Direct root method for Android 2.3.4 on D2G,D2,DX, and DX2

[bhigham]

I posted this on Rootzwiki, but figured I would post it here as well, and hopefully it is helpful for someone.
Since all these devices seem to be vulnerable to the same exploit found by phifc at
New root method for stock 2.3.4 (621/622) found (Droid2, R2D2) - Droid 2 / R2D2 / Milestone 2 / Droid 2 Global - RootzWiki
I have assembled rooting methods for all of them in EzSbf style CD. I have tested it on my D2G, and the same method has been tested by multiple users on the D2/R2D2, and has worked fine.
Credit for this method go to phifc, djrbliss, and the others who developed the method.
I have simply taken the method, and assembled the tools.
Credit for the idea behind the CD method should go to 1KDS, as I have mostly patterned this CD after his method.
Credit should also go to Skrilax_CZ, as without his Motorola Android Firmware (De)packer, we wouldn't be able to have a 55 meg CD that covers multiple devices.
Special thanks also to themib for testing and troubleshooting on the DroidX2. In fact, since I don't have a DX2, he actually did a majority of the work in finding a method that would work (the method for the D2 and D2G doesn't quite work), and then we worked together to get it assembled and working.

From what I can see, it should work for the Droid X as well, and Western Senju Ero-sannin on the rootzwiki DroidX forum reports that is has worked for him.
This CD is for the D2,R2D2, D2G, and DX on Android version 2.3.4, and the DX2 on 2.3.5.

Of course, like all other things here, I have done my best on this, but there are no guarantees, and anything you do on your phone is at your own risk.
So, without further ado, here is a link for the CD
Droid2_D2G_DX_DX2-RootCD-2012.iso
and the md5 is
7baee9c34f6ef7ad0b4fa219ae387c68

 

[themib]

updated many times see change log

created by phifc modified by bhigham

3 options mirror links posted Magic MD5 Root 2.3.4 for D2, R2D2, D2G, DX and 2.3.5 for DX2 - Google Docs
Multi-Device Root (54mb)
Droid2_621_SBF-and-RootCD.iso (213mb)
Droid2_R2D2_A957_2.3.4_SBF_and-or_RootCD.iso (250mb


How this works

Originally Posted by phifc
There's an exploit in loadpreinstall.sh. It compares md5 sum files of preinstalled apps and if they're different, copies the md5 to the local cache. The preinstall just has an empty file in app/ so it will parse the md5 for it. Instead of an md5 sum, it contains a local.prop that allows adb root shell. So the system thinks it's copying the md5sum to the cache when it bounces off the symlink and overwrites the /data/local.prop, giving adb root on next reboot

what is ezSBF?
original [TOOL] ezSBF (not for 2.3.4)

Don't let the word Linux scare you, this is just a cd you burn, nothing installs to your pc. Once you burn this CD you are ready to SBF flash anywhere you have a computer, no net connection needed to download any files.

This is an .iso file. It is a complete Linux operating system that you will download, burn to CD (or USB) then boot your pc from CD or USB, this allows your pc to reboot into a different operating system.

Instructions (Mac):
Download .iso
Use Disk Utility (built in) to burn iso file to a CD (instructions)
Shut computer down
Hold c key, push power and hold c until you see the Linux OS start
Hit enter at the yellow "boot baby... boot" screen
You will see yellow dots for 3-5 minutes then the script will start

Instructions (Windows):
Download .iso
Burn iso image to a disk (Instructions, Windows 7 - Vista and XP) or (Load to a USB flash drive)
Reboot PC
Hit F12 (sometimes F8 or esc) during boot to go to boot menu (possibly google search how to boot your specific pc from CDROM)
Select boot from CDROM (or USB if you used a flash drive)
Hit enter at the yellow "boot baby... boot" screen
You will see yellow dots for 3-5 minutes then the script will start

Live USB Instructions (Windows):
(Instructions from pendrivelinux.com)(thanks)
Download UNetBootin for Windows
Download your favorite Linux ISO
Double click the Unetbootin Executable to start the program
(1) Click the Diskimage radio box
(2) browse to select your ISO
(3) Set your target USB drive
(4) click OK to start the creation

(5) After the USB drive is done select reboot.
(6) During boot enter the boot menu and change USB to boot first, save and reboot.
(7) When booting from UNetbootin select SliTaz


________________________________________________

You will now be in the script and ready to flash.

select D2 for multi device root cd or /select root for the Droid2_621_SBF-and-Root CD
don't use numbers on right side of you keyboard, just use the ones above qwerty

turn phone on, connect to pc with usb cable

on phone check usb debugging (settings/apps/development)
on phone select charge only usb mode

on pc press continue
program will use adb to push

data/local.prop /data/preinstall_md5/magic.md5

program will prompt you to
manually reboot phone to bootloader
program will flash repacked sbf (less than 50mb)
program will reboot twice, very important (reboot just replaces the local.prop, but the old local.prop is still in memory, till second reboot)
adb pushes su,superuser, and busybox
program will reboot to recovery,
manually press both volume buttons when you see !, triangle, & android andy
manually select wipe cache
manually select reboot
rooted

error info
when running program you may see these errors
rm failed for /data/preinstall_md5/magic.md5 no such file or directory
no root.img.gz no such file or directory
rm failed for /data/preinstall_md5/magic.md5 read only file system


that is fine, it will still work

by bhigham -One item of note with this CD, it does require at least 1GB of RAM in order to work properly. Also, if you only have 1GB of memory, and you need to both SBF and root your phone, it will be necessary to reboot the computer after flashing the .629(or .621)SBF. If you are unsure of the amount of RAM that you have, go ahead and reboot to be on the safe side.
Also, I noticed that I neglected to put instructions for putting your phone in bootloader in the SBF Step. To put your D2G(/D2) in bootloader mode, power down and power on while either holding both volume buttons, or the up arrow on the keyboard.

if you plan on creating nandroid backups or flashing roms read
[HOW TO] Install/Use Droid 2 Bootstrap

Band unlock Droid 2 Global with 629 instructions


original thread New root method for stock 2.3.4 (621/622) found (Droid2, R2D2) - Droid 2 / R2D2 / Milestone 2 / Droid 2 Global - RootzWiki

edit:
02 Oct 2012 added mac info and ezSBF and root cd
09 Dec 2012 major rewrite

 

[Newenglandguy]

Newbie has some dumb questions

Want to root my phone, but I don't quite think I fully understand the full process. Do I have to burn the ISO file to a CD and boot off of it? I'm not clear on what the steps are. Sorry, for what most of you may be a dumb question, but I don't want to mess this up. Never rooted a phone before. I have a Droid 2 that is running 2.3.4.

Oh, and what does it mean "you need to SBF your phone"?

Thanks

 

[themib]

the ezSBF & root for 2.3.4/4.5.621 iso has two option
1 .sbf is a recovery system file, use to restore phones firmware
2 and magic md5 root

the iso file needs to be mounted to cd or usb drive, with an iso burner or UNetBootin (usb drive)
reboot pc from cd or usb, a linux program runs
follow on screen instructions

both the SBF and root options are very safe, if you have a problem, reread instructions or try on a different pc
each option only takes about 10 mins

edit: you only need to SBF, if phone is not running correctly, or won't boot past the m screen

this iso has been used by many people
Magic MD5 Root 2.3.4 for D2, R2D2, D2G, DX and 2.3.5 for DX2 - Google Docs

 

[Newenglandguy]

themib - thanks for your reply!

Now I have some questions on some of the steps:

reboot phone to bootloader - how do you reboot to bootloader - are there certain keys you must hold down?
flash repacked sbf (less than 50mb) - is this a step on the ISO CD that I have to do?
reboot twice, very important (reboot just replaces the local.prop, but the old local.prop is still in memory, till second reboot)
adb pushes su,superuser, and busybox - is this something that happens when I run off the CD?
reboot to recovery, wipe cache - how do you reboot to recovery mode - again, are there certain keys you must hold
down?
reboot normally

Thanks

 

[themib]

how do you reboot to bootloader

bootloader mode, power down and power on while either holding both volume buttons, or the up arrow on the keyboard.

flash repacked sbf (less than 50mb) - is this a step on the ISO CD that I have to do?

no this part of the root program

adb pushes su,superuser, and busybox - is this something that happens when I run off the CD?

yes other than manually booting to boatloader, the root program is automatic

- how do you reboot to recovery mode

phone should reboot to recovery automatically, if it doesn't
read The DROID Wiki

• Power down the phone.
• Slide out the keyboard.
• Press and hold the X button on the physical keyboard.
• Press the lock/power button.
• Once you see a warning sign with an android robot appear, press Volume Up and Down buttons.
• 
  Android system recovery:
• Use volume keys or arrow keys to highlight; power or enter button to select
• Options are
• reboot system now
• apply sdcard:update.zip
• wipe data/factory reset
• wipe cache partition

 

[Newenglandguy]

Themib - thanks again. Meant to ask a few more questions and I think I'll be confident enough to try to root it. Does that ISO image CD I will be burning have the things on there that I'll need to SBF my Droid 2 should the root not work? Again, it sounds like SBF is a way to restore to factory settings. Do I have that correct? What does the acronym SBF stand for?

Thanks

 

[Newenglandguy]

Themib - thanks again. Meant to ask a few more questions and I think I'll be confident enough to try to root it. Does that ISO image CD I will be burning have the things on there that I'll need to SBF my Droid 2 should the root not work? Again, it sounds like SBF is a way to restore to factory settings. Do I have that correct? What does the acronym SBF stand for?

Thanks

 

[themib]

What does the acronym SBF stand for

.sbf is the file extension, sometimes called a system boot file, is an image which restores the phone's firmware

need to SBF my Droid 2 should the root not work?

rooting shouldn't cause any problems,
but it's not uncommon for a custom rom install to to fail, requiring to flash an sbf, to fix, and have to reroot

 

[themib]

you wrote you have D2 2.3.4 but this is a D2G thread
so check
in settings/ system / about phone/ system version
D2 4.5.621 use ezSBF & Root 2.3.4/4.5.621
R2R2 4.5.622 use ezSBF & Root 2.3.4/4.5.622
D2G 4.5.629 use ezSBF & Root 2.3.4/4.5.629


or Droid2_D2G_DX_DX2-RootCD-2012.iso
has options for those devices, only 60mb, but does not include .sbf files

 

[Newenglandguy]

you wrote you have D2 2.3.4 but this is a D2G thread
so check
in settings/ system / about phone/ system version



D2 4.5.621 use ezSBF & Root 2.3.4/4.5.621
R2R2 4.5.622 use ezSBF & Root 2.3.4/4.5.622
D2G 4.5.629 use ezSBF & Root 2.3.4/4.5.629


or Droid2_D2G_DX_DX2-RootCD-2012.iso
has options for those devices, only 60mb, but does not include .sbf files

I have this one:
D2 4.5.621 use ezSBF & Root 2.3.4/4.5.621

Glad you posted that update. Still a little nervous I might hose it up.

 

[Newenglandguy]

Well I did it and now all I have is the boot loader screen. Got to spot where it ask me to put it in boot loader and I did. Hit return and it went for a few minutes. Then it said phone would reboot, which it did then it said waiting for device and it just sat there with the boot loader screen showing. Ten minutes wait, and nothing. How hosed am I?

 

[themib]

Not sure why I does that on some phones
Restart root program, and unplug usb, reboot phone reconnect usb
If it reboots to bootloader more than once, unplug usb, reboot phone, wait for phone to fully load android, reconnect usb, program should continue

 

[Newenglandguy]

OK now I got the droid guy with a triangle and a yellow explanation point. It did say root was successful and to reboot in recovery mode and wipe cache. Don't see any options

 

[themib]

[*]Once you see a warning sign with an android robot appear, press Volume Up and Down buttons.
[*]
Android system recovery:
[*]Use volume keys or arrow keys to highlight; power or enter button to select
[*]Options are
[*]reboot system now
[*]apply sdcard:update.zip
[*]wipe data/factory reset
[*]wipe cache partition

already covered this