Saturday, July 9, 2011

Unlocking the Nexus one for Android - research

So, today, we're going to explore how to unlock a Nexus one - probably. The motivation is that I need to do some debugging of a memory leak, and most of the tools seem to need root access.

But, first let's look at the reasons I haven't unlocked it as of yet. There must be a reason, no?


Ok, according to this review - it's already unlocked. Hmm...

http://reviews.cnet.com/smartphones/htc-nexus-one-by/4505-6452_7-33906802.html#reviewPage1

On the upside, both versions of the phone--$529 without service and $179 with a two-year T-Mobile contract--will be unlocked.

So, why do I want to unlock it? I need root privilege. So, what does "locked" exactly mean?

http://en.wikipedia.org/wiki/SIM_lock

A SIM lock, simlock, network lock or subsidy lock is a capability built into GSM phones by mobile phone manufacturers. Network providers use this capability to restrict the use of these phones to specific countries and network providers.

So, I'm pretty sure this phone is not locked - the fellow I purchased it from had ATT, and I have T-mobile.

So locking is maybe not the problem. Let's google "root access nexus one"


Ok, here's why I haven't done it:

http://www.talkandroid.com/guides/google-nexus-one-root-access/

A Guide To Getting Root Access On The Google Nexus One

Despite its very recent release, the Google Nexus One has already been hacked and rooted by enthusiasts in the altering community. Hacking and gaining root level access is not recommended for those who have not previously hacked an Android device before; the instructions assume the reader has done this at least once before. The process should not take more than half an hour and is relatively simple.


Anything that is supposed to took 1/2 hour and is relatively simple sound like it could be murderously difficult. Also, why is it that the phone can be unlocked, but still have no root access?

Here's another possibility:

http://androidandme.com/2010/01/hacks/video-how-to-unlock-and-root-a-nexus-one/

So, that heading even assumes the Nexus one is locked. Well, let's tune into the video and see what they say.

http://androidandme.com/2010/01/hacks/video-how-to-unlock-and-root-a-nexus-one/

Video: How to unlock and root a Nexus One
Taylor Wimberly on Jan 11, 2010 at 8:23 pm117 comments
5share0share0 0
Video: How to unlock and root a Nexus One

Everyone seems to appreciate it when we do guides and hacks so I thought it was time to film another. Today we will be hacking the new Nexus One.

This is not a beginners guide. If you are a beginner, you should not be hacking your phone. These instructions assume you have previously hacked at least one Android device.

// I like this. It's a catch 22 - if you've never hacked your phone, then you should never hack your phone. Funny.

Before we begin

Make sure you have accomplished the following things

Installed the USB drivers (grab them from Google or XDA)
Confirm your device is recognized by ADB (see CyanogenMod Wiki or XDA for help)
Backed up any important data from your device


Yeah this seems to be pretty much takin from the previous url. But it does have a video. Why do I need new drivers - am I loading a new image? Everything gone?

It sure looks that way. Hmmm...I'm not really ready to wipe out and restore all my stuff. Not that I have a whole lot. The only thing I really use is my app. Well, there are contacts. That sounds time-consuming. Let's try again and see if there's any way around this.


This one:

http://www.knowyourcell.com/google/nexus-one/nexus-one-guides/396032/how_to_root_the_google_nexus_one.html

at least has easier instructions. You only need their superboot.zip.

Ok, this definitely confirms it:

http://stackoverflow.com/questions/3645122/why-does-sqlite3-command-using-the-android-adb-shell-return-permission-denied

Why does sqlite3 command using the android adb shell return “permission denied”?


Specifically, I was trying to use the sqlite3 command with the adb shell to run some queries on the database of the Android application I'm building. I kept getting "sqlite3: permission denied". I'm developing on a Nexus One that I purchased from Google. Does my phone need to be rooted or something? Thanks in advance.


the files are read protected, you need to root your phone or use the emulator.

Ok, I'm think just root the darn thing.

What is the safest option? Will I somehow lose my phone service? How do I back my contacts? Does it differ with the version I'm running? What exactly is my current version on the Android? I think it's gingerbread, how to I check that?

Settings > about phone

2.3.4 - a maintenance update of Gingerbread.

Ok, here's something about rooting 2.3.4

http://androidforums.com/nexus-all-things-root/329775-how-root-nexus-one-2-3-4-a.html


Lots of guys are running rooted stock 2.3.3 and 2.3.4. It's a Nexus - you don't need to use an exploit to achieve root, you just need to add a couple of files (su, busybox) to it.

See this thread, it has pretty good information though you should augment it with some research.

http://androidforums.com/nexus-all-things-root/285399-gingerbread-android-2-3-3-seems-disable-superoneclick.html

At the very end of the thread, someone posts a new One Click method that purports to work, so you may want to try that first.

Always, always research. I don't do this stuff until I think I have a clear understanding of what to do and why. It doesn't matter if it turns out I'm wrong about something, if I have a framework, I can at least work back and figure out where my wrong assumption was.

// That makes sense. It also shows this is a not a process to take lightly.

Here's another one:

Sure, but since you can root a nexus by the simple expedient of unlocking the bootloader, flashing clockwork recovery, then flashing su.zip to the system folder there's really no need for something like oneclick except that it's three clicks instead of one. I've always been puzzled why such programs even exist for the nexus phones at all. The only thing I can think of is that they're probably what the exploit authors are using as development systems; finding the exploits that will be needed by non-nexus phones a year later when they finally get that version.

What is "flashing clockwork recovery"? What's flashing su.zip? Let's keep reading.

Just use GingerBreak 1.2 roots 2.3.3 very simply.
GingerBreak 1.2 did not work to root 2.3.4. Ill try the other options above and will report

Quote:
Originally Posted by elidoperezmd View Post
This method did not world for me, my drivers are up and running. But when i type fastboot devices nothing happens
You may want to try again. I am running 2.3.4 on my Nexus and these steps worked perfectly for me. Took a total of about 5 minutes to get rooted with these steps. "Fastboot devices" runs with no visible change, but the following fastboot command will push the recovery image.

Note: when in the Bootloader, you have to click "Bootloader", then click "Fastboot" in order for the fastboot command to run. They did not include that 2nd step in their instructions. Without going back, the fastboot command will just sit there waiting.


// Which instructions? Let's trace back.

Root Nexus One with Android 2.3.3 Gingerbread, and it's a link to:

http://chensun.net/android-development/root-nexus-one-with-android-2-3-3-gingerbread/8/

I will check that later. It seems as if this whole thread is done by someone with the handle N1nja. He had a lot of trouble, but finally got through it.

Ok, here is another link refrenced:

http://ilikemygooglephone.com/2010/01/06/complete-guide-with-images-unlock-bootloader-and-root-google-nexus-one-mac-windows-linux/


Lets' walk through it:

There are 2 types of Google Nexus One devices : Retail and Google’s holiday gift to its’ employees. The retail version bought from http://google.com/phone has its bootloader locked but Google lets you unlock your bootloader unlike Apple! Google warns that the warranty will be void if you unlock the bootloader but seriously, unless you install some really dumb applications, you cannot damage the device.


Rooting your Google Nexus One is a 2 step process. One, Fastboot and the other Superboot (courtesy Paul from Modaco).


// Ok, Fastboot and Superboot.

To get superboot:

http://android.modaco.com/content/google-nexus-one-nexusone-modaco-com/298782/08-mar-superboot-erd79-gri40-rooting-the-nexus-one/

Superboot is a boot.img that when flashed, will root your device the first time you boot (installing su and the superuser APK). No need to flash the system partition, no need to use ADB, no messing with the contents of your data partition, no overwriting the shipped ROM on your device, just flash the boot image using the instructions below and you're done!

//But it gives a bunch of files; I'm not sure which one.

I think I like this one better:


http://chensun.net/android-development/root-nexus-one-with-android-2-3-3-gingerbread/8/

Update: May 5, 2011.
This method also works for Android 2.3.4 on Nexus One. I just tried it.
———————

After I got Android 2.3.3 (Gingerbread) updated on my Nexus One, I lost root. It seems there is no easy way to root Nexus One running 2.3.3. I did lots of searches and finally found an effective solution from a Chinese Android forum. I tried it, and it did work! So here I’d like to share this solution with you.

// Ah, maybe that's what the problem was. I new I could do more things before!

[ Notice! The bootloader should be unlocked before you do the following steps! If your bootloader has already been unlocked, you should see an unlocked lock icon when you start your Nexus One. If you don't know how to unlock bootloader, simply search "unlock bootloader nexus one", you'll find lots of tutorials. ]

// I should already know that from the video.


1. Download su.zip, and put it on your phone’s SD card.

2. Download fastboot.zip, unzip it to C:\. Now you have a folder C:\fastboot\

3. Download recovery-RA-passion-v2.2.1.img, put it in C:\fastboot\

// Ok, I'm on a mac. So I just have to put these in some folder.

4. Shut down your phone. Then start your Nexus One in Fastboot mode by holding down the Trackball and press the Power button.

// Ok, so, this Fastboot mode might be an image selection thing

// 4.a from user replies:
After step four, the user should be instructed to start FASTBOOT on the device:
“Use Volume +/- keys to choose ‘Fastboot’ and hit the Power button.”
Otherwise the computer will not see the phone when executing the ‘fastboot devices’ command.

// should that be before step 4?

5. Connect your phone to your computer. Open a Command Prompt (Start -> All Programs -> Accessories -> Command Prompt), and run the following commands:

// That's just opening a terminal


cd C:\fastboot
fastboot devices
fastboot flash recovery recovery-RA-passion-v2.2.1.img

// So, it looks like it's going to load that image, no, it will point fastboot at it.


6. Use Volume +/- keys to choose ‘Bootloader’ and hit the Power button.


// Ok, so, then when it reboots it's going to load that recovery images.

7. Use Volume +/- keys to select ‘Recovery’ and hit the Power button.

// I wish there was more of a description of what exactly these steps do.


9. Select the su.zip file you previously copied to your SD card and hit the Trackball. Hit it one more time.

// So, that's the super user. Hmm. I actually wouldn't mind using adb, I'm familiar with it. I don't
// really even need su access from the android terminal.


10. When done, restart your Nexus One and you should be all set.

There you go. Enjoy your rooted Nexus One :)

[ To verify that your have root access, type "su" in Terminal, the prompt should change from "$" to "#". ]
Rooted Nexus One with Android 2.3.3 Gingerbread

// ok. So, I just did some checking and it seems as if rooting comes with the favors. One is unlimited tethering,
// which means that you can use your phone as a wifi hotspot, I believe, or at least without extra charges.
// This is irrelevant to me, as I have a pay as you go account. It's for people who are really into their phones,
// like to tinker with it and stuff, not my thing, the reverse inf fact.
// I'm developing product, not exploring the Android universe. I really want to get over to IOS, to be honest.
// Still, it is annoying not have root access to my own development phone.

Anyway, this is how the OEM unlock would be done:

Step I: (Entering bootloader mode)

Download and extract fastboot
Windows Users: enter bootloader mode by opening a command prompt and browse to the directory containing the fastboot files that you extracted, then type fastboot-windows oem unlock
Mac Users: enter bootloader mode by opening a terminal window and browse to the directory containing the fastboot files that you extracted, then type ./fastbook-mac oem unlock
Linux Users: enter bootloader mode by opening a terminal window and browse to the directory containing the fastboot files that you extracted, then type ./fastbook-linux oem unlock

// Ok, I've unzipped fastboot.zip and it's created a "fastboot" directory, and I copied
// recovery-RA-passion-v2.2.1.img into it. I might as well throw that onto the SD card

Let's look through some of the responses to Chen's post:

After step four, the user should be instructed to start FASTBOOT on the device:
“Use Volume +/- keys to choose ‘Fastboot’ and hit the Power button.”
Otherwise the computer will not see the phone when executing the ‘fastboot devices’ command.



// Ok, I just realized there is a dependency on windows for this method. The fastboot directory
// has fastboot.exe, a couple of dlls and adb.exe. I think I will have to go to the
// tools folder of android software sdk. That's where N1nja's problem's will come in handy - he had
// to do his from a linux distro. I hope the sdk I've set up is the right version! I don't know if it's from
// Honeycomb or what. I should've set up a symlink to the actual binary.

Here is some help offered to him:

You must put your phone into fastboot mode by turning it off, then hold down the track ball and press the power button. I don't know if it makes a difference if the phone is plugged in to the USB cable prior to entering fastboot mode or if yu plug it in after. I don't think it does.

Before you type the unlock command, type "fastboot devices" and make sure the phone is recognized by your PC

// So, maybe he is using windows. He seems to be alternating.
// One other problem that seems to constantly arise is the usb drivers. Will I need to have some new ones
// in place for the new image? I would be nice to have a conceptual overview of how this process works.

// Let's go back to that video at the beginning.

http://androidandme.com/2010/01/hacks/video-how-to-unlock-and-root-a-nexus-one/

// Actually, these instructions are better for me, on a mac, than Chen's - at least until the last part.

Step 1: Unlock your bootloader

In order to flash a new recovery image, you must unlock your bootloader. This process is quite simple, but it will wipe your phone.

// Ok. So, unlocking really means unlocking the bootloader. That probably means you get control over what gets
// booted.

Reboot phone into fastboot: Power off device and hold down trackball while powering back on. (The fastboot screen is the one with the Androids on skateboards)

// Ok, good.

Open a command prompt and navigate to your Android SDK tools folder.

// I can do that

Type ‘fastboot devices‘ to make sure your phone is recognized.

// Good

Type ‘fastboot oem unlock‘ to unlock the bootloader.

// Ok, there's the unlock.

Use volume keys to navigate to yes and press the power button to confirm.

// Good. That's straightforward.

// I'm still not totally understanding the preparation steps

1. Installed the USB drivers (grab them from Google or XDA)

// Wait, I'm probably already covered here - the mac has been talking to my Nexus via adb for a while.

Confirm your device is recognized by ADB (see CyanogenMod Wiki or XDA for help)
// I think this is adb devices.

Backed up any important data from your device
// Haven't done this yet, but I don't have much on there that matters - I've been careful about investing
// a lot of time into data. But it would be good to have a backup, just in case.

Step 2: Flash a new recovery image

Next we will download a new recovery image that allows us to flash custom zip packages.

// Ok, this is a "recovery" image. This means it's not a custom package - it just lets you load it, probably.

Visit XDA and download Amon_RA’s recovery image for the Nexus One.
Copy the file to your Android SDK tools folder.

// for this, I'll be using the recovery-RA-passion-v2.2.1.img from Chen's folder.

Open a command prompt and navigate to your Android SDK tools folder.

// That, I can do.

Type ‘fastboot flash recovery recovery-RA-nexus-v1.5.3.img‘. (Note filename will change as recovery image is updated)

// That I can do.

Step 3: Boot into recovery mode and flash N1 Addon

Now that the new recovery image is installed, it is time to reboot into recovery mode and flash a custom zip package.

// My big question is, I may not be flashing, i.e. replacing, the stock version with a custom zip.

Since your phone was just wiped, you might have to enable usb debugging again so ADB and fastboot commands will work.

// Right that's a good point.

Double check: Go to Settings > Application settings > Development > USB debugging (enable)

For this guide we will be flashing Cyanogen’s N1 Addon.

Visit XDA and download Cyanogen’s N1 Addon. (or any other custom .zip file you want to flash)
Copy the .zip file to the root directory of your SD card.
// Ah, wait. That might be the su.zip. I should adb push it onto the SDCard right now:
// from Chen's fastboot directory:
// adb push su.zip sdcard/su.zip
// Ok, now that's there.

Open a command prompt and navigate to your Android SDK tools folder.

Type ‘adb reboot recovery‘ to reboot the phone into recovery mode. (The recovery screen says “Android system recovery” with green text on black background)


Use the trackball to navigate to “Flash zip from sdcard” and then select the zip file you wish to flash.


Follow the on screen instructions. Press the trackball to begin the flash when prompted.

When the flash is complete, navigate to reboot and press the trackball to reboot.


// Ok, so, conceptually what it's doing is

// One, changing the bootloader to allow it to specify a custom image (recovery, or su.zip, or both?)
// Two, rebooting twice first load the recovery image, then the second time to use that recover image
// to flash a custom image
// Three select the custom image (in this case, su.zip)

Ok. I'm going wrap this up, and in the next post, actually go ahead and root the phone.

No comments:

Post a Comment