Database Info

[GUIDE] How To Root The Sprint CDMA Hero (Windows)

I have compiled this guide from the other one posted on this forum, the discussion therein, and my own knowledge. If you have any suggestions on making it better or to correct any mistakes I may have made please let me know.
This guide is intended for Windows and includes detailed instructions. It will cover the steps necessary to root, flash the new recovery image, create a full backup. This will work with software versions 1.29.651.1 and 1.56.651.2 (aka Android 1.5). If you have updated to 2.1 please following this guide here. I am not responsible for any damage done to your phone using this guide. Root at your own risk.
I have put to together a video on YouTube for you to follow along as well. The version numbers of certain files are now outdated in the video so change file names as necessary.
If you own a non-Sprint Hero, you will need to do some extra steps. Follow the guide in the How to Root Non-Sprint CDMA Hero thread.
Step 1: Download the Android SDK from http://developer.android.com/sdk/index.html The Windows file is called android-sdk_r06-windows.zip. Extract the files to your C: drive so that you now have the folder C:\android-sdk-windows
Step 2: Download the asroot2 exploit file from http://forum.xda-developers.com/attachment.php?attachmentid=244212&d=1257621154 Extract asroot2.zip to C:\android-sdk-windows\tools folder.
Step 3: Download the Hero recovery image from http://forum.xda-developers.com/showpost.php?p=4898505&postcount=1g Place this file in C:\android-sdk-windows\tools as well.
Step 4: Make sure USB Debugging is off by going to Settings>Applications>Development. Now connect the phone to your PC via USB cable.
Step 5: Mount your sdcard; Browse to the HTC Sync folder and install HTC Sync on your pc. After it is done installing unmount the sdcard then enable your USB debugging.
Step 6: Open a command prompt by clicking the Start button and typing cmd into the search box and pressing enter or found under All Programs>Accessories.
Step 7: You will now enter a series of commands which I will place inside code boxes to indicate the entire command. You may copy and then paste them into the command prompt window by right clicking. Only enter one command at a time.
1:
Code:
cd C:\android-sdk-windows\tools
2:
Code:
adb devices
If you've been following this guide you will see your phone's serial number. If you get "device not found" error, you either need to make sure you the drivers were properly installed or make sure you enable USB debugging AFTER you connect the USB cable. Continue on once you get the proper phone serial output.
3:
Code:
adb push asroot2 /data/local/
4:
Code:
adb shell
5:
Code:
chmod 0755 /data/local/asroot2
6:
Code:
/data/local/asroot2 /system/bin/sh
You should see an output that says:
$ /data/local/asroot2 /system/bin/sh
[+] Using newer pope_inode_info layout
Opening: /proc/857/fd/3
SUCCESS: Enjoy the shell.
#​Now for a few last commands.
7:
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
8:
Code:
cd /system/bin
9:
Code:
cat sh > su
10:
Code:
chmod 4755 su
You are now officially rooted. A few more steps and you will have flashed the recovery image.
11:
Code:
exit
12:
Code:
exit
13:
Code:
adb push recovery-RA-heroc-v1.6.2.img /sdcard
Pushing is equivalent of copy the file to the root of your sdcard. By the time you finished reading this it should be done. You'll know its done because the ouput will say something like transferred X bytes in X secs.
14:
Code:
adb shell reboot
This will cause the phone to restart automatically. Wait till it is fully booted to continue.
15:
Code:
adb shell
16:
Code:
su
17:
Code:
cd /sdcard/
18:
Code:
flash_image recovery recovery-RA-heroc-v1.6.2.img
FLASHING TO THE RECOVERY TAKES SEVERAL SECONDS-- BE PATIENT. ENTER THE NEXT COMMAND ONLY AFTER THE COMMAND PROMPT RETURNS TO THE # (ROOT SYMBOL).
19:
Code:
reboot recovery
Step 8: This is the last command; you may now close the cmd prompt. This will cause your phone to boot into recovery mode; it should take no longer than 30 secs. The third option on the list is "- Backup/Restore"; select it. Now, select the first option "- Nand backup". The phone will prompt you to press HOME to confirm which is want you want to do. The backup will begin. You will see the screen say, "Performing backup : .........." When done, the bottom of the screen will say "Backup complete!" and you will be given the menu options again. Go back to the main menu and select reboot system. Rebooting your phone after installing the new recovery image may take several minutes.
Step 9: Once your phone is fully booted, mount the sdcard. You will see a folder called "nandroid"; I highly recommend you copy this to your pc in case you lose your sdcard data or reformat it. Your phone is rooted, 100% backed up, and ready to install a custom rom if you wish!

wow dude,
instructions worked great on Win7
i was able to download the missing usb_drivers by running SDK Setup in C:\android-sdk-windows, and selecting the usb driver from the available packages. I was unable to download the index for the SDK Setup program until I enabled "force http://" in the settings menu.
had to copy over asroot again after i ran SDK Setup (that program deleted it from the directory)
your instructions worked like a charm. total time spent rooting this thing after finding your post: 18 minutes.
(you might want to add a line there in the "mount and copy over the zip file step" to backup the nandroid folder from your SDCard to your comp just as a backup of your stock phone image)
anyway.. cheers!

izanagi said:
wow dude,
i'm about to follow these instructions. thank's for the precise list!
(btw, about to try it on Win7.. may have to change some folder pathing but we'll see)
okay.. typo on the first command in parentheses, and I'm missing the usb_drivers folder (do you have it / can sent it to me) so am unable to install the device in win7.
Click to expand...
Click to collapse
Heh, thanks for the misspell heads up. I did my rooting from Win7 pc; it automatically installed correct drivers for me. To check go to the Control Panel>View devices and printers. You see one device named "Android Phone". Otherwise as far as Ive heard installing HTC Sync installs proper drivers.​

izanagi said:
*** edit had to copy over asroot again after i ran SDK Setup (that program deleted it from the directory)
**** edit: all done.. your instructions worked like a charm. total time spent rooting this thing after finding your post: 18 minutes.
(you might want to add a line there in the "mount and copy over the zip file step" to backup the nandroid folder from your SDCard to your comp just as a backup of your stock phone image)
anyway.. cheers!
Click to expand...
Click to collapse
Thank you for taking the time help make my guide better. I'm very glad to know there are little to no hiccups.

When I do step 5, instead of:
5. "/data/local/asroot2 /system/bin/sh"
You should see an output that says:
$ /data/local/asroot2 /system/bin/sh
[+] Using newer pope_inode_info layout
Opening: /proc/857/fd/3
SUCCESS: Enjoy the shell.
#
I get:
[1] Killed /data/local/asroot2 /system/bin/sh
Any suggestions? Should I just be quiet until there is an Eris specific way to do this?

When I do step 5, instead of:
5. "/data/local/asroot2 /system/bin/sh"
You should see an output that says:
$ /data/local/asroot2 /system/bin/sh
[+] Using newer pope_inode_info layout
Opening: /proc/857/fd/3
SUCCESS: Enjoy the shell.
#
I get:
[1] Killed /data/local/asroot2 /system/bin/sh
Any suggestions? Should I just be quiet until there is an Eris specific way to do this?

detox702 said:
When I do step 5, instead of:
5. "/data/local/asroot2 /system/bin/sh"
You should see an output that says:
$ /data/local/asroot2 /system/bin/sh
[+] Using newer pope_inode_info layout
Opening: /proc/857/fd/3
SUCCESS: Enjoy the shell.
#
I get:
[1] Killed /data/local/asroot2 /system/bin/sh
Any suggestions? Should I just be quiet until there is an Eris specific way to do this?
Click to expand...
Click to collapse
This guide is for the CDMA Hero not the Eris!

When I go to apply the rom I get an white screen with skateboarding androids on the bottom and the prompt to erase data yes/no. I press the home key and the Hero reboots without asking to "Apply sdcard:choose zip". This is done from the boot menu. Does the rom load automatically? Did I do something wrong? I got root with no problem. A tip; to make it easier and to avoid spelling mistakes copy and paste the rooting commands from the instructions. Made it go faster too. Thanks in advance.
Never mind. I held down Home and Power at
the same time instead of Home THEN power! ARRGH! Loading up now as I type. Sorry.

ELIMINATED said:
When I go to apply the rom I get an white screen with skateboarding androids on the bottom and the prompt to erase data yes/no.
I press the home key and the Hero reboots without asking to "Apply sdcard:choose zip".This is done from the boot menu.
Does the rom load automatically? Did I do something wrong? I got root with no problem.
A tip; to make it easier and to avoid spelling mistakes copy and paste the rooting commands from the instructions. Made it go faster too. Thanks in advance.
Click to expand...
Click to collapse
yuck... break up your sentences, that's alot of crap to throw on someone all at once... and the bold doesn't help it any.
check to see if you have the custom recovery installed....
-turn off phone
-hold vol down + power
-should search for some stuff then give three options
-press "home" to enter recovery image
do you see "!" and a phone.... does it just hang or do you see a green/yellow menu?

At the end of his post he says he figured it out. He wasn't holding down home key

None of this is working for me at all... I'm not sure what I'm doing wrong, but every time I enter ANY of the commands into the prompt all I get is "cannot find the path specified".
For reference, i have done everything in this guide to the letter, everything is downloaded, unzipped to the correct location, USB drivers installed, etc etc. Not sure what's wrong.
EDIT: I figured it out.. user error, awesome. Worked great, thanks for this!

awesomeindeed said:
None of this is working for me at all... I'm not sure what I'm doing wrong, but every time I enter ANY of the commands into the prompt all I get is "cannot find the path specified".
For reference, i have done everything in this guide to the letter, everything is downloaded, unzipped to the correct location, USB drivers installed, etc etc. Not sure what's wrong.
EDIT: I figured it out.. user error, awesome. Worked great, thanks for this!
Click to expand...
Click to collapse
"cd C:\android-sdk-windows\tools" is actually "cd C:\android-sdk_r3-windows\tools"
is that where you are stuck?

thank you TS. I've been lurking xda for a couple years now when i had the mogul and tp. First time on an android device. Thank you for your time in helping me.

someone buy this man a drink!!!
Invaluable piece of work right here, helped me get it done in no time at all....real clear concise and very helpful....REQUEST THIS BE A STICKY!!!!!

fenske09 said:
"cd C:\android-sdk-windows\tools" is actually "cd C:\android-sdk_r3-windows\tools"
is that where you are stuck?
Click to expand...
Click to collapse
That was the name of the zip file not the extracted folder.

Please help, I followed all of your instructions, I received no errors however I can't boot the recovery image. I checked and it is in the sd card, but every time it just hangs at the HTC logo
I downloaded a terminal emulator and typed su and it gave me # so I assuming I am rooted?!

newtodroid said:
Please help, I followed all of your instructions, I received no errors however I can't boot the recovery image. I checked and it is in the sd card, but every time it just hangs at the HTC logo
I downloaded a terminal emulator and typed su and it gave me # so I assuming I am rooted?!
Click to expand...
Click to collapse
Redownload the recovery image and reflash it. The one you're using probably became corrupt during DL or something.

theresthatguy said:
Redownload the recovery image and reflash it. The one you're using probably became corrupt during DL or something.
Click to expand...
Click to collapse
also make sure you have the heroc version there's a hero and heroC, i messed that up once and had similar results

new ROM
So i loaded the custom ROM, and i followed all the istructions as listed on this guide. When i rebooted my phone, a bunch of my apps started Force Closing on startup.
did i miss something, or do something wrong?
if i reinstall them on the new ROM will they work right?
thanks for any insight

kristaps said:
So i loaded the custom ROM, and i followed all the istructions as listed on this guide. When i rebooted my phone, a bunch of my apps started Force Closing on startup.
did i miss something, or do something wrong?
if i reinstall them on the new ROM will they work right?
thanks for any insight
Click to expand...
Click to collapse
you converted your sd card to fat32,ext2,swap and now the apps are looking for the program on your sd card,
turn off your phone
take out sd card
turn on phone
uninstall app
turn off phone
put in sd card
turn on phone
reinstall app
this should fix you

[DROID] Root instructions (UPDATED)

The following is a guide for how to obtain root access within an ADB shell, then locally on the device.
UPDATED TO SIMPLE VERSION WITHOUT ADB
--------------------------------------------------------------------------
Credit:
- embeem for bringing the Eclair signature check hole to attention.
- For creating the exploited update package: Zinx Verituse (initially posted here)
- mjxg for writing a complete guide which I have modified and reposted here (original thread here
- Cyanogen for providing Superuser.
--------------------------------------------------------------------------
THIS WILL NOT UPDATE YOU TO 2.0.1. If you would like to end up with a rooted 2.0.1 and haven't been pushed the update OTA yet, then please follow this (http://alldroid.org/viewtopic.php?f=210&t=568) guide THEN follow the directions below.
--------------------------------------------------------------------------
1 - Download the droid-super_user.zip file from: http://alldroid.org/download/file.php?id=659 (md5sum cf653352967253e99d967498ffd9ce69).
Do not extract.
2 - Rename the file to "update.zip".
3 - Plug your Droid into your computer via USB. On the Droid go to the Notifications bar and select "USB Connected" then press "Mount".
4 - Once the device is mounted, the SD card will show as a removable device on your computer
5 - Put the "update.zip" file you just renamed into the Root (top) directory of your SD Card.
6 - Unmount the device from your computer, and turn the Droid off.
7 - Hold down the "X" key on the physical keyboard and while doing so press the power button. Hold both of them down until you see a Triangle with an !.
8 - Press the Vol+ and the Camera button together until you get a menu.
9 - Using the D-pad on the physical keyboard, select the option to update with the update.zip file.
10 - This should take a little bit. Once it's done select the option to reboot the phone.
Now you can download a root application, or terminal emulator and try out your new found root access.
This works with 2.0.1
Please do not start removing any applications just yet. You will run into problems trying to flash anything. Wait until we have a recovery image made.

can some one dump the phone?

Looking at the change in Gerritt:
https://review.source.android.com/#change,12807
It has not been approved yet, although that doesn't prevent Mot from cherry picking it.
I just tried the droid-root.zip update on my Droid, worked great. The only thing I might add is to rename the otakeys.zip from /system/etc/security/otakeys.zip to prevent future OTA updates.
Don't want to lose root now that we have it.
-Howard
http://www.magicandroidapps.com. - Home of Better Terminal Emulator Pro, the best terminal emulator for Droid.

With root, you can dump out the MTD partitions to /data/local, ie:
adb shell
$ su
# cd /data/local
# cat /proc/mtd
Use this output to figure out which partitions are what, and then dump them out, ie:
# cat /dev/block/mtdblock0 > pds.bin
Then 'adb pull' the /data/local/*.bin files to your PC.
-Howard
http://www.magicandroidapps.com - Home of Better Terminal Emulator Pro, the best terminal emulator for Droid.

There is now a more streamlined way of going about this. I need to update the guide.

NEWEST METHOD that DOES NOT require adb
New exploit zip, including Superuser from CyanogenMod
First you have to update your phone to 2.0.1. If you have already done this manually, or if your phone has already received the OTA update, move on to the next section.
First, download this attachment ( http://alldroid.org/download/file.php?id=646 ) and rename it to "update.zip".
Copy update.zip to the SDcard in your phone.
Reboot your phone to recovery mode by holding down x while the phone turns on. once you see the /!\ emblem, press the Volume Up and Camera buttons at the same time.
Select Install update.zip from the menu.
Reboot once it is done.
Now your phone is updated to 2.0.1
Now, to root the phone.
download this attachment ( http://alldroid.org/download/file.php?id=659 ) and rename it "update.zip"
Copy update.zip to the phones sdcard
reboot phone to recovery mode (hold x while turning phone on, press volume up + camera button)
install update.zip
reboot
and you are done.
all credit to Zinx Verituse over on Alldroid.org

su works but apps still say I don't have root?
I'm an IT Professional not a newb, but not super great on Linux either.
I've followed the rooting steps, after updating manually to 2.0.1
The issue is, I can go: su using a term emulator on my phone and it says "access granted courtesy of magicandroidapps" (something like that).
I can do things through the term emulator, but for some reason when I download apps that require root and try to use them it still says I don't have root access? What gives? I couldn't even rename a file in /etc/bluez using ROOT EXPLORER (a file manager).
It's like root works on term emulator but not through GUI apps? Am I missing something?

Disregard, problem solved
Disregard.

Updated to new, simple, one flash instructions.

i cant get this to work for nothing. when i download the files i extract them to the desktop then put them into one folder named update.zip is this wrong?

dabo318 said:
i cant get this to work for nothing. when i download the files i extract them to the desktop then put them into one folder named update.zip is this wrong?
Click to expand...
Click to collapse
It never said to extract. Rename the .zip to update.zip (make sure it's not update.zip.zip) then carry on.

I've got a question. This is a hole found in android, so this should work for any android device, as long as you append the original exploit.zip to that devices update.zip, correct?

ok i finally got the zip on the phone and trying to setup metamorph now. its been setting up file: zip for about five min is this normal?

Here is a link to a tutorial on how to create your own update.zip in order to deliver whatever you may need to (with a size limitation).
http://alldroid.org/viewtopic.php?f=210&t=626
Please note this is exclusive to the current Android 2.0

cellulararrest said:
Here is a link to a tutorial on how to create your own update.zip in order to deliver whatever you may need to (with a size limitation).
http://alldroid.org/viewtopic.php?f=210&t=626
Please note this is exclusive to the current Android 2.0
Click to expand...
Click to collapse
And 2.0.1 ... thanks though, that pretty much answered my question. So any device that gets pushed 2.0/2.0.1 ota update and on before this hole is patched up this should work on. Let's hope they don't patch it before we get a hold of a milestoine update.
Btw- someone should check out the 2.1 sense dump and see if this hole is still present.
Oh and sorry about getting slightly off topic, just seemed the most revelent place to ask.

Yeah that would be good to check 2.1. But I don't think anyone is actually using that recovery image. If it's even available. Everyone has fancy dancy custom recovery images.

COMPREHENSIVE HOWTO "ROOT YOUR DROID" (my best attempt anyhow)
*deleted* per a noobs request (cuz I've heard from others as well that my directions were outdated even though they use super-root from Cyanogen).

Rainabba, Please delete that post. it's out-of-date and incorrect.

i just installed a terminal app from the market, type su and hit enter, it asked to allow or deny, so i believe just a terminal app will give you SU also, correct?
im an idiot when it comes to adb. also just a reminder to the root nobbs, if your using vista, just name the update, update dont add the .zip to it, or it wont work.

Correct. Please don't start removing apps from your system. A few people have been doing that just because they can and are causing themselves real problems. Hold off until someone succeeds in their endeavors for a custom recovery image.

HowTo re-flash the recovery image after old 2.1 RUU

This guide was taken from AndroidCentral and I thought I would share it here because it's taken me 4 hours this morning to figure out why I was having so many problems trying to flash a recovery image when I know my phone was rooted and flashed in order to get 2.1 a month or so ago. I have been searching these forums and google and hope anyone else who has my issue finds this post.
1. Make sure you have the Android SDK installed.
2. Download flash_image.zip
3. Download recovery-RA-heroc-v1.5.2.img
4. Unzip the first file, and place both in your Android SDK/tools folder.
5. Make sure USB debugging is ON
6. Connect your phone to the PC
7. Open the command window and navigate to the Android-sdk/tools folder on your computer.
8. At the prompt enter the following, one line at a time followed by enter
Code:
adb shell
su
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
exit
exit
adb push flash_image /system/bin
adb push recovery-RA-heroc-v1.5.2.img /sdcard
adb shell
chmod 0755 /system/bin/flash_image
reboot
9. Your phone will reboot. When it is finished, back at your command window, once again enter
Code:
adb shell
su
cd /sdcard
flash_image recovery recovery-RA-heroc-v1.5.2.img
reboot recovery
10. With any luck, you'll have the recovery image back and can load custom 2.1 based ROMS again.
Hope this helps. All credit goes to gbhil at Android Central.

You might want to change the title of the post. People might get confused thinking you found a way to downgrade the hboot and not how to flash the recovery image.

Can't get it to work.
I ran the RUU earlier.
Tried to root the old way.......didn't work.
Just tried this to get the recovery image back.
At the SU command it says: permission denied
Thanks,
Bubba.

bubbacs1 said:
Can't get it to work.
I ran the RUU earlier.
Tried to root the old way.......didn't work.
Just tried this to get the recovery image back.
At the SU command it says: permission denied
Thanks,
Bubba.
Click to expand...
Click to collapse
This won't work for the leak that was put out today. You lost root. This process requires root.

bubbacs1 said:
Can't get it to work.
I ran the RUU earlier.
Tried to root the old way.......didn't work.
Just tried this to get the recovery image back.
At the SU command it says: permission denied
Thanks,
Bubba.
Click to expand...
Click to collapse
If you used the new RUU that was leaked today you're screwed. The older 2.1 leaks were test ROMs that were already rooted so you could use the instructions above to flash the RECOVERY. Notice recovery in bold, not bootloader. Once hboot is updated there is no known way to downgrade so you could use an older RUU file.

This rom has no root. There is NO WAY to re-root after flashing the newest RUU. I'm sorry to say... you're ****ed.

HeroMeng said:
This rom has no root. There is NO WAY to re-root after flashing the newest RUU. I'm sorry to say... you're ****ed.
Click to expand...
Click to collapse
So they can't run an older ruu with 1.5?

HeroMeng said:
This rom has no root. There is NO WAY to re-root after flashing the newest RUU. I'm sorry to say... you're ****ed.
Click to expand...
Click to collapse
To clear that up, if you run the RUU you have no root. If you extract the ROM, set it up, and flash it, you will preserve root, just like damageless made for all of us. But, yeah, you are not gonna be able to get back from this one. at least until someone figures it out.

I changed the thread title to hopefully alleviate some confusion. I didn't realize there was a newer RUU released.
I flashed the Damageless Rom and it's running smoothly so far, but I'm still trying to figure out why wifi tethering isn't working out for me. :-(

celemew2 said:
I changed the thread title to hopefully alleviate some confusion. I didn't realize there was a newer RUU released.
I flashed the Damageless Rom and it's running smoothly so far, but I'm still trying to figure out why wifi tethering isn't working out for me. :-(
Click to expand...
Click to collapse
Did you get wifi tether version 1_60? That's the only version that ever worked for me.

Yeah, I have 1.60 installed on my phone right now, but when I try to start tethering, a SU Request black screen comes up and nothing happens until I get an error, "Activity SU Request (in application Superuser Permissions) is not responding."
I'm sure there's an answer somewhere, but lately I haven't been having luck searching for it.
Edit:
Thank you 98classic! All I had to do was enable USB Debugging. (I had it turned off cause I didn't like the warning up top when my phone was plugged into the computer)

"flash_image not found" what the f**k

need the binary? physically check its there with a root explorer
Sent from my broken Typewriter!!!

or do this download and set up the android SDK it itself includes the flash_image binary. after that u will need to open a command prompt on your computer u will have to change directory to platform tools
cd /path/to/platform-tools
after that u will get the chance to do
flash_image recovery /path/to/recovery.img
that will flash the recovery
now reboot into recovery
Typed from my broken Typewriter!!!

[Guide] How to gain root on 2.2 for Mac

*******UPDATED 8/31/10 *******
This rooting method was adapted from regaw_leinad's method and toastcfh's method. By following these steps you will successfully downgrade your phone back to android 2.1 in order to gain root.
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
special thanks to:
regaw_leinad
Sebastian Krahmer
Toastcfh
amon_ra
FILES YOU WILL NEED:
copy and paste into browser
Code:
sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip
evo4g.me/downloads//count.php?target=evo-root.zip
files.androidspin.com/downloads.php?dir=amon_ra/RECOVERY/&file=recovery-RA-evo-v1.8.0.img
developer.android.com/sdk/index.html
You will need the Android SDK in order to communicate between your computer and your phone. Download it (last link above) and follow the setup instructions that it comes with.
Unzip the contents of the evo-root.zip and put all the files from it into the tools folder located in the android sdk folder.
Rename the eng-PC36IMG.zip to PC36IMG.zip and then put it the tools folder located in the android sdk folder. DO NOT UNZIP IT!

******* PC36IMG.zip md5sum~ fe8aba99893c766b8c4fd0a2734e4738 *******
Move the recovery-RA-evo-v1.8.0.img into the android sdk folder as well.
Make sure usb debugging is enabled on your device. To do so go to Settings > Applications > Development > and make sure the check box is checked.
Plug your phone into the computer. Select "Charge Only" from the notifications bar.
Open up terminal and navigate your way into the android sdk folder.
Code:
cd /
cd asdk
Push all the files onto your phone.
Code:
tools/adb push /asdk/tools/flash_image /sdcard/
tools/adb push /asdk/tools/rageagainstthecage-arm5.bin /data/local/tmp/
tools/adb push /asdk/tools/mtd-eng.img /sdcard/
tools/adb push /asdk/tools/PC36IMG.zip /sdcard/
tools/adb push /asdk/tools/recovery-RA-evo-v1.8.0.img /sdcard/
Note that the PC36IMG.zip will take longer than the other files to transfer to the sdcard because it is a large file.

Now we will make rageagainstthecage.bin executable.
Code:
tools/adb shell
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
You should see this (below) after it has made the change.
Code:
$
Now to use the rooted shell.
Code:
cd /data/local/tmp
./rageagainstthecage-arm5.bin
You will now see some text on your terminal screen describing the exploit. 

Wait for the adb shell to finish the process. At this point it may or may not terminate the current shell session in terminal. If it does then it should look like this:
Code:
users-iMac:asdk user$
If it doesn't it will return to
Code:
$
in that case you need to exit the current session. To do so type
Code:
exit

Now we need initiate a new shell which should now have root permissions.
Enter the following:
Code:
tools/adb shell
and you will see you now have a
Code:
#
instead of
Code:
$
Now we need to flash the mdt-eng.img in order for it to let us install a custom recovery
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img
That will flash your misc partition with Toast's mtd-eng.img


This should return you to
Code:
#
Now boot into hBoot
Code:
reboot bootloader
This will reboot your phone into hBoot. It will scan for the PC36IMG.img. When it asks yes or no, select yes.
It should then reflash your phone into the engineering build.
When it asks to reboot select yes.
You will need to flash custom recovery in order to be able to flash other custom roms or modifications. I use Amon_RA's recovery because it works great and has NEVER caused me any problems.
Now, open up terminal and get back into the android sdk folder
Code:
cd /
cd asdk
Since we have already pushed the recovery onto the sdcard we only need to flash the recovery onto the phone so that we can use it
Code:
adb shell
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img
Now lets rename that PC36IMG.zip file again
Code:
mv /sdcard/PC36IMG.zip /sdcard/eng-PC36IMG.zip
that way your phone doesn't try to flash it when you go into recovery each time
And last but not least we need to boot into it to flash a custom rom
Code:
reboot recovery
Your phone should then reboot into Amon_RA's recovery and you may now head over to the dev forum to find your new favorite custom rom.

very nice! can anyone confirm this? my buddy wants me to root his 2.2 and i would like to try this.

To make life easier for some people add this to your post mate, and apply it yourself if you would like.
Here is how to add your sdk/tools directory to your .bash_profile file so you won't have to navigate to the folder each time.
Download this so you'll be able to see your hidden files http://www.mediafire.com/?diimft1ninn Run it, check "Show Hidden Files" then click Restart finder. Now, navigate to your home folder (/Users/UserName/) and see if there's a .bash_profile already there. If not, create with textedit.
Now add this to the file: export PATH=${PATH}:/Path/Of/Your/Sdk/Tools/Folder
Mine is /Users/bmxrider4444/Documents/Android/SDK/tools
Now do not save it as rich text. If yours is in rich text, click on "Format" in the menu bar, and click "make plain text". Now save it as .bash_profile and uncheck "if no extension is provided, use .txt".
Now you can go back to Ghost and uncheck "Show all hidden files" and restart finder again (special thanks to ajones7279 for these steps)
Enjoy!
Just as clarification as to what this does, it enables you to run adb commands and other commands without having to navigate to the /android/tools/ folder every time you want to run adb or whatever.

does this work?

seekis said:
At this point we need to push the recovery onto the sdcard
Code:
tools/adb push "location of recovery-RA-evo-v1.8.0.img" /sdcard/
Click to expand...
Click to collapse
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.

^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am

seekis said:
I don't trust unrevoked as I have had problems with it in the past.

I am not responsible for any damages to your phone.
Click to expand...
Click to collapse
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.

randymac88 said:
This is great! Thanks for the guide - I am planning on rooting my Wife's EVO but have been waiting for an easier method than the other one posted. Question on the above where we write "location of recovery-ra-evo-v1.8.0.img". Is that the exact code, or should we be adding a directory or folder location into this line? I rooted my 2.1 EVO on my Mac a couple months ago and don't remember this step. Once again - very much appreciate the help.
One last question - would it make more sense to have a custom ROM already on your SD Card prior to rooting, so that you can flash it right after you flash AMON-RA for the first time? Probably doesn't matter but thought i'd ask.
Click to expand...
Click to collapse
Thats not the exact code no. I just put that as a place holder you are suppose to put in the location of where you have the recovery.img. For example, the exact command for me would be:
Code:
/Users/seekis/Downloads/recovery-ra-evo-v1.8.0.img
Don't trust us with the unrevoked 3.x/unrevoked forever application combo that's worked for thousands of users without sideeffects on regaw's post?
You should note to everyone that your method will screw up their PRI, reverting it back to 1.34. By using unrevoked and unrevoked forever, you can keep 1.40.
Click to expand...
Click to collapse
As far as using unrevoked, I stated that I, ME, MYSELF, has had issues with it. not that anybody else has. By all means go and use it if you would like. I will not. It is true that you will loose PRI 1.40, but seeing as how even after installing the OTA from HTC my phone still didn't update it to 1.40, I don't see the issue.

rsage said:
^^ same question as above, plus one other n00b question - does this method unlock NAND?
[edit] I was not insinuating that randymac88 is a n00b; I, however, am
Click to expand...
Click to collapse
i believe it does unlock nand seeing as how i adapted it from toasts method

Hey Seekis - question, I'm stuck here. I keep getting "permission denied", or "operation not permitted" when trying to make the exploit executable at this step:
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
Am I missing something? I've tried a million times and can't seem to get past this. I've successfully pushed all the files onto the sdcard.
I've also have had some trouble finding the exact root path to these files. I've been able to navigate, but I would think a lot of users would have some trouble.
Regardless, many thanks for getting this posted...
EDIT: I pushed the rageagainstthecage file to the sdcard by mistake. Will try again tomorrow.

ok i got rid of that step by moving the file into the android sdk and pushing it with all the other files

Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!

The wife's EVO is now fully rooted running Baked Snack 1.5 w/Netarchy's kernel. Touch and go there for a minute, but it all worked out. No 1.40 PRI, but I don't really care about that right now.
Woot! Thanks Seekis!!

do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?

FoxHound630 said:
do u have to push the pc36img with adb every time or will drag and drop work or copy and paste work?
Click to expand...
Click to collapse
You can mount the card on your system and copy paste it over as well, yes.

randymac88 said:
Okay now I appear to be in big trouble as I've just messed up my wife's phone, and its probably going to be unusable for a while until I get this figured out (assuming I do!).
I got through most of the process. I flashed the PC36IMG.zip file; however when it asked to reboot, it just dumped me back into the bootloader. Whenever I say reboot, it just takes me back to the bootloader. Pull the battery, same thing - bootloader. Yikes.
I don't know how to get to the next step because I can't get into a booted rom in order to flash the amon-ra recovery. Am I totally effed? Can anyone help me here?
EDIT: Okay reflashed the PC36IMG.zip file, and it rebooted into the stock ROM. Onward! Phew!!
Click to expand...
Click to collapse
Had the same issue. When i first booked into the bootloader i had to select recovery then flash PC36IMG.zip. Then boot loop. Then i went back into the bootloader and it automagically read in the PC36IMG.zip and flashed it, then i got stock 2.1 root. Just a few minutes of "oh crap"

I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!

atom_jack said:
I'm stuck. I got as far as flashing PC36IMG.zip, which was successful, as my phone now runs 2.1, but it doesn't appear I'm rooted. When I go back into the adb shell, I'm getting the $ prompt, and running
Code:
cat /sdcard/flash_image > /data/flash_image
gives me a permission denied error. Help!
Click to expand...
Click to collapse
i dont know what to tell you other than try again. this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.

seekis said:
i dont know what to tell you other than try again.
Click to expand...
Click to collapse
So after you flash PC36IMG.zip you should automatically get a root (#) prompt when going into the shell? ie, I'll have rooted 2.1 yes?
seekis said:
this happened to me the first time through as well. i dont know why. i just started from the top and it worked the second time through.
Click to expand...
Click to collapse
Aha. Ok, I will keep trying til it gives me a root shell, I guess. I also tried unrevoked3 but that didn't seem to work.

Success!! So, I stupidly assumed that all PC36IMG.zip's were the same, and was using the one from the original 2.2 PC thread. Once I got the correct one, voila!
You might want to post the md5 of the one you are using, so there's no confusion for others. Also, you missed a tiny step when you first start up hboot - you have to select fastboot for it to start scanning for PC36IMG.zip.
Thanks!

[ROOT] G2X Gingerbread 2.3.3. stock ROM with flashable zip in Clockworkmod Recovery

Update on 9/11/11: Thanks to phburks there is now a flashable zip to root the G2X stock rom. He figured out that the update-binary we were using was not compatible with the G2X. He found the compatible binary that allows us to create flashable zip files. Hats off to phburks. This is an unsigned zip and you should not be required to toggle signature verification. Of course the files required to root the phone (su and Superuser.apk) were created by Chainsdd.
There are two flashable zip packages. The first one roots the G2X. You simply flash it with Clockworkmod Recovery. The second zip unroots the phone for those who wish to unroot their device for whatever reason.
After rooting go to the Android Market and get the Busybox installer referenced below. Use that to install and keep Busybox updated.
Root Zip for G2X: http://www.mediafire.com/?92qpr525ztblh8w
Unroot Zip: http://www.mediafire.com/?2vr7cmgg7qcdn14
HOW TO ROOT
1. Install latest Clockworkmod Recovery using NVFlash, if you haven’t already done so.
http://forum.xda-developers.com/showthread.php?t=1056847
2. Download the root zip package referenced above.
3. Put the zip package on your internal or external sd card on your G2X. Do not unzip the package.
4. Turn off phone and boot into Clockworkmod Recovery by pressing volume down and power and hold until the fancy LG (second one) appears.
5. Select install zip from sd card. Select and flash the root zip package. Note: You navigate in Clockwordmod Recovery by using the volume keys up and down and commit the action by pressing the power button.
6. Reboot your phone. You are now rooted.
NOTE: THE FOLLOWING BELOW IS OBSOLETE. IT IS LEFT FOR HISTORICAL PURPOSES ONLY.
Original post made on 9/9/11:
I wanted to run the stock Gingerbread ROM and wanted to root it without flashing a new ROM. I was able to succesfully do it and the instructions are below. I was attempting to make an update.zip to do this but it kept getting a "status 0" error. The original superuser zip by ChainDD also gets this error. So I decided to try and root it using ADB commands while running Clockworkmod Recovery. Here is how I did it. If someone can help me get an update.zip that will install without error in Clockworkmod Recovery to make this easier for people to install it would be much appreciated.
1. Download my G2X root package that includes necessary ADB files (Android SDK install not required) and unzip the contents. The package contains the latest versions of “su” and “Superuser.apk”.
http://www.mediafire.com/?6rdrdfxvdoq9nkv <download link for my root G2X package>
2. Install latest Clockworkmod Recovery using NVFlash, if you haven’t already done so.
http://forum.xda-developers.com/showthread.php?t=1056847
3. Boot into Clockworkmod Recovery by holding down volume down and power until fancy LG logo shows (about ten to fifteen seconds). This is not the first one displayed when the phone powers up. Wait for recovery to start. Just to be safe perform a backup of your device’s current state.
4. Using the recovery menu scroll down to “mounts and storage,” press the power button, scroll down to “mount system” and press the power button.
5. Now that your system is mounted plug your phone into your computer (let drivers install if you have not done before – requires LG USB driver package).
http://bit.ly/qyoAxY <shortened link for direct download from LG server>
6. Open a command prompt windows on your computer. In the command prompt window change to the directory to where you unzipped the G2X root package.
7. Issue the following ADB commands. Do not type the the text in the brackets <>. That is just information on what the command is doing.
adb kill-server
<make sure no conflict with another version of adb server running>
adb devices
<checks to see if phone is connected to adb>
adb push system /system
<make sure you type a space before “/system”>
adb shell chmod 6755 /system/bin/su
adb shell ln -s /system/bin/su /system/xbin/su
<make sure you type a space before “/system/xbin/su ”>
8. System is now rooted. You can unplug the USB cable now.
9. Now in Clockworkmod Recovery choose “unmount system.”
10. Go back to the main menu and choose “reboot system now.”
11. If you want busybox (some root programs such as Titanium Backup require it) on your system go to the Android Market after rebooting your phone and search on “Busybox.” Download and run the Busybox installer by Stephen (Stericson). When you are prompted allow it to have superuser permissions.
http://bit.ly/qIAoXZ <link to Android Market page for Busybox>
12. You are now rooted with a working busybox installation.
13. It is a good idea to go back into recovery and make a backup of your newly rooted system before you start installing and running programs that obtain superuser permissions.
14. Enjoy the power!
Please click the Thanks button if this helped you out.

Reserved for future use.

Much appreciated for the help, but I don't think I will be using it.
Why not just load a rooted GB or xboards GB, same thing isn't it? lol.

Paul Nur said:
Much appreciated for the help, but I don't think I will be using it.
Why not just load a rooted GB or xboards GB, same thing isn't it? lol.
Click to expand...
Click to collapse
This is for people who have been using the phone after applying the update and don't want to start from scratch again. This lets you just root the phone without needing to flash a rom and format the system.

Wow, I've been waiting fire this thanks jboxer.
Sent from my LG-P999 using XDA App

jboxer said:
This is for people who have been using the phone after applying the update and don't want to start from scratch again. This lets you just root the phone without needing to flash a rom and format the system.
Click to expand...
Click to collapse
Ohhhhhhhhhhhhhhh, I got it lol thanks for showing me it from a different angle

still realy no point xboarders is more stable and much faster then stock and all u need to do is flash his rom then go to advanced restore and only restore data ive gotten away with that doesnt always work though

Always good to have more options.

phburks said:
Always good to have more options.
Click to expand...
Click to collapse
Damn straight. Keep it up, jboxer.
Sent from my LG-P999 using xda premium

Very nice! Thanks man, much appreciated.
Sent from my LG-P999 using XDA App

awesome i tried it on another g2x phone running 2.3.3 root the phone so fast plus with no lost data
thread rated 5 stars ^-^

Change Directory
jboxer said:
I wanted to run the stock Gingerbread ROM and wanted to root it without flashing a new ROM. I was able to succesfully do it and the instructions are below. I was attempting to make an update.zip to do this but it kept getting a "status 0" error. The original superuser zip by ChainDD also gets this error. So I decided to try and root it using ADB commands while running Clockworkmod Recovery. Here is how I did it. If someone can help me get an update.zip that will install without error in Clockworkmod Recovery to make this easier for people to install it would be much appreciated.
1. Download my G2X root package that includes necessary ADB files (Android SDK install not required) and unzip the contents. The package contains the latest versions of “su” and “Superuser.apk”.
http://www.mediafire.com/?6rdrdfxvdoq9nkv <download link for my root G2X package>
2. Install latest Clockworkmod Recovery using NVFlash, if you haven’t already done so.
http://forum.xda-developers.com/showthread.php?t=1056847
3. Boot into Clockworkmod Recovery by holding down volume down and power until fancy LG logo shows (about ten to fifteen seconds). This is not the first one displayed when the phone powers up. Wait for recovery to start. Just to be safe perform a backup of your device’s current state.
4. Using the recovery menu scroll down to “mounts and storage,” press the power button, scroll down to “mount system” and press the power button.
5. Now that your system is mounted plug your phone into your computer (let drivers install if you have not done before – requires LG USB driver package).
http://bit.ly/qyoAxY <shortened link for direct download from LG server>
6. Open a command prompt windows on your computer. In the command prompt window change to the directory to where you unzipped the G2X root package.
7. Issue the following ADB commands. Do not type the the text in the brackets <>. That is just information on what the command is doing.
adb kill-server
<make sure no conflict with another version of adb server running>
adb devices
<checks to see if phone is connected to adb>
adb push system /system
<make sure you type a space before “/system”>
adb shell chmod 6755 /system/bin/su
adb shell ln -s /system/bin/su /system/xbin/su
<make sure you type a space before “/system/xbin/su ”>
8. System is now rooted. You can unplug the USB cable now.
9. Now in Clockworkmod Recovery choose “unmount system.”
10. Go back to the main menu and choose “reboot system now.”
11. If you want busybox (some root programs such as Titanium Backup require it) on your system go to the Android Market after rebooting your phone and search on “Busybox.” Download and run the Busybox installer by Stephen (Stericson). When you are prompted allow it to have superuser permissions.
http://bit.ly/qIAoXZ <link to Android Market page for Busybox>
12. You are now rooted with a working busybox installation.
13. It is a good idea to go back into recovery and make a backup of your newly rooted system before you start installing and running programs that obtain superuser permissions.
14. Enjoy the power!
Please click the Thanks button if this helped you out.
Click to expand...
Click to collapse
Hi,
Sorry i'm new on rooting android phone.
on step 6. how i change the directory in the command prompt to go to the g2x root file i saved?
thanks

yogieajuz said:
Hi,
Sorry i'm new on rooting android phone.
on step 6. how i change the directory in the command prompt to go to the g2x root file i saved?
thanks
Click to expand...
Click to collapse
That's a Command Prompt windows on your computer. The easiest way is to open the desired folder in Windows Explorer and then click on the address bar. Highlight the entire location and copy it. Then in your command prompt windows type "cd" a space, right click and paste the copied location and hit return. You will now be in the correct folder in your command prompt windows.

Thank you for quick reply

jboxer said:
That's a Command Prompt windows on your computer. The easiest way is to open the desired folder in Windows Explorer and then click on the address bar. Highlight the entire location and copy it. Then in your command prompt windows type "cd" a space, right click and paste the copied location and hit return. You will now be in the correct folder in your command prompt windows.
Click to expand...
Click to collapse
Thanks jboxer, work like charm....
but when i did back up they said error can not back up image data ???
whats wrong???

never mind, i found out i run out of space on my sd card

@jboxer, I figured out the flashable zip. Just tested it on an unrooted 2.3.3 installation and it worked perfectly. I PM'd you a link to the zip. Please add it to your OP if you'd like. There's no need for me to create a separate thread.

phburks said:
@jboxer, I figured out the flashable zip. Just tested it on an unrooted 2.3.3 installation and it worked perfectly. I PM'd you a link to the zip. Please add it to your OP if you'd like. There's no need for me to create a separate thread.
Click to expand...
Click to collapse
Thanks to phburks for the good work in figuring out why our update zip packages were being rejected by Clockworkmod Recovery. We now have flashable zips to root the G2X (works on stock GB rom) and to unroot it. They are listed in the first post that I have edited.
http://forum.xda-developers.com/showthread.php?p=17398464