Root allows you to modify just about everything, flash new images, change your boot image, change themes, run ARM debian, and tons more.
This guide goes through installing/downgrading to RC29, getting root, flashing the new recovery.img / test keys, changing the boot loader, and installing JesusFreke's modified RC33 builds.
If you're using a Rogers G1, this process will not work for you. See this.
If you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.
Update (3/10/09): Switched from RC30 to RC33 instructions, and clarified a few points.
And all of the great people over at xda-developers and freenode/#android who make it all happen.
Let's get started.
Also, please note that this will wipe out everything - all of your settings and apps - twice. By installing the RC29 nbh, you lose everything, and likewise moving to RC33.
There's 4 main files you're going to need:
DREAIMG.nbh
This is the NBH file needed to roll back to RC29.
Once you have all of the files, you're ready to go.
Once again, if you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.
It's definitely recommended that your phone's battery life remaining be full or near full when you start this, as it can take awhile depending on how quickly you do the steps.
Step 1)
- Format the Micro SD Card to FAT32.
- Copy the DREAIMG.nbh file to the Micro SD Card.
- With the phone off, hold camera and press power to boot into the bootloader.
- Once the bootloader is loaded, press power to install.
- Press the trackball to continue and press talk+menu+power to reboot.
Step 2)
- Copy recovery_testkeys.img onto the Micro SD Card.
- Turn the phone on (if not already)
- Type enter telnetd enter to start telnet
- Telnet into the phone with telnet (telnet ipaddress) OR use the telnet application from the market and connect to localhost
- Run the following as root (in telnet)
And you've created su, a way to switch to the root user easily. Now we need to add the modified recovery test keys. Run the following in telnet again (or as root).
It's also a good idea to note that the sdcard must be unmounted at this point, so if you moved the recovery image to your phone using the phone, unmount it first.
Code:
su
cd /system
cat /sdcard/recovery_testkeys.img > recovery.img
flash_image recovery recovery.img
- Rename whichever bootloader package you're going to use to update.zip
- Copy it onto the Micro SD Card.
- Turn off the phone (if not already,)
- Hold home+power to boot into recovery mode
- Alt+L to see the text
- Alt+S to install the bootloader
- When it's done, reboot
And now you've got the bootloader. Last but not least, if you'd like, you can install JesusFreke's RC33 builds that add a lot of extra goodness.
Step 4)
Note: It's recommended elsewhere that you wipe your data (Alt+W in Recovery Mode) before applying this update. Although I don't do this myself, doing so never hurts.
- Rename to update.zip
- Copy it onto the Micro SD Card.
- Turn off the phone (if not already,)
- Hold home+power to boot into recovery mode
- Alt+W to wipe the data, as noted above, if you so choose
- Alt+L to see the text
- Alt+S to install the update
- When it's done, reboot
Step 5)
- Repeat the same process as in Step 4 with the RC33 Radio update. This update will restart your phone a few times and display the 'flashing rom' graphic, be patient, as it can take some time. And now you're done.
I am looking forward to know more about Android OS.Like bionic...If any one have any docs regarding Android OS and app development..plz mail me @ sr_sutar@yahoo.com
First, I gotta give Devolio a million thanks for helping me to get this working on my phone. I would like to offer a little help to those that might get stuck/confused at the same place(s) that I did.
Step 2)
- Copy recovery_testkeys.img onto the Micro SD Card.
- Turn the phone on (if not already)
- Type enter telnetd enter to start telnet
- Telnet into the phone with telnet (telnet ipaddress)
- Run the following as root (in telnet)
- Type enter telnetd enter to start telnet
(your contacts will come up it, which is ok. hit the enter key then type telnetd and the enter key again).
- Telnet into the phone with telnet (telnet ipaddress)
(at this point you need to download "telnet" from the market. Run the app and hit the "connect to server" button. a bunch of funny symbols will pop along the top of the screen the last one is #
- Run the following as root (in telnet)
(simply type the code exactly like you see it, in the telnet app)
For those running windows 7 (as I am):
if the JesusFreke's RC30 build does not install, rename the JesusFreke's RC30 build to update instead of update.zip
Thanks for adding the clarifications One little nitpick:
It's not Windows 7 specifically that does this, Windows has a setting that's usually on by default (I believe, correct me if I'm wrong,) that hides file extensions for known file types.
Pretty much, Windows sees that you have a zip file. It knows what zip files are, so it doesn't show you the .zip portion of the file name, if that setting is enabled. From there, you'd push the update.zip to your phone, and it would be named update.zip.zip - all because of Windows.
By turning this off (in a folder view, Tools -> Folder Options -> Uncheck 'Hide extensions for known file types') it will stop this stupid feature.
Is this also working for "German" G1? I heard about that this only works for US or UK G1! Is it true? Has someone in Europe experienced different things?
Is there a possibility if I try this out and it doesn't work, that I get the old system back? Like creating a copy of it?
hi, i have rc9 and would like to root.so ive formatted the sd card in fat32,and downloaded all the files i need,and put the DREAIMG.NBH on the sd card. when i boot up again holding power/camera im getting the funky red/green/blue screen, but the bootloader is not finding the image.it just says NOT ALLOW. could some one please help !! as my head hurts trying to root this thing
I think Im an idiot or something. I type "enter telnetd enter" and well it just stares at me like I'm an idiot.
I did downgrade to RC29 and uploaded the files like discribed.
Yes I'm in the US too.
Welp after trying a few times I decided to download the telnet app and just tried to login. It failed and I tried the enter telnetd enter again and eventually it worked. Go figure.
I think Im an idiot or something. I type "enter telnetd enter" and well it just stares at me like I'm an idiot.
I did downgrade to RC29 and uploaded the files like discribed.
Yes I'm in the US too.
Welp after trying a few times I decided to download the telnet app and just tried to login. It failed and I tried the enter telnetd enter again and eventually it worked. Go figure.
Im having the same issue, it does nothing when I type (enter telnetd enter). will the phone do anything afterwards?
I keep trying but its still says file is for reading only. Am I not using the right file? Im opening the zip file called Androidmod.zip and saving the IMG file labeled recovery_testkeys.img to the micro sd card in the phone.
You should only need to remount.. Pretty much turn the phone on, get root with telnet, remount as writable (mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system) and then writing the keys should work.
You should only need to remount.. Pretty much turn the phone on, get root with telnet, remount as writable (mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system) and then writing the keys should work.
do I actually get ROOT when I type enter telnetd enter?
I am probably the first person who should have rooted their phone, I have modded, hacked, upgraded or totally changed the OS on all the smart phones I have had the pleasure of owning. For some reason I have not rooted my G1, and I am still asking myself *why* ?
I must be the stupid one here... I have followed all the directions and still can't get telnetd to work. Then there is the question of the telnet client.. ANY help would be appreciated. What I have done so far is downgrade to rc29 and here I sit... everytime I type telnetd is just sits there, I even tried the reboot command, just not happening..
I must be the stupid one here... I have followed all the directions and still can't get telnetd to work. Then there is the question of the telnet client.. ANY help would be appreciated. What I have done so far is downgrade to rc29 and here I sit... everytime I type telnetd is just sits there, I even tried the reboot command, just not happening..
Are you set for Debugging mode on the G1 ?? I haven't done this but I thought you had to have it set:
System Settings|Applications|Development|USB Debugging (checked)
__________________ Help Us: Submit FAQ's You have answered over and over! I will add them to OUR FAQ LIBRARY. Check out our FAQ's.... Also Check out our Tag Search.
I have just the rc29 and no mods, mybe I am missing something, if you type telnetd and nothing happens, at what point or what do I do to telnet into the phone,, ie client and usb cable connected to PC??? maybe that's the part missing,, the .apk files I see I thought were for the phone to telnet to itself,, ie localhost...
Does this version have the mods I need to get this thing going? I SOO much want to tinker and open the potential of this phone. Still not sure about the telnetd process,, any help??
Actually I may be doing it again, as I seem to have lost root access when I did the JF rc33 update, so I will be tinkering, back to RC29, HardSPL then JF RC30 the JF rc33.. may be overkill but I wanted to tinker,, unless I have overlooked something,, any ideas??
Original,, telnetd worked after I flashed with the RC29 link Shivers316 gave me, then used Telnet from Market, then input:
Borrowed from devolio post above...
Copy recovery_testkeys.img onto the Micro SD Card
Code:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /systemdd if=/system/bin/sh of=/system/bin/su
chmod 4755 /system/bin/su
Code:
su
cd /systemcat /sdcard/recovery_testkeys.img > recovery.img
flash_image recovery recovery.img
Then flashed with Engineering SPL, then ,JF1.42_ RC33 with the RC33 Radio Update.
Geeez, sometimes I feel like such a moron,, I still have root just access it different is all,,, ""READ THE POSTS"" ,, um all is working,, I do have a minor question,, If I want to change the bootloader do I have to start from scratch or can I just doit as an update as before??
I have my second G1 (experiment-play-with) phone ...
Possibly Step #1 did not go right ... therefore I cant use Telnet in Step #2???
I am braving into Rooting it and have gotten hung up at Step 2.
It was definately me ... failing in Step #1 ...
I formated the SDcard to Fat32 .. But not in the phone ... Rather than Formatting the Device ... the entire phone memory ... Which prepares the way for putting the Dream RC29 image (pre-Root_Block) Build on the phone.
In Step 2:
I had previous tried to use Terminal Emulator in place of Telnet...
That was a mistake ... so be sure to use Telnet ...
In Step 3:
The first time I renamed the image file to "Update.zip" and it should be just "Update" ... as the flasher looks for a zip-type file called "Update"
After those stumbles the rest went fine....
Quote:
Step 2)
- Copy recovery_testkeys.img onto the Micro SD Card.
- Turn the phone on (if not already)
- Type enter telnetd enter to start telnet
- Telnet into the phone with telnet (telnet ipaddress) OR use the telnet application from th market and connect to localhost
- Run the following as root (in telnet)
I copied the 'testkeys.img' onto the SDCard
I have telnet app downloaded...
I have the phone connected to the Computer ... SD is mounted ...
I tried .. "- Type enter, then telnetd enter to start telnet" and I get nothing but kicked into the phone contacts...
I have tried starting the Telnet App and iget a screen like:
"[ Localhost ]" "[ 23 ]"
Button "Connect to Sever"
I press the "Connect to Server" button ... and get "Error while connecting to server: Localhost/127.0.0.1:23
Do I need to put other info in the windows of --Localhost and [23] ?
Should something be running on the PC ...??
right i have manage to down garde from rc9 to rc7 ok no probs
start the first step ok on post instructions
second step it says all the time cannot create recovery.img read only
what am i doing wrong have gone through steps all fine i think
I have a European (Dutch) vodafone magic phone. And was wondering if i could unroot it. I can't seem to find any guide to do this. It is build-nummer is CRB43.
I have a European (Dutch) vodafone magic phone. And was wondering if i could unroot it. I can't seem to find any guide to do this. It is build-nummer is CRB43.
K i am on part 1, i did the first 3 task
and now i got to press power for yes,
but mine doesnt say power for yes, it says action for yes.
so i pressed action, and 1 min later it said.
Rooting: A quick guide (Updated 3/10/09)
hopefully my Hero will come to T-Mobile
Help Us: 
