[GUIDE] How to Root Sprint 2.1 Release for CDMA Hero

Search This thread

regaw_leinad

Inactive Recognized Developer
Jan 30, 2010
3,667
3,787
Seattle, WA
www.regawmod.com
Use my new RegawMOD Hero Rooter HERE


If you do not see the Superuser Permissions app in the app tray after running the exploit, on your phone, go to

Settings > About Phone > Software information

If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.

It's been a long search for root, but it has finally been achieved!

The Hero 2.1 exploit is based on the EVO rooting method.
The EVO rooting could not have been possible without the combined efforts of:
Matt Mastracci
ozzeh
Joshua Wise

They are all AMAZING and should be thanked for all they have done.
Thank you to Amon_RA for the recovery.img (1.5.2) and Jus10o for packing up a boot.img for me last night when I needed it quick.

Over the past week, Matt and I worked hard applying this exploit to gain permanent root on the Hero.
I now have permanent root access on 2.1 down to a few simple steps that are detailed in this guide.

Also, I'd like to thank everyone that worked really hard on trying to find root here in the Hero community, and specifically all of those who contacted me and worked together with me trying to gain root:

abcdfv
imleon
thatguythatdid
navalynt
nfinitefx45
lifetrip718
rejectedkid
nebenezer (for being cool)

These guys worked incredibly hard with me and had extremely innovative ideas. They deserve a ton of credit for sticking with it as well trying to find . They were all in this for all the Hero users.
If I forgot your name, please let me know via pm so I can add you to the list.

As of right now, this guide is for windows only. Soon to come, OSX & Linux.

HOW TO ROOT SPRINT'S 2.27.651.5 RELEASE FOR THE CDMA HERO (Stock Android 2.1)

Make sure your phone is unplugged from your computer until I tell you to plug it in!
If you already have the Android SDK and HTC Sync set up on your computer, skip to Step 4 now

Step 1: Download the Android SDK here

Step 2: Extract the Android SDK zip. Move the contents of the extracted zip to C:\
Your Android tools folder path should now be C:\android-sdk-windows\tools

Step 3: Download HTC Sync 2.0.33 here
Run the installer, and reboot your computer when it is finished. Move on to step 4 once rebooted.

Step 4: Download the hero-root.zip. This zip contains everything you need to root your Hero.
(md5: c6e5058ed14f71c68fb099e10be142fb)

Step 5: Extract the 3 files inside hero-root.zip to the C:\android-sdk-windows\tools folder on your computer.



Step 6: Make sure USB Debugging is ON (checked) on your Hero. Go to Settings > Applications > Development > and make sure it is checked.



Step 7: Plug your phone into the computer via USB, Make sure that the connection type in the Notification Pull-Down Bar is "Charge Only", not "Disk Drive" or else this won't work.
If your computer asks you to restart after the new drivers were installed, do that now.



Step 8: Open a Command Prompt window by clicking the Start button and typing cmd into the search box and pressing enter.
It is also found under Start Menu > All Programs > Accessories > Command Prompt



Step 9: You will now enter the commands that I have put in code boxes followed by pressing ENTER, one code at a time.
You may also copy/paste these commands in to the Command Prompt, pressing ENTER after each, one at a time.
Comments will be outside of the code boxes (do NOT type these into the Command Prompt as they just are to help describe the root process)
1:
Code:
cd C:\android-sdk-windows\tools
You should now see C:\android-sdk-windows\tools>



Now type
2:
Code:
adb devices
If you've been following this guide you will see your phone's serial number. If you get "device not found" error, you either need to make sure you the drivers were properly installed or make sure you enable USB debugging on your phone. Continue on once you get the proper phone serial output.

You will now push the files needed to gain root to your sdcard in your phone with these following commands:
3:
Code:
adb push unrevoked /sdcard
4:
Code:
 adb push recovery.img /sdcard
5:
Code:
adb push boot-patched.zip /sdcard
Now we run the exploit. Be patient, this may take up to 40 seconds.
6.
Code:
adb shell
(You should now see $)
7.
Code:
sh /sdcard/unrevoked
You should now see output that says this:

Code:
          $ sh /sdcard/unrevoked
          sh /sdcard/unrevoked
          Unpacking, please wait...
       
          88   88 88b 88 88""Yb 888888 88 dP dP"Yb  88  dP 888888 8888b.
          88   88 88Yb88 88__dP 88__   88dP dP   Yb 88odP  88__    8I  Yb
          Y8   8P 88 Y88 88"Yb  88""   8dP  Yb   dP 88"Yb  88""    8I  dY
          `YbodP' 88  Y8 88  Yb 888888 YP    YbodP  88  Yb 888888 8888Y
       
          ==================================================================
       
          unrEVOked: root for HTC evo and hero (http://unrevoked.com)
       
          #
-----------------
Now, on your phone, go to your app tray, and you will see that the Superuser Permissions app is in it.
Open the Superuser Permissions app. You will see a blank screen.



If you do not see the Superuser Permissions app in the app tray, go to

Settings > About Phone > Software information

If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first and run this guide again. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.
-----------------

In the Command Prompt on your computer, type:
8.
Code:
su
A prompt will appear on your Hero asking you to give /system/bin/sh privileges. Click Allow.



Go back to your command prompt, and you should see

Code:
$ su
  su
  #
Now type:
9.
Code:
flash_image recovery /sdcard/recovery.img
Flashing the recovery may take many seconds to complete. Wait until the # symbol returns to proceed.

You should now see
# flash_image recovery /sdcard/recovery.img
flash_image recovery /sdcard/recovery.img
#

This means it was a successful flash.

Now type
10.
Code:
reboot recovery
Your phone will now boot to the custom recovery image you just flashed.

If that doesn't work, (ie you get errors or it stays at the white/green HTC screen) try using this recovery image, put it on your sdcard, and try code #9 again.


In the Recovery Menu on your phone, choose the option:
Code:
Flash zip from sdcard
Then select
Code:
boot-patched.zip
and press the Home button to apply.

Once Recovery says "Install from sdcard complete", you need to make a nandroid backup!

In the main menu or the Recovery Screen, you will see an option that says

Code:
Backup/Restore
Choose that option, and then choose the option
Code:
Nand backup
This can take up to 5 minutes, so be patient while you see the
Code:
............
Once done, a nandroid backup of your phone will be created and saved to your sdcard in the folder directory:
Code:
/sdcard/nandroid/(your serial number)/
When it is complete, hit the back button to return to the Main menu, and hit "Reboot system now" from the menu to reboot normally!

DISABLE OTA UPDATES!!!!
To disable OTA updates that will patch this exploit, (after rooting and booted after creating a nandroid backup) run the following commands from Command Prompt.
Code:
cd  C:\android-sdk-windows\tools
Code:
adb remount
Code:
adb  shell
Code:
mv /system/etc/security/otacerts.zip  /system/etc/security/otacerts.zip.bak
After doing this, the OTA updates WILL still download, BUT they will not pass signature checks to flash because of the code you just entered.


You now have full root access on 2.1!




tether.png
 
Last edited:

regaw_leinad

Inactive Recognized Developer
Jan 30, 2010
3,667
3,787
Seattle, WA
www.regawmod.com
The RUU that was updated on HTC and Sprint's Websites was in fact the patch to this exploit. I am posting a few VERIFIED copies of the 2.27.651.5 RUU's that are from the original release date, and have not been patched. Use these to revert back to .5 before rooting.

My Personal One I used for testing

nfinitefx45

More mirrors to come after verification from me.
 
Last edited:

CarbonKang

Senior Member
Apr 6, 2010
630
1
Good job bro! I was wondering if it was even possible for a second there. Nice to see your back rooted too. ;)
 

bikcmp

Senior Member
Dec 8, 2009
321
4
I'm impressed. Great job man :), I was smart enough not to upgrade though (lol jk!). I should of tried to root 2.1, but I was way too busy; I guess I'll try when 2.2 comes around. ;)
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    Use my new RegawMOD Hero Rooter HERE


    If you do not see the Superuser Permissions app in the app tray after running the exploit, on your phone, go to

    Settings > About Phone > Software information

    If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.

    It's been a long search for root, but it has finally been achieved!

    The Hero 2.1 exploit is based on the EVO rooting method.
    The EVO rooting could not have been possible without the combined efforts of:
    Matt Mastracci
    ozzeh
    Joshua Wise

    They are all AMAZING and should be thanked for all they have done.
    Thank you to Amon_RA for the recovery.img (1.5.2) and Jus10o for packing up a boot.img for me last night when I needed it quick.

    Over the past week, Matt and I worked hard applying this exploit to gain permanent root on the Hero.
    I now have permanent root access on 2.1 down to a few simple steps that are detailed in this guide.

    Also, I'd like to thank everyone that worked really hard on trying to find root here in the Hero community, and specifically all of those who contacted me and worked together with me trying to gain root:

    abcdfv
    imleon
    thatguythatdid
    navalynt
    nfinitefx45
    lifetrip718
    rejectedkid
    nebenezer (for being cool)

    These guys worked incredibly hard with me and had extremely innovative ideas. They deserve a ton of credit for sticking with it as well trying to find . They were all in this for all the Hero users.
    If I forgot your name, please let me know via pm so I can add you to the list.

    As of right now, this guide is for windows only. Soon to come, OSX & Linux.

    HOW TO ROOT SPRINT'S 2.27.651.5 RELEASE FOR THE CDMA HERO (Stock Android 2.1)

    Make sure your phone is unplugged from your computer until I tell you to plug it in!
    If you already have the Android SDK and HTC Sync set up on your computer, skip to Step 4 now

    Step 1: Download the Android SDK here

    Step 2: Extract the Android SDK zip. Move the contents of the extracted zip to C:\
    Your Android tools folder path should now be C:\android-sdk-windows\tools

    Step 3: Download HTC Sync 2.0.33 here
    Run the installer, and reboot your computer when it is finished. Move on to step 4 once rebooted.

    Step 4: Download the hero-root.zip. This zip contains everything you need to root your Hero.
    (md5: c6e5058ed14f71c68fb099e10be142fb)

    Step 5: Extract the 3 files inside hero-root.zip to the C:\android-sdk-windows\tools folder on your computer.



    Step 6: Make sure USB Debugging is ON (checked) on your Hero. Go to Settings > Applications > Development > and make sure it is checked.



    Step 7: Plug your phone into the computer via USB, Make sure that the connection type in the Notification Pull-Down Bar is "Charge Only", not "Disk Drive" or else this won't work.
    If your computer asks you to restart after the new drivers were installed, do that now.



    Step 8: Open a Command Prompt window by clicking the Start button and typing cmd into the search box and pressing enter.
    It is also found under Start Menu > All Programs > Accessories > Command Prompt



    Step 9: You will now enter the commands that I have put in code boxes followed by pressing ENTER, one code at a time.
    You may also copy/paste these commands in to the Command Prompt, pressing ENTER after each, one at a time.
    Comments will be outside of the code boxes (do NOT type these into the Command Prompt as they just are to help describe the root process)
    1:
    Code:
    cd C:\android-sdk-windows\tools
    You should now see C:\android-sdk-windows\tools>



    Now type
    2:
    Code:
    adb devices
    If you've been following this guide you will see your phone's serial number. If you get "device not found" error, you either need to make sure you the drivers were properly installed or make sure you enable USB debugging on your phone. Continue on once you get the proper phone serial output.

    You will now push the files needed to gain root to your sdcard in your phone with these following commands:
    3:
    Code:
    adb push unrevoked /sdcard
    4:
    Code:
     adb push recovery.img /sdcard
    5:
    Code:
    adb push boot-patched.zip /sdcard
    Now we run the exploit. Be patient, this may take up to 40 seconds.
    6.
    Code:
    adb shell
    (You should now see $)
    7.
    Code:
    sh /sdcard/unrevoked
    You should now see output that says this:

    Code:
              $ sh /sdcard/unrevoked
              sh /sdcard/unrevoked
              Unpacking, please wait...
           
              88   88 88b 88 88""Yb 888888 88 dP dP"Yb  88  dP 888888 8888b.
              88   88 88Yb88 88__dP 88__   88dP dP   Yb 88odP  88__    8I  Yb
              Y8   8P 88 Y88 88"Yb  88""   8dP  Yb   dP 88"Yb  88""    8I  dY
              `YbodP' 88  Y8 88  Yb 888888 YP    YbodP  88  Yb 888888 8888Y
           
              ==================================================================
           
              unrEVOked: root for HTC evo and hero (http://unrevoked.com)
           
              #
    -----------------
    Now, on your phone, go to your app tray, and you will see that the Superuser Permissions app is in it.
    Open the Superuser Permissions app. You will see a blank screen.



    If you do not see the Superuser Permissions app in the app tray, go to

    Settings > About Phone > Software information

    If it says 2.27.651.6 under "Build Number" (notice the bolded, underlined, italic 6), you need to run the RUU in the second post of this thread to revert to .5 first and run this guide again. Doing this WILL erase all of your data on your phone, so be sure to back up anything if you need to first.
    -----------------

    In the Command Prompt on your computer, type:
    8.
    Code:
    su
    A prompt will appear on your Hero asking you to give /system/bin/sh privileges. Click Allow.



    Go back to your command prompt, and you should see

    Code:
    $ su
      su
      #
    Now type:
    9.
    Code:
    flash_image recovery /sdcard/recovery.img
    Flashing the recovery may take many seconds to complete. Wait until the # symbol returns to proceed.

    You should now see
    # flash_image recovery /sdcard/recovery.img
    flash_image recovery /sdcard/recovery.img
    #

    This means it was a successful flash.

    Now type
    10.
    Code:
    reboot recovery
    Your phone will now boot to the custom recovery image you just flashed.

    If that doesn't work, (ie you get errors or it stays at the white/green HTC screen) try using this recovery image, put it on your sdcard, and try code #9 again.


    In the Recovery Menu on your phone, choose the option:
    Code:
    Flash zip from sdcard
    Then select
    Code:
    boot-patched.zip
    and press the Home button to apply.

    Once Recovery says "Install from sdcard complete", you need to make a nandroid backup!

    In the main menu or the Recovery Screen, you will see an option that says

    Code:
    Backup/Restore
    Choose that option, and then choose the option
    Code:
    Nand backup
    This can take up to 5 minutes, so be patient while you see the
    Code:
    ............
    Once done, a nandroid backup of your phone will be created and saved to your sdcard in the folder directory:
    Code:
    /sdcard/nandroid/(your serial number)/
    When it is complete, hit the back button to return to the Main menu, and hit "Reboot system now" from the menu to reboot normally!

    DISABLE OTA UPDATES!!!!
    To disable OTA updates that will patch this exploit, (after rooting and booted after creating a nandroid backup) run the following commands from Command Prompt.
    Code:
    cd  C:\android-sdk-windows\tools
    Code:
    adb remount
    Code:
    adb  shell
    Code:
    mv /system/etc/security/otacerts.zip  /system/etc/security/otacerts.zip.bak
    After doing this, the OTA updates WILL still download, BUT they will not pass signature checks to flash because of the code you just entered.


    You now have full root access on 2.1!




    tether.png
    2
    The RUU that was updated on HTC and Sprint's Websites was in fact the patch to this exploit. I am posting a few VERIFIED copies of the 2.27.651.5 RUU's that are from the original release date, and have not been patched. Use these to revert back to .5 before rooting.

    My Personal One I used for testing

    nfinitefx45

    More mirrors to come after verification from me.
    1
    Are you typing in:
    cd C:\android-sdk-windows\tools
    before you try: adb devices ?
    1
    Make sure your SDK is saved directly to C:\ if you want to follow the steps verbatim. Also if the new SDK has adb.exe in the platform-tools folder, you will want to change the first command to:
    cd C:\android-sdk-windows\platform-tools
    Then, adb devices
    1
    Trying to re-root my CDMA Sprint HTC Hero after rooting it using "superoneclick" rooting program. If that's an issue that's problem number one.

    If that's not an issue, here's problem number two. I've got all the necessary files downloaded and extracted to the right locations. USB debugging enabled on phone. Phone connected with settings on charge only. Opened cmd prompt entered the first line to get to tools directory. Then entered the second line and got this message:

    'adb' is not recognized as an internal or external command, operable program or batch file.

    Any direction is helpful...Here is my current phone software information:

    Firmware: v.2.1-update1
    Build: 2.32.651.2

    Review post 1370 (pg 137) and see if that is your adb issue
    Secondly - if you are still running 2.32.651.2, I don't think you will root with success using this thread unless you run the RUU in post #2 on pg1 to get back to .5.