Overview

In order to install kind of new operating system I needed to have root access on the device. This meant I had to root it. Since Android 1.6 (Release R10) on the G1 doesn’t have any useful exploits I had to downgrade the OS to Release R7 first. Once it is downgraded it you can use the rooting exploit in R7 to get root access and install a recovery image that will allow the installation of an updated radio software and the new operating system.

Preliminaries

Firstly read all of this blog post and all of the pages linked to from this blog post. There is at least one point in this process where you can “brick your phone”. I.e. you can put it in a state where by a regular user cannot make it usable.

Secondly you will be wiping your phone and replacing the software on it. Back anything up you want to keep. This includes purchased applications, data, contacts, whatever.

Make sure the phone is fully charged. You don’t want it running out of power mid-flash!

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Downgrading and rooting

Downgrading, rooting the phone, and installing a recovery image is described in the link below. However since there are specific requirements for upgrading to Android 2.X I’ll explain each stage here.

http://forum.xda-developers.com/showthread.php?t=442480

Downgrading

Before you do anything take note of the radio version string in the boot-loader. Its the fourth line down. You get the boot-loader screen up by holding down the camera button when powering on the phone. With the original loader you should have multi-coloured bars with yellow text in the top left hand corner. On my phone the radio version string read “RADIO-2.22.19.26I”. Write down the string and store it somewhere safe. You’ll need it later.

Now download the appropriate older image for your phone. The links to the image downloads are on the page above however here’s the link for RC7 for those with UK phones. Download the image, unzip it, and save the DREAMIMG.nbh file in the root of your SD card. While you’re at it also download recovery-RA-dream-v1.5.2.img which is a recovery image and will be used later. Save this in the root of your SD card also.

Turn off your phone, insert the SD card, and turn it back on again holding down the camera key as before. It should now re-flash your phone. There should be a progress bar. When its all complete you can restart your phone normally (without the camera key held down). This will result in some old school Android graphics and you wondering how anyone ever coped with that software. Once the phone has booted find the phone details in settings and check the software build version number. It should appear as something like TC5-RC7 112931.

Rooting the phone

Now you have exploitable image installed it is time to root the phone. This can be done using a back door. Go to the home screen then type…

<return>
<return>
telnetd
<return>

…on the slide out keyboard. This will look like a search in contacts for the name of telnetd. In fact telnetd is the telnet daemon which allows you to connect to shell on the phone via telnet. So now you need a telnet client. Use the Android Market to download a telnet client. Once installed you should be able to telnet to localhost and get a telnet prompt.

If all is well you have shell access as root (a ‘#’ prompt). Yay!

Installing a recovery image

Now we are going to install the recovery image we downloaded earlier. This will also give us permanent root access. In the shell type…

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery-RA-dream-v1.5.2.img
cat recovery-RA-dream-v1.5.2.img > /system/recovery.img

For those who are interested the lines do the following:

1. Remounts the flash memory in read/write mode. This allows you to save to the flash in the phone.
2. Navigate to the sdcard (which is mounted at /sdcard)
3. Flashes the recovery-RA-dream-v1.5.2.img image file in to the special recovery partition in the flash.
4. Copies the recovery-RA-dream-v1.5.2.img as /system/recovery.img (The Android busybox doesn’t have the copy command but cat with a pipe works just as well!).

Once you’ve done this and have a prompt again you can reboot the phone. This time if you hold down the home and power buttons when you power on the phone it will boot in to the recovery image. You can use the short cuts or the track ball to select a menu item.

Now we are ready to install the new software.

New radio software and DangerSPL

Now we have to repartition the flash to give enough room for the new platform. This is the scary bit. As I said before…

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Read this page thoroughly http://wiki.cyanogenmod.com/index.php?title=Dream:DangerSPL. If you’ve gotten this far you fulfil the prerequisites to install Danger/SPL. You now need to download the appropriate radio image, place it in the root of your SD card and flash it. Remember that number we noted down from the boot-loader screen at the start (“RADIO-2.22.19.26I” or similar). You will need it now.

Boot in to recovery by holding down the home and power buttons. Select “Flash zip from sdcard”. Select update.zip (if that’s the name of the file) from the file menu. The image should be flashed and will then reboot the phone. Reboot the phone again.

Take out the SD card and boot back in to the boot loader. It should now appear as below.

Upgrading to FROYO and installing Google Apps

All the hard work is now done. You have a rooted phone with a nice recovery menu which allows you to flash anything that will fit.

To install the latest Android read this link: http://wiki.cyanogenmod.com/index.php?title=Dream:Installing_CyanogenMod_5%2B.

Clear out your SD card and download Froyo for the G1/Dream and the Google Tiny Apps (The G1 is a bit short on flash space so wont fit the all singing all dancing versions of the Google apps). Boot in to recovery as before (home and power buttons) and again select “Flash zip from sdcard”. Flash first Froyo and then the apps.

Finally reboot your phone. You should now have Android 2.2 installed!

Issues

The only issue I had was an exception from the keyboard software the first time I used Froyo. This can be solved using the “Wipe” menu in the recovery image. I wiped data, cache and delvik cache (The latter generated an error I ignored) and then re-installed Froyo.

There are other shells which have a completely different syntax and other scripting languages such as Perl and PHP so when writing a shell script you can indicate the correct interpreter using the ‘hash bang bin bash’ comment to indicate you are using bash. I.e.

#!/bin/bash

Some lazy programmers don’t indicate the exact shell they require and use

#!/bin/sh

to mean bash when it means sh.

Ubuntu, in their wisdom, have decided to go for dash as their shell. It is an evolution of the Almquist shell and is smaller and lighter weight than bash however they install bash anyway. dash and bash have the common subset of sh commands but are different. So if you find you have a problem building or similar on Ubuntu it may be that the wrong shell is being used. Ubuntu has a symlink as follows:

lrwxrwxrwx 1 root root       4 Mar 29  2009 sh -> dash

You may need to change this to point to dash as follows:

$ cd /bin
$ sudo rm sh
$ sudo ln -s bash sh

While we’re handling Ubuntu oddities building against NCurses, the terminal output library, can also be problematical. A little while ago NCurses was split in to two libraries, libncurses.so and libtinfo.so. Some badly written software will try and link explicitly with libtinfo.so directly rather than trying libncurses.so first. Ubuntu does not split these two libraries but provides just the one libncurses.so library so if you have an issue with a missing libtinfo.so you will need to add symlinks in to your library directory as follows:

$ cd /usr/lib
$ ln -s libncurses.so.5 libtinfo.so.5
$ ln -s libtinfo.so.5 libtinfo.so

PHP Warning:  PHP Startup: Unable to load dynamic library 'modules/gd.so' -
modules/gd.so: cannot open shared object file: No such file or
directory in Unknown on line 0

Warning: PHP Startup: Unable to load dynamic library 'modules/gd.so' -
modules/gd.so: cannot open shared object file: No such file or
directory in Unknown on line 0

The default PHP package on Ubuntu 9.10 is fairly minimalist. Most extensions are provided as separate packages which include an INI file and a dynamic library. The dynamic library is stored in:

/usr/lib/php5/20060613+lfs

And the INI file for each extension is in:

/etc/php5/conf.d.

The make tests rule in the generated Makefile in the extension you are compiling modifies the path that PHP searches for extensions by to point to the modules directory within the extension source. So PHP, which is used to run the tests, cannot find the extensions.

I’ve found the easiest way (if slightly hacky) to fix the make test failure is just to copy the .so files from the PHP5 extension directory in to the modules directory within the extension source.