Warning
As usual, backup all your messages (SMS / E-mail / etc) before using this tutorial.
We will perform a total reset so everything will be lost.
Oh and you’re doing this at own risk 😉 … (so for those who care, your warranty will be void).
Requirements
- A T-mobile G1 USA or a T-mobile G1 UK (Firmware version does not matter, RC30 or RC8 will work)
- An USB cable
- A Micro SD memorycard (comes with the G1)
- A fully charged battery
- A MS Windows / Linux or Mac OS X system
Downgrading
- Download the factory reset firmware.
If you have the USA version download this file: HappyNewYear.zipMD5sum: 4f0efb2037524a06bda26f286bba474d
If you have the UK version download this file: HappyNewYearUK.zip
MD5sum: b253b71fad2ed0352bcb58c4966b9a25
- Connect your G1 to your computer and mount the SD card.
- Backup the content of the SD card.
- Format the SD card to FAT32 mode.
- Unzip the zipfile and copy the file DREAIMG.nbh to the SD card.
- Rename DREAIMG.nbh to DREAIMG.NBH (might also work without the capitals…, but better save than sorry).
- Unmount the SD card.
- Unplug the USB cable.
- Turn the G1 off.
- Hold the Camera button and press the Power button to start in bootloader mode.
- Press the power button to start the downgrade to RC29 USA or RC7 UK
(this takes a few minutes, dont interupt the progress) - After finishing, softreset the G1 to reboot (Hold Call, Menu and End).
If everything went well, you are now a proud owner of a rooted G1. Sign in with your Gmail account. If the login fails, you might need to add your APN settings (use the Menu button to add a new APN profile).
If you don’t have a dataplan, it is also possible to use wifi to sign in. Follow the instructions from modmygphone.com.
Installing testkeys
Before we can install a custom firmware we need to install the test sign keys.
- Go to the market and download the Telnet application.
- (optional) Press menu and selection the settings. Click Sound & display. Disable the screen timeout by selecting Never timeout. If the screen is locked while we are installing the test keys, the telnet connection might be interrupted … (Trust me, you don’t want this 😉 , my heart skipped a beat when it happened here…)
- Mount your SD card (connect the USB cable).
- Delete everything that is on the SD card.
- Download this package: AndroidMod.zip (mirror)
- Unpack the AndroidMod zipfile.
- Copy recovery_testkeys.img and boot_nosecure.img on the SD card.
- Unmount the SD card.
- Unplug the USB cable.
On your G1, everything you type on your keyboard is also being run in a hidden console with root permissions. So we will now start a telnet deamon in root mode.
Note: There are 2 ways to install the test keys, one is from the SD card and the other one is using ADB (from the android SDK). I recommend using the SD card method because this is easier for non-developers.
- First I recommend rebooting your phone after installing the telnet client and disabling the screen timeout.
- Press enter a few times to clear the hidden console.
- Type telnetd and press enter (It will open up the contact search while you’re typing but don’t worry this is normal).
- Open the application tab and start the telnet client.
- Keep the settings (server: localhost with port: 23), press connect to server.
- You should now see a console.
- Hit enter a few times to clear the line.
- We first need to mount the system, type:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
- Next we need to copy the keys to the system dir, type (one command at the time!):
cd /system cat /sdcard/recovery_testkeys.img > recovery.img
- Now its time to flash the image, type:
flash_image recovery recovery.img
- Turn off the phone.
- Hold the Home + Power button to start in recovery mode.
- If you did it the right way you will see a triangle with an exclamation mark.
- Press ALT+L
- It should now say something like Android system recovery utility Using test keys.
Your phone should now be ready for custom firmwares.
Customizing the bootloader
Installing the bootloader allows developers to test patches from the android code base (cupcake, Cupcake, CUPCAKE!). The following instructions will work on any G1 that is using the custom firmwares from Jesusfreke (v1.3). The following instructions will work on any G1 using RC29.
The installation process is the same as installing a new android os update. This update wont overwrite your OS (Bootloader and OS are two separate parts)
- Mount your SD card (connect the USB cable).
- Delete everything that is on the SD card.
- Download the file EngBootloader_v2_NoSigCheck.zip from this XDA topic (mirror)
MD5sum: 8008e01cb2c35e06b704e4dfb624ce4e
- Rename the file to update.zip and copy the file to the SD card.
- Unmount the SD card.
- Unplug the USB cable.
- Turn off the G1
- Boot into recovery mode (Home + Powerbutton)
- Press Alt-L (View console)
- Press Alt-S (Install update)
This takes a few minutes, xda states:Take particular caution not to interrupt the process, as a damaged SPL block will irreversibly brick your G1.
- When the update is done, restart your phone.
- To confirm that you installed it properly, power off your G1.
- Power on your G1 with Power + Camera button.
- You should now see a picture of three androids on skateboards.
- Exit the bootloader by pressing Call + Menu + End.
If you want to revert to the original G1 bootloader, use the file attached in the XDA topic.
Updating to a rooted firmware
Note: This section is a bit outdated.
If you are unfamiliar with the different types of firmwares, I recommend to use either the Official ADP firmware (1.5) from HTC or a customized firmware made by Jesusfreke. If you’re upgrading to a new firmware, be sure to apply the radio update before the system/recovery image.
General instructions for updating to a new firmware
(Outdated, new Jesusfreke firmwares are available)
Its now time to install the custom firmware. Currently there are three flavours available:
- RC30 (USA) Jesusfreke v1.3
- RC8 (UK) Jesusfreke v1.3
- ADP1 (Android Development Phone) Jesusfreke v1.3
If you are a normal user that wants to have root access, install RC8.
If you are an advanced developer that wants to do kernal hacking, install ADP1.
Unless you’re using a T-mobile USA sim, do not install RC30 because this version comes with myfaves. Depending on your provider this could cost money. You will also get messages from your provider about sms messages that could not be delivered.
The RC8 and ADP1 release comes with all the apps of RC30 (excluding myfaves) so you wont miss anything.
I will now continue on how to install RC8 on your rooted G1.
- Mount your SD card (connect the USB cable).
- Delete everything that is on the SD card.
- Download RC8 from this topic (filename JFv1.3_RC8.zip) (mirror)
- Rename the file to update.zip and copy the file to the SD card.
- Unmount the SD card.
- Unplug the USB cable.
- Turn off the G1
- Boot into recovery mode (Home + Powerbutton)
- Press Alt-L (View console)
- If you updating from RC30 to RC8 it might be wise to perform a wipe (Alt-W).
- Press Alt-S (Install update)
This takes a few minutes, do not interrupt the process or you may brick your phone. - When the update is done, restart your phone.
- Congrats! If no errors appeared you should now have a properly working RC8 with root access.
- You can now sign in with your gmail account (You probably need to fill out the APN settings again).
Because we changed our signature keys to use test sign keys, updates from T-mobile or google wont install anymore (OTA Updates). Future updates need to be installed manual.
Used sources / Credits
- HTC Dream Service Manual (Mirror).
- Downgrade instructions by Disconnect.
- Modded recovery and boot images by Jesusfreke.
- Wiki entry on installing the testkeys at ModMyGphone.
- Getting root on a G1 at XDA.
- Custom firmwares by Jesusfreke.
(RC30 USA, RC8 UK, ADP1 Android development phone) v1.3. - Engineering bootloader for G1 posted by Jashu.
Special thanks to
Disconnect, hmepass and JesusFreke for helping me downgrade my G1.
One response
Hi, So far I’ve downgraded using the HappyNewYearUK zip. My build number is kila_uk-user 1.0 TC5-RC7 112931 ota-rel-keys,release-keys. I was just about to continue onto installing testkeys but then I read the Updating to a rooted firmware section. You say be sure to apply the radio update before the system/recovery image if you’re upgrading to a new firmware. So I want to be going from rc7 to a custom rom, probably the Jesusfreke rc8 to start off with. Would I need the radio update and if so where would I get it and how would I go about applying it? Many Thanks