[G1 Android Development] agentfusion:
Please note, this is NOT my own work. It's on the CM Wiki, but since so many people seem to not want to be bothered to read the damn wikis for their intended purpose, I'm going to be a ratbastard enabler and post the steps HERE in a thread, so next time someone goes to post to ask how, IF they use the search function they'll find THIS thread and not threadnaught this forum with questions about how to do it.

This has been tested and works 100%. I have not tried it for CM6, and I don't suggest anyone try it on a 911 patched Rogers Dream until CM6 is stable AND there's a proper kernel image for Dream/Magic 32A/32B. As usual, I hold no responsibility if this bricks your Dream. I have made ROMs for the Raphael, Rhodium, Topaz, and Kaiser, and am an expert on those devices but this is my first actual Android device that I've had for less than a week, and just rooted/flashed it today, so I am NOT an Android expert AT ALL.

Original Guide: Here!

(Note: This guide is for CM5)

Step 1) Download all of the required software. SDK, Fastboot, Exploid from DroidXRoot, SPL 1.33.2005, Amon_Ra Recovery for CM, CM5 Itself, Googleapps, and extra kernel for Rogers Dream.

Step 2) Install extract the SDK archive and rename it to 'sdk' for easier use. In Windows, extract to C:\sdk, linux ~/home/sdk, mac .. wherever you want. Extract the Fastboot.zip to the sdk/tools folder. Move exploid, SPL, and Recovery to sdk/tools for easier use with adb.

Step 3) On your Dream, go to Settings->Applications->Development and enable USB Debugging, and connect your Dream to your computer via USB cable.

Step 4) Enter your sdk/tools directory and type the following:

* adb push spl-signed.zip /sdcard/1_33_2005_spl.zip
* adb push update-cm5* /sdcard/update-cm5*
* adb push gapps-ds-ERE36B-signed.zip /sdcard/gapps-ds-ERE36B-signed.zip
* adb push bc-5.0.x-ebi1-signed.zip /sdcard/bc-5.0.x-ebi1-signed.zip
* adb push recovery-RA-dream-v1.7.0R-cyan.img /data/local
* adb push exploid /sqlite_stmt_journals
* adb shell chmod 777 /sqlite_stmt_journals/exploid

(*whatever your CM image is.)

Step 5) Running Exploid!

adb shell /sqlite_stmt_journals/exploid

should produce the following:

$ adb shell /sqlite_stmt_journals/exploid

[*] Android local root exploid (C) The Android Exploid Crew

[*] Modified by birdman for the DroidX
[+] Using basedir=/sqlite_stmt_journals, path=/sqlite_stmt_journals/exploid
[+] opening NETLINK_KOBJECT_UEVENT socket
[+] sending add message ...
[*] Try to invoke hotplug now, clicking at the wireless

[*] settings, plugin USB key etc.

[*] You succeeded if you find /system/bin/rootshell.

[*] GUI might hang/restart meanwhile so be patient.

Now unplug/replug USB cable to apply exploit. ROOOOOTED!

Step 6) Custom Recovery time!

Type the following:

adb shell

this will take you to a $ prompt (that's the shell.)

rootshell

this will ask for a password, which is 'secretlol' without quotes.

Now that you're at a root shell, type

chmod 666 /dev/mtd/mtd1
exit

Now you're back at the regular shell prompt, type:

flash_image recovery /data/local/recovery-RA-dream-v1.7.0R-cyan.img

If this gives a "mtd: read error at 0x00000000 (Out of memory)" error, it's okay, just type it again and it should work without the error. This is normal, do not panic.

Once this is complete, type

exit

and power down the phone. (long hold end key)

Step 7) SPL

Hold Home and press the End key to power up the Dream. At the recovery menu select

Flash Zip from SDCARD

and select the

1_33_2005_spl.zip

.

Now reboot by holding home+back. It will take you back to the recovery shell, and this is okay. This is actually what we want. Now, type

adb shell reboot bootloader

and watch the screen to verify that you see:

HBOOT: 1.33.2005
RADIO: 3.22.26.17

Now, run the following Fastboot commands:

fastboot erase system -w
fastboot erase boot
fastboot oem powerdown

Step 8) Flashing CM!

Press home+end to power up the phone in recovery mode, and select

Flash Zip from SDCARD

, Select your CM image, then

Flash Zip from SDCARD

and select gapps-ds-ERE36B-signed.zip, and finally

Flash Zip from SDCARD

and select bc-5.0.x-ebi1-signed.zip.

Once that is complete, home+back to reboot, and you're done. That's it. First CM boot may take 5-15 mins.