[Android Q&A, Help & Troubleshooting] :
Hey there I was bored at work so decided to run through and translate that guide for y'all. Let us know how it goes!

Okay I’m not going to translate everything verbatim and I’ll assume you know what you’re doing in terms of setting up adb and where to find the appropriate tools :)

-----------------

Preparations

1. adb

Make sure adb is installed and working either via Windows or Ubuntu. Make sure the adb driver for the phone is installed and can be seen by adb as well (open up cmd and type “adb devices”, if you get a string of numbers listed you’re good to go.

2. Install SHbreak4

http://marijuana.ddo.jp/index.php?moddir=downloads&action=single&cid=3&lid=73

You can’t start the rooting process without this so download and install this. After installing your phone might freak out a bit (crashing apps and the like, restart if this happens and all will be well).

3. Create or get the custom ROM for the SH-12C (fyi don’t freak when he says ROM here he basically means replacing whatever files are necessary to achieve a permanent root, although if you would like to flash a more complete ROM for the phone it does exist…). Regardless, download the following package and unzip it, we’ll be using different tools from this package to achieve a full root:

http://sun.dyndns.info/sh12c/sh12c_boot_rescue0910.zip

In this guide it will be assumed that you have unzipped the files to C:\Android\ sh12c_boot_rescue0910

4. Copying the necessary files to your phone

We’ll now copy some tools from the sh12c_boot_rescue0910.zip package you unzipped.

From now we’ll be using adb commands so make sure the USB Debug option is enabled in your phone settings under development tools.

Type the following commands into terminal:

cd C:\Android\sh12c_boot_rescue0910

adb push boot_rescue0910.img /data/local

cd 初回導入用 ***(just cd into this directory, copy and paste the Japanese into the command prompt or rename the folder to something memorable in English)***

adb shell mkdir /data/local/bin/

adb push flash_image /data/local/bin/

adb shell chmod 755 /data/local/bin/flash_image

adb push Superuser2.3.6.3 \ su /data/local/bin/

To place the su file into the /sbin directory run the following command:

adb push autoexec.sh /data/local/bin/

It is necessary to perform this step (copying the autoexec.sh file) to continue. Later, if you would like to place the su file into the /system/bin directory (which the author of this guide recommends) then after attaining root it would be best not to copy this file.

If you were able to get to this step then you’re doing good!

Running the Commands

1. Restart the device

This step is highly recommended because you are likely to get out of memory errors if you continue without restarting and the SHbreak4 program twill cause all sorts of strange side-effects (crashes and the like).

After restarting your phone do not continue with this guide until the phone seems entirely stable and completely started up (wait a few minutes or so after the lock screen appears for the first time).

2. Open up the SHbreak4 app you installed on the phone earlier

Although it looks like there’s nothing inside the app stuff is happening in the background. After opening the app hit the ‘exit’ button to “close” out of the app. Wait 30 seconds or so without touching or opening ANYTHING else, you’ll get many errors and the app will probably fail if you do.

3. Open up SHbreak4 a second time

We’re opening up SHbreak4 a second time in order to unlock the nand.

After opening the app for a second time it should present you with different options, make sure both boxes are checked (they should already be) and without changing anything hit the break button (only hit it once even though it looks like it doesn’t recognize your click). A pop-up window will appear with a bunch of different info and a nice little success notification at the end. This means we’ve successfully removed the nandlock.

Some services might crash anyways at this point. If you can just force close one or two of the apps and continue then you’re probably okay, but if you can’t continue and you keep on getting crashes it’s probably best to restart your device and try again.

At this point we have achieved a temp root, but it is very important not to just use the phone like you normally do at this point, it’s very dangerous and unstable and can screw up your permissions and junk.

4. backing up the boot/recovery images

I don’t think it’s necessary to explain this step but now to play it safe we’ll be making some backups.

In command prompt enter into an adb shell (type “adb shell”).

Type the following:

au

***typing “au” should change the $ sign to # which means we have root abilities now***

mkdir -p /mnt/sdcard/mtdbackup/

cat /dev/mtd/mtd0ro > /mnt/sdcard/mtdbackup/boot.img

cat /dev/mtd/mtd3ro > /mnt/sdcard/mtdbackup/recovery.img

***To make sure that there images are correct we’ll use another backup method for the boot and recovery partitions***

dd if=/dev/mtd/mtd0ro of=/mnt/sdcard/mtdbackup/boot_dd.bin

dd if=/dev/mtd/mtd3ro of=/mnt/sdcard/mtdbackup/recovery_dd.bin

***and now we’ll backup some other yaffs partitions***

cat /dev/mtd/mtd2 > /mnt/sdcard/mtdbackup/mtd2.img

cat /dev/mtd/mtd4 > /mnt/sdcard/mtdbackup/mtd4.img

cat /dev/mtd/mtd7 > /mnt/sdcard/mtdbackup/mtd7.img

exit

exit

This part was copied from 452-san’s readme, sorry about that!

At this point we now have backups copied onto the sdcard of your phone.

Now we’ll make sure that the boot.img and recovery.img files were indeed copied correctly.

Type the following into command prompt:

mkdir C:\Android\backup

cd C:\Android\backup

adb pull /mnt/sdcard/mtdbackup/boot.img

adb pull /mnt/sdcard/mtdbackup/recovery.img

adb pull /mnt/sdcard/mtdbackup/boot_dd.bin

adb pull /mnt/sdcard/mtdbackup/recovery_dd.bin

fc /b boot.img boot_dd.bin

fc /b recovery.img recovery_dd.bin

These last two ‘fc’ commands look for any differences between the .img and .bin files that we made earlier. If it says that there are differences between the files then something went wrong. Try making the backups again and re-verifying with the ‘fc’ commands.

After verifying that the backups were done successfully don’t forget to copy the other backed up partitions to your computer for safe keeping as well (on your own time!)

5. Flashing the ROM

You’re free to flash the ROM to either the boot or recovery partition but I highly recommend first trying to flash the ROM to the recovery partition as if something goes wrong you can just do a battery pull and boot your phone normally again. If the flash to the recovery partition is successful though you can then flash to the boot partition so that the ROM is booted every time you start/restart your phone as opposed to just this one time. Remember that flashing a boot image to the recovery partition won’t run that boot image every time (refer to here for more on that! http://worldtsunami.blog136.fc2.com/blog-entry-38.html).

So for the time being I’ll write how to flash to the recovery partition first, and then the boot partition afterwards.

Again, go into an adb shell in command prompt (“adb shell”)

Type the following

su

cd /data/local/bin/

./flash_image recovery /data/local/boot_rescue0910.img

After you enter this last command you might get an out of memory error, if you don’t you flashed the image to the recovery partition successfully. If you did get an error(s), try typing in the last command (./flash_imag... ) again until you get no out of memory errors.

Type ‘exit’ twice to quit the adb shell.

6. Booting into the recovery partition

Because we have flashed the boot image to the recovery partition we will instruct the phone to boot from the recovery partition once as opposed to the default boot partition’s image.

Type the following:

adb reboot recovery

7. Entering rescue mode

After you type the above command your phone will restart and the docomo carrier logo should appear (or whatever logo your phone’s carrier is).

If the recovery partition was indeed flashed to correctly then after a little the menu, home, and aback buttons on your phone should start flashing lightly. At this point press the home button. If you do, then the flashing should speed up, this lets us know that we have entered rescue mode.

***NOTE: My phone is actually not on the Docomo network but rather on the AU network which means the phone is very slightly different because of the network (my phone is actually an IS12SH as opposed to an SH-12C, although they are very similar). However, because of this difference I am actually not able to get my phone to enter rescue mode and my phone will not boot from the recovery partition. If you also can’t get your phone into rescue mode then unfortunately you’re in the same boat as I and cannot continue. Do a battery pull on the phone and you should be able to boot back into it normally. If you are able to enter rescue mode though then congrats, let’s continue (although at this point I am definitely just writing what the author of this guide wrote without first hand knowledge)***

8. Backing up partitions that we haven’t backed up yet

We backed up some partitions earlier but we have not backed up any yaffs2 partitions, so now we will do that.

If you’re inside of rescue mode then you should still be able to connect to your phone through adb, so open up an adb shell in command prompt again (‘adb shell’).

Type the following:

su

mount_sd

mkdir -p /mnt/sdcard/mtdbackup

dump_image_oob persist /mnt/sdcard/mtdbackup/mtd1_persist_oob010106.img

dump_image_oob system /mnt/sdcard/mtdbackup/mtd5_system_oob010106.img

dump_image_oob cache /mnt/sdcard/mtdbackup/mtd6_cache_oob010106.img

dump_image_oob battlog /mnt/sdcard/mtdbackup/mtd8_battlog_oob010106.img

dump_image_oob calllog /mnt/sdcard/mtdbackup/mtd9_calllog_oob010106.img

dump_image_oob ldb /mnt/sdcard/mtdbackup/mtd10_ldb_oob010106.img

dump_image_oob userdata /mnt/sdcard/mtdbackup/mtd11_data_oob010106.img

These commands will make oob backups on your SD card but, if you’re worried, you can continue to make tar.gz backups as well. This is kind of a pain in the ass to do so I will omit that process here. If you would like to do this though please refer to the readme file inside of the sh12c_rescue_0910 directory we unzipped at the beginning.

Now let’s temporarily unmounts the sdcard card. Type:

umount /mnt/sdcard

9. Installing su (for people who want to place su inside of /system/bin/)

Okay so what we’re going to do is mount the /system partition, remount with rm, and then place su in the /system/bin directory.

Before we copied the su file to the /data/local/bin directory so we’ll also need to mount the /data partition and copy from there and change some permissions.

Once we’re done with this process we’ll have no need for rescue mode and so we’ll get out of that mode.

Type the following:

su

mount_system

mount -o remount,rw /mnt/system/

mount_data

cp /mnt/data/local/bin/su /mnt/system/bin/su

chown 0.0 /mnt/system/bin/su

chmod 6755 /mnt/system/bin/su

cd /

umount /mnt/system/

umount /mnt/data/

rm /rescue

Once you’ve typed to this point the phone should leave rescue mode and boot into Android.

10. Copying backup files to PC

Those who’ve gotten to this point will have a directory on their phone’s sdcard called “mtdbackup”. It’s a very good idea to keep another copy of these somewhere off of your phone so, using whatever method you prefer, copy this directory and everything in it to the place of your choice, that part’s your responsibility, I won’t write about it here :)

11. Installing and running the Superuser app

I forgot to mention installing Superuser! Using command prompt, you can install Superuser the following way:

cd C:\Android\sh12c_boot_rescue0910\Superuser2.3.6.3

adb install Superuser.apk

Now your phone should have Superuser installed.

You can also install Superuser without using adb if you would like. Just push the apk to your phone with the following commands and then navigate to your phone’s sdcard with your favorite file explorer (efs explorer, etc) and click to install!

cd C:\Android\sh12c_boot_rescue0910\Superuser2.3.6.3

adb push Superuser.apk /mnt/sdcard/

I think you have to open up the app once so it’ll start working as it should so you know, try opening it once....

12. Finishing up

So we’ve flashed to the recovery partition, booted from there, and should’ve made it so that all the root permissions and required apps have been set correctly. So, at this point you could be finished. However, as has been said before, flashing to just the recovery partition has no point, (refer to that earlier link for more info). So now we’ll flash that same image to the /boot partition and re-flash our original, backed up recovery image.

12. flashing the custom ROM to the boot partition and restoring the recovery partition

Enter back into rescue mode:

adb reboot recovery

***Hit the home button when you first see flashing lights around the home, back, and menu buttons and make sure you can connect via adb***

If you’re able to enter rescue mode and bring up an adb shell (‘adb shell’) then do the following commands:

su

mount_sd

mount_data

flash_image recovery /mnt/sdcard/mtdbackup/recovery.img

flash_image boot /mnt/data/local/boot_rescue0910.img

If the flash_image commands don’t give you any errors then you flashed successfully. If you did get an error(s) then keep trying the flash_image commands until it flashes without error. If the recovery.img flash keeps giving you errors we can fix that later but definitely make sure that the boot partition is flashed to without error or else you will have successfully bricked your phone.

Now let’s boot normally (through the typical boot partition)

Type the following:

***exit the adb shell***

exit

exit

***boot via the boot partition with the following command***

adb reboot

Once your phone boots up as always you will have successfully gotten a full root as well as a working rescue mode. If you had problems with the image we flashed to the boot partition then your phone won’t boot into rescue mode again on its own. In this situation make sure you hit the home button again after the phone logo appears and the buttons start flashing. Try flashing to the boot partition again....

If you’ve gotten to this point and you don’t download any updates from the manufacturer or your carrier then you shouldn’t have to worry about your phone becoming a paperweight.

If you’d like to make sure that your recovery partition has indeed been restored successfully then try rebooting your phone into the recovery partition again with the following command:

adb reboot recovery

If you get a picture of a surprised droid and nothing else happens after that then you have restored the recovery correctly.

Your phone will only boot from the recovery partition if you try to factory reset your phone.

Fin….