .jar file to run code as systemhttp://vulnfactory.org/public/razr_blade.zip

.

X-Factor10/23/2012blisschange CIDsymlink attack on telephony ADB restore to change permissions on /dev/diag, followed by kernel exploit (same as Poot)http://forum.xda-developers.com/showthread.php?t=1952038

.

Samsung Admire Root9/12/2011blissrootsymlink attack on /data/log/dumpState_app_native.loghttp://vulnfactory.org/blog/2011/09/12/rooting-the-samsung-admire/

.

Thinkpad Tablet1/22/2012blissrootsymlink attack on Lenovo Mobility Managerhttp://vulnfactory.org/public/Thinkpad_Root_Windows.zip

.

Sony Tablet S2/8/2012blissrootsymlink attack on /log to change package.list, followed by symlink attack on "pm" (replace "lib" directory of system app to remove arbitrary files)http://vulnfactory.org/blog/2012/02/08/rooting-the-sony-tablet-s/

.

Xoomfail2/18/2012blissrootcmdclient changed perms on /data to 0777 by designhttp://vulnfactory.org/blog/2012/02/18/xoom-fe-stupid-bugs-and-more-plagiarism/

.

Motofail2Go10/16/2012blissrootsymlink attack on data directory for bug2gohttp://vulnfactory.org/public/motofail2go_windows.zip

.

XPRT10/8/2012blissrootsymlink attack on /data/dontpanichttp://vulnfactory.org/public/xprt_root_windows.zip

.

Nandpwn8/4/2012blissrootRidiculousness on Logitech Revuehttps://github.com/djrbliss/revue/tree/master/nandpwn

.

Motochopper4/9/2013blissroothttp://vulnfactory.org/public/motochopper.zip

.

ADB Restore Rootbin4ryroot

.

Exynos-abusealephzainrootAccess to system memory through /dev/exynos-mem on Exynos deviceshttp://forum.xda-developers.com/showthread.php?t=2057818

.

IconiaRootalephzainroothttp://forum.xda-developers.com/showthread.php?t=2048511

.

fr3voKevin BruckertrootArbitrary kernel write in Qualcomm's MSM rotator

.

levitatorJon Larimer, Jon OberheiderootOut-of-bounds memory mapping in pvrsrvkmhttp://jon.oberheide.org/files/levitator.c

.

mempodroidsaurik/zx2c4rootBad kernel jazz with /proc/pid/mem and suid binaries

.

asroot (Wunderbar?)zinxroothttp://code.google.com/p/flashrec/source/browse/#svn%2Ftrunk%2Fandroid-root

.

Samsung Infuse 4G1/3/2012Michael Coppolarootsymlink attack on /data/data/.drm/.wmdrm/sample.hdshttp://www.poppopret.org/?p=22