Vodafone Froyo Root Ohne Unlock

This is an alternative approach of rooting the Nexus without touching the bootloader. No downgrade neccessary and also working for European or Korean FRF91.

Please excuse that the URLs are not clickable directly. My status doesn't allow that currently.

-------
Credits:
-------
- The Android Exploid Crew:
c-skills.blogspot.com/2010/07/android-trickery.html
- Amon_RA
- cyanogen

-------
Notes:
-------
- Donate if I've helped you with this guide:
paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=JH9PHSE5M6UNY

- The exploit wasn't found by me (see credits), I just implemented it as a proof of concept for the Nexus One

- Basically this method should work on all currently known ROM versions.
- I tested it on EPF30, Korean FRF91, Vodafone FRF91.
- As usual when doing this kind of stuff: DO THIS AT YOUR OWN RISK.
- It could even work on other Android devices as long as their system partition is at
/dev/block/mtdblock3/ with yaffs2 file system and there is still some space left on the system partition (without any changes).


-------
Prerequisites:
-------
- Locked Nexus One
- Lastet Android SDK incl. USB drivers
- Working ADB
- The file "freenexus.zip"
get it here:
smartdrive.web.de/guest?path=nexus%20von%20aetsch&token=9A3F8428149F 7AA2&locale=de


-------
Step-by-step guide:
-------
1. install android sdk & USB drivers
2. extract zip file into the tools directory of SDK (i.e. \android-skd-windows\tools)
3. open a command prompt (Windows: Start, Run, "cmd", OK; Linux: Terminal)
4. change to SDK tools directory (i.e. cd \android-skd-windows\tools)
5. connect Nexus to USB and check if debugging mode is activated
(Settings/Application/Development/USB Debugging)
6. run "adb devices" in shell and see if there is a device lsited. if not back to step 5 or reinstall USB-drivers

7a. for Windows: run "freenexus.bat" in command shell (this copies the neccessary files to /data/local/tmp)
7b. for Linux or manual installation: run the following commands
adb push freenexus /data/local/tmp/freenexus
adb push Superuser.apk /data/local/tmp/Superuser.apk
adb push su /data/local/tmp/su
adb push busybox /data/local/tmp/busybox
adb shell chmod 755 /data/local/tmp/freenexus
adb shell chmod 755 /data/local/tmp/busybox

8. run the following commands:
adb shell
(you should see a "$" prompt now)
cd /data/local/tmp

9. on your phone go to a screen where you can easily toggle wifi (widget or settings/wireless)
10. be prepared to toggle wifi immediately after you execute the next step
11. run "./freenexus"
12. toggle wifi
13. you should see something like that:
[*] Android local root exploid (C) The Android Exploid Crew[*] Modified by ak for HTC Nexus One
[+] Using basedir=/sqlite_stmt_journals, path=/data/local/tmp/freenexus
[+] opening NETLINK_KOBJECT_UEVENT socket
[+] sending add message ...[*] Try to invoke hotplug now, clicking at the wireless[*] settings, plugin USB key etc.[*] You succeeded if you find /system/bin/rootshell.[*] GUI might hang/restart meanwhile so be patient.

14. run "rootshell"
15. if you succeeded you will be asked for a password, if not try again from step 10
16. enter the password "freenexus"
17. now you should see a "#" as a prompt -> you are root now
18. run the following commands:
./busybox cp busybox /system/bin
chmod 4755 /system/bin/busybox
busybox cp Superuser.apk /system/app
busybox cp su /system/bin
chmod 4755 /system/bin/su
rm /system/bin/rootshell
exit
exit
19. Check if you keep root rights:
adb shell
su
20. after you executed the su command the Superuser app on your device should ask you for allowance
21. you should see the "#" prompt again, if you didn't get that try su again
22. done

-------
If you only want root rights you are done here. If you want to install custom ROMs you have to install
a custom recovery first. Easiest way would be to download "ROM Manager" from the market. There are
plenty of tutorials on how to install custom recovery/ROM at xda.


If you rooted from a Korean Rom or have installed the latest Vodafone Rom via PASSIMG you probably have
HBOOT 0.35 which makes it currently difficult to install Cyanogenmod or other custom ROMs.
(There is an assertion in the install script) There is a tutorial to revert HBOOT here if you want to:

forum.xda-developers.com/showthread.php?t=726258
Instead of using the EPF30 image you can also use any other PASSIMG file (unless it has HBOOT 0.33,
otherwise this step wouldn't make sense...)

Caution:
After you have reverted your HBOOT, you have lost your root rights and you are back on stock recovery.
But you can (or have to) repeat the above procedure to get root rights back.

Zum Vergrößern anklicken....