Rooting: A quick guide (Updated 3/10/09)

Last Updated:

  1. devolio

    devolio Well-Known Member

    Root allows you to modify just about everything, flash new images, change your boot image, change themes, run ARM debian, and tons more.

    This guide goes through installing/downgrading to RC29, getting root, flashing the new recovery.img / test keys, changing the boot loader, and installing JesusFreke's modified RC33 builds.

    If you're using a Rogers G1, this process will not work for you. See this.

    If you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.

    Update (3/10/09): Switched from RC30 to RC33 instructions, and clarified a few points.


    JesusFreke's modified updates
    Registering without a sim or data plan
    Modded recovery and boot images
    Dream SPLs
    RC30 to JFv1.31

    And all of the great people over at xda-developers and freenode/#android who make it all happen. :)

    Let's get started.

    Also, please note that this will wipe out everything - all of your settings and apps - twice. By installing the RC29 nbh, you lose everything, and likewise moving to RC33.

    There's 4 main files you're going to need:

    This is the NBH file needed to roll back to RC29.

    The modified recovery image/test keys.
    The engineering bootloader. An It's recommended that you read more about them here before choosing this one.

    JesusFreke's (latest, at time of writing) modified RC33

    RC33 Radio update
    The radio update to apply when moving to RC33.

    Once you have all of the files, you're ready to go.

    Once again, if you're unsure about why you would want root, or aren't comfortable with flashing or poking around on your device, do not do this.

    It's definitely recommended that your phone's battery life remaining be full or near full when you start this, as it can take awhile depending on how quickly you do the steps.

    Step 1)

    - Format the Micro SD Card to FAT32.
    - Copy the DREAIMG.nbh file to the Micro SD Card.
    - With the phone off, hold camera and press power to boot into the bootloader.
    - Once the bootloader is loaded, press power to install.
    - Press the trackball to continue and press talk+menu+power to reboot.

    Step 2)

    - Copy recovery_testkeys.img onto the Micro SD Card.
    - Turn the phone on (if not already)
    - Type enter telnetd enter to start telnet
    - Telnet into the phone with telnet (telnet ipaddress) OR use the telnet application from the market and connect to localhost
    - Run the following as root (in telnet)

    Code (Text):
    2. mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
    4. dd if=/system/bin/sh of=/system/bin/su
    6. chmod 4755 /system/bin/su
    And you've created su, a way to switch to the root user easily. Now we need to add the modified recovery test keys. Run the following in telnet again (or as root).

    It's also a good idea to note that the sdcard must be unmounted at this point, so if you moved the recovery image to your phone using the phone, unmount it first.

    Code (Text):
    2. su
    4. cd /system
    6. cat /sdcard/recovery_testkeys.img > recovery.img
    8. flash_image recovery recovery.img
    Now that's finished.

    Personally, I prefer to go with the Engineering bootloader, but you can choose whichever you'd like.

    Step 3)

    - Rename whichever bootloader package you're going to use to
    - Copy it onto the Micro SD Card.
    - Turn off the phone (if not already,)
    - Hold home+power to boot into recovery mode
    - Alt+L to see the text
    - Alt+S to install the bootloader
    - When it's done, reboot

    And now you've got the bootloader. Last but not least, if you'd like, you can install JesusFreke's RC33 builds that add a lot of extra goodness.

    Step 4)

    Note: It's recommended elsewhere that you wipe your data (Alt+W in Recovery Mode) before applying this update. Although I don't do this myself, doing so never hurts.

    - Rename to
    - Copy it onto the Micro SD Card.
    - Turn off the phone (if not already,)
    - Hold home+power to boot into recovery mode
    - Alt+W to wipe the data, as noted above, if you so choose
    - Alt+L to see the text
    - Alt+S to install the update
    - When it's done, reboot

    Step 5)

    - Repeat the same process as in Step 4 with the RC33 Radio update. This update will restart your phone a few times and display the 'flashing rom' graphic, be patient, as it can take some time. And now you're done.

    Easy as pie. :D

    amit_eighty8 and degratnik like this.
  2. SecretAsianMan

    SecretAsianMan Well-Known Member

    WOW, my g1 exploded in my hands after i did all this. looks like i got too rooted. lol. thanks for the info. i really want root!
  3. Phases

    Phases Community Manager Administrator

    Excellent dev, thanks!
  4. soumyasutar

    soumyasutar New Member

    Hi All,

    I am looking forward to know more about Android OS.Like bionic...If any one have any docs regarding Android OS and app development..plz mail me @

  5. randel77

    randel77 Well-Known Member

    First, I gotta give Devolio a million thanks for helping me to get this working on my phone. I would like to offer a little help to those that might get stuck/confused at the same place(s) that I did.

    Step 2)

    - Copy recovery_testkeys.img onto the Micro SD Card.
    - Turn the phone on (if not already)
    - Type enter telnetd enter to start telnet
    - Telnet into the phone with telnet (telnet ipaddress)
    - Run the following as root (in telnet)

    - Type enter telnetd enter to start telnet
    (your contacts will come up it, which is ok. hit the enter key then type telnetd and the enter key again).

    - Telnet into the phone with telnet (telnet ipaddress)
    (at this point you need to download "telnet" from the market. Run the app and hit the "connect to server" button. a bunch of funny symbols will pop along the top of the screen the last one is #

    - Run the following as root (in telnet)
    (simply type the code exactly like you see it, in the telnet app)

    For those running windows 7 (as I am):
    if the JesusFreke's RC30 build does not install, rename the JesusFreke's RC30 build to update instead of

    As of writing this the latest JesusFreke's RC30 build is JFv1.41 (multi-touch browser). Heres where to get it
  6. devolio

    devolio Well-Known Member

    Thanks for adding the clarifications :) One little nitpick:

    It's not Windows 7 specifically that does this, Windows has a setting that's usually on by default (I believe, correct me if I'm wrong,) that hides file extensions for known file types.

    Pretty much, Windows sees that you have a zip file. It knows what zip files are, so it doesn't show you the .zip portion of the file name, if that setting is enabled. From there, you'd push the to your phone, and it would be named - all because of Windows.

    By turning this off (in a folder view, Tools -> Folder Options -> Uncheck 'Hide extensions for known file types') it will stop this stupid feature.
  7. ksimmons

    ksimmons New Member

    Thank everyone so much for this tutorial. it is very clear and easy to understand. Worked like a charm.
  8. muzicman0

    muzicman0 Well-Known Member

    Awesome...used this to go to the RC33 version of JFv1.41, and it works great!
  9. GiantKruemel

    GiantKruemel Member

    Is this also working for "German" G1? I heard about that this only works for US or UK G1! Is it true? Has someone in Europe experienced different things?
    Is there a possibility if I try this out and it doesn't work, that I get the old system back? Like creating a copy of it?

    Thx for helping out :)

    MFG Da Wolf
  10. devolio

    devolio Well-Known Member

    From what I've read, you're correct, this won't work on a German G1 :(
  11. noonehereyet

    noonehereyet No One... VIP Member

    Thank-you Devolio and Shivers.... I found my roots :)
  12. azzf26

    azzf26 Member

    hi, i have rc9 and would like to ive formatted the sd card in fat32,and downloaded all the files i need,and put the DREAIMG.NBH on the sd card. when i boot up again holding power/camera im getting the funky red/green/blue screen, but the bootloader is not finding the just says NOT ALLOW. could some one please help !! as my head hurts trying to root this thing
  13. devolio

    devolio Well-Known Member

  14. burnticarus

    burnticarus New Member

    Just wanted to say Thanks! for a great tutorial. I had no problems.

    N3TWORK BURN3R Well-Known Member

    After i updated the Radio to RC33 is it normal for a bunch of text to display, then go back to the "update" screen?
  16. kizer

    kizer Active Member

    I think Im an idiot or something. I type "enter telnetd enter" and well it just stares at me like I'm an idiot. ;)

    I did downgrade to RC29 and uploaded the files like discribed.

    Yes I'm in the US too.

    Welp after trying a few times I decided to download the telnet app and just tried to login. It failed and I tried the enter telnetd enter again and eventually it worked. Go figure. ;)
  17. Lithium

    Lithium Member

    Im having the same issue, it does nothing when I type (enter telnetd enter). will the phone do anything afterwards?
  18. Lithium

    Lithium Member

    Code (Text):
    2. su
    4. cd /system
    6. cat /sdcard/recovery_testkeys.img > recovery.img
    8. when ever I type this into telnet it tells me it cannot flash because its a read only file?
  19. devolio

    devolio Well-Known Member

    You need to remount the system to be able to write to it

    mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
  20. Lithium

    Lithium Member

    so i need to remount again after I enter ?
    mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system

    dd if=/system/bin/sh of=/system/bin/su

    chmod 4755 /system/bin/su
  21. Lithium

    Lithium Member

    I keep trying but its still says file is for reading only. Am I not using the right file? Im opening the zip file called and saving the IMG file labeled recovery_testkeys.img to the micro sd card in the phone.
  22. devolio

    devolio Well-Known Member

    You should only need to remount.. Pretty much turn the phone on, get root with telnet, remount as writable (mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system) and then writing the keys should work.
  23. Lithium

    Lithium Member

    do I actually get ROOT when I type enter telnetd enter?
  24. Lithium

    Lithium Member

    thanks for the help man, I decided to install RC33 and start from scratch and it worked.
  25. Ageless Stranger

    Ageless Stranger Well-Known Member

    I am probably the first person who should have rooted their phone, I have modded, hacked, upgraded or totally changed the OS on all the smart phones I have had the pleasure of owning. For some reason I have not rooted my G1, and I am still asking myself *why* ?

Share This Page