the dreaded process of rooting Rogers Dream

This is not as smooth as [rooting the G1]{rooting-g1}, and comes no where close as [my second attempt at rooting the G1]{simple-rooting-g1} (ie the easy way).

WARNING: I’ve said it before, but this time I want to stress it… this may brick your phone! Until I figured things out and found the right pages I had a non-booting phone.

Some background info #

• Rogers Dream is a 32A phone, this means that the hardware is a bit different and you need a special kernel.
• Rogers Dream has a different HBoot bootloader which needs to be replaced with a different process.
• It comes down to this: Do not use Tmobile G1 files.

Also… I assume you have the fastboot executable. Having adb is handy, but not required. Google for instructions if you don’t.

Installing CM recovery #

In case you don’t know Android phones have a bunch of boot modes (5, I think). Anyway, one of them lets you upgrade software using update.zip files. This mode comes up when you boot with the HOME button held. We will overwrite the recovery partition with one that will do more for you, and you will need it to upgrade to community firmware in the future.

• I used the new 32a-aware flashrec to get a CM-recovery 1.4 image installs.

  This app will detect the CPU, download the right imag, use CVE-2009-2692 exploit, and give you a recovery image.

  After this step you can always boot with HOME button and get the full featured recovery image.

• Not part of the rooting procedure, but very important… use the recovery image to take a nandroid backup.

  It will make a nandroid directory on your SD-card and store all the images on it. I was able to recover my phone with it.

Preping for root #

Next you need to download Haykuro’s rooting files. These were hard to find, because the service he uploaded them to has a 10k download limit… and I came in too late.

I initially started with this write up: Rogers, heres your real root, but it didn’t work for me. I ended up with a phone that booted to the ROGERS screen and never went further. Sounds like the kernel wasn’t getting to init. Maybe a timing issue or the kernel was just wrong. Anyway…

I had previously found this write up: All the technical details you’d like - Rooting the Rogers Dream, but like I said, the link provided there – http://drop.io/ii4t2ax – had already expired it’s download quota.

I will give you the new link I found for this file: http://drop.io/081mnjs, linked off this forum post. In case it’s gone again, you can always google for “rogers_root_unzipme.zip” and maybe you’ll get another mirror.

• so… download http://drop.io/081mnjs

• Unzip the file.

  Here are the files I got (for your verification):

   #  md5sum *
   85114a9f478c1ffba7105c1faacef980  boot.img
   b877cfd3959e65abd5559862994c4db0  instructions.txt
   fdb11cc50fc692584d49b1e22835131c  recovery.img
   2b1aaa9012dc28f88c482e1b21a46fdd  update.zip
  

• cat instructions.txt. I followed most of this procedure, except for flashing the recovery image since I already had CM 1.4 + JF installed from above.

The steps #

Here are the steps I took while the phone was in recovery mode:

• copy the update.zip to the phone.

  You can do it the old fassioned way by dragging them onto your SD-card, or with adb run:

   # adb shell mount /sdcard
   # adb push update.zip /sdcard/update.zip
   # adb shell umount /sdcard
  

• activate fastboot

  You could power down and boot up holding the CAMERA button, or if you have adb run:

   # adb reboot bootloader
  

  … you may now have to push SEND to switch to FASTBOOT as opposed to HBOOT mode.

• reboot with the fastboot iamge

   # fastboot boot recovery.img
  

  … note, this does not flash the image, just reboots to it. You will get a different looking screen (blue/black background).

  Select apply update. And as Haykuro put it:

  LET IT FINISH, DO NOT TOUCH ANYTHING UNTIL YOUR PHONE IS COMPLETELY IDLE. DO NOT TOUCH AFTER FIRST REBOOT (WHEN CHIP APPEARS) UNLESS YOU LIKE A BRICK. :)

  When it completes, you will have the 1.33.2005 bootloader. It lets you flash in unofficial firmware images.

• It will then return to recovery mode. Push HOME and BACK to reboot. Then power off your phone.

• Boot your phone up while holding the CAMERA button, this gets you to Hboot/fastboot. Activate FASTBOOT.

  Alternatively, if your phone has already booted up from the previous step, you can just run this command to get to FASTBOOT:

   # adb reboot bootloader
  

• flash in the boot image

   # fastboot flash boot boot.img
   # fastboot reboot
  

• this should hopefully get you up to the Rogers firmware, but you now have root.

   # adb shell id
   uid=0(root) gid=0(root)
  

Yey!

Resources #

As always, here are the links that I found useful in my adventures…

• Rogers Dream pics:

  • board pics
  • what’s what

• rooting

  • flashrec – the tool that installs the recovery image
  • Haykuro’s first rooting entry
  • Haykuro’s second rooting entry – didn’t work for me
  • repost of the rogers_root_unzipme.zip
  • another writeup on rooting Rogers Dream – never tried

• Kernel 2.6.27 for 32A (careful, these are for the Sapphire)

  • 32a GBO kernel. More designed to ROM cookers
  • Reverse Engineering a 32A Kernel

• extracting images

  • unyaffs - a program to extract files from a yaffs image
  • How to extract contents of *.img
  • HOWTO: Unpack, Edit, and Re-Pack Boot Images

• CM 32a ROMs

  • Cyanogen 4.0.4 & 4.1.2.1 32a – not tried yet
  • eventually experimental will support 32a, so I hear.
  • TheOfficial Rogers (dream/sapphire-32B) - Enomther’s MOD

• tools

  • installing SDK

• misc

  • Dream forum
  • HTC MAGIC original ROM running on TIM, unbranded A6161, Rogers, … by daldroid
  • why we can’t root rogers andoirds?? YES U CAN!!!
    • Root your Rogers’s Magic !!!
    • Alright, so here’s what I’ve done so far.
  • Rooting Rogers HTC Dream – nothing special
  • Magic Rooting