In the last few days, rooting the T-Mobile G1 and myTouch 3G has become much easier. [Zinx] released FlashRec which lets you flash a new recovery image onto your Android phone. It takes advantage of Linux kernel vulnerability CVE-2009-2692. The app lets you backup your current image and then flashes Cyanogen’s Recovery Image 1.4. Once that’s done, you can use any custom Android build you want. Android and Me has documented the entire process on their site and points out the ridiculously large number of custom ROMs that are out there. Embedded below is a video from [unknownkwita] showing the rooting process.

It’s been many months since the T-Mobile G1 was initially rooted. In that time, the process has been streamlined and tools have been built to make it much easier. Having a rooted phone has become even more desirable with the recent release of the 1.5 firmware that includes an onscreen keyboard along with other improvements. Having a rooted phone means you can do tricks like setting up a 3G/WiFi bridge. [Taylor Wimberly] has written a guide to help you easily root your G1 without having to go digging through forums for software bits. The process starts by using [Mike Moussa]‘s rooting app to revert the phone to the RC29 build. You then use the “Android stupidly executes everything you type” exploit to launch telnetd and upgrade the bootloader. After that, the upgrade process is fairly easy. You just flash a new baseband and build. Once you’ve got your new custom firmware, you can do future updates using an app from the Android Market. We recently updated our Android Dev Phone 1 to 1.5 and haven’t had any issues.

[photo: tnkgrl]

For those wanting to do some hacking  or kernel debugging on their G1, [macpoddotnet] shows how to make a serial to USB cable. He gathered enough information on the Android platform google group to be able to piece something together. He’s using a USB 2.8V serial TTL level converter, and lists several available that should work. Looks like a pretty easy build.

[ghostwalker] has put together instructions for running X11 on your Android device. This means you can run a full-blown Linux desktop environment on your phone. It requires you to already have a Debian shell on the phone, which we covered earlier. Instead of having to come up with a custom display driver, it’s hooked to a VNC server. You can connect to it using an Android VNC viewer on the phone or via any other VNC client. The how-to suggests either IceWM or the even lighter-weight LXDE for a window manager. You could potentially install Gnome or KDE, but we’d be surprised if it was any faster than dog slow. Let us know if you have any success with this and what you think the best use is.

Many G1/ADP1 owners have been using the app Tetherbot to get internet access on their laptop via USB to the phone’s data connection. The app relied on the Android Debug Bridge to forward ports. It worked, but people wanted a solution better than a SOCKS proxy. The community figured out a way to create a properly NAT’d connection using iptables and then [moussam] rolled them up into easy to use applications. There’s one for setting up a PAN device on Bluetooth and another for adhoc WiFi networking. It requires you to have root on your phone, but hopefully you’ve achieved that and are already running the latest community firmware.

[photo: tnkgrl]

When we first saw [Jeffrey Nelson]‘s G1 based robot we immediately wondered what the transport for the controls was. The G1‘s hardware supports USB On-The-Go, but it’s not implemented in Android yet. It turns out he’s actually sending commands by using DTMF tones through the headphone adapter. The audio jack is connected to a DTMF decoder that sends signals to the bot’s Arduino. He wrote client/server code in Java to issue commands to the robot. You can find that code plus a simple schematic on his site. A video of the bot is embedded below.

[via Engadget]

[ghostwalker] dropped in on our previous Debian Android post to let us know that he had streamlined the install process. The first time around, it quickly became difficult to complete the process because firmware updates had taken away root access. Hackers have since figured out how to downgrade from RC30 and install BusyBox. All you need to do to put Debian on your phone is download the package from [ghostwalker] and then run the installer script. This isn’t technically a port since Debian already has ARM EABI support. What would you run on your phone if you had access to the entire Debian package tree? A video of Debian starting up is embedded below.

[photo: tnkgrl]

It’s the season of gift giving. Did you get anything interesting/hackable? What will you work on next?

We gave ourselves an Android Dev Phone 1 (ADP1). We hadn’t really considered getting a G1 until the ADP1 was announced… It’s actually a lot of fun to use as our primary phone. Our favorite app so far is connectbot, the SSH client. The interface is really smart, way better than all of the iPhone clients.

What did you get?

In our Dev Phone 1 excitement last week, we somehow overlooked phoneWreck’s teardown of the T-Mobile G1. The complex slider mechanism is certainly worth looking out. One of the major oddities they point out is the inclusion of two vibration motors. One is mounted next to the SIM on the mainboard. While the other is mounted in the frame next to the earpiece. We wonder what was gained/solved by using two. The phone also includes a digital compass module. We’d like a more detailed explanation of how the Xilinx CPLD is used. From this article in 2006, it seems HTC uses them to generate custom clock signals and switching off devices for power management.

While working towards open-sourcing Android, the team continued to work on new features in their own private development branch. These have now been published publicly in the “cupcake” branch. There’s a lot of interesting new features and bug fixes included. We’ve got a rundown of many of the significant additions after the break.

The A2DP and AVRCP profiles were both added to the Bluetooth stack. This means support for stereo headsets and remote control. Dial Up Networking wasn’t added, but preliminary work was done on USB Gadget Framework support, which means future devices could appear to the host device as just an ethernet interface.

The browser has been bumped up to the November release of WebKit with the optimized JavaScript engine SquirrelFish. Copy/paste in browser and a 5x draw speed improvement were also added. The trackball now does accelerated scrolling.

Hardware accelerated video recording and playback, an often noted oversight in the initial T-Mobile G1 release, finally show up. A framework for an on-screen keyboard and predictive text are being worked on. Android lets you run background processes and users will be pleased to know there’s a process manager now. Finally, a new Linux 2.6.27 kernel and the least explained addition “basic x86 support” round out the branch.

While there are many good improvements here, there is no indication as to when G1 users will see them or when Android Dev Phone 1 (ADP1) owners will be able to build the release themselves. [Disconnect] points out that there were some other gems included in the branch that aren’t in the announcement like mounting an encrypted e2fs volume which could enable installing apps on the SD card.

[photo: tnkgrl]

[via GotOnTheInter.Net]

Google has new program to sell Android phones directly to developers. The Android Dev Phone 1 is both SIM-unlocked and hardware-unlocked. SIM-unlocked means you can use it on any GSM carrier you want. Hardware-unlocked means you can run any system you want on the phone, not just officially signed ones. No more need to worry about security patches taking away your root access.

The device is $399. You will need to purchase it through the Android Market as a registered developer (a $25 fee). We wonder how long before the unsigned bootloader starts getting flashed to T-Mobile phones.

Two new Android phones have surfaced recently which may prove just as friendly: the Kogan Agora Pro and the QiGi i6.

UPDATE: While shipping is free in US, it is incredibly expensive everywhere else. Yes, we bought one.

[via Techmeme]

[photo: tnkgrl]

Google has been trickling out info about what they’re actually fixing in the G1 firmware updates. Before RC29, users were able to bypass the phone lock using safe mode. RC29 also brought WebKit up to date, presumably patching the bug [Charlie Miller] found. RC30 takes care of root console problem. Unfortunately there are very few details as to what or how particular items were broken. This release method leaves much to be desired; having the official Android Security Announcements group be the absolute last place to get security news is asinine.

[photo: tnkgrl]

[Jay Freeman] has a rather exhaustive tutorial on how to set up a Debian environment on your T-Mobile G1. The first major issue with this is that getting root level access through telnetd is being patched. It certainly is a security issue that needs to be fixed, but a user shouldn’t have to root their own phone to begin with. While the G1 comes with some Linux tools, they’re limited. [Jay]‘s goal was to create a familiar Debian environment on the phone. It takes a few tricks, but if you’re familiar with the command line, you shouldn’t have any problems. Debian already has ARM EABI support, so creating a working image isn’t a problem. The image file is stored on the SD card and mounted using the loopback device. The G1′s kernel has module support turned on, so [Jay] created an ext2 and unionfs kernel modules. [Benno Leslie]‘s Android version of busybox is used to perform the actual mounting. Once mounted, you just need to chroot into the environment to start playing with native Linux apps. [Jay] takes this a step further by using unionfs to make the Android and Debian environments share the same root. This is really a great how-to and it’s nice to know that modules can be added to the kernel.

[photo: tnkgrl]

[via Hackszine]

The G1 ‘execute every command you type‘ bug naturally spawned ‘rm -rf /’ jokes. rm is the Linux command for deleting files. The -r and -f flags will cause it to remove files recursively and ignore confirmation. Executed as root it will annihilate the entire filesystem. Won’t it? [Jon Hohle] decided to test exactly how destructive the command was to *nix systems. How functional would the system be afterwards? He tested it side by side with the Windows equivalent, both ‘format c:’ and ‘del /F /S /Q’. He wanted to see what protections were available and what would be left working. Linux ended up completely broken while Windows, thanks to file locking, actually shutdown cleanly… and never came back. Some OSes, like Solaris, refuse to run the command ‘rm -rf /’ to prevent accidents.

This is one of the more bizarre bugs we’ve ever heard. The T-Mobile G1 has an open root shell that interprets everything you type as a command. It was discovered when a user just happened to type the word ‘reboot’ in a conversation and the phone immediately rebooted. A patch has already been rolled out to fix this issue. It also buttons up the earlier telnetd SUID problem.

[photo: tnkgrl]