has created a couple of boot imgs, (like ezSBF)based on /
for current links and more detailed instructions
I have assembled a rooting CD for Droid 2 Global phones that have taken the .629 update.
I got the info on how to do this from phifc's post at
so all credit for this method go to phifc, djrbliss, and the others who developed the method.
I have simply taken the method, and assembled the tools for the Droid 2 Global.
Credit for the idea behind the CD method should go to 1KDS, as I have mostly patterned this CD after his method.
Credit should also go to Skrilax_CZ, as without his Motorola Android Firmware (De)packer, we wouldn't be able to have a CD under 50 meg.
I have tested this CD on my phone, and found it to work properly, but I can't guarantee that it will work for others. Others have also found it to work, but I can't guarantee you will have the same results.
You are welcome to try it, and I hope it is helpful to someone, but as with all modifications, you do so at your own risk.
Instructions for using this CD.
Download and burn this image file to CD. (or create bootable USB)
It might be a good idea to do a factory reset before starting this process, but you might be ok without it. My phone had already been rooted, so I had to sbf it back to stock, in order to test the CD, so I have only tried it after a factory reset.
1 Enable USB debugging on the phone,
2 Boot computer off of this CD
3 Hook up phone to computer (phone needs to be on at this point)
4 Start the root process by selecting option 2
5 When it says on the screen that phone needs placed in bootloader, (almost right away, as it only needs to send 1 command before placing in bootloader) power off the phone, and put it in bootloader by holding the up arrow on the keyboard of the phone while powering on.
6 when in bootloader and hooked up to the phone, press enter on the computer to proceed, a preinstall image will be flashed to the phone, providing the exploit that will root the phone.
7 When it has flashed, the phone should reboot. If it hangs when booting, unplug phone, remove battery, replace battery and power back on. When powered on, hook up cable again, and the process will continue (it will immediately reboot again)
8 When the phone reboots, ADB should be root, so it will push the necessary files to the phone, and reboot the phone again. Per Morlok8k, cache should be wiped to avoid bootloop problems, so the phone will be rebooted into Recovery.
9 You will have to press both volume buttons to enter recovery, where you should wipe cache partition and reboot.
If all went well, your phone should be rooted.
If you try it, please verify if it works for you, or gives you trouble.
Hope this helps someone.
I updated the CD (mainly just made it a bit smaller) and uploaded it to Mediafire
I also uploaded it to rapidshare,
the md5 for the updated CD is
I also previously forgot to mention that this method works fine off a bootable usb drive, a CD is not necessary. I use Unetbootin to create the bootable usb, and it works well for me.
I went ahead and put together an EzSbf style CD that contains both the full .629 sbf, as well as the root option.
I tested it out on my phone, and it appears to work fine. However, if you don't have over 1 GB of RAM, it will be necessary to reboot the computer between flashing 629, and rooting the phone. The reason for this is that the CD loads into RAM, and the SBF file unzips to around 600 Meg, and the preinstall to close to 300. So, they can't be both unzipped at once. I tried the idea of having the script rezip the sbf after flashing it, but it took longer than rebooting the computer. If you run this with under a GB of RAM, the computer will not be able to unzip the SBF, and will crash the script, without giving error messages, as when the command fails, it will try to advance.
All that to say, if someone wants the CD for recovery and root, here it is.
How this works
Originally Posted by phifc
There's an exploit in loadpreinstall.sh. It compares md5 sum files of preinstalled apps and if they're different, copies the md5 to the local cache. The preinstall just has an empty file in app/ so it will parse the md5 for it. Instead of an md5 sum, it contains a local.prop that allows adb root shell. So the system thinks it's copying the md5sum to the cache when it bounces off the symlink and overwrites the /data/local.prop, giving adb root on next reboot
Edited by sd_shadow, 20 January 2013 - 09:18 AM.