• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root Rooting WITHOUT USB. I know it's been posted before, I've searched.

Branndon

Android Enthusiast
Nov 10, 2009
481
30
Orange County, CA
My daughter broke my charging port on my phone, I now have 2 batteries and an external charger, it works fine.

However, I want to root, and I only find people asking why you would root without USB and people saying they don't think so. Some people said no, but that was a long time ago.

Has anything come out which would allow me to root? Like the old update.zip type deal for the OG Droids?
 
there is not a way that i know of.at least not the current revolutionary tool,since it needs to comunicate with the phone in fastboot.

you could prolly root the "old school" way,using adb, with a wireless adb app on the phone.

it involves getting temp root,rewriting the misc image,then flashing old firmware where you can temp root again,unlock emmc write protect,and install an eng hboot.

its a fair amount of adb commands,and could be a little scary rewriting the hboot(screw it up=no hboot=dead phone :eek:)

but,it should be possible. :)

heres the old root method,basically what wed be doing,but with a different temp root exploit for gingerbread: http://forum.xda-developers.com/showthread.php?t=996616

i could put together a download and help you with the commands if you are interested. do you have any experience entering things in a cmd window?
 
  • Like
Reactions: Branndon
Upvote 0
I'm a web developer, and started with dos back before 6.22, so I am comfortable with coding. This is a new area though, and I don't want to risk killing the phone, so I'd go ahead and try something if you were comfortable that we wouldn't brick the phone. What do you think?

Also I used adb for my OG droid, so I have done that before.
 
Upvote 0
there is only one chance of bricking the phone beyond use. writing the new hboot at step 6. there are 2 places where the steps say to compare the md5 before proceding. as long as you do those steps,and get the correct md5 outputs,the chances of bricking are literally none. :)

do you allready have the sdk set up? i normally include adb/fastboot in a my downloads so folks dont have to bother with the entire sdk.
 
Upvote 0
ok,we are gonna do it a lil differently,since the original temp root exploits do not work on gingerbread. were also going to use shadowmites permanent patched hboot instead of the original eng hboot.

prolly the best way to transfer large PG05IMG files is via an sd cardreader.

1)downlaod the exploits:
mini-adb_TB_exploits.zip
md5:mini-adb_TB_exploits.zip f99b7ec00d7bc49cc299baf050ae16fb

-download downgrade firmware:
PG05IMG_downgrade
md5:pG05IMG_downgrade.zip aae974054fc3aed275ba3596480ccd5b

you can empty the contents into your tools or platform tools,if you wish,or just extract it and use it instead,its got everything we need.. extract,place on root of C drive on your PC

2)install revolutionary drivers:
http://downloads.unrevoked.com/HTCDriver3.0.0.007.exe

3)install this wifi over adb app on your phone: WiFi ADB im sure others will work,but i used this one and it worked great.

4)prepair your phone
-charge battery to 100%
-go to settings/display and set your time out to NEVER sleep. *this is important.
-launch the app
-touch the "turn on" button
.
5)connect and downgrade
-open a cmd window(on windows 7,click start bubble,type "cmd" or "command" in search box. other versions of windows may be same or similar)
-change to your mini-adb_TB_exploits directory by typing this command in your command window: cd c:\mini-adb_TB_exploits this should change your command prompt to: "c:\mini-adb_TB_exploits>"
-enter the command on the screen of your phone to connect to adb over wireless. in my case it was : adb connect 192.168.1.68:5555 i have no idea if it will be different in other cases

from this point forward,all adb commands will be bold,copy and paste them into the cmd window. additional comments will be red or blue and shouldnt be copy/pasted

adb devices should return your serial number


adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/busybox

adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF fre3vo will start,and do a bunch of stuff.at the end youll see "exploiting device..." then your promt will reapprear

adb shell if fre3vo worked,youll see a #

/data/local/busybox md5sum /data/local/misc.img should output c88dd947eb3b36eec90503a3525ae0de if its not,dont panic,its just the misc image. but youll need to re-download the exploits file,swap out the "misc" images and try again. :(

if the md5 matches,then:
dd if=/data/local/misc.img of=/dev/block/mmcblk0p17

exit

at this point,you can flash the downgrade firmware. rename it PG05IMG and place it on the root of your sd card. power off,then on into hboot. it should find the file,check it,and ask to update. tell it yes :) its a long process,and a long first boot,so be patient.

after the old firmware is booted,youll have to deal with the hassle of signing into google and redownloading the adb wireless app. repeat step 4 and get reconected to adb. remove PG05IMG from your sd card


adb devices

adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis
adb shell
/data/local/psneuter gain temp root. will throw you out of your root shell

adb shell
/data/local/wpthis disables emmc write protect
exit

ok,heres the scary part where you want to make sure the md5s match

adb push hboot_sm_perm_1.04.0000_110223.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hboot_sm_perm_1.04.0000_110223.nb0
output must be 95ecb03e355003af6fc0be393ab2fba7 if so,then procede. it doesnt match,stop. youll need to redownload the exploits file,swap out the hboot files, and try again.

if the md5 matched,write the new hboot:
dd if=/data/local/hboot_sm_perm_1.04.0000_110223.nb0 of=/dev/block/mmcblk0p18

confirm proper write:
/data/local/busybox md5sum /dev/block/mmcblk0p18
again,output must be 95ecb03e355003af6fc0be393ab2fba7 if it is,then REBOOT. if not, DO NOT REBOOT

you can reboot the phone manually,or with the following:
exit to get out of your root shell and back to normal prompt
adb reboot

once the phone reboots,you should be running stock,old firmware with shadowmites permanent patched hboot :) you can power off,power on into hboot and verify that you are s-off

if so,its just a matter of running an ruu of your choice to get back to current,up to date firmware,then install a recovery of your choice as a PG05IMG file in hboot,then flash superuser files or the rom of your choice in recovery.

you can use PG05IMG_no_hboot_2.11.605.19 from the root/unroot thread to upgrade,as its the most current radio,etc. note that shadowmites hboot will not allow itself to be overwritten,so if you run an ruu,or recieve an OTA,you will remain s-off.

choose a recovery from here:
http://androidforums.com/thunderbol...0-radios-recoveries-hboot-updated-9-24-a.html

if you wish to root the stock firmware,flash this in recovery: superuser 3.0.7

or consider just flashing jrockers rooted stock rom:
http://androidforums.com/thunderbol...ted-5-21-12-rooted-ota-2-11-605-19-files.html

last and not least,ill get the downgrade ruu link up as soon as it uploads,and if you want to wait till later this afternoon,ill run through it on my phone and makde sure theres nothign i forgot :eek:

if youre confident and comfortable in the cmd window,youre welcome to go ahead and try it :) ill be doing fathersday stuff until prolly 3 or 4,tho,and unavailble for advice if somethin happens
 
  • Like
Reactions: Branndon
Upvote 0
Would it be possible to put fre3vo on the phone first thru an SD reader or just downloading it onto the phone, and then chmod'ing and executing it through Terminal Emulator? If so, that would give you temp root so you could run the ADB over WiFi app, and then you could do the rest of the instructions as listed.

ive been looking into that,but terminator emulator commands are different than adb commands. seems it should be possible,but i havent figured out exactly how to do it.

fre3vo needs to get from the sd to data/local

has to be changed to a file that can be run(chmod)

then the file ran

after that, su prolly needs pushed to system/bin and system/xbin,permissions set,etc. then the superuser app can be either pushed and installed,or possibly just downloaded from the market.

then the whole process will need repeated to get it working again on the downgrade :eek:

if we could find a non-root requiring wifi or bluetooth adb app,it would very greatly simplify things ;)
 
  • Like
Reactions: Branndon
Upvote 0
I'm not familiar with what fre3vo's files are, but you should be able to do it all in terminal emulator:

This should get the files into the directory you need:

Code:
cp sdcard/<file name> data/local/tmp/<file name>

If that doesn't work, you may need the first forward slash:

Code:
cp /sdcard/<file name> /data/local/tmp/<file name>

Then, to CHmod it:

Code:
chmod 755 data/local/tmp/<file name>

I'm not sure how to run it, though. You might just be able to type the file location and the file name and the terminal emulator will try to execute it, like a script. So, if my guess is right:

Code:
cd data/local/tmp (push enter)
<file name>

Although I'm not sure, I haven't done much with linux terminal. My experience is with HPUX and that was years and years ago.
 
Upvote 0
Jer / guys:

Yeah, unless your PATH variable is setup to look in (and use) your local directory, it won't "see" a file to be executed using a relative path.

Probably the best way to do things is to just use an absolute (full path) file reference.

For example, if you've pushed a file, say busybox, to /data/local, then you would reference it with (here's an example command):

/data/local/busybox md5sum filename

This is probably the simplest way. You can make relative references to it (i.e., something like this:

cd /data/local
. ./busybox md5sum filename


But it gets a bit tricky with all the "dot" references, etc. (I've even gotten confused by this and I should know what I'm doing ;) :)). Best to stay simple.

Lemme know if you need any shell command help--I live in that world every day and have done a fair bit in Android with it.

Cheers!
 
Upvote 0
thanks a bunch for the replies! so far,im stuck at the beginning :eek:

running this comand:
cp sdcard/<file name> data/local/tmp/<file name>
no matter how i try it,with or without the extra /'s i get this error:

Code:
cp: not found

is it not finding sd card? or not finding fre3vo? or not finding the cp command? :p do the file names need extensions? :thinking:

mister scary,im sure we can use all the help we can get!
id come across this yesterday when i messed with it some,but its still a bit over my head :eek: ive always hated typing precise commands on a virtual keyboard,and thus have always avoided the use of terminal emulator until now ;)
 
Upvote 0
thanks a bunch for the replies! so far,im stuck at the beginning :eek:

running this comand:
cp sdcard/<file name> data/local/tmp/<file name>
no matter how i try it,with or without the extra /'s i get this error:

Code:
cp: not found

is it not finding sd card? or not finding fre3vo? or not finding the cp command? :p do the file names need extensions? :thinking:

mister scary,im sure we can use all the help we can get!
id come across this yesterday when i messed with it some,but its still a bit over my head :eek: ive always hated typing precise commands on a virtual keyboard,and thus have always avoided the use of terminal emulator until now ;)

Yep, native "cp" command does not exist in the base shell--its there in the busybox, but not in sh or su.

You'll have to use "cat" instead...yeah, I know...pain in the butt ;) :).

cat /sdcard/filename > /data/local/tmp/filename
 
Upvote 0
grrrr :mad:

Code:
[COLOR="Red"]$ cat/sdcard/fre3vo > /data/local/tmp/fre3vo[/COLOR]
cannot create /data/local/tmp/fre3vo: permission denied

unfortunately i gotta get to work,so ill have to play with this some more later this evening.

No problem, Scotty--ping me on PM, email, or cell if I can help later...will be easier from home, too for me.

:)
 
Upvote 0
will do mister scary! :cool:

branndon,where are you located? it occured to me there is an extremely easy way to root your TB with no usb port,if you can get your phone to me,or dont mind spending $80ish on an xtc clip :eek:

if youre close enuff to dayton,oh,to meet somewhere i can turn your radio secureflag off with my xtc clip. ive done 2 tunderbolts to date at frickers :p

alternatively,if you can be without the phone long enuff to ship it here and back,i can do it and send it back to you

edit:
ooooh i see your avitar says orange county,CA. bit to far for a meet,lol... well the offer stands to ship it here,or you can search your ocal craiglist. i see guys advertising here all the time. the clip sim-unlocks the phone as well,so alot of phone shop guys have them. your chanches of finding someone local that has one are pretty good.
 
  • Like
Reactions: Branndon
Upvote 0
Thanks Scotty, you guys are all amazing here. I could ship the phone because I have an old OG droid I could use for a week or 10 days while you worked on it. But at that point, I'd have to go back to Verizon for a new sim card. Wouldn't that cause problems?

What's this xtc clip you're talking about?

you could call verizon and explain that you want to use your OD droid for a few days,i believe now they can suspend your sim so that you will not need a new one,you will just have to call them to reactivate it. in a worse case,they will have to send you a new sim.

it shouldnt really cause any prollems,now and then i use my merge or inc 2,neither of wich are 4g phones.

basically the clip software provides a factory PG05DIAG file that is used to simunlock,supercid,and turn off the radio secure flag. the clip is important,becasue it emulates an engineering sim card via a flex cable plugged into the sim card spot.this is needed to allow the DIAG file to work

this results in radio s-off,wich is way cooler than the patched hboot that revolutionary provides,lol. :smokingsomb:

shoot me a PM if youre interested in going this route and ill give you my snail mail addy to send it to. or,as i said,you can prolly find someone local that may meet you somewhere and do it while you wait. the clip itself is can be powered by a 9v battery,and the diag file is put on a small micro sd "gold card" so a pc is not even needed. as i mentioned,ive done 2 of my friends TBs at frickers :)
 
Upvote 0
I'm connected! Which commands should I try to see if this will work?

if youve got a cmd window open and a serial number back from "adb devices",then just procede with the rest of the commands,if youre comfortable venturing into somewhat uncharted territory. the responses may not be instantaneous like they are when simply connected via a cable,so be patient when it seems like its hung. the first session contains nothing (that i know of) that could permanently damage your phone,so should be pretty safe.

if you get the downgrade to work,the only dangerous part is writing the new hboot,so just make sure that the md5 matches,and you should be fine there as well.

if it will make you more comfortable,you are welcome to describe what you did to get things working,and i can run thru it on my phone first so well know what to expect. :)
 
  • Like
Reactions: scary alien
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones