obeliscum
16/08/09, 21:55:52
Android Rooting in 1-click (limited time only… until it gets patched) (http://www.ryebrye.com/blog/2009/08/16/android-rooting-in-1-click-in-progress/)
As is customary with these kind of posts, some disclaimers:
This could be dangerous.
This should only be used if you know what you are doing.
Although this technique should work for any currently shipping android phone, this specific APK will only work with phones that are compatible with cyanogen’s 1.4 recovery image. (http://forum.xda-developers.com/showthread.php?t=523558)
Now, some credit:
Zinx did all the work on this
Flashing your recovery image:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/droidflasher-150x150.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/droidflasher.png) Although the exploit itself (http://zenthought.org/content/file/android-root-2009-08-16-source) can be used to execute anything as root, the prepackaged APK is designed to flash your recovery image with an updated one that allows installing modified updates signed with a publicly available key The reason for this is pretty simple: It’s the easiest way to enable you to install some modified image. It also enables you to use nandroid to backup (and restore) your entire phone to your sd card, and basically gives you what you need to be one of the cool kids and install custom android roms at will (http://code.google.com/p/android-roms/wiki/Install_Custom_ROM)
Install the APK
In your settings, under software, tell it to allow untrusted sources. (necessary since the APK isn’t available in the market) Then, from the browser on your phone download the “recovery flasher 0.1 APK (http://ryebrye.com/files/flashrec.apk)” from here: http://ryebrye.com/files/flashrec.apk Install it… and open it up.
It looks like this:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recfasher-200x300.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recfasher.png) From here:
click on “backup recovery image”
click on “Flash Cyanogen Recovery 1.4″
(in mine there is the option to restore my previous one since I already backed that thing up)
Test that it worked
Power your phone down. Reboot into “recovery mode”. On all phones I’m aware of, you do this by holding down “Home” and “Power” when turning it on. When you see something like this:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recovery-200x300.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recovery.png) From here, you can install any of the custom roms using the instructions above. I highly recommend you use the “nandroid backup” button at this point. Known issues:
If your phone doesn’t work with cyanogen 1.4’s image (which I believe are 32A based HTC Dreams) you should probably not use this. If recovery fails to boot, you should be able to pull the battery and reboot into the normal phone and then open the recovery flasher app again and “restore” your backed up recovery.img – but no promises… This is all done at your own risk.
The exploit used (CVE-2009-2692 (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2692)) in this hack is already patched. The kernel was patched upstream on August 11th, so it is likely that an update will be pushed out from T-mobile VERY quickly to help prevent malicious people from using this same exploit.
Apologies in advance to anyone who has to work quickly and work hard to patch this exploit in the wild. (Although it should be noted that if you just shipped phones that weren’t neutered in the first place, it would save us all a lot of work and help us all be on the same team… but that’s a topic for another post.)
Original links:
If my blog goes down, these links are the original source for the files:
http://zenthought.org/content/project/flashrec
Mirrors:
http://g1files.webs.com/Zinx/android-root-20090816.tar.gz
http://g1files.webs.com/Zinx/flashrec-20090815.apk
http://g1files.webs.com/Zinx/flashrec-20090815.tar.gz
LINK:
http://www.ryebrye.com/blog/2009/08/16/android-rooting-in-1-click-in-progress/
As is customary with these kind of posts, some disclaimers:
This could be dangerous.
This should only be used if you know what you are doing.
Although this technique should work for any currently shipping android phone, this specific APK will only work with phones that are compatible with cyanogen’s 1.4 recovery image. (http://forum.xda-developers.com/showthread.php?t=523558)
Now, some credit:
Zinx did all the work on this
Flashing your recovery image:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/droidflasher-150x150.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/droidflasher.png) Although the exploit itself (http://zenthought.org/content/file/android-root-2009-08-16-source) can be used to execute anything as root, the prepackaged APK is designed to flash your recovery image with an updated one that allows installing modified updates signed with a publicly available key The reason for this is pretty simple: It’s the easiest way to enable you to install some modified image. It also enables you to use nandroid to backup (and restore) your entire phone to your sd card, and basically gives you what you need to be one of the cool kids and install custom android roms at will (http://code.google.com/p/android-roms/wiki/Install_Custom_ROM)
Install the APK
In your settings, under software, tell it to allow untrusted sources. (necessary since the APK isn’t available in the market) Then, from the browser on your phone download the “recovery flasher 0.1 APK (http://ryebrye.com/files/flashrec.apk)” from here: http://ryebrye.com/files/flashrec.apk Install it… and open it up.
It looks like this:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recfasher-200x300.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recfasher.png) From here:
click on “backup recovery image”
click on “Flash Cyanogen Recovery 1.4″
(in mine there is the option to restore my previous one since I already backed that thing up)
Test that it worked
Power your phone down. Reboot into “recovery mode”. On all phones I’m aware of, you do this by holding down “Home” and “Power” when turning it on. When you see something like this:
http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recovery-200x300.png (http://www.ryebrye.com/blog/wp-content/uploads/2009/08/recovery.png) From here, you can install any of the custom roms using the instructions above. I highly recommend you use the “nandroid backup” button at this point. Known issues:
If your phone doesn’t work with cyanogen 1.4’s image (which I believe are 32A based HTC Dreams) you should probably not use this. If recovery fails to boot, you should be able to pull the battery and reboot into the normal phone and then open the recovery flasher app again and “restore” your backed up recovery.img – but no promises… This is all done at your own risk.
The exploit used (CVE-2009-2692 (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2692)) in this hack is already patched. The kernel was patched upstream on August 11th, so it is likely that an update will be pushed out from T-mobile VERY quickly to help prevent malicious people from using this same exploit.
Apologies in advance to anyone who has to work quickly and work hard to patch this exploit in the wild. (Although it should be noted that if you just shipped phones that weren’t neutered in the first place, it would save us all a lot of work and help us all be on the same team… but that’s a topic for another post.)
Original links:
If my blog goes down, these links are the original source for the files:
http://zenthought.org/content/project/flashrec
Mirrors:
http://g1files.webs.com/Zinx/android-root-20090816.tar.gz
http://g1files.webs.com/Zinx/flashrec-20090815.apk
http://g1files.webs.com/Zinx/flashrec-20090815.tar.gz
LINK:
http://www.ryebrye.com/blog/2009/08/16/android-rooting-in-1-click-in-progress/