Saturday, April 24, 2010

How to Root/Hack the Motorola Milestone

So I've noticed that quite a few people are buying the Motorola Milestone for whatever reason. Apparently the Droid in the US has sold quite a bit ( 1.02 million in the first 72 days of release ) and the Milestone is just the "rest-of-the-world" versions ( ie GSM ).

So I figured I'd write a little guide on how to gain root access to the Motorola Milestone so you can replace apps, gain more memory, remove bloatware, etc etc.

This currently works for all versions from 2.0 to 2.0.1 to 2.1-update1.

To see what version you have, go to Settings --> About Phone --> Firmware Version.

Without further ado, here goes.

Here's the stuff you'll need to have downloaded.

Required :

Motorola USB Drivers version 4.5.0  - available here or here ( 64bit )
RSD Lite 4.6 - available here
Vulnerable Recovery for the 90.78 bootloader - available here
Update.zip required for rooting - available here

Optional :

Android SDK tools ( not required for rooting per se, but VERY useful for taking advantage of rooted devices )

Steps to root :

1. Install the Motorola USB drivers for your respective OS ( ie 32bit or 64bit )

2. Plug in the phone, and put into Portal & Tools mode ( drag the notification bar down and click on Manage USB Connection ). The OS will install the drivers for the phone automatically, provided you have followed Step #1.

3. Install RSD Lite, and start it up. Click on Show Device. The phone will only show up if it's put into Portal and Tools mode.

4. Since you should have downloaded the vulnerable recovery already, extract the zip and in RSD Lite, in the textbox, enter the full path of the extracted .SBF file. Alternatively, you can browse for the file by clicking the ... button and selecting the SBF.

5. Click on Start. This does not affect your contacts or emails or messages or logs or anything. It merely flashes a new recovery image that can be rooted and is perfectly safe. The program will flash the software REALLY quickly after it reboots the phone into recovery mode.

6. Allow the phone to reboot fully. Now put it into Mass Storage Mode.

7. Copy the update.zip as it is ( no extraction at all ) to the root folder of the memory card of the phone. In Android terms, the root folder is the highest folder in a given storage device. So basically, as soon as you enter the Removable Disk ( in Windows Exploda ) you'll be in the root folder of the sdcard.

8. Switch off the phone.

9. Hold down the Camera button and then hold the Power button to switch on the phone. Keep the Camera button held until a big exclamation mark comes up on the screen of the phone after the M logo.

10. Reached the exclamation mark? Good job. Now hold the Volume UP button and press the Camera button. At this point, if you've done it right, a small menu should come up on the screen with four options. If the Power+Camera combination doesn't work, slide out the keyboard, and hold down Power+X on boot. This is a special method for people who are running the 90.78 bootloaders.

11. Slide open the keyboard and navigate to the second option using the D-Pad. The second option is apply sdcard : update.zip . Select this option with the selection key on the D-Pad ( the center of the D-Pad if you must. Some people press Enter like idiots )

12. The phone will do some stuff, including echoing a message which reads Rooting your phone. Then it'll say update from sdcard complete. At this point, you navigate to the first option, which is Reboot the phone.

13. Let the phone reboot. Once its rebooted, open up the Applications Drawer ( the little arrow at the bottom that houses all the apps ) and look for an app called Superuser Whitelist.

14. If this app is installed, your phone is rooted. Now what you can do is go to the Android Market, and look for SetCPU which is an application that controls the phone's power profiles and install it. This is to test the root access to the phone as *surprise surprise* this particular app requires root access.

15. If this app installs and works without a hitch, your phone is perfectly rooted.

16. Congratulate yourself on rooting Android 2.0/2.0.1/2.1

This concludes my small guide to rooting the Motorola Milestone. I shall soon be adding steps on how to enjoy lifetime free navigation on Motonav and how to acquire the detailed Indian maps for it to function in India flawlessly so you can enjoy what the Indian Milestone users enjoy.

Until next time.

Pz.

Edit - I have updated the links as of Sept 6th 2010 and changed some stuff in the process.

58 comments:

  1. Lemme just start off by saying I have MotoTorch LED on the stock/unrooted 2.1 and it works like a charm (loving the app, btw)

    Now to the "important" stuff - when I apply the SBK with the vulnerable RAMDLD, RSD lite says everything went ok, the message on the phone's screen says everything ok, but then when I want to apply update.zip from recovery mode I get EOCD marker occurs after start of EOCD, signature verification failed.
    Also after applying the SBK none of the SW versions change - not the bootloader shown in RSD lite, none of the strings in phone's about section.

    So... what I'm asking is... what can I do from here? Doesn't appear that I did anything wrong :/ Any amount of help would be appreciated.


    My bootloader ver is 90.74
    Everything else is South Asia 2.1 retail firmware

    ReplyDelete
  2. Well, the versions aren't supposed to change. Youre flashing what, a 4MB SBF which is essentially just the recovery.img. The first time I attempted this, it didn't work either. I just redownloaded the vulnerable recovery and the update.zip ( more commonly known as the original milestone_root.zip ) and then after a few more tries it worked. Not sure what stopped it before. However, for the other friends who've used my help rooting, its worked on the first try.

    ReplyDelete
  3. You say 4MB like it's a small thing, but the official bootloader from moto is just a 700kB file, so it could very well have been in there :)

    Anyway... I tried and retried maybe 10 times by now, hoping you'd be right, but still the same. Nobody in other dedicated forum seems to know what the problem may be either. So... I'm kinda ready to give up :(

    ReplyDelete
  4. Yea... I even tried applying a different bootloader (one of the official ones leaked from moto) and then doing the procedure.
    RSD lite still says everything ok, new BL version shows up, but update.zip continues to give the EOCD error.

    That's it, I give up.
    Thanks for the walkthrough though :)

    ReplyDelete
  5. Well, if youre up for trying, try this update.zip

    http://rapidshare.de/files/49019165/milestone_root.zip

    ReplyDelete
  6. Thanks, I will as soon as I get home (@work now)
    But what doesn't compute for me is why a file from one source would work and another wouldn't, if they are exactly the same... This is computer science (with emphasys on science) it's not reading the future in a coffee cup :/

    ReplyDelete
  7. So I got home and tried to get the file, but it's offering me to upload a file, the link doesn't lead to a download. I guess the file has been removed.

    ReplyDelete
  8. I'm guessing the rapidshare.de site is redirecting to rapidshare.com for no apparent reason.

    Try this.

    http://www.sera-apps.de/milestone_root.zip

    If this doesn't work, I give up.

    ReplyDelete
  9. Now I discovered that RSD lite is writing log files whenever you flash something. And despite it saying that all is fine at the end, there are some errors during flashing the SBK


    10:15:17, April 26, 2010
    Line: 517
    ERROR: AP Die ID: 186001196c760304000000000400

    10:15:17, April 26, 2010
    Line: 524
    ERROR: BP Die ID: 0000000000000000000000000000

    10:15:17, April 26, 2010
    Line: 531
    ERROR: AP Public ID: 92a2208469528baa95d1ba47e6145d0aaf761bf9

    10:15:17, April 26, 2010
    Line: 538
    ERROR: BP Public ID: 0000000000000000000000000000000000000000


    PS: I'm really sorry for spamming your blog, but maybe this will be useful for others too somehow :)

    ReplyDelete
  10. Then it hasn't flashed properly -.-

    Just redownload the SBF and reflash it. That should do it.

    ReplyDelete
  11. Ideally, you should follow whats in this post

    http://www.modmymoto.com/forums/showpost.php?p=3923295&postcount=50

    Good luck rooting ;)

    I just installed JIT, FLAC support, and busybox on my Milestone and I'll probably be writing guides for that soon as well.

    ReplyDelete
  12. So finally i got to the bottom of it, I messaged the guy who created this vulnerable SBF file.
    The sollution was to not let the phone boot up in Android before RSD lite signals "PASS"
    So after it goes to bootloader and flashes the sbf, you should hold down the "up" key (or right if you look at the phone vertically) on the d-pad to make it go into bootloader again instead of normal Android. RSD will still signal "PASS" then close RSD, turn off phone and boot into recovery to apply update.zip. Working now, my 'stone is rooted.

    And those errors in RSD lite log are no problem apparently, according to this guy.

    Maybe you can add this info to the post in case someone else encounters the same problem as I did.

    ReplyDelete
  13. Hey Dan I am having the same Probs you were with the 90.74 BL. so what your saying is start the Rsd and after it finishes go into Bl again and then the phone will be able to update

    ReplyDelete
  14. Yeah. All you have to do is hold the up key on the dpad while he phone is booting to get back into the bootloader mode.

    ReplyDelete
  15. Thanks everyone who commented here. Ran into the same issue. Not letting the Milestone boot into Android solved it!

    Cheers,
    weipah

    ReplyDelete
  16. Hi Aumkar....Thrilled to see that an Indian is maintaining a tech blog and helping out android phone users...I bought the milestone 3 weeks back and i am still confused whether i should root it or not...Considerring the fact that milestone phones cannot be overclocked and neither does it provide support for Apps2SD...Keeping in mind these 2 main reasons for rooting it is there anything else u might want me to consider and change my mind...How is your rooted milestone functioning though...?Any help will be appreciated greatly and u can email me on rohankhettry@hotmail.com...Thanks!!

    ReplyDelete
  17. My rooted Milestone functions beautifully actually. I dont really think Apps2SD is ALL that necessary to be honest. Theres a workaround moving the dalvik-cache ( just think of it as a regular cache ) to another system partition such that it doesn't eat into the apps space. When its moved, a LOT more space is freed up.

    Another reason to root, possibly the installation of JIT ( Just In Time compiler ) for a 20% speed boost. A good enough reason for me to root was for FLAC support so that I coupld complement my IEMs with the great sound quality of the Milestone.

    Other than that, rooting provides a method of removing unnecessary system apps, and replacing them with better ones. For example, on my HK Milestone, I replaced the original Motonav with a trial free version, removed the stock launcher and replaced it with the Helix launcher, and plenty of other stuff that I like to keep as a standard on the phone.

    Hope this helps

    Pz.

    ReplyDelete
  18. That was a quick and detailed reply...:D....Ok...Lets just say i am going to root my phone...The build , the bootloader etc. on my Indian bought Milestone.Do i need to consider all this and continue to root or the particular tutorial written by you above is sufficient and will help me get successfully rooted..Sorry for asking these nooby questions...But this is the first time i am messing around with my phone and would not want to do anything to screw this beauty up...Thanks a ton for the help!!!

    ReplyDelete
  19. See, this root method only flashes your phone to have a "rootable" recovery.img ... which is located in the SBF. Even if the flash goes bad, the phone will still be in perfect working condition. And yes, this tutorial should be enough.

    But if you do have the 90.74 bootloader, you just have the added step of not letting your phone boot into Android so the flash can go successfully.

    The first time I bought my phone, I had a friend root it, but it was on 2.0 at the time, not even 2.0.1 and 2.0 was absolute crap. Plenty of bugs and all that.. A week later, I plucked up the courage to upgrade my phone to 2.1 and root it as well. The fact that it was so easy and was successfully done, pushed me more to Android, and now everyday, I'm busy trying something or the other out with my phone.

    Soon, I'll be writing a guide on how to use a tool called ADB recovery, in case the phone screws up at any point of time.

    ReplyDelete
  20. Well...That explains a lot of things then...I guess your the only successful Indian to verify that indian milestones are being rooted successfully and safely...Could not find another soul in india maintaining a blog about it...Well..There are definitely more pros than cons on rooting it from what i can gather...I guess i will just wait for your tutorial with the adb shell guide ...just curious , which rom are u using and would recommend me...I have added you on gmail...I shall stay in touch when i root my phone and once again thanks a million Bro!
    Peace!

    ReplyDelete
  21. No problem.

    Well I'm about to crash. So ttyl.

    ReplyDelete
  22. great work here aumkar. got a question here.

    what will happen if i flash an official sbf using rsd lite on a rooted milestone? can it be done? if yes, will it be still rooted? or not?

    and btw, wow that was fast! cheers mate.

    ReplyDelete
  23. Yes, you can flash an official SBF on a rooted Milestone. Thats no problem. However, you will lose the root. Hence you use this guide to fix that and re-root the phone :D.

    ReplyDelete
  24. Aumkar..
    Did you find any noticeable difference after installing JIT?
    Think it only makes difference if you are on a firmware less than 2.1?

    ReplyDelete
  25. The system was notably snappier and everything was a little faster, but I'm guessing Froyo ( 2.2 ) has a better version of JIT installed and it may make more of a difference.

    However, overclocking the Milestone yields HUGE gains in the form of usability and it feels so much more better.

    ReplyDelete
  26. I did NOT install the vulnerable sbf file and I could root the device.

    ReplyDelete
  27. Yeah. There are multiple ways of rooting the device. Unfortunately, restoring from nandroid backups may not be reliable.

    ReplyDelete
  28. Erm, fucking learn to turn off caps lock. This isn't your personal thread where you can fucking use caps whenever the hell you want.

    And also, the Milestone can be overclocked. Get your facts straight.

    ReplyDelete
  29. Hi Aumkar,

    Congrats on this blog, looks very useful. I'm wondering if it's possible to install a stock ROM from a country other than where the phone was purchased? Mine is a Spanish Milestone but I'm living in Australia, the main reason I want to do this is to be able to have the voice recognition function which is on the UK ROM but wasn't included in the Spanish ROM. Seems possible right?

    ReplyDelete
  30. Yes. I have a HK Milestone, and I have the EU ROM installed on it.

    You can also acquire the voice dialer and voice search apks directly anyway and just install them. There really no need to install another ROM jsut for that functionality.

    ReplyDelete
  31. Hey Aumkar and Dan...Thanks for a super guide...I just rooted the phone but my Super User list is empty and I am unable to download MotoTorch LED...It says "starting download" just like it used to say before rooting..please help!!

    Thanks.

    ReplyDelete
  32. Ah just start up Google talk if its not started yet already, else go to settings, applications, services and end the gtalk service and start it up again. Hope this helps.

    ReplyDelete
  33. Thanks Aumkar for ur quick reply!! I tried but could not connect gtalk, it keeps trying for some time and says "couldnt connect to server"...I have few questions after i rooted my milestone, please help!

    1. I cant see any SuperUser Id created...on youtube i saw a guy having an Id after root. does that mean my rooting was not successfull?

    2. do i need a valid sim card for downloading apps? right now i dont hv a valid sim and trying to download apps using wifi..it always says "starting download but apps never get downloaded.

    Kindly help!!

    ReplyDelete
  34. hello, How do I unroot back to original firmware to 2.1?

    ReplyDelete
  35. Just download the original SBF files from Moto ( 100+mb ) and reflash the phone. It'll take out the root.

    ReplyDelete
  36. Firmware version
    2.1-update1
    Firmware configuration version
    GAS_EMEA_USASHLS00RT1NT_P016
    Baseband version
    3GSMEPU91A_U_91.07.561
    Baseband configuration version
    UCASHLSMR2EMEAB1B806D.0R
    Kernelversion
    2.6.29-omap1
    milestcm@il93lnxebld05 #1
    Build number
    SHOLS_U2_02.36.0

    E:Can't open /cache/recovery/command

    -- Install from sdcard...
    Finding update package...
    Opening update package...
    Verifying update package package...
    E:failed to open /sdcard/update.zip (No such file or directory)
    E:signature verified failed
    Installation aborted.

    ReplyDelete
  37. Erm. You didnt put the update.zip on the SDCard.

    3rd line from the bottom. Clearly says No such file or directory

    =/

    ReplyDelete
  38. I am sorry for the trouble but can you give me the link to download the SBF file pertaining to indian devices, and recently i got an update of about 31 MB size, i am from bangalore, do u know what is the update about?

    ReplyDelete
  39. stuck at step 9... xclamation mark doesnt cums.. nw watt 2 do... rest f d thng went ryt

    ReplyDelete
  40. nope, i already follow all step from many tutorial and the result still the same. im also already put my update.zip on my sd card

    ReplyDelete
  41. Please tell step by step how to update to froyo from 2.1( which I did frm ur tutorial).

    ReplyDelete
  42. Use this.

    http://modmymobile.com/forums/401-motorola-milestone/554590-image-motofrenzy-froyo-2-2-milestone.html

    ReplyDelete
  43. I can't access the bootloader after #11

    E:Can't open /cache/recovery/command

    -- Install from sdcard...
    Finding update package...
    Opening update package...
    Verifying update package...
    E:EOCD marker occurs after start of EOCD
    E:signature verification failed
    Installation aborted.

    ReplyDelete
  44. Just to say that on my device the /!\ mode is reached by holding X while powering on instead of the camera button... might save some time for some people to know that.

    ReplyDelete
  45. Hi Sir,

    Will the Cracked moto Nav still work after i update to Froyo?

    Using this guide?
    http://modmymobile.com/forums/401-motorola-milestone/554590-image-motofrenzy-froyo-2-2-milestone.html

    Thanks fot the great work so far

    ReplyDelete
  46. It should. I just reuploaded the files to multiupload for different filesharers.

    And I'm running the v0.5c build of froyo so yeah, should work.

    ReplyDelete
  47. After trying a lot of times and failing, i successfully rooted. The problem for (No such file or directory) is because you named your file in your SD card as update.zip . I changed it to update . Thats it and it works. And for the [ E:EOCD marker occurs after start of EOCD
    E:signature verification failed ] problem , press the up button on the keyboard immediately when the bootloader shows up. That works for me and i hope it helps the others. Btw thanks for the guide :)

    ReplyDelete
  48. Sharfick
    press the up button on the keyboard immediately when the bootloader shows up
    it doesn't bring anything

    ReplyDelete
  49. Hi Aumkar, first of all, Thanks for sharing.

    I followed your steps and completed. I have got the Superuser Whitelist. However, I am unable to uninstall the stock apps like motonav, alarm etc. I tried downloading some paid apps(including SetCPU) but I can't find them in the market.

    Does this mean I did not root successfully? Can you kindly advise what can I do next?

    Jeryl.

    ReplyDelete
  50. No, you've rooted successfully.

    In order to see paid apps in the market, you have to use the Market Enabler.

    Google it, you'll stumble upon a code.google.com page, and thats where you get the file.

    Install it on your phone, run it, give it SU privileges, and fake the desired provider ( I usually use T-Mobile USA ) and then you restart the market app, and you should have access to paid apps as well.

    Regards.

    ReplyDelete
  51. Aumkar, really can't thank you enough for responding so soon. I was having prob via ota update for days. You solved my prob...Thanks again!

    Jeryl.

    ReplyDelete
  52. My pleasure :)

    Now I'm running a 2.2 ROM. Its got its bugs, like no camera focus and all that, but its running beautifully fast.

    ReplyDelete
  53. Hi Aumkar,

    Can u plz help me in getting 2.2 on my phone? Do u have any other thread for 2.2 update?

    My milestone is rooted and running on 2.1-update1.

    Thank you!

    ReplyDelete
  54. Hey,

    I'm sorry, I can't write a guide to installing 2.2 on the Milestone because its for advanced users who know how to get around the OS. I won't be able to dumb down the installation process or troubleshoot either.

    I would, however, suggest going to modmymobile.com, and checking out the process there. The thread youre looking for is "MotoFrenzy"

    ReplyDelete
  55. Hi Aumkar,

    I Really love your blog, pretty damn good info on it ;)

    I need your help here, I'm about to root my milestone, and I need you to tell me if your guide will work for me. The following is my milestone info:

    Firmware version
    2.1-update1
    Firmware configuration version
    GAS_EMEA_USASHLS00RT1NT2_P015
    Baseband version
    3GSMEPU91A_U_91.07.561
    Baseband configuration version
    UCASHLSMR2EMEAB1B806D.0R
    Kernelversion
    2.6.29-omap1
    milestcm@il93lnxebld03 #1
    Build number
    SHOLS_U2_02.36.1

    *Notice the firmware version and the build number*

    Thank you!

    ReplyDelete
  56. Just made a typo

    GAS_EMEA_USASHLS00RT1NT2_P015

    should be

    GAS_EMEA_USASHLS00RTINT2_P015

    (RETAIL INTERNATIONAL 2)

    ReplyDelete
  57. You should be able to root using the vulnerable recovery anyway. Its the same for all versions.

    ReplyDelete