Database Users

[Q] Bell Atrix on GB root stuck, need OC kernel

I've been on XDA for 2 days straight now. I just need some help. Everytime I search for what I need I find I'm getting side tracked to do 2 or 3 more steps to get to what I wanted... it's just getting way to messy and I have to ask some questions.
So here's what I've done, because I am a noob, and I do hate myself
Started with a Bell Atrix on 2.2.2 OTA, unlocked with RSD Lite and installed Bell Ihop, installed CWM with moto-fastboot and flashed a custom GB 2.3.4 ROM (RedPill). Everything went smooth.
Even using Bell_Ihop I still have less than 300mb of RAM. So I'm trying to find out what kernel I should use to fix that. The problem I'm having is that the root privliges are stuck, so I don't know what version of the kernel I need . I've tryed at least 4 different methods for rooting and all end up with root checker saying that it's not properly returning it's group id (BTW, I have no idea what that means)
root checker says:
Superuser.apk is version 2.3.6.3 - installed
Standard su binary location:
lrwxrwxrwx root root
su -> /system/bin/su
Standard su binary location:
lrwxrwxrwx root root
su -> /system/xbin/su
Alternate su binary location:
/sbin/su: Permission denied
I either need to figure out how to remove Superuser in 2.3.4 (so far I can't even locate it using any guide I've read here.) and reinstall it or if someone can tell me an easier way to find out if I need a d00 or 1100 kernel and how/when to flash it. I tried one kernel late last night and the phone wouldn't go past the moto screen, so I just ran though flashing the ROM back on and left it for the night. I throw myself at your mercy MODs

First off here is a link to some kernel's the i recommend, http://forum.xda-developers.com/showthread.php?t=1177556&highlight=international+oc+kernel
Not only do they have the ram fix built in but they are OC'd to 1100mhz (1.1ghz)
To find out which tegra part you have i recommend downloading "Terminal Emulator" from the market which is free. Then open it up (provided superuser allows you) and type these commands...
su <---then hit enter
cat /proc/cmdline <----then hit enter
A bunch of crap will appear and in that bunch of crap you need to find if it says this:
tegrapart=mbr:d00:100:800,kpanic:2100:400:800:
or this:
tegrapart=mbr:1100:100:800,kpanic:2500:400:800:
and then you download the appropriate kernel with matching tegra part to your phone...so it would be either the d00 version or the 1100 version =)
Hope that helps....NOW HIT THE THANKS BUTTON =) hehehe cheers bro!!

I have the terminal emulator and have tried su etc...
I get this:
$su
su: symbolic link loop
$cat /proc/cmdline
/proc/cmdline: permission denied
... the reason why I already know I have Superuser issues.
EDIT: I have 3 browser windows on 2 PC's with a total of 14 tabs open just trying to get this root to work again so I can run this command and move on with the right kernel. I know that's small beans to you guys but when your phone is far more powerful than your computers, it's a pain.

root 2.3.4,downgrade,and s-off

ATTENTION! this thread is OUTDATED
unrevoked has always been a finicky program,3.22 working fine for some,not so much for others.recent updates seemd to have made it even worse, i see alot of issue and fustration with it lately. as such, i do not recomend this method any longer.
IMO,at this time htcdev is the best way to root,downgrade,and achieve s-off. while it technically does void your warranty,and wipe your data,it has thus far at least proven to be reliable. i doubt may original droid incredibles have factory warranty left anyway it does not use unrevoked,or any otehr root tools or programs,just htcs own unlock(you can giggle loudly,or silently,as you use their unlock to achieve s-off
the original home of the hctdev method is here, on android forums.
it is also here: http://forum.xda-developers.com/showthread.php?t=1600904 but not as well supported since im not here as much.
_______________________________________________________________________________________________________________________
*outdated guide:
i wasnt sure if this should be here,or in development,so feel free to move it if you feel its in the weong spot. i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several have succesfully downgraded and regained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. ive had this guide up here on AF for a few days. ill try and provide support here as well,but please underdstand computer time is limited these days and i dont make it here as often. in otherwords,please help each other out
_______________________________________________________________________________________
PLEASE NOTE: this thread is for the original droid incredible. NOT the incredible 2(vivow) or incredible S(vivo)
for info on downgrading the inc 2 to .97 hboot so you can root with revolutionary,see this thread here in the inc 2 all things root subforum
if you DO have an original droid incredible,aka Inc 1,then procede
_________________________________________________________________
**********************************************************
_________________________________________________________________
READ THIS: i dont mean to sound like i dont want to be bothered with questions. however,folks are having basically the same issues thru-out the 600+ posts,so i can almost gauarntee if you have a prollem,it has been covered. please try and search for some answers before jumping to the end and posting. answering the same things over and over is just making the thread even longer and harder to search.
if you do have trouble and need to post questions about ADB commands,please provide a copy of your entire session in the command window along with the question. its usually pretty easy to see what went wrong when we can see the whole thing.
copy everything in the command window,and paste it into a code box by:
-right click in the command window,click mark.
-highlight everything in white. hit enter.
-then,in your "reply to thread" box here,click the "#" up top
-right click and "paste" everything between the
Code:
tags.
_________________________________________________________________
i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several now have rooted 2.3.4,and 1 has succesfully downgraded and gained s-off.
its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.
thots and feed back are welcome. there will prolly be several edits of this as i try to clarify it,and make it a lil better. but for now im tired and 5am comes early ;)
[B]first and foremost,giving proper credit to all that deserve it:[/B]
*alpharev and unrevoked for all they for the root community :cool:
-efizzle for getting the ball rolling in [URL="http://forum.xda-developers.com/showthread.php?t=1286223"]this thread[/URL] on xda by figuring out that an older version of unrevoked would get superuser access on 2.3.4
-iowabowtech for point me in the direction of [URL="http://forum.xda-developers.com/showthread.php?t=768295&highlight=ota"]this thread[/URL] that i collected the misc image,and parts of the guide. also for his support answering questions.
-sele and the crew in the "rescue squad" on [URL="http://api.viglink.com/api/click?format=go&drKey=1153&loc=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F418539-thunderbolt-root-unroot-thread.html&v=1&libid=1318297929451&out=http%3A%2F%2Fwww.thunderboltforums.com%2F&ref=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F&title=Thunderbolt%20Root%2FUnroot%20Thread%20-%20Android%20Forums&txt=HTC%20Thunderbolt%20Forum&jsonp=vglnk_jsonp_13182980284911"]the thunderbolt forum[/URL] for what i like to call the "mini-adb" concept.
-rooter28 for testing and keeping me updated as he made progress. hopefully he will stop in and help answer questions :)
-mkreiger for fearlessly jumping in to be the second official tester
-lovejess for finding a mac download for unrevoked 3.22
-gkinsella2 for contributing the mac specific instructions
-whomever origianlly came up with the images and guide linked above. if i can figure out who this was,ill add you in later.
*special thanks to sdrawcab for his invaluable support in helping answer questions and prollems
-prolly more,im sure there will be several edits of this.
1)[B][I]download these files[/I][/B],and save them somewhere you can easily find them:
[U]unrevoked 3.22[/U] [url=http://www.multiupload.com/WMGYYGL97Z]unrevoked 3.22[/url]
[U]mirror:[/U] [URL="https://www.box.net/shared/8e3nb5l5lnjjuh6vbqt7"]unrevoked 3.22 mirror[/URL]
md5: [COLOR="red"]5760fbe8ed6d44752e78433252f2d5b2[/COLOR]
[U]unrevokeds modified usb drivers[/U] [url=http://unrevoked.com/rootwiki/doku.php/public/windows_hboot_driver_install]public:windows_hboot_driver_install [RootWiki][/url]
[U]mini-adb_inc[/U](contains misc image,flash image,and some basic adb tools)[url=http://www.multiupload.com/0G635MCZS2]Multiupload.com - upload your files to multiple file hosting sites![/url]
md5: [COLOR="red"]a793cc0142e1cd18f60849894bbc47cd[/COLOR]
[U]mirror:[/U][url]http://www.mediafire.com/?o6c4kq4wyccuom5[/url]
mirror md5: [COLOR="Red"]7c5211686a20b558ccd660c782f82e2b[/COLOR]
[I]*clockwork and zergrush included in mirror[/I]
[U]PB31IMG for 2.2[/U] (2.2 downgrade) [url=http://www.mediafire.com/?uvha2u2pv3xp8d5]PB31IMG.zip[/url]
[U]mirror:[/U] [url]http://pvillecomp.com/?page_id=22[/url]
md5: [COLOR="red"]31bb1611a0fa8197d447c0438426717e[/COLOR]
[U]clockwork 5.0.2.0[/U] [url=http://www.multiupload.com/FGEU9VPGKF]Multiupload.com - upload your files to multiple file hosting sites![/url]
[U]mirror:[/U][url]http://pvillecomp.com/?page_id=28[/url]
md5: [COLOR="Red"]e8ac35ddc1c37000bb0852d1f380b5bb[/COLOR]
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: [url=http://www.md5summer.org/]Home of the MD5summer[/url]
2)[B][I]root with unrevoked 3.22[/I][/B]
-go to settings/applications and [U]uncheck[/U] "fastboot". having this checked will prevent you from getting to hboot via power/vol down.
-open the recovery-clockwork-5.0.2.0-inc_PB31IMG download. extract it first if you need to. inside there is an image called "recovery-clockwork-5.0.2.0-inc". right click on this image,then click "copy". navigate to a directory you can easily find it,then right click in that directory,then "paste". alternatively,you can drag it from the extracted folder to a convienient spot(i personally like to drag files around,but its fine either way).
-use your md5 summer to verify the md5 of just the image,not the whole .zip. it should be: [COLOR="Red"]ea382ca5809cb872d0582aa22741d592[/COLOR]
-install the drivers as described on unrevokeds page above.
-unplug your phone.
-extract the contents of the unrevoked 3.22 .zip. open the folder, right click on "reflash" and run as administrator if possible.
-click on "file" in the corner of the relfash window
-click custom recovery
-navigate to,and select your "recovery-clockwork-5.0.2.0-inc" image and select it. at the bottom of your reflash app window, it should now say "recovery:custom" and "waiting for device"
-make sure usb debugging is checked ON in settings/applications/development.
-plug in your phone and place it in charge only mode. assuming you installed the drivers correctly,unrevoked 3.22 will start. let it do its thing. it will reboot a couple of times. when its finished,it may leave you on a blank screen. if this is the case,pull the battery and reboot.
-you [I]should[/I] now have the superuser app in your app drawer. if so,go to settings/applications/manage apps/superuser and clear data. test that superuser is working and granting permissions by downloading rom manager,and using it to flash the newest clockwork recovery. alternatively,download and run a "root checker" or any of your favorite "root only" apps and make sure they work.
-once you get "successfully flashed clockwork recovery" boot to it and make a backup,since downgrading to get s-off [U]WILL[/U] wipe all your data. boot back into the operating system.
*[I]special note to slcd users[/I]: this version of unrevoked is installig an old, non-compatible version of clockwork,so you will just see a black screen if you do not install newer clockwork as described above.
-if you plan to install a custom rom after downgrading,now is a good time to download titaium backup,and its pro key(WELL worth the $$) and do a batch backup of all your user apps and app data(no system data)
*at this point,you could just enjoy root access without doing anything else. if all you care about is using a couple of root only apps,and deleting some bloatware,you can remain rooted and s-on if youd like. id personally reccomend to downgrade and become s-off in case future OTAs knock out your root access.
3)[B][I]prepare to downgrad[/I]e[/B]
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c drive. it comtains mtd0,flash_image,and some adb tools.
-place the 2.2 downgrade on the root of your sd card,and verify it is named "PB31IMG". now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting [U]WILL[/U] wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
[U]special notes on hboot flashing PB31IMG files[/U] a common issue folks are having is the PB31IMG is not being found by hboot.
*there are only 2 reasons a PB31IMG is not found on the root of the sd card:
a)not named correctly. the phone muse see exactly "PB31IMG.zip". due to the way windows automatically adds and hides file extensions,it is usually correct to name the file "PB31IMG" with windows. common errors are for the file to be named "PB31IMG.zip.zip" after manually tying in the ".zip". on rarer occasions,it may not be adding/hiding the file extension,resulting in the file actually beening seen by the phone as "PB31IMG" :eek: [I]check your file with a file manager on your phone[/I] and see how its seeing it.
b)sd card not formatted FAT32. if it is plain FAT or anything else,PB31IMG is invisible. on rare occasion,i have seen claims that a bad sd card,or card that needs reformatted(even tho it may be FAT32) will have the same affect.
*this has been addressed [U]several[/U] times in the thread,skim thru it for more information.
4)[B][I]downgrade with adb[/I][/B]. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in [B]bold[/B] so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on,in charge only mode
-at the promt in your command window:
[B]cd c:mini-adb_inc [/B] [COLOR="Blue"]this should change your command promt to "mini-adb_inc",indicating youre using that directory.[/COLOR]
[B]adb devices[/B] [COLOR="blue"]this should output your phones serial number,indicating its recognized[/COLOR]
[B]md5sums mtd0.img [/B] [COLOR="blue"]it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
[/COLOR]
[B]md5sums flash_image[/B] [COLOR="blue"]again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a[/COLOR]
[COLOR="Red"]*both those numbers must match exactly. if they do then you can procede.
[/COLOR]
[B]adb push flash_image /data/local/[/B]
[B]adb push mtd0.img /sdcard/[/B]
[B]adb shell[/B] [COLOR="Blue"]your prompt should change to a #. if it changes to a $,then type[/COLOR] [B]su[/B] [COLOR="blue"]note your phone may pop up a message asking you to allow permissions the first time you do this. if it does check "always" and touch "allow" on the superuser request on the phone screen.[/COLOR]
[B]cd /data/local[/B]
[B]chmod 0755 /data/local/flash_image[/B]
[B]cd /data/local[/B]
[B]./flash_image misc /sdcard/mtd0.img[/B]
[COLOR="blue"]you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off[/COLOR]
[B]exit[/B] [COLOR="Blue"]to get out of your adb shell,and back to the "mini-adb_inc" prompt[/COLOR]
[B]adb reboot bootloader[/B] [COLOR="blue"]this will boot your phone to "fastboot" select "bootloader" with the power button.[/COLOR]
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
*[I][U]special note:[/U][/I] if your phone does not fully boot after running PB31IMG,dont panic. its happened to quite a few users,for some reason. simply pull your battery,boot to hboot via power/volume down and run PB31IMG again.
download unrevoked forever from here: [url=http://www.unrevoked.com/recovery/]unrevoked3 recovery reflash tool, v3.32[/url]
run it as you did the previous version. before plugging in your phone,make sure "disable phone security is checked" in the file menu. this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
[I][U]*unrevoked 3.32 note:[/U][/I] if you check the "disable phone security" box as described above,and unrevoked still fails to turn s-off,you are not lost.[U]simply flash the s-off tool in recovery[/U]. you can find it here: [url=http://unrevoked.com/rootwiki/doku.php/public/forever]public:forever [RootWiki][/url]
if you wish to return to where you were,sign into google,download rom manger,flash the latest clockwork recovery. boot to recovery,then restore the back you made before we started.
optionally,you can now install the custom rom of your choice,along with a new recovery and radio if you desire. :)
and heres what you will see when entering the commands(the red are my copy/paste's):
[CODE]Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:UsersScott>[COLOR="Red"]cd c:mini-adb_inc[/COLOR]
c:mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HT07DHJ02777 device
c:mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
mtd0.img 34307be744275f1db1dd16af04c37839
c:mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:mini-adb_inc]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1662 KB/s (655360 bytes in 0.385s)
c:mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]su[/COLOR]
su
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
# [COLOR="red"]exit[/COLOR]
exit
$ [COLOR="red"]exit[/COLOR]
exit
c:mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:mini-adb_inc>
other info:
-unrevoked 3.22 for mac can be found here: http://downloads.unrevoked.com/recovery/3.22/Reflash.dmg at this point youre on your own converting the adb commands. if someone wants to translate,or make a mac adb guide,ill gladly add it in
-until we put together a mac specific guide,directions for modifying the rest of it to work on a mac are found in post #629,here: http://androidforums.com/incredible...-3-4-root-downgrade-s-off-13.html#post3623666 courtesy of gkinsella2. mac users(and everyone else ) make sure to click the thanks button on his post!
______________________________________________________________________________________
*last and not least,this is a direct copy/paste of the AF thread,so any references to pages numbers are references to THAT thread on AF

the zergRoot method
this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.
this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.
alternately,use this if you just like ADB if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.
like above,this is intended for someone whose never installed ADB or entered command lines before.
1)download these files,and save them somewhere you can easily find them:
unrevokeds modified usb drivers public:windows_hboot_driver_install [RootWiki]
mini-adb_inc(contains misc image,flash image,and some basic adb tools)Multiupload.com - upload your files to multiple file hosting sites!
md5: a793cc0142e1cd18f60849894bbc47cd
PB31IMG for 2.2 PB31IMG.zip
md5: 31bb1611a0fa8197d447c0438426717e
zergRush tool from xda: Revolutionary - zergRush local root 2.2/2.3 - xda-developers
md5: 12c52b97e75e73595b325c03610b3380
**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer
3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.
4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.
at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.
-make sure phone is plugged in and usb debugging checked on in charge only mode
-at the promt in your command window:
cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.
adb devices this should output your phones serial number,indicating its recognized
md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839
md5sums flash_image again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a
md5sums zergRush again,output stuff, then this number: 3cf8a3fbceb667121d91f4ef1a66684c
*all those numbers must match exactly. if they do then you can procede.
adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush
this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.
last thing it says will be: Killing ADB and restarting as root... enjoy!
you should then be returned to your "mini-adb_inc>" prompt
adb push flash_image /data/local/
adb push mtd0.img /sdcard/
adb shell your prompt should change to a #
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local
./flash_image misc /sdcard/mtd0.img
you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off
exit to get out of your adb shell,and back to the "mini-adb_inc" prompt
adb reboot bootloader this will boot your phone to "fastboot" select "bootloader" with the power button.
hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.
let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.
download unrevoked forever from here: unrevoked3 recovery reflash tool, v3.32
run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.
and heres what you should see when entering the commands(my copy/pastes are in red):
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inc[/COLOR]
c:\mini-adb_inc>[COLOR="red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT117HJ00242 device
c:\mini-adb_inc>[COLOR="red"]md5sums mtd0.img[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
mtd0.img 34307be744275f1db1dd16af04c37839
c:\mini-adb_inc>[COLOR="red"]md5sums flash_image[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
flash_image 0098a7dd6600b55fac34fc6645be5d7a
c:\mini-adb_inc>[COLOR="red"]md5sums zergRush[/COLOR]
MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help
[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inc\]
zergRush 3cf8a3fbceb667121d91f4ef1a66684c
c:\mini-adb_inc>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
1150 KB/s (21215 bytes in 0.018s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
chmod 755 /data/local/zergRush
$ [COLOR="red"]/data/local/zergRush[/COLOR]
/data/local/zergRush
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00015108
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219e4 0x006c
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xafd158bf 0xafd1ace3
[*] Sending 149 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
c:\mini-adb_inc>[COLOR="red"]adb push flash_image /data/local/[/COLOR]
1547 KB/s (76044 bytes in 0.048s)
c:\mini-adb_inc>[COLOR="red"]adb push mtd0.img /sdcard/[/COLOR]
1017 KB/s (655360 bytes in 0.629s)
c:\mini-adb_inc>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]chmod 0755 /data/local/flash_image[/COLOR]
chmod 0755 /data/local/flash_image
# [COLOR="red"]cd /data/local[/COLOR]
cd /data/local
# [COLOR="red"]./flash_image misc /sdcard/mtd0.img[/COLOR]
./flash_image misc /sdcard/mtd0.img
#[COLOR="red"] exit[/COLOR]
exit
c:\mini-adb_inc>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\mini-adb_inc>
edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.

This does work, but god I wish it was all ADB it was all so easy before unrevoked it didn't work the first time it gave me SU and root but no s-off then unrevoked would not run again due to new firmware. I did full downgrade to 2.2 and followed all directions ADB is so simple but unrevoked took 2 hours of just missing around to get s-off which included flashing 2.2 in hboot again starting over, running what I could run again in ADB without the gingerbreak since I was now on froyo, it was mostly just repushing the files and binary. But after all that unrevoked ran and gained root and s-off. Worst root I have ever done but people its all about making smart decisions before you do it if you make a mistake and get stuck, get help or trouble shoot but use you head before you battery pull and make sure you read before you hit anything.
If I helped you in any way please use the thank you button

sorry you had such issue with unrevoked. usually thats the easy part most folks are confused by adb and running commnads and wish it was all automated!
just a couple things that may help folks in the future:
-if you dont want to fool with unrevoked 3.22 in 3.2.4 use the "zergRoot"method in post 2. its all adb up to the downgrade. once you get to this point,you could easily roll yourself all the way back to the shipping firmware(assuming amoled screen) if you wanted,and then use an adb method(if one exists,im not that flamiliar with the inc). you dont have to go back to 2.2. i just picked that cause most folks are familiar with it,and with using unrevoked 3.32 to root/s-off it
-there have been a few complaints of unrevoked not giving s-off on 2.2. before you start,make sure "disable phone security" is checked in the file menu. if s-off still fails,but gives you root and a recovery,its worked for everyone thus far to just run the "forever" .zip in recovery,no real need to reflash the 2.2 ruu and run unrevoked multiple times.
-last and not least unrevoked is not ever going to give s-off in the 2.3.4(unless they release a new version for 2.3.4),as is uses an unsupported baseband,thats why the 2.2 downgrade is needed. folks that have no intention of backing up or returning to 2.3.4 and are fairly savy like the poster above,id strongy encourage to just use directions in post 2,its a lil quicker to not have to mess with unrevoked 3.22. its mainly included for the folks that want to make a nandroid or run tibu prior to the downgrade(plus zergRoot hadnt come out yet,when i originally put this together )
once your back on 2.2 you could even just use z4root to get get root access,install rom manager and clockwork,then flash the forever patch. once you can downgrade,there are alot of ways to skin the cat

Worked after a few tries!
Thanks Scotty for this writeup. I thought for a minute that things wouldn't work, but a third try proved fruitful.
Here's a few tips that I can add to things.
Things failed for me at the restore 2.2 part - HBOOT would not recognize the zip file as correct.
I am on a Win XP machine... Format the sd card to fat 32 using something other than Windows - I used a little program called "fat32format.exe". Windows seems to have a problem formatting sd cards correctly, so that could have been it.
Once I made sure the sd card was formatted, I put the 2.2 zip (PB31IMG) back on the sd card and started over using the zergRush method.
If you have tried this before, you will have to remove two directories from the /data/local/tmp directory. These are sh and boomsh. Thanks to ieftm in this forum for this tidbit of info.
If your zergRush is giving you problems stating:
[-] Cannot copy boomsh.: Permission denied
Then use this method to fix as I stated in paragraph above: remove sh and boomsh
Once these directories were removed and the zergRush was completed, the downgrade commenced just as described.
Side note - Unrevoked 3.32 installed Unrevoked forever automatically onto my DInc, so there was no reason to do the additional forever installation. You may have the same results.
For anyone else that can't seem to get things working, the search is your friend. It took me a while of hacking away at things, but eventually they all turned up roses...
Good Luck!

problems install roms
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?

saosinalm:
First off, that's the wrong name for the downgrade zip according to the instructions that scotty posted above. Make sure the file is titled correctly and follow his instructions from beginning to end. I believe when mine succeeded my file title was "PB31IMG.zip" but in his instructions he leaves off the ".zip" at the end.
If there is an error in the process, you will have to start over from about step 3. You can't just start back from where you left off if you reboot the phone. Make sure you check your MD5's once you download, then you won't have to go back over that step.
I found the zergRush method easier, but I am more comfortable with adb...
I would suggest re-reading the instructions and following closely - he walks you through things really well.

I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?

epescina:
That's really best answered differently depending on the type of person you are. If you like to play around and experiment with things or like learning how things work, maybe this works for you. Some people do it to get a custom look that no one else has, some do it to try and get better performance out of their phone that may have been bloated with apps out of the factory, and others are learning about developing apps and programming with it. Every person is different. Maybe it's just not for you, but others on this board can't live without it. To each his (her) own...

saosinalm said:
I have a problen,I can't install a Rom error e: can't open/sdcard/primexl3d.zip, why?
Click to expand...
Click to collapse
what are you trying to do exactly? no part of this guide requires you to flash a rom. so if youre tryingto root,be more specific what youre having trouble with, and if this is just a general question about flashing roms,you might do some research and/or post a new thread where more people will see it

epescina said:
I have one question....
Why root a phone? I had my phone rooted and honestly it was a complete waste of time. NONE of the Roms I downloaded ever worked properly, the apps never worked, and it was nothing but trouble for me. My phone always "force close" my apps too. No offense to the developers I just didn't see a benefit.
Am I wrong?
Click to expand...
Click to collapse
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own

scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
I too hate the HTC Sense and wish I could change the overall layout of my phone. When I did load a new ROM that changed the layout it always seemed to be screwed up for one reason or another.
For example the lastest rom (Cyanogen) I absolutely loved but it didn't have market and I never could find out how to load it!

scotty1223 said:
i personally have the opposite experience. while there are a couple minor issues with the rom that i run,i feel my phone is faster and more pleasureable after root. i love htc phones,but hate htc sense,so i root mainly root so i can run AOSP based firmware.
but as was said,to each his(her) own
Click to expand...
Click to collapse
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.

kjy2010 said:
Couple of quick questions (which might appear silly):
"place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG"
#1) What do we rename "PB31IMG.zip" to? The directions simply state to rename it.
#2) Move it to the root of the external sdcard or internal sdcard?
tia, and I hope these questions weren't too ridiculous.
Click to expand...
Click to collapse
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work. It is best to have your pc show extensions you can do that by going to controll pannel / folder options / view tab uncheck hide extensions for known file types.

cmlusco said:
It should be named PB31IMG.zip
It all depends how you rename it, if you use your pc it may not show the.zip extension if you have "show extensions" turned off. So on your pc it may just say PB31IMG even though it is really a zip. Sometimes when extensions are off people end up naming it PB31IMG.zip.zip wich will not work.
Click to expand...
Click to collapse
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?

kjy2010 said:
wow lol ok, that just seems common sense, but I guess you never know who your audience is
Which sdcard should the file be on?
Click to expand...
Click to collapse
It should be on the removable sd not the internal storage if thats what you were asking.

cmlusco said:
It should be on the removable sd not the internal storage if thats what you were asking.
Click to expand...
Click to collapse
thanks again, just making certain. going for my third try now!
---------- Post added at 01:20 PM ---------- Previous post was at 01:14 PM ----------
I'm getting an unmatched number on zergRush
"md5sums zergRush again,output stuff, then this number: 795275fb9c41ebd5b9fe7ab19108c52b"
I get "4bf71b766a9603fa7db98e71e3f3b470"
??
It states:
"*all those numbers must match exactly. if they do then you can procede."
What do you do if they don't match?
Sorry for the n00b questions, been dealing with nothing but HC since June.

I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.

cmlusco said:
I would try redownloading and then check it again. If its still wrong i would contact the op scotty and ask him, as he is the one who provided the original md5.
Click to expand...
Click to collapse
thanks, d/l it three times already what a PITA

I get a md5 of
3cf8a3fbceb667121d91f4ef1a66684c
for the zergrush file in the zip and.
12c52b97e75e73595b325c03610b3380
for the zip it self, different than both of your guys.
Edit. I believe that the zergrush file has been updated since this post to include more phones so that is probably why the md5 is different.

New method for rooting Droid 2 on stock 2.3.4 (621)

I have a method for rooting stock 2.3.4 on Droid 2/R2D2, but I can't post howto/links because my account is new. There's now a bootable EzSBF image that will update your phone to stock 621 and give you the option of rooting it, courtesy of beh (bhigham)
The thread is here:
rootzwiki.com/topic/29930-new-root-method-for-stock-234-621622-found-droid2-r2d2/

Not to be rude but....I have to call BS.
Sent from my Droid Incredible using xda premium

months formaj
Albinoman said:
Not to be rude but....I have to call BS.
Sent from my Droid Incredible using xda premium
Click to expand...
Click to collapse
Understandable since I appeared out of nowhere.
Well, I posted it on rootzwiki. It's an exploit in loadpreinstall.sh. You can make a symlink in /data/preinstall_md5/ to /data/local.prop, create a dummy file in the preinstall /app dir and instead of a md5sum, put a copy of local.prop that contains ro.sys.atvc_allow_all_adb=1. When the system thinks it's copying an md5 sum to your preinstall md5 cache, it hits the symlink and overwrites the local.prop, giving adb root access on next reboot. It seems you can put whatever you want in CG66 and the phone boots just fine. This probably works on quite a few motorola devices

phifc said:
Understandable since I appeared out of nowhere.
Well, I posted it on rootzwiki. It's an exploit in loadpreinstall.sh. You can make a symlink in /data/preinstall_md5/ to /data/local.prop, create a dummy file in the preinstall /app dir and instead of a md5sum, put a copy of local.prop that contains ro.sys.atvc_allow_all_adb=1. When the system thinks it's copying an md5 sum to your preinstall md5 cache, it hits the symlink and overwrites the local.prop, giving adb root access on next reboot. It seems you can put whatever you want in CG66 and the phone boots just fine. This probably works on quite a few motorola devices
Click to expand...
Click to collapse
Well it looks like I have to retract my previous statement. Great job!
Sent from my Droid Incredible using xda premium

D2 "ezSBF" 2.3.4/4.5.621 with magic md5 root option
updated many times see change log
root created by phifc modified by bhigham
3 options mirror links posted Magic MD5 Root 2.3.4 for D2, R2D2, D2G, DX and 2.3.5 for DX2 - Google Docs
Multi-Device Root (54mb)
Droid2_621_SBF-and-RootCD.iso (213mb)
Droid2_R2D2_A957_2.3.4_SBF_and-or_RootCD.iso (250mb
How this works
Originally Posted by phifc
There's an exploit in loadpreinstall.sh. It compares md5 sum files of preinstalled apps and if they're different, copies the md5 to the local cache. The preinstall just has an empty file in app/ so it will parse the md5 for it. Instead of an md5 sum, it contains a local.prop that allows adb root shell. So the system thinks it's copying the md5sum to the cache when it bounces off the symlink and overwrites the /data/local.prop, giving adb root on next reboot
Click to expand...
Click to collapse
what is ezSBF?
original [TOOL] ezSBF (not for 2.3.4)
1KDS said:
Don't let the word Linux scare you, this is just a cd you burn, nothing installs to your pc. Once you burn this CD you are ready to SBF flash anywhere you have a computer, no net connection needed to download any files.
This is an .iso file. It is a complete Linux operating system that you will download, burn to CD (or USB) then boot your pc from CD or USB, this allows your pc to reboot into a different operating system.
Click to expand...
Click to collapse
1KDS said:
Instructions (Mac):
Download .iso
Use Disk Utility (built in) to burn iso file to a CD (instructions)
Shut computer down
Hold c key, push power and hold c until you see the Linux OS start
Hit enter at the yellow "boot baby... boot" screen
You will see yellow dots for 3-5 minutes then the script will start
Instructions (Windows):
Download .iso
Burn iso image to a disk (Instructions, Windows 7 - Vista and XP) or (Load to a USB flash drive)
Reboot PC
Hit F12 (sometimes F8 or esc) during boot to go to boot menu (possibly google search how to boot your specific pc from CDROM)
Select boot from CDROM (or USB if you used a flash drive)
Hit enter at the yellow "boot baby... boot" screen
You will see yellow dots for 3-5 minutes then the script will start
Live USB Instructions (Windows):
(Instructions from pendrivelinux.com)(thanks)
Download UNetBootin for Windows
Download your favorite Linux ISO
Double click the Unetbootin Executable to start the program
(1) Click the Diskimage radio box
(2) browse to select your ISO
(3) Set your target USB drive
(4) click OK to start the creation
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(5) After the USB drive is done select reboot.
(6) During boot enter the boot menu and change USB to boot first, save and reboot.
(7) When booting from UNetbootin select SliTaz
________________________________________________
You will now be in the script and ready to flash.
Click to expand...
Click to collapse
select D2 for multi device root cd or /select root for the Droid2_621_SBF-and-Root CD
don't use numbers on right side of you keyboard, just use the ones above qwerty
turn phone on, connect to pc with usb cable
on phone check usb debugging (settings/apps/development)
on phone select charge only usb mode
on pc press continue
program will use adb to push
Code:
data/local.prop /data/preinstall_md5/magic.md5
program will prompt you to
manually reboot phone to bootloader, To put your D2G(/D2) in bootloader mode, power down and power on while either holding both volume buttons, or the up arrow on the keyboard.
program will flash repacked sbf (less than 50mb)
program will reboot twice, very important (reboot just replaces the local.prop, but the old local.prop is still in memory, till second reboot)
adb pushes su,superuser, and busybox
program will reboot to recovery,
manually press both volume buttons when you see !, triangle, & android andy
manually select wipe cache
manually select reboot
rooted
error info
when running program you may see these errors
rm failed for /data/preinstall_md5/magic.md5 no such file or directory
no root.img.gz no such file or directory
rm failed for /data/preinstall_md5/magic.md5 read only file system
that is fine, it will still work
by bhigham -One item of note with this CD, it does require at least 1GB of RAM in order to work properly. Also, if you only have 1GB of memory, and you need to both SBF and root your phone, it will be necessary to reboot the computer after flashing the .629(or .621)SBF. If you are unsure of the amount of RAM that you have, go ahead and reboot to be on the safe side.
Also, I noticed that I neglected to put instructions for putting your phone in bootloader in the SBF Step. To put your D2G(/D2) in bootloader mode, power down and power on while either holding both volume buttons, or the up arrow on the keyboard.
Click to expand...
Click to collapse
if you plan on creating nandroid backups or flashing roms read
[HOW TO] Install/Use Droid 2 Bootstrap
Using Oracle VM VirtualBox, and Magic MD5 root iso
Older Methods see instruction by phifc below
windows Batch file (uses rsd lite)
Linux batch file (adb and sbf_flash)
Linux manual (adb and sbf_flash)
original thread New root method for stock 2.3.4 (621/622) found (Droid2, R2D2) - Droid 2 / R2D2 / Milestone 2 / Droid 2 Global - RootzWiki
Posted by phifc (OP)
This is for original Droid2 and Droid R2D2. If you have issues b
ooting after root, check the end of this post.
I've been working on root for a few days after having to flash stock 621. I've tested this with my R2D2 running 621.
7/25/2012 - Thanks to beh for putting together an EzSBF cd for this! Just burn, boot from CD and follow the directions. It can flash to the stock 621 update for those that want the stock Gingerbread image, then gives you the option to root if you like. You can also create a bootable USB stick with the iso using UNetbootin - Homepage and Downloads
Droid 2 621 EzSBF with root option
The MD5 is
e50bc7914c4852ca32e9f08f7744c056
The instructions below work, but beh's EzSBF is far superior.
If you want to use CyanogenMod 7.2 after root with this method check this post.
I've been working on root for a few days after having to flash stock 621. I've tested this with my R2D2 running 621.
Windows
Install Motorola drivers and RDS Lite.
Get RootDroid2 file, extract folder, run RootDroid2.bat and follow the instructions.
You'll have to flash the phone as part of the process.
Linux (Easy way)
You'll need adb and sbf_flash.
1) Download the RootDroid2 file, extract it wherever you like.
2) Using adb enter
Code:
adb shell ln -s /data/local.prop /data/preinstall_md5/magic.md5
3) Flash using sbf file in download.
4) Reboot
5) adb shell will now be root
Linux (Long way)
What you need: Stock SBF (thanks to droid-developers.org), custom preinstall.img, adb (from android sdk), and sbf_flash
1) Enable USB debugging on your phone and send this adb command:
Code:
adb shell ln -s /data/local.prop /data/preinstall_md5/magic.md5
2) Unpack the custom preinstall file, then reboot your phone into flash mode by holding the up arrow on the keypad. Then send the custom SBF file with sbf_flash:
Code:
sbf_flash -r --preinstall preinstall.img <stock sbf filename>
(For example, I used 1FF-p2a_droid2_cdma_droid2-user-2.3.4-4.5.1_57_DR4-51-120117-release-keys-signed-Verizon-US.sbf so the command is "sbf_flash -r --preinstall preinstall.img 1FF-p2a_droid2_cdma_droid2-user-2.3.4-4.5.1_57_DR4-51-120117-release-keys-signed-Verizon-US.sbf")
3) Wait for phone to boot after flashing, then reboot again one final time.
4)
Code:
adb shell
should give you a root prompt (# instead of $)
5)Send superuser utils from Superuser
Code:
adb shell mount -o remount,rw /dev/block/system /system
adb push su /system/bin/su
adb shell chmod 4755 /system/bin/su
Code:
adb push Superuser.apk /system/app/Superuser.apk
adb shell chmod 644 /system/app/Superuser.apk
adb shell mount -o remount,ro /dev/block/system /system
Thanks to Dan Rosenberg (djrbliss) and those that helped him researchhttp://vulnfactory.o...ng-the-droid-3/ for ideas
Click to expand...
Click to collapse
for basic SBF and RSD lite info read The DROID Wiki
First, where do i download all these tools like motorola drivers and RSDlite? Do i put them on my phone or my PC?
Click to expand...
Click to collapse
use pc, links are baked into text just click on name of file
moto drivers USB and PC Charging Drivers - Motorola Mobility, Inc. USA
...Where do i enter this adb command?...
Click to expand...
Click to collapse
abd in command prompt start/search cmd.exe
...What version of software will be on my droid 2...
Click to expand...
Click to collapse
same version, rooting alone doesn't change that, rooting just gives you access to change system files/settings
My Links
Magic MD5 Root 2.3.4 for D2, R2D2, D2G, DX and 2.3.5 for DX2 - Google Docs
sd_shadow's [Collection] of Links: FAQs, Guides, Rooting, SBFs, ROMs... - Google Docs
edited:
02 Oct 2012 added mac info
10 Oct 2012 added error info
19 Oct 2012 total reorganized post
26 Oct 2012 added mirror
05 Nov 2012 added 622 sbf
09 Dec 2012 major rewrite of instructions

It should....I've looked it over.
Sent from my Droid Incredible using xda premium

works!!!
Thanks for the root
Sent from my newly rooted droid 2

I can confirm it works, I just registered to let you guys know
I have been lurking here for like 3-4 months looking for a root method, and this morning I checked rootzwiki and saw this. So glad! Thanks OP!
I am currently not at home(vacation in Germany) so I can't take a picture of root checker, but it works, very easy as well.

I can confirm that this works also except I still can't install CM7 because apparently I'm not on the OTA kernel and I'm on a leaked GB one.
Sent from my Senseless Rezound

circa881 said:
I can confirm that this works also except I still can't install CM7 because apparently I'm not on the OTA kernel and I'm on a leaked GB one.
Sent from my Senseless Rezound
Click to expand...
Click to collapse
Give LiquidICS a try, I really like it so far. Or CM9, I think LiquidICS is based on that though with some improvements.
I can't post links yet, but check droidforums. net for that

I will, thanks.

phifc said:
I have a method for rooting stock 2.3.4 on Droid 2/R2D2, but I can't post howto/links because my account is new.
Click to expand...
Click to collapse
Big thanks for this! No issues rooting, and got CM9 up and running on the D2.

big thanks for this.
finally can swap over to cricket

phifc said:
I have a method for rooting stock 2.3.4 on Droid 2/R2D2, but I can't post howto/links because my account is new.
Click to expand...
Click to collapse
You my friend, don't just deserve a nice cold root beer, you deserve stock in A&W.
Thank you so much, can't wait till I get home from vacation to try it.

hey guys im having an issue.
i have a droid 2 with .621
I ran the .bat, rebooted, and attempt the sbf. it goes all the way through verifying the checksums then i get this error:
"Failed flashing process. Interface BP: Checksum error in the RAM Downloader for Flash Bootloader. File: 0x13AD (0x702C)"
The phone says SW Update In progress..
so i pulled the battery and put back in and now it goes to the bootloader and says corrupt code
I tried the sbf 3 times and redownloaded all the files 3 times.
I dont know what to do........
EDIT: i was able to sbf back to the unrooted .621. then i tried the root process again but still got the error. should i do a full factory reset then try??
EDIT: I tried flashing the root sbf one more time, and this time i still got the error, but the phone rebooted and booted up ok. i installed voodoo rootkeeper and protected root :]

yes you will get rsd lite errors, it's a repacked sbf
just ignore the errrors
if you bootloop, go to to recovery and wipe cache or data
if you can't get to recovery, reflash sbf

jwagman1 said:
hey guys im having an issue.
i have a droid 2 with .621
I ran the .bat, rebooted, and attempt the sbf. it goes all the way through verifying the checksums then i get this error:
"Failed flashing process. Interface BP: Checksum error in the RAM Downloader for Flash Bootloader. File: 0x13AD (0x702C)"
The phone says SW Update In progress..
so i pulled the battery and put back in and now it goes to the bootloader and says corrupt code
I tried the sbf 3 times and redownloaded all the files 3 times.
I dont know what to do........
EDIT: i was able to sbf back to the unrooted .621. then i tried the root process again but still got the error. should i do a full factory reset then try??
EDIT: I tried flashing the root sbf one more time, and this time i still got the error, but the phone rebooted and booted up ok. i installed voodoo rootkeeper and protected root :]
Click to expand...
Click to collapse
You will get that error you have to wait for device to say it is finished which takes maybe 5 mins or so after you get the error

supergear said:
You will get that error you have to wait for device to say it is finished which takes maybe 5 mins or so after you get the error
Click to expand...
Click to collapse
I got the "Failed flashing process. Interface BP: Checksum error in the RAM Downloader for Flash Bootloader. File: 0x13AD (0x702C)" message as well. I waited for the phone to reboot, finished the flashing process, got errors from the .bat file saying to send the info.txt file to the OP, and tried installing Titanium Backup regardless. It asked for root permission, which I granted. Then I got a message saying "BusyBox works but the "su" command does not elevate to root." I've tried it twice now with the same RSD Lite error. I'll give it another go after it finishes charging.

scubamike said:
I got the "Failed flashing process. Interface BP: Checksum error in the RAM Downloader for Flash Bootloader. File: 0x13AD (0x702C)" message as well. I waited for the phone to reboot, finished the flashing process, got errors from the .bat file saying to send the info.txt file to the OP, and tried installing Titanium Backup regardless. It asked for root permission, which I granted. Then I got a message saying "BusyBox works but the "su" command does not elevate to root." I've tried it twice now with the same RSD Lite error. I'll give it another go after it finishes charging.
Click to expand...
Click to collapse
I don't know if this means anything, but after rooting, I had to reinstall busybox (there's an app in the market) but the newest version didn't work. I had to install 1 version back.
Sent from my rooted DROID 2! Much thanks to phifc from rootzwiki for the 2.3.4 .621 root!

fixed sbf fails everytime and I've waited 10this to 15you min after each fail msg in rsdlite..phone never reboots and when I pull the battery and reboot the phone it gos straight into bootloader which says its corrupt..

[GUIDE] |ROOT + Tethering + MORE| Moto X ver. 4.4.4 for XT1060 and XT1058 (VZW/AT&T)

[GUIDE] |ROOT + Tethering + MORE| Moto X ver. 4.4.4 for XT1060 and XT1058 (VZW/AT&T)
Moto X Root for AT&T/VZW [KXA21.12-L1.26]
This is a rewrite of instructions found HERE by CrashXXL. This will get you PERMANENT[meaning it will not disappear after reboot, but will die if you reflash or upgrade, etc] root on your 4.4.4 AT&T/VZW [KXA21.12-L1.26] Moto X. This will NOT disable system write protection or unlock your bootloader, etc.
The following steps were used by me on Ubuntu 15.04 to root my XT1060 from Verizon:
0. Reinstall your stock rom from HERE you will want the firmware that matches your current 4.4.4 KXA21.12-L1.26 firmware. If you are unsure how to do this HERE is a guide. [NOTE: If you skip this step and you are on 4.4.4 from an OTA then you will be stuck on the M Logo and will have to do this step and all the other steps over]
1. Make sure you have the necessary applications:
Code:
sudo apt-get install android-tools-fastboot python python-serial unrar
2. Download your _Root_<Your phone carrier>_KXA21.12-L1.26_Stock.rar from HERE
3.
-- a) Extract the files
-- b) From the terminal cd into the directory of the extracted files.
-- c) Put your phone into fastboot mode [reboot holding the power and volume down button]
4. Type [NOTE/WARNING: This will softbrick your phone. Which is completely fine if the steps are all followed]:
Code:
sudo fastboot flash sbl2 sbl2.mbn
sudo fastboot reboot
Your phone will have a black screen, but will be in QCOM Emergency mode. You can type in lsusb to confirm this.
5. Type:
Code:
python qdloadRoot.py MPRG8960.bin -ptf _root/partitions.txt
This will take a good 5-15mins. Make sure you are plugged into power and this step is not interrupted. Once this is done your phone will reboot and start up and you will see that SuperSu is installed.
Congrats you have root
NOTE: Read on to the next posts for more info and resources.

Xposed Install
The original post can be found HERE by Sabissimo.
Assuming the above steps were followed and you now have root. Do the following:
1. Download THIS for AT&T XT1058 or THIS for VZW XT1060
2. Extract the file as in step 3 above
3. Run the same commands from step 4 above.
5. Type:
Code:
python qdloadXposed.py MPRG8960.bin -ptf _root/partitions.txt
Be patient for a few minutes. Your phone will reboot.
6. Install 2.6.1 or 2.7.1 of Xposed from their SITE and install as normal.
Congrats you now have root and Xposed that will survive reboots

Thanks to @Nicene Nerd he put together a nice set of scripts to make custom packages to add/remove packages from system images. Check it out here!
Make a tutorial how to pack new applications onto the system AdAway etc.
-- Tutorial to bake in new apps. Thanks Sabissimo. I might rewrite this in the future to make it easier. If anyone follows that guide and would like to write please let me know and we can share files here.

Flash the same way you do the above.
This is for the xt1060.
Here are a list of addition flashables after you have root/xposed
Download:
This will change your /system/etc/hosts file to point to /data/data/hosts. Change this setting in AdAway and be ad free
Adaway_hosts_Root_4.4.4_VZW_KXA21.12-L1.26.zip
This has the buildprop edited for entitlement bypass (tether check) and has all stagefright options set to false. This also has the CF.lumen driver installed (look on playstore great app):
CF.lumenPLUS_Root_4.4.4_VZW_KXA21.12-L1.26.zip

jahrule said:
3. Go further and make our own system images.
Click to expand...
Click to collapse
If you are interested in MoFo, I first need someone to help me make the "pre-rooted" image. It must be in ext4 format. I have an XT1060 Dev Ed that is rooted. According to maiko1,
maiko1 said:
Simplest way is to make the system block device readable by everyone (chmod 644), and then adb pull the block device to your computer.
For example on the turbo via adb shell as root:
Code:
# ls -l /dev/block/bootdevice/by-name
lrwxrwxrwx root root 1970-01-09 20:49 system -> /dev/block/mmcblk0p39
# chmod 644 /dev/block/mmcblk0p39
Then pull it with adb:
Code:
$ adb pull /dev/block/mmcblk0p39 system.img
Click to expand...
Click to collapse
I tried that but I get the error
remote object '/dev/block/mmcblk0p39' not a file or directory
Now, I am not your most experienced adb user so I may have been doing something wrong. What I did was start an adb shell while my XT1060 was running in Android. Then I typed:
su # ls -l /dev/block/bootdevice/by-name
lrwxrwxrwx root root 1970-01-09 20:49 system -> /dev/block/mmcblk0p39
then
# chmod 644 /dev/block/mmcblk0p39
But when I went to pull it I got that error above. I just noticed that SuperSu had silently denied root to the adb shell. Not sure how to stop that.
Also, if I can get this to work, then I could put AdAway, Busy Box, etc. on my XT1060 and pull the image and it should be flashable with mofo.

Finally
I will follow this guide and then post results! I wanna root in my XT058 from long time ago!

Alexdream said:
I will follow this guide and then post results! I wanna root in my XT058 from long time ago!
Click to expand...
Click to collapse
If you need help. Just ask, but it is quite simple.
Don't forget to hit thanks!

JulesJam said:
If you are interested in MoFo, I first need someone to help me make the "pre-rooted" image. It must be in ext4 format. I have an XT1060 Dev Ed that is rooted. According to maiko1,
I tried that but I get the error
remote object '/dev/block/mmcblk0p39' not a file or directory
Now, I am not your most experienced adb user so I may have been doing something wrong. What I did was start an adb shell while my XT1060 was running in Android. Then I typed:
su # ls -l /dev/block/bootdevice/by-name
lrwxrwxrwx root root 1970-01-09 20:49 system -> /dev/block/mmcblk0p39
then
# chmod 644 /dev/block/mmcblk0p39
But when I went to pull it I got that error above. I just noticed that SuperSu had silently denied root to the adb shell. Not sure how to stop that.
Also, if I can get this to work, then I could put AdAway, Busy Box, etc. on my XT1060 and pull the image and it should be flashable with mofo.
Click to expand...
Click to collapse
Looks like you are trying to dd from a partition that does not exist. We can take this offline as it is off topic from this thread.

jahrule said:
Looks like you are trying to dd from a partition that does not exist. We can take this offline as it is off topic from this thread.
Click to expand...
Click to collapse
/dev/block/mmcblk0p39 exists - I can see it in ES File Explorer.
Bottom line is this - I have an XT1060 Dev Ed unlocked and rooted and was trying to help those of you who have unlockable XT1060's to be able to use MoFo. I don't need it for my XT1060 and it looks like you all have another option, although I am not sure how good of an option it is.
If someone wants to enlist my help, I would be willing to help but the ball in your court.

Does anyone has succesfully rooted Moto X1060 (VZW) using this tutorial?

JoseLoarca97 said:
Does anyone has succesfully rooted Moto X1060 (VZW) using this tutorial?
Click to expand...
Click to collapse
Other than me? You can check the original thread. Many other people have done it there.

I can root successful my XT1058 following this guide. Thank you so much! Finally I have xposed and GravityBox.

Post 3 updated with guide to bake in new system applications!

Where should I get the files in step 1 of the root process?

abuttino said:
Where should I get the files in step 1 of the root process?
Click to expand...
Click to collapse
The links are all in post 1. The first step are the packages you need. In my case I was running Ubuntu. If you are running Windows. The you can check the linked original thread and try to do it like that.

I tried it the Windows way and everything went very smoothly. Thanks.
I just don't have the experience to run Ubuntu yet. Been running Windows since v3
Sent from my XT1060 using Tapatalk

Thx! @jahrule
Any chance we can modify it so it will work for the XT1052?

dagoban said:
Thx! @jahrule
Any chance we can modify it so it will work for the XT1052?
Click to expand...
Click to collapse
I think the xt1052 is Europe version and can have the bootloader unlocked. It is then trivia to root.

jahrule said:
I think the xt1052 is Europe version and can have the bootloader unlocked. It is then trivia to root.
Click to expand...
Click to collapse
Yep, 1052 is the Europe one. I have 2 lying around here, for one the BL is unlockable, but the other one has an error and the moto page says that device is not unlockable even thou its a xt1052.
So I would really appreciate something for the xt1052
Thx again!
And let me know if you need any files from the xt1052 partitions / sbfs

dagoban said:
Yep, 1052 is the Europe one. I have 2 lying around here, for one the BL is unlockable, but the other one has an error and the moto page says that device is not unlockable even thou its a xt1052.
So I would really appreciate something for the xt1052
Thx again!
And let me know if you need any files from the xt1052 partitions / sbfs
Click to expand...
Click to collapse
If it shows error try the US support site instead of the one in your country.. Worked for me

Android root fail - LG H440n Spirit 4G

Hi,
rooting my LG H440n Spirit 4G phone (Lolipop 5.0.1) has failed at the moment when "Firmware Update" notification showed up on the mobile phone screen (after rooting had started and rebooted once). It says on the phone screen that I should not unplug USB connection to my phone. But since rooting failed what should I do now?
Closing down command line with LG Root Script running did not stop Firmware Update and it is still displayed on my phone.
Is it safe to disconnect usb right now from my phone and try rooting my phone again?
Thank you very much for any advise and support.

cbx44 said:
Hi,
rooting my LG H440n Spirit 4G phone (Lolipop 5.0.1) has failed at the moment when "Firmware Update" notification showed up on the mobile phone screen (after rooting had started and rebooted once). It says on the phone screen that I should not unplug USB connection to my phone. But since rooting failed what should I do now?
Closing down command line with LG Root Script running did not stop Firmware Update and it is still displayed on my phone.
Is it safe to disconnect usb right now from my phone and try rooting my phone again?
Thank you very much for any advise and support.
Click to expand...
Click to collapse
I have the same problem I tried one click root 1.3 and the old script 1.2 android 5.0.1 v10f-EUR-XX. HELP US!

Updated to V10j-214-03 and cannot root
Hello.
Last Friday 23/10/2015 I updated my phone to V10j-214-03 and cannot root it again.
Anyone has updated and rooted this version?
Thank you very much!

Hello. I tried to see if we could use the Low Effort Root on our device. I made some progress, but I am unable to finish what I started because I am stuck[ somewhere.
What I did:
1. Extract the v10h kdz.
2. Get the v10h system.img and the file "PrimaryGPT_0.bin" from the extracted files.
3. Inject root into the v10h system.img: http://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586
3. Rename the "PrimaryGPT_0.bin" into "gpt.img". Then go to ubuntu, open a terminal and run: "# sudo gdisk /path/of/gpt.img"
This gives us the partition info for our device: http://pastebin.com/u9maAAdm
This will help us determine the bs, seek and count when we will use the "Send_Command.exe" to push the v10h system to our device.
4. Based on @autoprime 's help, we have to do some calculations. http://pastebin.com/brcXBpja
[I think that he made a mistake though (missed to multiply by 512 on count). This seems more correct to me: http://pastebin.com/tHUbicR8 )
5. After calculating bs, seek and count, we are supposed to run the Low Effort Root procedure for our device.
But, after running the dd command, a "#" comes immediately, which means that something is going wrong. The "#" should take some time to appear, meaning that the copy is in progress. I couldn't identify what I am doing wrong, so I publish my effort, because maybe someone has more knowledge and may be able to make it work! @midzan21 maybe?
Autoprime, thanks for your help and guidance through irc.
Original Low Effort Root thread: http://forum.xda-developers.com/g4/orig-development/root-tmo-vzw-intl-variants-soon-root-lg-t3164765

polfrank said:
Hello. I tried to see if we could use the Low Effort Root on our device. I made some progress, but I am unable to finish what I started because I am stuck[ somewhere.
What I did:
1. Extract the v10h kdz.
2. Get the v10h system.img and the file "PrimaryGPT_0.bin" from the extracted files.
3. Inject root into the v10h system.img: http://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586
3. Rename the "PrimaryGPT_0.bin" into "gpt.img". Then go to ubuntu, open a terminal and run: "# sudo gdisk /path/of/gpt.img"
This gives us the partition info for our device: http://pastebin.com/u9maAAdm
This will help us determine the bs, seek and count when we will use the "Send_Command.exe" to push the v10h system to our device.
4. Based on @autoprime 's help, we have to do some calculations. http://pastebin.com/brcXBpja
[I think that he made a mistake though (missed to multiply by 512 on count). This seems more correct to me: http://pastebin.com/tHUbicR8 )
5. After calculating bs, seek and count, we are supposed to run the Low Effort Root procedure for our device.
But, after running the dd command, a "#" comes immediately, which means that something is going wrong. The "#" should take some time to appear, meaning that the copy is in progress. I couldn't identify what I am doing wrong, so I publish my effort, because maybe someone has more knowledge and may be able to make it work! @midzan21 maybe?
Autoprime, thanks for your help and guidance through irc.
Click to expand...
Click to collapse
Well that what you try to did we got for v10a ROM via Universal LG Root for Lollipop. There is something that you can look about commands. Unfortienatly I can't try anything for now, because I need fully working phone and fully working Arch Linux VM for some networking testings.

midzan21 said:
Well that what you try to did we got for v10a ROM via Universal LG Root for Lollipop. There is something that you can look about commands. Unfortienatly I can't try anything for now, because I need fully working phone and fully working Arch Linux VM for some networking testings.
Click to expand...
Click to collapse
I think it's not the same. With Universal tool we ran a script that was stored on internal SD and this script pushed SuperSU.apk su.bin etc to the system. Now, we replace the whole System.img with a rooted one, and I think this is the point of Low Effort Root.

polfrank said:
I think it's not the same. With Universal tool we ran a script that was stored on internal SD and this script pushed SuperSU.apk su.bin etc to the system. Now, we replace the whole System.img with a rooted one, and I think this is the point of Low Effort Root.
Click to expand...
Click to collapse
so here are some of calculations which I did on my Windows ... I think that somewhere calculation for count is weird because it get into floating data point (decimal numbers)
skip/seek = 51008
count = 314530.125
bs = 8192 (used that as default)
edit: calculated using this calculations for count
[(end sector - start sector +1)*Logical sector size] / bs
Logical sector size iz 512 b

midzan21 said:
so here are some of calculations which I did on my Windows ... I think that somewhere calculation for count is weird because it get into floating data point (decimal numbers)
skip/seek = 51008
count = 314530.125
bs = 8192 (used that as default)
Click to expand...
Click to collapse
Aha, I noticed this and I set the bs to 1024. Then, I made the calculations and they seemed normal. But I 'm not sure if changing the bs would mess up things. The thing is that, whatever I used as numbers, the command wouldn't run.

I mean like how will ur calculations help us to root our phones? Is there a way to root my LG spirit?

JJolii said:
I mean like how will ur calculations help us to root our phones? Is there a way to root my LG spirit?
Click to expand...
Click to collapse
They can help us write a dd command correctly, so that we can send a rooted system.img in the correct partition of our device. So basically, if it worked, we would have had root on v10h now. But as I said, I am missing something.

polfrank said:
They can help us write a dd command correctly, so that we can send a rooted system.img in the correct partition of our device. So basically, if it worked, we would have had root on v10h now. But as I said, I am missing something.
Click to expand...
Click to collapse
Ive got v10f-eur-xx
I've tried SRSroot v5.1.
20:02:34 [+] Testing exploit: root8 (please wait..)
20:02:35 [+] Remounting /system Filesystem as R/W..
20:02:35 [+] Installing SU Binary...
20:02:35 [+] Installing SuperUser APK...
20:02:35 [+] Remounting /system Filesystem as R/O..
20:02:42 [+] Rooting Complete !
After restart theres not SU apk and I checked if my phone is rooted by Root checker basic and it says its not rooted. Im so frustrated in rooting my phone.. Im out of solutions how to root that piece of ****.

JJolii said:
Ive got v10f-eur-xx
I've tried SRSroot v5.1.
20:02:34 [+] Testing exploit: root8 (please wait..)
20:02:35 [+] Remounting /system Filesystem as R/W..
20:02:35 [+] Installing SU Binary...
20:02:35 [+] Installing SuperUser APK...
20:02:35 [+] Remounting /system Filesystem as R/O..
20:02:42 [+] Rooting Complete !
After restart theres not SU apk and I checked if my phone is rooted by Root checker basic and it says its not rooted. Im so frustrated in rooting my phone.. Im out of solutions how to root that piece of ****.
Click to expand...
Click to collapse
Have you tried kingroot?

polfrank said:
Have you tried kingroot?
Click to expand...
Click to collapse
Yes I did, Pc version and android app version, none of them worked.

Well, just go back to v10e-EUR-xx with the LG Flash Tool and root it with Kingroot. Worked for me.
Not mentioning the amount of hair I pulled out trying to root v10f...

Tomo123 said:
Well, just go back to v10e-EUR-xx with the LG Flash Tool and root it with Kingroot. Worked for me.
Not mentioning the amount of hair I pulled out trying to root v10f...
Click to expand...
Click to collapse
Just CSE flashed v10c and rooted with kingroot

Tomo123 said:
Well, just go back to v10e-EUR-xx with the LG Flash Tool and root it with Kingroot. Worked for me.
Not mentioning the amount of hair I pulled out trying to root v10f...
Click to expand...
Click to collapse
can u help me/guide me through Skype or Teamviewer? Please.

k got v10e-eur-xx rom and tried to root with kingoroot and oneclickroot 1.3 still doesn't root. What could be the problem?

JJolii said:
k got v10e-eur-xx rom and tried to root with kingoroot and oneclickroot 1.3 still doesn't root. What could be the problem?
Click to expand...
Click to collapse
Which version of kingroot are you using?

polfrank said:
Which version of kingroot are you using?
Click to expand...
Click to collapse
BETA : 2.5 android app

JJolii said:
BETA : 2.5 android app
Click to expand...
Click to collapse
Try this one: http://forum.xda-developers.com/devdb/project/dl/?id=14576
Click Direct Download.