[Nexus One Themes and Apps] efrant:
How to root FRG33 and FRG83

Ok, it seems that a lot of folks are not getting that the Wi-Fi exploit (on which the 1-click root program is based) has been patched with FRG33 and higher. In order to root FRG33 and higher, you need to use the local root exploit (i.e., rageagainstthecage).

There are instructions posted all over these forums, but as it seems that many are still not able to follow the instructions, let me try to dumb them down a a bit.

I take NO credit for this method or any files mention -- all credit goes to the devs. I've just tried to simplify the instructions from various sources.

Ok, here goes. This assume that you already have the Android SDK properly installed, which is found here:

http://developer.android.com/sdk/index.html

First, let's list all the required files:

1) rageagainstthecage-arm5.bin

2) busybox

3) su

4) Superuser.apk

Second, let's get all the files:

1) rageagainstthecage-arm5.bin is available here from many place. Try here: http://www.4shared.com/file/SY__sCo_/Droid2Root.html. The file which I used was 5,392 bytes (I had tried a different one, but it didn't work).

2) busybox, su, and Superuser.apk are available here: http://multiupload.com/MVT98F5HBY

3) Place/extract all the files in the /android-sdk-windoes/tools directory. All the files should be in the tools directory, not in any subfolders

(Note: The commands you type in are after the colon.)

Now, let's get all the files onto your device:

1) Open a command prompt and navigate to your /android-sdk-windows/tools directory

2) Type: adb push rageagainstthecage-arm5.bin /data/local/tmp/rageagainstthecage

3) Type: adb push Superuser.apk /data/local/tmp/Superuser.apk

4) Type: adb push su /data/local/tmp/su

5) Type: adb push busybox /data/local/tmp/busybox

Now let's get to the rooting:

1) Open an adb shell: adb shell

2) Change directory to where you pushed the exploit: cd /data/local/tmp

3) Change permissions on the exploit: chmod 700 /data/local/tmp/rageagainstthecage

4) Change the permissions on busybox: chmod 755 /data/local/tmp/busybox

5) Run the exploit: ./rageagainstthecage

6) Wait for it to run, and it will exit the shell

7) Enter the following command at the prompt: adb kill-server

8) Enter the following command at the prompt: adb start-server

9) Open an adb shell again: adb shell

10) Now you should have a temporary root shell. You should see a # instead of a $. If you still see the $, go back to step 5. You may have to do this a few times (I had to do it 3 times before I got root access).

Now, We need to make the root permanent by installing su:

1) Mount the partition as read/write: mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system

2) Change directory to where you pushed su, busybox and superuser.apk: cd /data/local/tmp

3) Run busybox to copy itself to the proper directory: ./busybox cp busybox /system/bin

4) Change the permissions on busybox: chmod 4755 /system/bin/busybox

5) Run busybox to copy Superuser.apk to the proper directory: busybox cp Superuser.apk /system/app

6) Run busybox to copy su to the proper directory: busybox cp su /system/bin

7) Change the permission on su: chmod 4755 /system/bin/su

8) Mount the partition as read-only: mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system

9) Exit the root shell: exit

10) You should now see $ instead of #

11) Exit the shell: exit

Now you are back to the commnd prompt. Let's verify that you still have root access:

1) Open a shell: adb shell

2) Type: su

3) At this point, it will hang until you give su permission through the Superuser app on your device, so look on your device and give it permission.

4) If the $ changes to a # when you type su, congratulations, you are rooted.