I wondered how this was made ?
I share with you what i have found.
AS USUAL USE THIS GUIDE AT YOUR OWN RISK I'M NOT RESPONSIBLE IF YOU BRICK YOUR HANDSET.
The first thing you need is to get the boot.img of your phone.
As your phone isn't rooted you need an app to install a small exploit. This app is romdump, thanks Sebastian404 to have provided it.
App can be downloaded here :
I) get the boot.img
Extract the files and follow the next steps :
I do these steps with adb but you can use a terminal emulator too (see the readme.txt in the zip)
so type the following 3 commands
adb push install /data/local/
adb shell chmod 04755 /data/local/install
adb shell /data/local/install
Following the readme.txt
you should see something like following:
Android ROM dumper v0.72b
©2010 Sebastian404[*] Android local root exploid © The Android Exploid Crew
[+] Using basedir=/sqlite_stmt_journals, path=/data/local/install
[+] opening NETLINK_KOBJECT_UEVENT socket
[+] sending add message ...[*] Try to invoke hotplug now, clicking at the wireless[*] settings, plugin USB key etc.[*] You succeeded if you find /system/bin/romdump.
Once you see that you need to turn your Wifi on and off, usualy in
Settings / Wireless & Networks / Wi-Fi
now thats done, type the following:
adb shell romdump
then wait for it to finish, it can take a while.
Once the program has finished you should find a directory in the root of
your SD card called romdump and a sub-directory named after your device
model. Take those files and give them to someone who knows how to make a
Take the boot.img in the sdcard and copy it in your computer
I recommand you create a directory named Superboot where you'll put all the tools needed by this guide.
The first tool you need to install is cpio
So ubuntu users do a sudo apt-get install cpio
Arch users do a pacman -S cpio
The second tool you need is split_bootimg.pl that you can download here :
Save it in the same dir than boot.img
in this dir type split_bootimg.pl boot.img
note all the values given by split_boot.img you'll need them later
This is what my blade give :
Page size: 2048 (0x00000800)
Kernel size: 3203212 (0x0030e08c)
Ramdisk size: 149760 (0x00024900)
Second size: 0 (0x00000000)
Command line: androidboot.hardware=blade console=ttyMSM2,115200 g_android.product_id=0x1354 g_android.serial_number=Alice-Blade
2 files have been created boot.img-kernel & boot.img-ramdisk.gz
II) extract the ramdisk
Follow the steps :
1) cp boot.img-ramdisk.gz ramdisk.cpio.gz (we make a backup in case)
2) gzip -d ramdisk.cpio.gz (extract the ramdisk)
3) mkdir tmp
cp ../ramdisk.cpio . (we take ramdisk appart to work)
4) cpio -i -F ramdisk.cpio (extract the ramdisk.cpio in the tmp folder to have a clean environment)
5) rm ramdisk.cpio (Remove the ramdisk.cpio in the tmp)
III) Insert super user in your ramdisk
Edit the file init.rc and find the line ## Daemon processes to be run by init.
After the second ##
Insert the four folowing lines
service superboot /system/bin/sh /superboot/superboot.sh
Save the file and quit.
Now we need the app Superuser.apk and the script superboot.sh which install the superuser.apk
Download them here :
Thanks to Paul to have provided the script superboot.sh
Extract the file in the directory tmp
IV) Recreate the boot.img
1) cpio -i -t -F ../ramdisk.cpio | cpio -o -H newc -O ../ramdisk_new.cpio (Recreate the ramdisk.cpio named ramdisk_new_cpio)
mv boot.img-ramdisk.gz boot.img-ramdisk.gz.sauve (backup the old ramdisk)
rename ramdisk_new_cpio img-ramdisk
gzip img-ramdisk (recompress the new ramdisk)
You need now a tool called mkbootimg that you can download here :
and download it in the superboot directory
chmod +x mkbootimg (to make it executable)
mv boot.img boot.img.sauve (save the old boot.img)
type now the following command
mkbootimg --kernel boot.img-kernel --ramdisk boot.img-ramdisk.gz --cmdline androidboot.hardware=blade console=ttyMSM2,115200 g_android.product_id=0x1354 g_android.serial_number=Alice-Blade --pagesize 2048 --output boot.img
WARNING REPLACE THE VALUES BY YOUR OWN VALUES GIVEN BY SPLIT_BOOTIMG.PL
V) Flash your new boot.img
Download fastboot here :
Extract it in the superboot directory
and type the following commands :
chmod +x fastboot-linux
adb reboot bootloader
./fastboot-linux flash boot boot.superboot.img
Once your handset is rebooted it will be rooted.
I'll appreciate any comment / error / improvement that you'll say me.
Edited by Phoenix Silver, 09 August 2011 - 09:52 PM.