Android Rooting and Rooted Apps Here is a compact yet deep technical step-by-step guide on how to root Google Android mobile smartphones and tablets, all in one page with clickable flowcharts, wise tips, but without the sales hype and confusing generalities. Topics are presented in a sequence determined from a meticulous analysis of what needs to be learned first. Related topics elsewhere on this same website (WilsonMar.com):   1. Android Index of Articles, Blogs, Books, Videos, Chats, etc.   2. Android Versions   3. Android Device and Carrier Selection   4. Android Device Usage Basics   5. Android App Markets   6. Android Utility Apps   7. Android User Apps   8. Android USB Connections   9. Android OS Rooting and Rooted Apps 10. Android App Frameworks 11. Android Java Eclipse Development Setup 12. Android Emulators 13. Android Java Programming and Testing 14. Android App Localization and Testing 15. Android Lifecycle Data Management and Testing 16. Android User Preferences and Experience Features 17. Android UI Programming and Testing 18. HTML5/CSS3 Features and Testing 19. Android User Controls Coding and Testing 20. Android Hardware Control and Testing 21. Android Services Coding and Testing 22. Android App Monetization 23. Android App Marketing 24. Mobile VuGen Scripting for Load Testing 25. Lua Programming

Topics this page: What Is Rooting Why Root? Anti-Rooting Automated Testing Rooting HTC Rooting Samsung Better Way? Android OS Linux Backups Original Components Stock ROMs Unlocking Before Returning Custom ROMs Google Apps Theme Files Flash ROMs Download Mode Recovery Mode Terminal Access Download Larger Apps Stock Apps File Managers CarrierIQ Removal Tethering Network Tweaks Home Screens Other Root Utilities MSL Codes Hard Reset Your comments???

Site Map About this site Enter your search terms Web   Wilsonmar.com   Submit search form x`

system Folders Protected

Similar to the Microsoft Windows Administrator or SYSTEM account which has elevated access to everything, the Android operating system limits access to its
[1.] /system and /data folders
only to users granted root privileges. And that's not regular users.

File explorer apps cannot even see files in these folders.
So only Partial Backups can be performed.

Apps (bloatware) that carriers (such as Samsung and AT&T) force upon their users cannot be uninstalled because those apps waste space installed in the /system folder.

All this is unless the device is "rooted".

Rooted with su and Superuser

Exploits are defined by
hackers at
WEBSITE: Lifehacker's guide
WEBSITE: XDA Developers.
WEBSITE: SDX Developers.
WEBSITE: Pwnies are awards
given during Black Hat
conferences to those who
identified the best
exploits...and lame vendors.
WEBSITE: androidadvices.com
[sic] provides advice for
each phone model/brand.
ARTICLE: Gingerbrew and
ARTICLE: SuperOneClick.
Rooting with exploits such as "rage against the cage" achieve root (elevated) privileges so that:

[2.] the su binary (executable program written by brit Adam Shanks, aka ChainsDD) and placed in the
/system/bin or /system/xbin directory and

[3.] the Superuser.apk app in the
/system/app directory provides a GUI to approve or deny the use of root access to whitelist other apps and thus enable them to run with impunity. Separate versions of this are needed for cupcake/donut and eclair/froyo

Thus, to confirm whether a phone has been rooted, look for the Superuser app icon on the desktop/home screen and in Options > Applications for a skull shaped icon named "Super User".

[4.] Custom Java Android app programs such as APP: Root Checker (by joeykrim) use this code:

Runtime runtime = Runtime.getRuntime();
try {
	runtime.exec("su");
}  catch (Exception e) {
	// Error occurred while executing command, does not have root.
}

Why Root? Capabilities After Rooting

ARTICLE: The Power of Rooting
ARTICLE: Why Root?

WIKIPEDIA: Rooting_(Android_OS)

With elevated privileges after rooting, users can:
• Make complete backups of a device, including files which only the root user can read. This is aka Nandroid backup. This should be done before other actions after rooting as it provides a restore point. Backups can be done from an option by entering Recovery Mode.
• Conduct Automated Testing
• Make GPS work better and faster
• Remove carrier-imposed CarrierIQ which spys on users
• Remove carrier-imposed bloatware apps consumers cannot delete on their own. These apps continue to consume limited storage space and memory
• Download apps larger than 5 MB by relocating downloads to the sdcard
• Enable tethering to turn phone networks into a wi-fi router for Windows/Mac clients
• Make wifi faster and block ads
• Change home screen, use custom fonts, and other aspects of a theme
• Improve battery life
• Access protected hardware featuers like the camera strobe (to use as a flashlight)
• Use the device across various carriers, since root access is required to modify carrier settings.

These benefits entice users to root their phones.

Wireless Carrier Anti-Rooting

Capabilities available after rooting, such as tethering means less money for wireless carriers. So carriers:

1. void warrenties on rooted phones
2. add blocks to make rooting more difficult
3. patch device firmware to detect rooting

On July 26, 2010, the U.S. Copyright office announced a new exemption making it officially legal to root a device and run unauthorized third-party applications, as well as the ability to unlock any cell phone for use on multiple carriers. In China and some other countries, users need no such ruling.

Recent Motorola phones (Devour, Droid X, Droid 2, Droid Pro, Atrix, etc.) have signed boot partitions, which render them unfriendly for rooting. Motorola's purchase by Google may not change this, as it's an enterprise requirement. A similar secure boot mechanism is being introduced into Windows 8.

Barnes & Noble’s NOOK Tablet has a locked bootloader.

Early roots of Amazon's Kindle Fire for Ice Cream Sandwich had difficulty with sound drivers.

Making Use of Exploits

Do you want someone else to run a script over the internet which operate your device the same way you do?

Well, that's exactly what mobile software testers want to do for a living.

This is why some software testing programs require rooting, to overcome blocks to remote control.

But some organizations, especially feduciary banks and health care organizations, are concerned that rooting would expose them to vulnerabilties.

Rooting would need to occur on devices only during testing, not during productive (production) use.

However, since the devices operate in the “wild” on the public internet, one feared scenario is for a malware IP scanner to discover a mobile device under test, and somehow cause a virus to infect it. Or if the tester visits a rogue website. See: http://blog.mylookout.com/blog/2012/05/04/oh-no-my-phone-bought-tickets-to-the-one-direction-concert/

But are these vulnerabilities there even when devices are not rooted?

The fear with rooting is that it introduces something which has not been adequately vetted for security by corporations such as Symantec or HP Fortify who provide enterprise security services. For example, CyanogenMod replaces firmware on devices.

But no legitimate company is likely to step forward and stand behind any rooting mechanism because the cost of possible lawsuits with carriers won't offset the revenue from selling rooting services.

So rooting is likely to remain in hobbyist hands. This is the most troubling issue to me. On the one hand, since hobbyists are not professionals working with "adult supervision" in corporations, it's less obvious if one of them goes rogue and implants malware. On the other hand, wide variation in device manufacturers, models, and operating systems means the small community of hobbyists cannot produce all root kits for every phone soon after public release.

Thus I call on the software testing technical community to help out here, and apply their expertise. What is needed is some group to define a rigorous approach to evaluating root mechanisms ROMs. More open, objective evaluations are needed.

Rooting HTC Phones

FreeyourAndroid.com
WEBSITE: HTC website: Unlocking Your Bootloader lists HTC devices since 2011

The following instructions apply to earlier HTC devices:

• Sprint EVO 4G (HTC Supersonic)
• Droid Incredible (HTC Incredible)
• Droid Eris (HTC DesireC)
• HTC Desire GSM
• HTC Desire CDMA (HTC BravoC)
• HTC Aria
• HTC Wildfire (HTC Buzz)

[5.] On Windows clients, first make the phone install its USB HBOOT driver on your Windows machine by using an alternate power-up mode:

1. Power off the phone
2. Keep holding down the volume down button and power button at the same time until the menu appears.
   • FASTBOOT
   • RECOVERY
   • CLEAR STORAGE
   • SIMLOCK
   • HBOOT USB
3. On EVO 4G phones, at the menu press volume down to option "HBOOT USB" and then presss the power button to select it.
4. TEST: "S-ON" at the top of the screen indicates that the phone lock is active.
5. Connect the USB cable between the Windows PC and phone. This causes default USB drivers from the phone to be installed on Windows.
6. In Windows Start > Control Panel > Device Manager > Other devices > Android 1.0 should now appear.

[7.] Update USB drivers:

7. Using [6.] an internet browser, download and unzip android-usb-driver.zip to a temp folder so it contains android_winusb.inf.
   Right-click on "Android 1.0" to Update Driver Software. Choose Browse my computer, the location where you unzipped folder Android USB Driver. Check Include subfolders. Windows Device Manager should now have an Android Phone category containing Android Bootloader Interface

Obtain and run rooting programs:

8. On the device, uninstall apps which might interfere with reflash, such as DoubleTwist, anti-virus, HTC Sync.

WEBSITE: Unrevoked.com offers an approach that bypasses "NAND locks" (whatever that is) with:
TOOL: Unrevoked3 to root Android 2.2 wireless smartphones from HTC:

9. Download and run the [9.] rooting program reflash.package.exe. Don't touch anything until it says done.
10. Some rooting programs changes what [10.] manufacturers "flashed" onto [11.] an area of the stock ROM to a [12.] Custom ROM which the [13.] Boot Loader now loads into device RAM upon [14.] normal power-up.

    TEST: After the phone reboots on its own, a [3.] "Superuser Permissions" app should display in the app tray.

Rooting Samsung Phones Option 1 with SuperOneClick

For the most popular devices:
TOOL: Samsung Galaxy S2 4G
TOOL: Samsung Infuse 4G
TOOL: Samsung Tablet
On Samsung phones, establish USB connection so [16.] adb can interact with the device.
1. [18.] Odin confllicts with [15.] Samsung Kies, so right-click on the Windows time in the task bar select Processes, click on Image Name to sort, right-click on KiesTrayAgent.exe and select End Process Tree. Confirm.
2. Install .NET Framework 3.5 SP1 or later from Microsoft if it is not already installed.
3. Using IE, DOWNLOAD: [17.] SuperOneClick.exe in a zip from ShortFuse.org.
4. Invoke the exe to install to a temp folder and close the unzip program. Early versions publish .7z rather than .zip files. If so, download and invoke the 7-zip installer from
   TOOL: 7-zip
5. Unplug the USB cable between the device and Windows.
6. To enable SuperOneClick to use adb, on phone Menu > Settings > Applications > USB Settings > Development > check USB Debugging (on).
7. On phone Menu > Settings > SD card & phone storage > Unmount/eject SD card.
8. Press the Home button to return to the home screen.
9. Plug the USB cable between the device and Windows.
10. Use Windows Explorer to navigate to the folder and invoke SuperOneClick.exe. Do not click any folder or only that one will be unzipped.
11. In Windows Task Manager > Processes, end any adb.exe processes running.
12. Invoke SuperOneClick.exe.
13. Click Update Check. v2.3.1.0 has a bug. Change https to http.
14. TEST FIRST: SuperOneClick.exe has a reputation of freezing. So in Advanced, check
15. Click Root.
16. In Windows Task Manager, two adb.exe entries will show.This is part of the exploit.
17. At "Automatic version check failed" click Yes for Is your version 2.0 or higher?
18. At "Device properties cannot be read!", restart.

Is There a Better Way?

It is confusing to read websites and videos on rooting because procedures to obtain root access is different for each model of phone from each manufacturer. US and international versions may also require different methods. Thus, rooting methods change over time. But obsolete methods still clutter the internet, confusing people who have better things to do than keep up with such matters.

Android OS

Android uses a fork of Linux for its security and drivers for many common devices.

Unlike other Linux OS (such as Centos and Unbutu running in PCs), the Android installer does not include X11 windowing and related utilities.

Rather than use the standard copyleft Linux LibC, Android created its own BSD closed-source faster, smaller GLibC, called Bionic C (which uses 4-byte rather than 12-byte mutexes). To allocate reference-counted memory that can be freed automatically, a mmap() call is made after ashmem_create_region(). Android's Ashmem (Anonymouse SHared MEMory) can free memory when POSIX SHM (on which it is based) cannot. To allocate process memory shared between userspace and kernel drivers (for DSP, GPU, etc.), a pmem() call is made after ashmem_create_region().

More importantly, rooting Android devices involves Linux conventions.

Linux ROM, PIT, Backups

TIP: Look for these features in rooting offerings:

• Provide a temporary unlock option
• Ways for both Windows and Mac/Linux environments, such as a root.bat for Windows and root.sh for Mac/Linux.
• Current versions of components such as Odin, Superuser, etc.

[?] When users hold down just the power button, a connection is made from the battery to the Boot Loader which loads binary executable resources (the operating system kernel) from firmware into dynamic RAM memory where programs are executed.

The Boot Loader senses what keys were pressed to determine what to boot (normal boot, recovery mode, download mode).

Firmware is also (incorrectly) call "ROM". By definition, ROM (Read-only memory) cannot be written to or modified. So in the context of Android devices, "ROM" is a contraction of EEPROM -- NAND type of WIKIPEDIA: Flash Memory, in which "flash" is an analogy of a camera flash imprinting new patterns on memory logic (as if it actually can).

Partition Image ID Description Size /dev/block PBL boot.bin Primary Boot Loader 0.256MB - EFS efs.rfs contains the IMEI 5.9MB - SBL Sbl.bin Secondary Boot Loader 1.25MB - SBL2 Sbl.bin Backup Secondary Boot Loader 1.25MB - KERNEL zImage Primary (Linux) Kernel 7.5MB bml8 RECOVERY zImage Backup Kernel 7.5MB bml6 FACTORYFS factoryfs.rfs Android /system partition Size depends on pit file specified/used. 276.3MB 297.5MB 287.5MB - DBDATAFS dbdata.rfs where app data gets stored app choices, passwords, email, web history, etc Size depends on pit file specified/used. 126.7MB 107.2MB 117.2MB stl14 CACHE cache.rfs Dalvik VM cache 30.1MB - MODEM modem.bin wireless modem 12MB - PIT .pit Partition Information Table (size inferred) *256KB - PARAM param.lfs The images shown when something is wrong Size inferred. *640KB -

The Linux-based Android firmware has severage partitions defined in a PIT (Partition Information Table).

TIP: Backup the EFS partition which holds the device's IMEI, MAC address, etc.

adb shell
su
dd if=/dev/block/stl4 of=/sdcard/efs.rfs

TIP: Backup the user data partition which holds passwords, emails, etc.

adb shell
su
# dd if=/dev/block/stl14 of=/sdcard/userdata bs=4096

Verify the /dev/block ???

CAUTION: The concern is that people are blindly installing software from those they don't really know. So far, hobbyists creating ROMs have not created malware. But who knows what the future holds.

TIP: Rather than executables which are difficult to examine, prefer rooting tools using open mechanisms such as shell scripts (.bat files for Windows and .sh for Mac/Linux). This provides a way to see what exactly is being changed and how it is being done, even if it's not examined unless there is a problem.

CSC (Customer Software Customization) area which stores the packages, APN settings, and branding specific to each geographical region and carrier/service provider.

There are several rules which custom ROMs need to follow (and cause problems if not), such as PIT files being in little-endian format (where hex numbers are read backward); and each image needs to fit within the partition size defined for it in the PIT (Partition Information Table) used.

Odin needs the tar files to be in the USTAR format. I haven't seen a free program that can write these other than the gnu linux tools - hence why I use Cygwin.

TIP: Prefer Odin for Windows and Heimdall for Mac. It does not specify which PIT because they just send the files along with an ID that tells the device WHAT will be flashed. The device decides according to its PIT WHERE it will be flashed.

Original Component Downloads

For Windows, Odin Multi Downloader works with USB drivers for Samsung phones.

Odin v3.95.exe' is used to flash the Samsung Galaxy.

Odin3 v1.85_intratech.zip (192.32 KB)

ODIN3 v.1.82.exe (415.5 KB)

Mobile Odin???

BusyBox by Stericson (Stephen Erickson) enable scripting operation.

APP: $2 Samsung OdinMaker by P3Droid uses BusyBox scripts to build restore files (and tar.md5) on the device such that Odin or the Samsung PST flashing software can restore them from a Windows computer.

ClockworkMod Recovery (CWM):

APP: from ClockworkMod Recovery (CWM) WEBSITE: clockworkmod.com by Koushik Dutta makes ROM Manager for various smart phones.

From Apple Mac or Linux, download Heimdall rooting files (by clicking "CLICK HERE to Download", not the big Download button).

Amon_RA ???

Using Windows, download from MultiUpload I777UCKH7 OCD Root No BL.exe the Return/Unbrick to Stock, Kernel + Rooted System Package plus stock modem (Contains stock zImage, factoryfs.img with root, and modem.bin.) by Entropy512 (Andrew Dodd). Double-click on it to start the Odin3 One-Click Downloader program.

Cyanomod by developer Cyanogen (Steve Kondik) ( WIKIPEDIA) ironically requires a hack to establish a more secure VPN client connection, as well as purported higher reliability than official firmware.

Rooting Samsung Phones Option 2 with Odin

First:

Enter Samsung Download Mode

This is like entering BIOS mode on Windows machines by pressing Del, Esc, or some other key during boot-up.

Prepare the phone for download:

1. At the Home screen, press the Options key to enter Settings.
2. Tap SD card and phone settings.and Unmount SD Card.
3. In Applications > Development, Check USB Debugging (on).

To put a Samsung S2 (GT-I9100) phone (as SGH-I777 on ATT and SGH-T989 on T-Mobile) into
Download mode:

How to Root AT&T Galaxy S2
shows to press all 3 buttons
(Vol Up/ Vol Down / Power)
without first powering down.

4. Power off the phone by holding down the power button and selecting "Power off", then OK.
5. Unplug the usb cable if it is connected to a Windows/Mac client machine.
6. Take out the battery. Wait for a minute, and put it back in.
7. While holding both vol up and vol down buttons at the same time (but not the power button),
   plug the connected usb cable into the phone.

Either way, The warning screen should appear to say:

A custom OS can cause critical
problems in phone and installed applications.

If you want to download a custom
OS, press the volume up key.
Otherwise, press the volume down
key to cancel.
8. Press the Volume up button to continue into download mode.

If you are NOT flashing, remove the usb cable, and hold down the power button until the phone begins to reboot. Otherwise...

WARNING: Samsung and AT&T added to their Galaxy S II phones a way to detect whether rooting has occured. When a device is returned for service or other reason, AT&T technicans check for If "CUSTOM BINARY DOWNLOAD: YES" shown with a yellow warning triangle.

Hackers found that a micro-usb jig plug with 301,000 ohms of resistance connected across pins 4 and 5 forces the phone into Download Mode used to reset the flash counter. Make one.

The flag is triggered by a counter which is set to YES when a non-stock binary (kernel/ROM) is flashed. But hackers noticed that the flag is not triggered if Download Mode was entered by another method (by using adb or the power menu).

1. DOWNLOAD: GalaxyS2ATTRootZedomax.zip
2. Unzip it to a temp or installers folder so that the Odin3 v1.85.exe can read its ini file and tar file.
   Heimdall is Odin's equivalent for Mac/Linux.
3. In Windows Start > Run > cmd > OK > cd to the folder
4. Invoke Odin3 v1.85.exe. The "Epic 4G" is specified in odin's ini text file.
5. There should be a yellow. "0:[COM11]"
6. Click the PDA icon and specify the full file path to the tar file. It contains a zImage binary file.
7. Press Start.
8. If all is good, delete the zip file to return disk space.

CAUTION: Obtain programs directly from those who created them because download utility sites such as wupload.com and filesonic.com may offer obsolete or even malware-infused copies. Such sites obtain revenue from selling subscriptions for faster download speed and clicks on their pop-up windows. Those who make their files available can get a comission from such subscriptions. This is a way authors can monitize their work. So don't click thru, but do reward the author with a donation. It's only fair.

CAUTION: APK files must be converted to a flashable zip format file before being flashed on the device.

TIP: Create flashable zip files from original APK packages on the device so that you can revert back to untouched state.

Un-rooting brings the device back to conditions under warranty.

fastboot oem unlock

Google-branded Nexus line of devices and some other manufacturers make root-friendly devices which allow rooting without the need for an exploit by running the fastboot program within Google Android SDK for Windows.

1. Make the Windows PATH environment variable should include two folders: tools and platform-tools. So if you installed it to the C: root folder, your PATH should have "C:\android-sdk\tools;C:\android-sdk\platform-tools".
2. Open a Windows Run command window. cd to the Android-SDK tools folder.
3. Plug in the USB cable between the phone and Windows.
4. Prove that your PC has a good channel to the phone. The phone's serial number should appear after typing this on the command prompt:
   fastboot devices
5. Enter boot-loader mode.
6. Unlock the boot-loader from a computer connected to the device while it is in boot-loader mode by command:
   fastboot oem unlock

   Sony Ericsson Xperia GSM phones also require a key. Their X10 and CDMA phones cannot be unlocked because of signed boot partitions.

   < waiting for device > will appear forever if your phone is not recognized.
   In this case, press Ctrl_C to exit.

7. Enter Recovery Mode
8. Once in recovery mode, on Nexus phones, with a command prompt connection:
   Press Alt-W to wipe the device
   Press Alt-S to apply updates.

z4mode

Telnet Connect

To transfer files, a telnet program is needed on each end.

On the Android:

A successful connection will show # the root prompt.

Stock ROM (Read Only Memory) Packages

It's a good idea to backup original ROM so that one can return to it.

These apps is the operating system that manage 7) custom apps downloaded from Android Market or other store.

[6.] On new devices, resources are flashed onto the "ROM" by device manufacturers. Such versions are nicknamed stock ROMs, versus custom ROMs created by hobbyists.

Who has them?

The Froyo version of Android has its ROM resources at:
* /system/framework/framework-res.apk

The file extension APK (Android Package File) contains a set of files Android can execute.

Gingerbread version phones have two ROMs files:
* /system/framework/framework-res.apk
* /system/app/SystemUI.apk

Additionally, manufacturers add their own resources:

Devices runniing HTC Sense UI have this ROM:
* /system/framework/com.htc.resources.apk

Samsung Froyo has a ROM at:
* /system/framework/twframework-res.apk

TOOL: apktool can be used to pull framework resources needed to build APKs for those phones.

$ apktool if com.htc.resources.apk
I: Framework installed to: /home/brutall/apktool/framework/2.apk

Custom ROM (Read Only Memory) Packages

miuiandroid.com WEBSITE: en.miui.com provides the US translations of ROMs coded in Simplified Chinese for users in the mainland China locale. It sports iOS (iPhone) look and feel.

The original target was Nexus One and HTC Desire, but Cyanomod and others have ports to Droid X, Evo 4G and others.

Adding Back Google Android Apps

Due to licensing, AOSP ROMS not created by Google itself does not contain
APP: Google apps (GApps) such as Gmail, Android Market, Maps, and Voice Search. So they must be downloaded separately. Different version of WEBSITE: CyanogenMod and dpi resolution supported by each device (from High to Medium to Tiny). http://wiki.rootzwiki.com/index.php/Google_Apps

Entering Recovery Mode

APP: Root Booter from well-regarded Speed Software, for $.99, boots rooted devices into recovery mode without the finger gymnastics described below.

To put the older G1 phone into recovery mode, hold down the home button and press power.

To put a Samsung S2 (GT-I9100) phone (as SGH-I777 on ATT and SGH-T989 on T-Mobile) into
Recovery mode:

1. If present, unplug the usb cable connected to a Windows/Mac client machine.
2. Keep holding both vol up and vol down buttons at the same time AND the power button
   until the Recovery screen appears.

Recovery Menu

Custom ROMs usually contain a replacement recovery console.

The stock Samsung Galaxy S2 phone offers this recovery menu:

Android system recovery (3e)
Enter: Power key. Select : Vol UP / Vol Down
reboot system now
Apply update from sdcard
wipe data/factory reset
wipe cache partition

If you are just visiting, when "reboot system now" is selected, press the power button to reboot to the screen normally seen.

Modified phones have more options and keys to navigate. In the CWM (ClockworkMod) Recovery menu, go back with the power button and select using home button. Added menu options include:

- install zip from sdcard
- backup and restore (Nandroid)
- mounts and storage
- advanced

Full Backup

Those who get the eebee jeebies while doing finger gymnastics prefer the comforts of an app for rooted phones:

APP: Titanium Backup from Titanium Track backs up apps.
APP: $7 pro version key enables backups to operate without first closing apps.

Commanding Phone via Terminal Access

To issue commands to an Android device, one first has to connect from a Windows client machine to the phone, using a terminal app. There are several options.

APP: irssi connectbot from liro Uusitalo

Once installed, invoke it for its blue screen terminal view.
Type in su, then press the Enter (crooked arrow) symbol on your keypad.
Confirm the "Root access from the Super user Application".
Tap on “Allow to Proceed”.

Make GPS Work Better

GPS receivers can be slow -- as much as 12.5 minutes to acquire a location fix, even though the GPS system is designed to have several satellites visible from an unobstructed location. Being among large buildings (in Manhattan, New York) can cause GPS to lose their way.

To help in quickly determining a position, GPS devices also have Assisted-GPS (A-GPS), which use satellite acquisition information obtained via mobile data and/or WiFi connections. BTW, A-GPS data is obtained via the Secure User Plane Location (SUPL) protocol, on default port 7276 from host supl.google.com.

A-GPS data can become incorrect or corrupted somehow. This may be the case after large earthquakes which can move whole areas several meters.

To reset (flush) and re-download AGPS data, make sure wi-fi in available, then install:

APP: GPS Status & Toolbox from EclipSim

After installation, launch the app. Hit the Settings button > Tools, and Manage A-GPS state. Tap Reset, then "Download". When done, exit the app and see if Google Maps (or whatever GPS app you use) gets a quicker GPS lock.

If resetting data doesn't do it, try rooting the device to run cm7, which enables access to /system/etc/gps.conf to remove SUPL_HOST and SUPL_PORT specifications.

Redefine Symlink Location to Download Apps Larger Than 5 MB

The symlink "download" used to receive downloads from Android Market can be changed from the default /cache/download folder.

After root access to the phone is establish via a Terminal app:
define a new folder on the SD card:
mkdir /mnt/sdcard/market-cache
Then su to get root access and define the new symlink:
ln -s /mnt/sdcard/market-cache download
Confirm the new symlink value and its access rights:
ls -ahl

Remove Stock (Default) Apps

Settings > Applications > Manage applications
does not list system and stock default apps not installed by the device user.

After root access to the phone is establish via a Terminal app:
Type these commands (subsituting your-app-name for the name of your app):

mount -o remount,rw -t yaffs2 /dev/block/mtdblk3 /system
ls   /system/app
rm /system/app/your-app-name
mount -o remount,ro /dev/mtdblock3 /system

Detecting and Removing CarrierIQ

CarrierIQ is a rootkit. Devices are automatically entered into using Carrier IQ.

Apple iPhone 5 provides a Settings menu to switch off Carrier IQ (under Diagnostics).

HTC android devices have no off switch.

Samsung android devices have an on off switch that is not easily accessible and not made known to users that it’s there.

APP: Logging Checker by TrevE detects logging

APP: $1 Logging TestApp Pro Key - ROOT by TrevE () installs busybox for more automated operation and removal

Tethering

Carriers put limitations on this. But once rooted, cellphone wireless signals can pass thru to a PC or Mac workstation.

APP: android-wifi-tether has a limited number of phone models (and Android versions) it supports.
HTC Dream/T-Mobile G1, Magic, Hero (1.5)
Samsung Galaxy I7500 (1.5)
Motorola Droid/Milestone, Cliq (2.0)

APP: barnacle app ???

For tethering, the Linux kernel needs to have features CONFIG_NETFILTER, CONFIG_IP_NF_IPTABLES, and CONFIG_NETFILETR_XT_MATCH_MAC).

Networking Tweaks

APP: MasquedCrusader from rooted app specialist Soapbox Apps improves network speed by locally caching nameserver data and forcing the use of Google's fast DNS servers.
APP: MasquedCrusader Pro, for $4.99, also blocks ads and enable use of OpenDNS.

This we need because Comcast hijacks invalid DNS lookups by sending users to the Comcast search site rather than returning an error. This fools Chrome into thinking a valid webpage is being visited, and thus caches it in the browser's history.

Home Screen Changes

APP: GDE home screens which are selectable as a spinning cube. Some say it's more stable than PandaHome and OpenHome.

Theme Files

CAUTION: Due to differences in ROMs, theme files must be associated with a specific ROM.

WEBSITE: Ultimate Online Theme Kitchen provides a cafeteria-like approach to assemblying a custom flashable zip compatible with Clockworkmod 3.

Other Apps for Rooted Phones

APP: SetCPU and
APP: Root Explorer.

APP: Android Optimizer has several utilities, including file explorer.

APP: File Expert reads as well as list files, even within zip folders.

APP: Root Explorer, for $3.99, provides readers of files as well as listing them.

APP: Spare Parts is like PowerTools for Windows, making it easier to tweak hidden settings.

MSL Codes

Unlock GSM phone

This page summarizes Brian's page and
Sprint MSL code list

An Master Subsidy Lock (MSL) code (such as ##868021# entered in the dialer instead of a phone number) accesses carriers' back-end functions in carrier's EPST: (Equipment Performance Support Tools).

Each carrier uses a different algorithm to create the MSL code based on each phone's ESN. So a different code is assigned to every customer/device. Sprint uses a 8-digit code. BlackBerry uses a 16-digit code.

CDMA phones also have a one-time Service Programming Code (SPC) to activiate new phones.
Verizon uses CDMA.
T-mobile USA uses UMTS 3G data frequencies 1700/2100.
AT+T uses GSM 3G band on 850/1900.

MSL codes are kept from consumers because they want to recoup the subsidy for charging a lower cost for the phone at activation.

Carriers won't release the MSL nor activate a phone if that account has an outstanding balance. So before buying a second-hand phone, get the ESN and make sure it's clear.

APP: ROM Manager (by koush@ClockworkMod.com) is used to manage ROM files. Premium

Device Hard Reset

Mistakes in rooting may require a hard reset of the device.

CAUTION: This wipes out everything on the device, which is why we do it.

Each device model has a different approach:

For the Samsung Galaxy S2, type this in your phone dialer: *2767*3855#

For the Nexus One:
1. Switch the phone off by holding down on the power button.
2. With the phone off, hold the Volume Down button, and while still holding the Volume Down button, firmly press and release the Power button.
3. You'll boot into a menu with a white background, small text and the little skateboarding Android guys.
4. Press the Volume Down button until you reach the Clear Storage option.
5. Press the Power button to select Clear Storage.
6. Press Volume Up to confirm the selection.Sit back while your phone reboots in its virgin state.