One of my friends came to me and asked if I would help her root her Motorola I1. Always up to help friends liberate their devices, I told her I would, then set out on my google quest to find all the resources this process would require. As is usually the case with unpopular, niche, or older devices like the Motorola I1, there was a lot of non-working scripts and a hefty handful of misguidance. This article is intended to replace other articles on the subject. Hopefully, you found this article first and didn’t have to waste too much of your time messing around with the others. This article is accurate as of the date it was written. I can’t make any guarantees that the reptilian overlords at Motorola haven’t added some kind of horrible phone-bricking code to prevent this method.
Caution: You must know how to use the command line to do this. I provide no guarantees and cannot be held liable for any damage that may occur to your phone by following this guide. This is for informational purposes only.
Step 1. Install the android sdk
I won’t go into this in detail. There are maintained & updated instructions at http://developer.android.com/sdk/installing.html#Installing
Step 2. Enable USB debugging on your phone
An excerpt from: http://developer.android.com/guide/developing/device.html
Turn on “USB Debugging” on your device.
On the device, go to Settings > Applications > Development and enable USB debugging.
Once this is complete, plug your phone into your computer via your USB cable.
Step 3. Get the files
The files are available in .zip and .tgz archives here. You don’t need both. The tgz is there for convenience for those who prefer it. Once you have the archive, unzip it somewhere that’s easy to get to from a command line.
Step 4. Edit the install file
I was hoping to automate this step so you didnt have to do it manually, but unfortunately stock android (at least 1.5) does not have the gnu-utils necessary to do this – so you’ll have to do it by hand… Thankfully, it’s not a terribly difficult process.
In your local terminal (on your computer, not on the device), run the following command:
adb shell mount
You will see a bunch of output that looks something like this:
rootfs / rootfs ro 0 0 tmpfs /dev tmpfs rw,mode=755 0 0 devpts /dev/pts devpts rw,mode=600 0 0 proc /proc proc rw 0 0 sysfs /sys sysfs rw 0 0 tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0 /dev/block/mtdblock10 /phx/cp yaffs2 rw 0 0 /dev/block/mtdblock18 /phx/cpb yaffs2 rw 0 0 /dev/block/mtdblock17 /phx/bp squashfs ro 0 0 /dev/block/mtdblock15 /phx/csd squashfs ro 0 0 /dev/block/mtdblock14 /phx/ue squashfs ro 0 0 /dev/block/mtdblock11 /phx/logger yaffs2 rw 0 0 /dev/block/mtdblock7 /system yaffs2 ro 0 0 /dev/block/mtdblock9 /data yaffs2 rw,nosuid,nodev 0 0 /dev/block/mtdblock8 /cache yaffs2 rw,nosuid,nodev 0 0 /dev/block/mtdblock12 /data/preload yaffs2 ro 0 0
I have highlighted the line you are looking for in this example. You want to find the line that shows the device that is mounted to /system. In this example, /dev/block/mtdblock7 is mounted to /system. Yours may be different, hence why we check to see what it is first. Once you have this value, open install.sh in your favorite editor (on Windows, I like Notepad++), there are instructions as to where to paste this value. Then save the file and close it.
Step 5. Push the files to the phone
In your local terminal, cd to the directory where you unzipped the files, then run the following commands.
adb push Superuser.apk /sdcard/Superuser.apk adb push busybox /sdcard/busybox adb push su /sdcard/su adb push rage /data/local/tmp/rage adb push install.sh /data/local/tmp/install.sh adb shell chmod 775 /data/local/tmp adb shell chmod 755 /data/local/tmp/*
Step 6. Install ConnectBot
Pretty straightforward. Install ConnectBot from the android market. This method may work with other terminal apps, but I have not tested them. I had no luck getting this method to work over ADB.
Step 7. Execute rage
Open ConnectBot and connect to your phone, then issue the following command:
Step 8. WAIT
This has its own step because it’s really important. You have to wait. Be patient. I know, it’s hard, you’re excited, but don’t get all button happy. you’ll mess up the process. The process is complete when you see
[*] Forked %d childs.
(Where %d is replaced by the number of threads forked.)
Once you see this message, disconnect from ConnectBot.
Step 9. Check for root and install root utilities
Open ConnectBot and reconnect to your phone. Where before you saw the $ character indicating you were in userland, you should now see a # indicating that you are root. If you see the # character, congrats! You’re almost done and you may proceed. If you still see the $ character, something messed up and you need to backtrace your steps and figure out where you went wrong. If you are now root, issue the following command:
If all went well, this script should have executed with no output and no errors. If everything looks good, go ahead and sync/reboot your phone.
Step 10. Test your install
At this point, if all went well, your Motorola I1 should be rooted, rebooted and have all the utilities necessary to escalate to root on the command line or run applications that require root permissions. To be sure that it worked correctly let’s test it.
To test on your phone with ConnectBot, start ConnectBot, connect to your phone and issue the command:
To test from your computer, you can simply run:
adb shell su
If you’re a security-minded individual or a researcher and are interested in the details of how the root escalation works, there is a great article about it here.