Apps Rooting: A quick guide (Updated 3/10/09)

[devolio]

Root allows you to modify just about everything, flash new images, change your boot image, change themes, run ARM debian, and tons more.

This guide goes through installing/downgrading to RC29, getting root, flashing the new recovery.img / test keys, changing the boot loader, and installing JesusFreke's modified RC33 builds.

If you're using a Rogers G1, this process will not work for you. See this.

If you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.

Update (3/10/09): Switched from RC30 to RC33 instructions, and clarified a few points.

Sources

JesusFreke's modified updates
Registering without a sim or data plan
Modded recovery and boot images
Dream SPLs
RC30 to JFv1.31

And all of the great people over at xda-developers and freenode/#android who make it all happen.

Let's get started.

Also, please note that this will wipe out everything - all of your settings and apps - twice. By installing the RC29 nbh, you lose everything, and likewise moving to RC33.

There's 4 main files you're going to need:

DREAIMG.nbh
This is the NBH file needed to roll back to RC29.

recovery_testkeys.img
The modified recovery image/test keys.

EngBootloader_v2_NoSigCheck.zip
The engineering bootloader. An update.zip. It's recommended that you read more about them here before choosing this one.

JFv1.42_RC33
JesusFreke's (latest, at time of writing) modified RC33 update.zip.

RC33 Radio update
The radio update to apply when moving to RC33.

Once you have all of the files, you're ready to go.


Once again, if you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.


It's definitely recommended that your phone's battery life remaining be full or near full when you start this, as it can take awhile depending on how quickly you do the steps.


Step 1)

- Format the Micro SD Card to FAT32.
- Copy the DREAIMG.nbh file to the Micro SD Card.
- With the phone off, hold camera and press power to boot into the bootloader.
- Once the bootloader is loaded, press power to install.
- Press the trackball to continue and press talk+menu+power to reboot.


Step 2)

- Copy recovery_testkeys.img onto the Micro SD Card.
- Turn the phone on (if not already)
- Type enter telnetd enter to start telnet
- Telnet into the phone with telnet (telnet ipaddress) OR use the telnet application from the market and connect to localhost
- Run the following as root (in telnet)

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system

dd if=/system/bin/sh of=/system/bin/su

chmod 4755 /system/bin/su

And you've created su, a way to switch to the root user easily. Now we need to add the modified recovery test keys. Run the following in telnet again (or as root).

It's also a good idea to note that the sdcard must be unmounted at this point, so if you moved the recovery image to your phone using the phone, unmount it first.

su

cd /system

cat /sdcard/recovery_testkeys.img > recovery.img

flash_image recovery recovery.img

Now that's finished.

Personally, I prefer to go with the Engineering bootloader, but you can choose whichever you'd like.


Step 3)

- Rename whichever bootloader package you're going to use to update.zip
- Copy it onto the Micro SD Card.
- Turn off the phone (if not already,)
- Hold home+power to boot into recovery mode
- Alt+L to see the text
- Alt+S to install the bootloader
- When it's done, reboot

And now you've got the bootloader. Last but not least, if you'd like, you can install JesusFreke's RC33 builds that add a lot of extra goodness.


Step 4)

Note: It's recommended elsewhere that you wipe your data (Alt+W in Recovery Mode) before applying this update. Although I don't do this myself, doing so never hurts.

- Rename to update.zip
- Copy it onto the Micro SD Card.
- Turn off the phone (if not already,)
- Hold home+power to boot into recovery mode
- Alt+W to wipe the data, as noted above, if you so choose
- Alt+L to see the text
- Alt+S to install the update
- When it's done, reboot

Step 5)

- Repeat the same process as in Step 4 with the RC33 Radio update. This update will restart your phone a few times and display the 'flashing rom' graphic, be patient, as it can take some time. And now you're done.

Easy as pie.

 

[SecretAsianMan]

WOW, my g1 exploded in my hands after i did all this. looks like i got too rooted. lol. thanks for the info. i really want root!

 

[Phases]

Excellent dev, thanks!

 

[soumyasutar]

Hi All,

I am looking forward to know more about Android OS.Like bionic...If any one have any docs regarding Android OS and app development..plz mail me @ sr_sutar@yahoo.com


Thnx,
Soumya

 

[randel77]

First, I gotta give Devolio a million thanks for helping me to get this working on my phone. I would like to offer a little help to those that might get stuck/confused at the same place(s) that I did.


Step 2)

- Copy recovery_testkeys.img onto the Micro SD Card.
- Turn the phone on (if not already)
- Type enter telnetd enter to start telnet
- Telnet into the phone with telnet (telnet ipaddress)
- Run the following as root (in telnet)


- Type enter telnetd enter to start telnet
(your contacts will come up it, which is ok. hit the enter key then type telnetd and the enter key again).


- Telnet into the phone with telnet (telnet ipaddress)
(at this point you need to download "telnet" from the market. Run the app and hit the "connect to server" button. a bunch of funny symbols will pop along the top of the screen the last one is #


- Run the following as root (in telnet)
(simply type the code exactly like you see it, in the telnet app)


For those running windows 7 (as I am):
if the JesusFreke's RC30 build does not install, rename the JesusFreke's RC30 build to update instead of update.zip


As of writing this the latest JesusFreke's RC30 build is JFv1.41 (multi-touch browser). Heres where to get it
http://forum.xda-developers.com/showthread.php?t=475381

 

[devolio]

Thanks for adding the clarifications One little nitpick:

It's not Windows 7 specifically that does this, Windows has a setting that's usually on by default (I believe, correct me if I'm wrong,) that hides file extensions for known file types.

Pretty much, Windows sees that you have a zip file. It knows what zip files are, so it doesn't show you the .zip portion of the file name, if that setting is enabled. From there, you'd push the update.zip to your phone, and it would be named update.zip.zip - all because of Windows.

By turning this off (in a folder view, Tools -> Folder Options -> Uncheck 'Hide extensions for known file types') it will stop this stupid feature.

 

[ksimmons]

Thank everyone so much for this tutorial. it is very clear and easy to understand. Worked like a charm.

 

[muzicman0]

Awesome...used this to go to the RC33 version of JFv1.41, and it works great!
mm0

 

[GiantKruemel]

Is this also working for "German" G1? I heard about that this only works for US or UK G1! Is it true? Has someone in Europe experienced different things?
Is there a possibility if I try this out and it doesn't work, that I get the old system back? Like creating a copy of it?

Thx for helping out


MFG Da Wolf

 

[devolio]

From what I've read, you're correct, this won't work on a German G1

 

[noonehereyet]

Thank-you Devolio and Shivers.... I found my roots

 

[azzf26]

hi, i have rc9 and would like to root.so ive formatted the sd card in fat32,and downloaded all the files i need,and put the DREAIMG.NBH on the sd card. when i boot up again holding power/camera im getting the funky red/green/blue screen, but the bootloader is not finding the image.it just says NOT ALLOW. could some one please help !! as my head hurts trying to root this thing

 

[devolio]

As I don't have a european device, I can't say for sure, but this thread should get you started on the process : HOW TO: downgrade, root and upgrade ANY G1/Dream (even Continental European) - xda-developers

I know there's also threads on xda-developers that has the rollbacks for the UK devices.

 

[burnticarus]

Just wanted to say Thanks! for a great tutorial. I had no problems.

 

[Deleted User]

After i updated the Radio to RC33 is it normal for a bunch of text to display, then go back to the "update" screen?

 

[kizer]

I think Im an idiot or something. I type "enter telnetd enter" and well it just stares at me like I'm an idiot.

I did downgrade to RC29 and uploaded the files like discribed.

Yes I'm in the US too.


Welp after trying a few times I decided to download the telnet app and just tried to login. It failed and I tried the enter telnetd enter again and eventually it worked. Go figure.

 

[Lithium]

I think Im an idiot or something. I type "enter telnetd enter" and well it just stares at me like I'm an idiot.

I did downgrade to RC29 and uploaded the files like discribed.

Yes I'm in the US too.


Welp after trying a few times I decided to download the telnet app and just tried to login. It failed and I tried the enter telnetd enter again and eventually it worked. Go figure.

Im having the same issue, it does nothing when I type (enter telnetd enter). will the phone do anything afterwards?

 

[Lithium]

su

cd /system

cat /sdcard/recovery_testkeys.img > recovery.img

when ever I type this into telnet it tells me it cannot flash because its a read only file?

 

[devolio]

You need to remount the system to be able to write to it

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system

 

[Lithium]

You need to remount the system to be able to write to it

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system

so i need to remount again after I enter ?
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system

dd if=/system/bin/sh of=/system/bin/su

chmod 4755 /system/bin/su

 

[Lithium]

I keep trying but its still says file is for reading only. Am I not using the right file? Im opening the zip file called Androidmod.zip and saving the IMG file labeled recovery_testkeys.img to the micro sd card in the phone.

 

[devolio]

You should only need to remount.. Pretty much turn the phone on, get root with telnet, remount as writable (mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system) and then writing the keys should work.

 

[Lithium]

You should only need to remount.. Pretty much turn the phone on, get root with telnet, remount as writable (mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system) and then writing the keys should work.

do I actually get ROOT when I type enter telnetd enter?

 

[Lithium]

thanks for the help man, I decided to install RC33 and start from scratch and it worked.

 

[Ageless Stranger]

I am probably the first person who should have rooted their phone, I have modded, hacked, upgraded or totally changed the OS on all the smart phones I have had the pleasure of owning. For some reason I have not rooted my G1, and I am still asking myself *why* ?