Find Your Device:
Or Continue to Thread: [GUIDE] How to Root Sprint 2.1…
4th June 2010, 03:33 AM |#1  
regaw_leinad's Avatar
OP Recognized Contributor / Recognized Developer
Flag Seattle, WA
Thanks Meter: 3,684
Use my new RegawMOD Hero Rooter HERE

If you do not see the Superuser Permissions app in the app tray after running the exploit, on your phone, go to

Settings > About Phone > Software information

If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.

It's been a long search for root, but it has finally been achieved!

The Hero 2.1 exploit is based on the EVO rooting method.
The EVO rooting could not have been possible without the combined efforts of:
Matt Mastracci
Joshua Wise

They are all AMAZING and should be thanked for all they have done.
Thank you to Amon_RA for the recovery.img (1.5.2) and Jus10o for packing up a boot.img for me last night when I needed it quick.

Over the past week, Matt and I worked hard applying this exploit to gain permanent root on the Hero.
I now have permanent root access on 2.1 down to a few simple steps that are detailed in this guide.

Also, I'd like to thank everyone that worked really hard on trying to find root here in the Hero community, and specifically all of those who contacted me and worked together with me trying to gain root:

nebenezer (for being cool)

These guys worked incredibly hard with me and had extremely innovative ideas. They deserve a ton of credit for sticking with it as well trying to find . They were all in this for all the Hero users.
If I forgot your name, please let me know via pm so I can add you to the list.

As of right now, this guide is for windows only. Soon to come, OSX & Linux.


Make sure your phone is unplugged from your computer until I tell you to plug it in!
If you already have the Android SDK and HTC Sync set up on your computer, skip to Step 4 now

Step 1: Download the Android SDK here

Step 2: Extract the Android SDK zip. Move the contents of the extracted zip to C:\
Your Android tools folder path should now be C:\android-sdk-windows\tools

Step 3: Download HTC Sync 2.0.33 here
Run the installer, and reboot your computer when it is finished. Move on to step 4 once rebooted.

Step 4: Download the This zip contains everything you need to root your Hero.
(md5: c6e5058ed14f71c68fb099e10be142fb)

Step 5: Extract the 3 files inside to the C:\android-sdk-windows\tools folder on your computer.

Step 6: Make sure USB Debugging is ON (checked) on your Hero. Go to Settings > Applications > Development > and make sure it is checked.

Step 7: Plug your phone into the computer via USB, Make sure that the connection type in the Notification Pull-Down Bar is "Charge Only", not "Disk Drive" or else this won't work.
If your computer asks you to restart after the new drivers were installed, do that now.

Step 8: Open a Command Prompt window by clicking the Start button and typing cmd into the search box and pressing enter.
It is also found under Start Menu > All Programs > Accessories > Command Prompt

Step 9: You will now enter the commands that I have put in code boxes followed by pressing ENTER, one code at a time.
You may also copy/paste these commands in to the Command Prompt, pressing ENTER after each, one at a time.
Comments will be outside of the code boxes (do NOT type these into the Command Prompt as they just are to help describe the root process)
cd C:\android-sdk-windows\tools
You should now see C:\android-sdk-windows\tools>

Now type
adb devices
If you've been following this guide you will see your phone's serial number. If you get "device not found" error, you either need to make sure you the drivers were properly installed or make sure you enable USB debugging on your phone. Continue on once you get the proper phone serial output.

You will now push the files needed to gain root to your sdcard in your phone with these following commands:
adb push unrevoked /sdcard
 adb push recovery.img /sdcard
adb push /sdcard
Now we run the exploit. Be patient, this may take up to 40 seconds.
adb shell
(You should now see $)
sh /sdcard/unrevoked
You should now see output that says this:

          $ sh /sdcard/unrevoked
          sh /sdcard/unrevoked
          Unpacking, please wait...
          88   88 88b 88 88""Yb 888888 88 dP dP"Yb  88  dP 888888 8888b.
          88   88 88Yb88 88__dP 88__   88dP dP   Yb 88odP  88__    8I  Yb
          Y8   8P 88 Y88 88"Yb  88""   8dP  Yb   dP 88"Yb  88""    8I  dY
          `YbodP' 88  Y8 88  Yb 888888 YP    YbodP  88  Yb 888888 8888Y
          unrEVOked: root for HTC evo and hero (
Now, on your phone, go to your app tray, and you will see that the Superuser Permissions app is in it.
Open the Superuser Permissions app. You will see a blank screen.

If you do not see the Superuser Permissions app in the app tray, go to

Settings > About Phone > Software information

If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first and run this guide again. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.

In the Command Prompt on your computer, type:
A prompt will appear on your Hero asking you to give /system/bin/sh privileges. Click Allow.

Go back to your command prompt, and you should see

$ su
Now type:
flash_image recovery /sdcard/recovery.img
Flashing the recovery may take many seconds to complete. Wait until the # symbol returns to proceed.

You should now see
# flash_image recovery /sdcard/recovery.img
flash_image recovery /sdcard/recovery.img

This means it was a successful flash.

Now type
reboot recovery
Your phone will now boot to the custom recovery image you just flashed.

If that doesn't work, (ie you get errors or it stays at the white/green HTC screen) try using this recovery image, put it on your sdcard, and try code #9 again.

In the Recovery Menu on your phone, choose the option:
Flash zip from sdcard
Then select
and press the Home button to apply.

Once Recovery says "Install from sdcard complete", you need to make a nandroid backup!

In the main menu or the Recovery Screen, you will see an option that says

Choose that option, and then choose the option
Nand backup
This can take up to 5 minutes, so be patient while you see the
Once done, a nandroid backup of your phone will be created and saved to your sdcard in the folder directory:
/sdcard/nandroid/(your serial number)/
When it is complete, hit the back button to return to the Main menu, and hit "Reboot system now" from the menu to reboot normally!

To disable OTA updates that will patch this exploit, (after rooting and booted after creating a nandroid backup) run the following commands from Command Prompt.
cd  C:\android-sdk-windows\tools
adb remount
adb  shell
mv /system/etc/security/  /system/etc/security/
After doing this, the OTA updates WILL still download, BUT they will not pass signature checks to flash because of the code you just entered.

You now have full root access on 2.1!

Last edited by regaw_leinad; 11th April 2011 at 08:52 PM.
The Following 4 Users Say Thank You to regaw_leinad For This Useful Post: [ View ]