[GUIDE] Permanent root on Desire Z 'the clean way', using rage

Search This thread

Mr_Q

Senior Member
Dec 6, 2008
259
75
This thread is copied and modified from the G2 thread by trigeek for the Desire Z:
http://forum.xda-developers.com/showthread.php?t=834228


Apart from the changed hboot and wpthis-Z kernel module for the Desire Z instead of the G2, I have also updated the su-binary and SuperUser.apk to the latest version by ChainsDD


In no way I can be held responsible for any bricks to your phone. You are using this guide at your own risk!! I did test this guide on my own, and also on a friend's Desire Z.

As there was no manual rooting guide for the Desire Z, I posted it myself in order to help others that do not like visionary and like to do it 'the clean way'.


[GUIDE] Temp to permanent root on Desire Z, using rage instead of visionary
=================================================
There's already a guide here for obtaining permanent root using VISIONary, but some folks in #G2ROOT are having issues with the way that VISIONary modifies parititons. Using rage directly is a bit cleaner, since you know exactly what it's going to touch at each step of the way. I did NOT come up with any of this on my own, I'm building completely off of work that others have done. Speaking of which-

None of this would be possible without the tireless work that scotty2 put in. He stayed with the project for well over a month, through lots of smashed hopes and dead ends, until the solution was finally found. Were it not for his work, as well as the help of a few other key folks- we wouldn't be here. He deserves our thanks and some donations! We're talking hundreds of hours of work here, a couple bucks is not too much for that. His paypal is:

[email protected]
Send him some love! I'm not asking for anything myself, because I spent a half hour putting this together, and that doesn't deserve any donations!


DESIRE Z ROOT INSTRUCTIONS
=================================================
These are modified instructions based on the ones posted at http://bit.ly/g2root that use Visionary. A number of people have run into issues with the way that Visionary juggles around temporary partitions, and using the original root exploit is a much easier, and cleaner method for achieving permanent root. This tutorial will walk you through the rooting process by first achieving temporary root, and moving on to permanent root.

REQUIREMENTS
=================================================
•Visionary disabled at boot or uninstalled completely
•Android Terminal Emulator app
•ADB
•desirez-combined-root.zip (Attached to this post)

In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands.


VERY IMPORTANT!
Visionary has caused filesystem corruption for some users during the rooting process. Before attempting the instructions below, make sure that you have "auto run on boot" turned OFF, and reboot your system. Since you will not need visionary anyway after this, you might as well just uninstall visionary and reboot NOW before doing anything.

TEMP ROOT
=================================================
ON YOUR PC:
Unzip the z-temp-root files to a folder. From a cmd window or terminal, navigate to that folder and execute these commands:

Code:
$ adb push su /sdcard/su
$ adb push Superuser.apk /sdcard/Superuser.apk
$ adb push rage /data/local/tmp/rage
$ adb push busybox /data/local/tmp/busybox
$ adb push root /data/local/tmp/root
$ adb shell chmod 0755 /data/local/tmp/*

ON YOUR PHONE:

1.Launch Terminal Emulator
2.
Code:
/data/local/tmp/rage
3.Wait for the message: "Forked #### childs."
4.Menu > Reset Term - Terminal Emulator will exit.
5.Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell
6.**NOTE**: in the original directions from the XDA thread, you are instructed to run the /data/local/tmp/root script here. DON'T do this just yet. Leave the terminal window open.

PERM ROOT
=================================================
ON YOUR PC:
unzip z-perm-root and navigate to that folder. There will be four files. You will need to push two of these to your phone: hboot_7230_0.84.2000_100908.nb0 and wpthis-Z.ko. The other two files are optional for checksum verification.

Code:
$ adb push hboot_7230_0.84.2000_100908.nb0 /data/local
$ adb push wpthis-Z.ko /data/local

Optional but might came in handy:
Code:
$ adb push md5checksum /sdcard/md5checksum


ON YOUR PHONE:
You should still have terminal emulator up, at a root prompt. Now run:

Optional but recommended:
Code:
# /data/local/tmp/busybox md5sum /data/local/*

You should see:
hboot_7230_0.84.2000_100908.nb0 2ce1bdd5e4c1119ccfcecb938710d742
wpthis-Z.ko c73c5e77c91d306c418983c002b60b93

In case your hboot or wpthis-Z.ko file do not have the same md5hash as shown above, DO NOT CONTINUE. This means your file is corrupt or you are using a different file, for example the one for the G2 instead of Desire Z.

Now, let's turn off security for permanent flashing:

Code:
# insmod /data/local/wpthis-Z.ko
init_module 'wpthis-Z.ko' failed (Function not implemented)

That means it worked. This next step is CRUCIAL. You must make sure that you are writing to the proper partition here or you could brick your phone. To be absolutely clear- the partition is mmcblk(zero)p(one)(eight)

# dd if=/data/local/hboot_7230_0.84.2000_100908.nb0 of=/dev/block/mmcblk0p18
You should see some messages indicating that it was written.

Code:
# /data/local/tmp/root
This will lock in root, and give you 'su' access in the future. Next, run:

Code:
# sync

Now wait at least a minute, just to be safe. After waiting, reboot your phone using the power button. After it finishes starting up, launch the terminal emulator, and type 'su'. You should get the prompt asking you to grant permissions. If you got the prompt, congratulations! You have permanent root!
 

Attachments

  • z-combined-root.zip
    1.4 MB · Views: 7,151
Last edited:

MarDor

Senior Member
Jun 16, 2009
60
1
Hoofddorp
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists

when I just ignore it and type sync after that I have no root acces after a reboot.

Does anybody have a solution for it? I have already done a hardreset with the same results.
thanks in advance...
 

ssyed

Senior Member
May 22, 2007
50
1
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists

when I just ignore it and type sync after that I have no root acces after a reboot.

Does anybody have a solution for it? I have already done a hardreset with the same results.
thanks in advance...



Everything was fine up until this point. So i restarted the phone and phone is stuck on the "quietly brilliant" screen
 

AnyDone

Member
Nov 18, 2010
47
1
So I'm looking into these S-OFF and rooting threads and here is two bricks too. Does anyone have an answer for these two or should I skip this? Did the hboot do this or was it due to some problem in inserted kernel module? (I.E. the reboot of the emmc controller resulted in a ****ed up file system?)
 

ssyed

Senior Member
May 22, 2007
50
1
having the same issue here

So I'm looking into these S-OFF and rooting threads and here is two bricks too. Does anyone have an answer for these two or should I skip this? Did the hboot do this or was it due to some problem in inserted kernel module? (I.E. the reboot of the emmc controller resulted in a ****ed up file system?)

Ok, so I have figured out how to get out of this "quietly brilliant" loop.

First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.
 

AnyDone

Member
Nov 18, 2010
47
1
First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.

Ok, so does any one have an explanation why this happened?

1. It wasn't wrong or screwed hboot, otherwise we would be facing a real brick?

Was it the root method? Was it the wpthis-Z.ko?

It might have been the kernel module, but I can't be sure about that with so little knowledge I have. (sure not the module itself but the kick to the emmc?) Just that it seems to be more likely option than a rooting attempt on a cached r-o file system?


I'm not complaining about the guide, it is specific and easy to follow but I would really love to have these semi bricks etc inspected more closely. It is not really helping to encourage ppl to root and try safe-off when we have unexplained bricks and semi-bricks around :(
 
Last edited:

steviewevie

Retired Forum Moderator
Oct 28, 2009
5,335
617
UK
first of all.. thanks for this great guide. Everything went perfect until I came to the step to lock in root. After the command "/data/local/tmp/root" I get this error:
mkdir failed for /system/xbin, File exists

Everything was fine up until this point. So i restarted the phone and phone is stuck on the "quietly brilliant" screen

having the same issue here

Did you guys run Visionary before trying this "rage" method of rooting ?
 

goldenarmZ

Senior Member
Oct 14, 2008
712
1
Sheffield
www.gzthemes.com
The root script threw an error for me too, so just to be safe I opened the script and typed in the commands manually. If you have problems with the script, just run these commands from the root terminal on your phone:

Code:
/data/local/tmp/busybox killall rage

mount -o rw,remount -t ext3 /dev/block/mmcblk0p25 /system

mkdir /system/xbin
/data/local/tmp/busybox cp /data/local/tmp/busybox /system/xbin/busybox
chmod 4755 /system/xbin/busybox
/system/xbin/busybox --install -s /system/bin

cp /sdcard/Superuser.apk /system/app/Superuser.apk
cp /sdcard/su /system/bin/su
chmod 4755 /system/bin/su

mount -o ro,remount -t ext3 /dev/block/mmcblk0p25 /system

sync

"mkdir /system/xbin" just creates a directory, if it already exists you can ignore this command and proceed.

Hope this helps someone.. Thanks to the OP for the scripts. :)
 

steviewevie

Retired Forum Moderator
Oct 28, 2009
5,335
617
UK
Have a quick look, /system/xbin already seems to exist on my phone too.

So is there an error in the script ? e.g. needs to ignore if the directory already exists ? Or am I (we ?) missing something ?
 

goldenarmZ

Senior Member
Oct 14, 2008
712
1
Sheffield
www.gzthemes.com
Good info, thanks. Perhaps just comment out that line of the script, to save running it all by hand (and therefore be prone to more error ?) ?

I did that first.. it threw more errors with the mount commands because I'd already run the script once, so some of the commands were repated. If it's your first run through, commenting it out would be fine.

I only did it line by line so I could see any more errors for myself and decide if they were important. As it turns out the script is very simple and only involves moving files around and changing their permissions.. anything that goes wrong should be immediately apparent even if you have no experience with shell commands. :cool:
 

steviewevie

Retired Forum Moderator
Oct 28, 2009
5,335
617
UK
I only did it line by line so I could see any more errors for myself and decide if they were important. As it turns out the script is very simple and only involves moving files around and changing their permissions.. anything that goes wrong should be immediately apparent even if you have no experience with shell commands. :cool:

Thanks, I was starting to worry about the bad experiences outlined above, given that this method appeared to be a more reliable one than VISIONary, and a route I was going to go down. But I'm pretty comfortable with shell scripts, so your input makes me feel a whole lot better ! :)
 

MarDor

Senior Member
Jun 16, 2009
60
1
Hoofddorp
The root script threw an error for me too, so just to be safe I opened the script and typed in the commands manually. If you have problems with the script, just run these commands from the root terminal on your phone:

-code-

"mkdir /system/xbin" just creates a directory, if it already exists you can ignore this command and proceed.

Hope this helps someone.. Thanks to the OP for the scripts. :)

thanks for this... I will give it a try :)
 

steviewevie

Retired Forum Moderator
Oct 28, 2009
5,335
617
UK
Yay, I just perma-rooted my phone using this method, many thanks to those who came up with the method in the first place, plus this handy guide too.

I got the message about /system/xbin already existing, but you can just ignore that message, it runs the rest of the script anyway.

:D
 

buzmay

Senior Member
Aug 31, 2010
433
7
Ok, so I have figured out how to get out of this "quietly brilliant" loop.

First of all, this isn't a brick and all that is needed to fix this is a quick factory reset from the bootloader.

So after doing the guide you simply reeboot your phone into bootloader and select factory reset?

And then will the device be perm root and s-off???
 

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    This thread is copied and modified from the G2 thread by trigeek for the Desire Z:
    http://forum.xda-developers.com/showthread.php?t=834228


    Apart from the changed hboot and wpthis-Z kernel module for the Desire Z instead of the G2, I have also updated the su-binary and SuperUser.apk to the latest version by ChainsDD


    In no way I can be held responsible for any bricks to your phone. You are using this guide at your own risk!! I did test this guide on my own, and also on a friend's Desire Z.

    As there was no manual rooting guide for the Desire Z, I posted it myself in order to help others that do not like visionary and like to do it 'the clean way'.


    [GUIDE] Temp to permanent root on Desire Z, using rage instead of visionary
    =================================================
    There's already a guide here for obtaining permanent root using VISIONary, but some folks in #G2ROOT are having issues with the way that VISIONary modifies parititons. Using rage directly is a bit cleaner, since you know exactly what it's going to touch at each step of the way. I did NOT come up with any of this on my own, I'm building completely off of work that others have done. Speaking of which-

    None of this would be possible without the tireless work that scotty2 put in. He stayed with the project for well over a month, through lots of smashed hopes and dead ends, until the solution was finally found. Were it not for his work, as well as the help of a few other key folks- we wouldn't be here. He deserves our thanks and some donations! We're talking hundreds of hours of work here, a couple bucks is not too much for that. His paypal is:

    [email protected]
    Send him some love! I'm not asking for anything myself, because I spent a half hour putting this together, and that doesn't deserve any donations!


    DESIRE Z ROOT INSTRUCTIONS
    =================================================
    These are modified instructions based on the ones posted at http://bit.ly/g2root that use Visionary. A number of people have run into issues with the way that Visionary juggles around temporary partitions, and using the original root exploit is a much easier, and cleaner method for achieving permanent root. This tutorial will walk you through the rooting process by first achieving temporary root, and moving on to permanent root.

    REQUIREMENTS
    =================================================
    •Visionary disabled at boot or uninstalled completely
    •Android Terminal Emulator app
    •ADB
    •desirez-combined-root.zip (Attached to this post)

    In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands.


    VERY IMPORTANT!
    Visionary has caused filesystem corruption for some users during the rooting process. Before attempting the instructions below, make sure that you have "auto run on boot" turned OFF, and reboot your system. Since you will not need visionary anyway after this, you might as well just uninstall visionary and reboot NOW before doing anything.

    TEMP ROOT
    =================================================
    ON YOUR PC:
    Unzip the z-temp-root files to a folder. From a cmd window or terminal, navigate to that folder and execute these commands:

    Code:
    $ adb push su /sdcard/su
    $ adb push Superuser.apk /sdcard/Superuser.apk
    $ adb push rage /data/local/tmp/rage
    $ adb push busybox /data/local/tmp/busybox
    $ adb push root /data/local/tmp/root
    $ adb shell chmod 0755 /data/local/tmp/*

    ON YOUR PHONE:

    1.Launch Terminal Emulator
    2.
    Code:
    /data/local/tmp/rage
    3.Wait for the message: "Forked #### childs."
    4.Menu > Reset Term - Terminal Emulator will exit.
    5.Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell
    6.**NOTE**: in the original directions from the XDA thread, you are instructed to run the /data/local/tmp/root script here. DON'T do this just yet. Leave the terminal window open.

    PERM ROOT
    =================================================
    ON YOUR PC:
    unzip z-perm-root and navigate to that folder. There will be four files. You will need to push two of these to your phone: hboot_7230_0.84.2000_100908.nb0 and wpthis-Z.ko. The other two files are optional for checksum verification.

    Code:
    $ adb push hboot_7230_0.84.2000_100908.nb0 /data/local
    $ adb push wpthis-Z.ko /data/local

    Optional but might came in handy:
    Code:
    $ adb push md5checksum /sdcard/md5checksum


    ON YOUR PHONE:
    You should still have terminal emulator up, at a root prompt. Now run:

    Optional but recommended:
    Code:
    # /data/local/tmp/busybox md5sum /data/local/*

    You should see:
    hboot_7230_0.84.2000_100908.nb0 2ce1bdd5e4c1119ccfcecb938710d742
    wpthis-Z.ko c73c5e77c91d306c418983c002b60b93

    In case your hboot or wpthis-Z.ko file do not have the same md5hash as shown above, DO NOT CONTINUE. This means your file is corrupt or you are using a different file, for example the one for the G2 instead of Desire Z.

    Now, let's turn off security for permanent flashing:

    Code:
    # insmod /data/local/wpthis-Z.ko
    init_module 'wpthis-Z.ko' failed (Function not implemented)

    That means it worked. This next step is CRUCIAL. You must make sure that you are writing to the proper partition here or you could brick your phone. To be absolutely clear- the partition is mmcblk(zero)p(one)(eight)

    # dd if=/data/local/hboot_7230_0.84.2000_100908.nb0 of=/dev/block/mmcblk0p18
    You should see some messages indicating that it was written.

    Code:
    # /data/local/tmp/root
    This will lock in root, and give you 'su' access in the future. Next, run:

    Code:
    # sync

    Now wait at least a minute, just to be safe. After waiting, reboot your phone using the power button. After it finishes starting up, launch the terminal emulator, and type 'su'. You should get the prompt asking you to grant permissions. If you got the prompt, congratulations! You have permanent root!
    1
    ok i hope i'm not screwed. When i typed in "$ /data/local/tmp/rage' suddenly my phone asked for a connection type, and I didn't get to see the 'forked XXX child' msg. but a bunch of text that included 'screwing kids' or something liek that. Can i proceeed? Or I need to type in "$ /data/local/tmp/rage" again? I did not key in the $ sign just the command after it.

    Terminal emulator exited and the phone became laggy. I launched it back and instead of a $ sign it was now a # sign.

    Help?

    I have now put the default connection to 'charge only', previously it was 'disk drive' but i selected 'charge only' for the purpose of rooting when prompted but did not check 'do not ask me again'. I guess it won't prompt me again now.

    Or is it easier for me to reboot the phone and resume the steps right after pushing the files?

    The connections are still intact as I'm posting.
    The phone is still functional though, not laggy anymore.

    Summary:
    Last command in command prompt = adb shell chmod 0755 /data/local/tmp/*
    Last command in Terminal emulator = $ /data/local/tmp/rage
    now it's showing (after reopening the app) = export PATH=/data/local/bin:$PATH# #
    Phone suddenly asked for connection type
    Terminal emulator exited
    Panic!

    That sounds ok, though I wonder if you didn't wait long enough for the "forked" message.

    What rage does is start up a couple of thousand processes on your phone, to exploit a bug that lets it become root. So your phone will go a bit slower while this is happening.

    If you've got the # prompt then that's good news, it means you've got root. At this stage it's only a temp root, but that's what it's supposed to do.

    Can you get the terminal emulator back up and open again with the # prompt ?
    1
    thing is my screen turned off and (screen timeout? lol) and connection prompt thingy before I get to see the 'forked ....' msg.

    Opened terminal emulator and it's showing me now:

    export PATH=/data/local/bin:$PATH#
    # #

    Proceed? Any way I can check if i'm in the right steps?

    ok, well it sounds like "rage" worked fine. So just proceed to the next step. Skip over the "dd" though.
    1
    ok i've proceeded with the perma root steps and the last return was

    mkdir failed for /system/xbin, File exists


    I've proceeded with the 'sync' command.

    Ok to reboot?

    Yes, go ahead. That "File exists" message is normal.
    1
    YES! Reboot was OK! Man it did take a life time to reboot (longer, I suppose?). How do i check if root access is persistent? Typing 'su' in terminal?

    Yes, do an "su" and check you can get the # prompt after a reboot.