What exactly does "rooting" mean (for a new device that has no ready-made tools yet)? Disclaimer: The question is not meant like these:


How do I root my device? &ndash; Take tool X/Y/Z!
Where do I find tool X/Y/Z for rooting? &ndash; Link, Link, Link!
What is "root"? &ndash; Full permissions on Linux, UID 0!


The question I have is this: When a new device with a customized Android gets released, what exactly do the "root release crews" do? And why does it differ for each device? Aren't all "Androids" across the different devices with the same x.y version identical? Yeah, OK, most have custom brand programs (because everyone wants user data these days, or for device-specific sensors and so on), but all have the same kernel and core tools (which handle the permission system).

Let's say I buy a new device and want "to root" it fully myself (without ready-made tools/images from others), where would I start? Do a full dump of the flash memory and change some bits?
A rooted system is a system that has a working su binary, that is, one that allows the user and/or processes to attain full root rights. So, in order to root a device, you "just" need to get that binary in place, and you're done. (In practice, it's not as simple; most superuser applications ship with a daemon that is actually responsible for giving apps root privileges, and they might also apply patches to the SELinux policy so processes can get root rights).

How you root device depends on the model of the device. There are devices that can be "unlocked". That usually means that it will disable the checks the system has in place to ensure that the device only boots an operating system supplied by your manufacturer. So, with the checks disabled, the easiest option to root your device is flashing a custom recovery (which is basically a stripped down OS, used to update the actual Android OS and for other tasks like backups). This recovery will then run with root rights, so it can also place a su binary on the device.

If your device cannot be unlocked, the process is much more complicated. In this case, the developers try to find exploits in the software that can be used to attain (temporary) root privileges, which can then be used to install a su binary. Obviously, since this process involves finding flaws in the device's security, it may take a long time for it to happen, or it might not happen at all.

This process of finding exploits is different for different devices, but you may find that some root exploits work for similar devices. Not all devices run the same operating system, or the same hardware. Device X might ship with a modified version of software component Y, which is vulnerable, while device Z doesn't ship with it, so you'll have to find another exploit.