Upgrading your UK T-Mobile Google G1 (HTC Dream) to Android 2.x

I’m currently developing a new project. Its a bluetooth enabled bracelet. I wanted to write an iPhone app to control it. However, much as I like my iPhone 4, Apple’s policy about locking the thing down sucks. So I then looked at writing an Android application for my G1. The problem with that is that bluetooth support only arrived in Android 2.0 and T-Mobile/HTC ceased upgrades at 1.6 on the G1. Since my G1 is two years old and out of contract I decided to be brave and upgrade it to Android 2.2. Note the G1 is called the HTC Dream in many markets.


In order to install kind of new operating system I needed to have root access on the device. This meant I had to root it. Since Android 1.6 (Release R10) on the G1 doesn’t have any useful exploits I had to downgrade the OS to Release R7 first. Once it is downgraded it you can use the rooting exploit in R7 to get root access and install a recovery image that will allow the installation of an updated radio software and the new operating system.


Firstly read all of this blog post and all of the pages linked to from this blog post. There is at least one point in this process where you can “brick your phone”. I.e. you can put it in a state where by a regular user cannot make it usable.

Secondly you will be wiping your phone and replacing the software on it. Back anything up you want to keep. This includes purchased applications, data, contacts, whatever.

Make sure the phone is fully charged. You don’t want it running out of power mid-flash!

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Downgrading and rooting

Downgrading, rooting the phone, and installing a recovery image is described in the link below. However since there are specific requirements for upgrading to Android 2.X I’ll explain each stage here.



Before you do anything take note of the radio version string in the boot-loader. Its the fourth line down. You get the boot-loader screen up by holding down the camera button when powering on the phone. With the original loader you should have multi-coloured bars with yellow text in the top left hand corner. On my phone the radio version string read “RADIO-”. Write down the string and store it somewhere safe. You’ll need it later.

Now download the appropriate older image for your phone. The links to the image downloads are on the page above however here’s the link for RC7 for those with UK phones. Download the image, unzip it, and save the DREAMIMG.nbh file in the root of your SD card. While you’re at it also download recovery-RA-dream-v1.5.2.img which is a recovery image and will be used later. Save this in the root of your SD card also.

Turn off your phone, insert the SD card, and turn it back on again holding down the camera key as before. It should now re-flash your phone. There should be a progress bar. When its all complete you can restart your phone normally (without the camera key held down). This will result in some old school Android graphics and you wondering how anyone ever coped with that software. Once the phone has booted find the phone details in settings and check the software build version number. It should appear as something like TC5-RC7 112931.

Initial bootloader Installing an image from SD card Software information screen

Rooting the phone

Now you have exploitable image installed it is time to root the phone. This can be done using a back door. Go to the home screen then type…


…on the slide out keyboard. This will look like a search in contacts for the name of telnetd. In fact telnetd is the telnet daemon which allows you to connect to shell on the phone via telnet. So now you need a telnet client. Use the Android Market to download a telnet client. Once installed you should be able to telnet to localhost and get a telnet prompt.

If all is well you have shell access as root (a ‘#’ prompt). Yay!

Installing a recovery image

Now we are going to install the recovery image we downloaded earlier. This will also give us permanent root access. In the shell type…

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery-RA-dream-v1.5.2.img
cat recovery-RA-dream-v1.5.2.img > /system/recovery.img

For those who are interested the lines do the following:

  1. Remounts the flash memory in read/write mode. This allows you to save to the flash in the phone.
  2. Navigate to the sdcard (which is mounted at /sdcard)
  3. Flashes the recovery-RA-dream-v1.5.2.img image file in to the special recovery partition in the flash.
  4. Copies the recovery-RA-dream-v1.5.2.img as /system/recovery.img (The Android busybox doesn’t have the copy command but cat with a pipe works just as well!).

Once you’ve done this and have a prompt again you can reboot the phone. This time if you hold down the home and power buttons when you power on the phone it will boot in to the recovery image. You can use the short cuts or the track ball to select a menu item.

Now we are ready to install the new software.

Custom recovery image menu

New radio software and DangerSPL

Now we have to repartition the flash to give enough room for the new platform. This is the scary bit. As I said before…

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Read this page thoroughly http://wiki.cyanogenmod.com/index.php?title=Dream:DangerSPL. If you’ve gotten this far you fulfil the prerequisites to install Danger/SPL. You now need to download the appropriate radio image, place it in the root of your SD card and flash it. Remember that number we noted down from the boot-loader screen at the start (“RADIO-” or similar). You will need it now.

Boot in to recovery by holding down the home and power buttons. Select “Flash zip from sdcard”. Select update.zip (if that’s the name of the file) from the file menu. The image should be flashed and will then reboot the phone. Reboot the phone again.

Take out the SD card and boot back in to the boot loader. It should now appear as below.

Updated Google G1 bootloader

Upgrading to FROYO and installing Google Apps

All the hard work is now done. You have a rooted phone with a nice recovery menu which allows you to flash anything that will fit.

To install the latest Android read this link: http://wiki.cyanogenmod.com/index.php?title=Dream:Installing_CyanogenMod_5%2B.

Clear out your SD card and download Froyo for the G1/Dream and the Google Tiny Apps (The G1 is a bit short on flash space so wont fit the all singing all dancing versions of the Google apps). Boot in to recovery as before (home and power buttons) and again select “Flash zip from sdcard”. Flash first Froyo and then the apps.

Finally reboot your phone. You should now have Android 2.2 installed!

Cyanogen's Froyo (Android 2.2) booting Cyanogen's Froyo (Android 2.2) home screen.


The only issue I had was an exception from the keyboard software the first time I used Froyo. This can be solved using the “Wipe” menu in the recovery image. I wiped data, cache and delvik cache (The latter generated an error I ignored) and then re-installed Froyo.

Tags: , ,

Leave a Reply