HACK The Android RC30 t-mobile G1, get root access, and unlock!

Posted on December 22nd, 2008

So my brother bought a gPhone along with many other things with the money he made from selling some of his shoes. A PS3, a few games, 2 very nice cameras, and other things. I guess he wasn’t thinking when he bought the gPhone, he could probably only think about, “I NEED THIS!” Like me, my little brother has obsession with technology, and electronics. We are both crazy about electronics, we have to mess around, hack them, mod them, but first of all HAVE them. So anyways, he doesn’t have any phone service, and the phone is locked. So I set forth a bit of time to research and figure out how to hack the gPhone, and I figured it out. So here’s a tutorial on doing so. Later I will put together a graphic or video tutorial on “file” when I have some time. Until then, enjoy this hacking tutorial. The tutorial includes timeliness of facts as well.

First we have to force the Android into root access…
–Recently since the release, hackers around the world have been doing their duty to unlock and modify Android as they like. Although it’s open source Google has tricks up it sleeves, well for the T-Mobile phones.

This is starting to turn into a cat-and-mouse game akin to the the back-and-forths we’ve seen between Apple and the iPhone jailbreak underground community. This war has the underground scene always looking for new security exploits that will allow them to gain root access to their handset’s file-system. On the other side, the powers that be are always working to seal whatever security holes were used by the “jailbreak” community.

Google’s most recent move to thwart a nascent Android OS jailbreak uprising by rolling out a new Android OS update (RC30) that aimed to patch the security hole exploited by Android developers. The automatic, over-the-air (OTA) update was expected to essentially kill the Android OS jailbreak movement throughout the T-Mobile G1 fleet.

Today we’re seeing the jailbreak community’s counter-punch to Google’s left-hook. The ever driven developers over at XDA Developers have devised a method that allows G1 users to update their T-Mobile G1 to the latest Android OS RC30 build while still retaining access to the file-system root.

jailbreak the android

The updated Android jailbreak method mirrors the jailbreak solution currently available for the iPhone OS. By modifying the security checks that the handset performs during a firmware restore, jailbreak developers are able to load modified firmware update files. These modified update files udpate the handset’s firmware to the latest version while retaining particular desired functionality.

In this case, the Android development community has come up with a method that allows them to modify the Android OS’s recovery.img file, which in turn allows them to flash a modified version of Android OS build RC30 to a T-Mobile G1. The modified Android RC30 firmware brings with it all the benefits of the new firmware version while still allowing users to gain root access to the file-system.

If you haven’t yet updated your T-Mobile G1 to the new RC30 update, and you want to preserve root access, you’ll want to follow this G1 jailbreak tutorial.

After the break, that is…

This guide has been made to reflect the latest modified RC30 file – RC30 v1.2.

Please note that this forced update method is to be used only by those that want to preserve the root access exploit. Applying the modified Android OS update file takes time and familiarity with command line. Once applied, you will have to manually update to any future Android OS updates – because of this, it’s not recommended that casual users with no need for root access jailbreak their G1’s.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

* First off, you’ll need to download two files to your desktop:
o Modified recovery image (which will become your recovery.img file)
http://fscked.net/%7Ejesusfreke/AndroidMod.zip
o Modified Android OS RC30 update file with root access preserved
http://rapidshare.com/files/165227766/update_TC4-RC30_full_xda-dev_v1.2.zip
* Download and install the Android Telnet Client from the Android Market
* Download and install the Terminal Emulator app from the Android Market
* Turn on WiFi and connect to your WiFi network
* Now, go back to your downloaded files on your desktop
o Decompress the AndroidMod.zip file
o Extract “recovery_testkeys.img” to your desktop
o Rename “recovery_testkeys.img” to “recovery.img”
o Rename the modified Android OS RC30 update file from “update-RC30-fullupdate-modified-testkeys-v1.1.zip” to “update.zip”
* Transfer the newly named “recovery.img” file and the newly named “update.zip” to your microSD card (you can use the microSD card that came with your G1)
o Put microSD card in your G1 (if it’s not already in there)
* Fire up “Terminal Emulator”
o Type “cd system” and hit Enter
o Type “cd bin” and hit Enter
o Type “telnetd” and hit Enter
o Type “netstat” and hit Enter
o The IP address you want is listed on the same line as the word “Established”
o Write down this IP address
o Close Terminal Emulator (hit the “Home” button)
* Fire up “Telnet”
* In the IP address field (it should show “localhost”) enter the IP address you wrote down
o Hit “Connect”
* Now that you have root access, you’ll want to type in the following (hitting “Enter” at the end of each line):
o mount -o rw,remount -t yaffs2 /dev/block/mtdblock2 /system
o cat /sdcard/recovery.img > /data/local/recovery.img
o cd /system
o cat /sdcard/recovery.img > recovery.img
o flash_image recovery recovery.img
* Now turn off your phone
* Restart the handset by holding down the “Power” and “Home” buttons simultaneously
* When you see the triangle logo (you’ll know it when you see it), hold press “Alt” and “L” simultaneously
* Ensure that you see “using test keys” along the top
* Press “Alt” and “S” simultaneously
* Follow the on-screen instructions
* Press “Home” and “Back” buttons simultaneously when you’re done and ready to reboot
* The G1 will reboot as it does its thing - let it do so.
* You have now fully updated your T-Mobile G1 to Android OS RC30 with the root access exploit preserved - get at the root with the Terminal app.

Again, you run a very real possibility of bricking your T-Mobile G1 by updating it yourself. Making sure your battery is fully charged and that you disconnect the G1 from your computer before updating will help ensure a smooth update. Should things go awry, however, you’re on your own. (T-Mobile will likely help you out, but it’s not going to be a fun or speedy process)

Sourcex: http://forum.xda-developers.com/showthread.php?t=443041

Now to hack and unlock the gPhone…

Just the other day, Google announced that it will be offering its Android developers a special variant of the T-Mobile G1 (the first ever Android-powered smartphone to hit market) – the Android Dev Phone

1. Today, we’ve stumbled across a new hack that allows T-Mobile G1 owners with a bit of gumption and a dash of courage to turn their T-Mobile G1 into an unlocked Android Dev Phone 1.

The Android Dev Phone 1 is intended for Android developers with a need to load up custom firmware builds and test out unsigned software. Moreover, the Android Dev Phone 1 is unlocked to work on any GSM network in the world – a significant difference when compared to the T-Mobile G1, which is locked to T-Mobile’s network.

Fortunately for G1 owners, Google mistakenly shipped an Android Dev Phone 1 as a warranty replacement to an intrepid Android hacker. With a little help from those in the know, dream_kill managed to extract the Android Dev Phone 1’s unlocked bootloader and has posted the file online for all. Now, anyone can unlock their T-Mobile G1 to work just like an Android Dev Phone 1.

The G1-to-DevPhone1 conversion is easier than you think. The conversion requires little more than applying the update.zip file and rebooting the G1. In the end, you’ll have an unlocked G1 capable of running unsigned code. Unfortunately, this hack doesn’t endow your G1 with the Android Dev Phone 1’s cool battery-cover graphics.

More detailed T-Mobile G1 unlock instructions after the jump.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

* You’ll need an Android-powered T-Mobile G1 running RC30 with root access - that means you updated your G1 to RC30 using the above workaround method to preserve root access.
* You must have root access!
* Download the unlocked bootloader here.

1. Rename the unlocked bootloader file to “update.zip”
2. Move the newly renamed “update.zip” file to a microSD card.
3. Insert microSD card into G1.
4. Restart the handset by holding down the “Power” and “Home” buttons simultaneously
5. When you see the triangle logo (you’ll know it when you see it), hold press “Alt” and “L” simultaneously
6. Ensure that you see “using test keys” along the top
7. Press “Alt” and “S” simultaneously
8. Follow the on-screen instructions
9. Press “Home” and “Back” buttons simultaneously when you’re done and ready to reboot
10. The G1 will reboot as it does its thing - let it do so.
11. You have now hacked/unlocked your T-Mobile G1 to work just like an Android Dev Phone 1 - enjoy all those unsigned Android builds and the freedom to use whatever GSM network tickles your fancy!

Sourcex: http://www.modmygphone.com/forums/showthread.php?t=8051

So that’s it, if you have successfully followed all these steps above, your gPhone should be unlocked, hacked, and ready to go!

Ronald A. Richardson
www.ronaldarichardson.com

11 Comments on “HACK The Android RC30 t-mobile G1, get root access, and unlock!”

1 markus said at 12:59 am on December 30th, 2008:

Can I jailbreak my rc 30 updated g1

2 Ronald said at 1:12 am on December 30th, 2008:

Yeah you can jailbreak it following this tutorial, if I ever have the time, I’ll try to put soemthing easier together…

3 Khaled said at 2:39 pm on January 18th, 2009:

Hi All,

What I know is that you can’t run processes that listen to ports below 1024 with an unprivileged user.

The case.

After firing the terminal emulator application I discovered that the working user is “app_57″

and by navigating to /system/bin then type telnetd

it returned no errors but the return code is 255

like so:
$ cd system
$ cd bin
$ telnetd
$echo $?
255

I can’t start the telnet daemon like that.

Please advice.

4 Ronald said at 3:32 pm on January 18th, 2009:

@Khaled –>
quote#jesusfreke:

Here is a zip file containing a modified recovery and boot image, as well as a few other things:
http://rapidshare.com/files/166164961/AndroidMod.zip
http://jf.nyquil.org/AndroidMod.zip
http://android-dls.com/forum/index.p…rb_v=viewtopic (see post for actual link to file)

The recovery image (recovery_testkeys.img) uses the test keys that are distributed with the android platform source. This means that an OTA update or an update.zip update must be signed with the test key in order for it to install. In other words, it will no longer install OTA updates from t-mobile. You don’t want them stealing back root access from you now do you? .

I’ve also included the test keys and the SignApk.jar tool, so you can sign your own update scripts (for use only with the modified recovery image). You can resign any image, even if it has been signed before. So for example, if you needed to install an “official” t-mobile update, you must re-sign it with the test keys first.

Another bonus in this recovery image is that ADB is enabled while in recovery mode. You can’t adb into a shell (no sh binary), but you can at least use it to push and pull files from the device. For example, you could push an update.zip file to the sdcard.

The boot image (boot_nosecure.img) has been modified so that adb has root access by default. So when you do an adb shell, you automatically get a root shell. You can remount the system image using adb, and then push files directly to the system partition.

Finally, the “update – Restore Original RC29 Boot Image.zip” file is an update.zip file signed with the test keys, which will restore your boot partition back to the stock RC29 image. Useful if you accidentally hose your boot partition..

To install the recovery image onto your phone:

=========================================================
D:\Android\AndroidMod>adb push recovery_testkeys.img /data/local/recovery.img
912 KB/s (0 bytes in 1767424.001s)

D:\Android\AndroidMod>adb shell
$ su
su
# mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
# cd /system
cd /system
# cat /data/local/recovery.img > recovery.img
cat /data/local/recovery.img > recovery.img
# flash_image recovery recovery.img
flash_image recovery recovery.img
#
=========================================================

Note: You must place the recovery image at /system/recovery.img. the init.rc boot script automatically flashes the recovery partition with that file every time you boot up the phone.

At this point, it’s probably a good idea to reboot the phone into recovery mode, and make sure it loads OK. If the recovery image is corrupt somehow, it will throw you back into SPL mode (the multi-color bootloader screen). If that happens, just boot the phone normally, and reflash recovery image.

Once it boots into recovery mode, press alt+L, and the next to top line of text should say something like “using test keys.”. If it doesn’t, then you’re still using the original recovery image.

Note: If you are planning on installing the modified RC30 update, you can ignore the following – there is no need to install the boot image. The update already has a newer, modified boot image.

Now that you know you have the modified recovery image loaded, you can install the boot image:

=========================================================
D:\Android\AndroidMod>adb push boot_nosecure.img /data/local/boot.img
939 KB/s (0 bytes in 1533952.001s)

D:\Android\AndroidMod>adb shell
$ su
su
# flash_image boot /data/local/boot.img
flash_image boot /data/local/boot.img
# rm /data/local/boot.img
rm /data/local/boot.img
#
=========================================================

Now reboot the phone and let it boot normally. If the boot image was corrupted, it will boot into recovery mode instead. You can use the included update zip file to reload the original RC29 boot image.

Otherwise, if it boots up normally, open a command prompt however you like (telnet, adb, terminal emulator app, etc.) and type “getprop ro.secure”. If it says 0, then you’re running the modified boot image. Otherwise, if it says 1, you’re still running the original boot image.

from: http://forum.xda-developers.com/showthread.php?t=443041

5 wil b said at 11:34 am on April 10th, 2009:

can you make a video showing all this; it would be a hell of a lot easier )

6 Ronald said at 5:09 pm on April 11th, 2009:

I would but my brother long sold his g1. He didn’t like it in the end, it’s not the software Android. He just didn’t like the hardware.

7 anu said at 2:42 am on May 12th, 2009:

I want the unlock code via software iam using blackberry 6220 & i got the mobile-unlocker can anybody help me

8 mike foster said at 7:24 pm on August 9th, 2009:

I have done this as soon as the hacker posted the files. I highly recommend you do this. I have 1 question. How can I get the myfaves back without restoring the g1?

9 danny said at 10:50 pm on December 14th, 2009:

how come anytime I open terminal,til the point type in telnetd i got message in my phone said permission fail,can u help me with that

10 Ronald richardson | EricJonpHelps said at 6:11 am on March 6th, 2011:

[...] ronald a. richardson » HACK The Android RC30 t-mobile G1, get rootRonald Richardson stats, photos, and news on ESPN.com. … Ronald Richardson #15 WR… [...]

11 Can't SU on ADB in Command Prompt - Android Forums said at 6:46 pm on December 13th, 2011:

[...] now this is weird. I used a differing rooting method and now it seems that it rooted except I'm still having problems such as in ADB. First problem, [...]

HACK The Android RC30 t-mobile G1, get root access, and unlock!

11 Comments on “HACK The Android RC30 t-mobile G1, get root access, and unlock!”

Leave a Reply