1. sd_shadow's Avatar
    [How To] Root 4.5.621 with magic md5 (does not require Milestone SBF)

    bhigham /beh modified the root method
    based on New D2 root method for stock 2.3.4 (621/622) found (Droid2, R2D2)

    How this works
    Originally Posted by phifc
    There's an exploit in loadpreinstall.sh. It compares md5 sum files of preinstalled apps and if they're different, copies the md5 to the local cache. The preinstall just has an empty file in app/ so it will parse the md5 for it. Instead of an md5 sum, it contains a local.prop that allows adb root shell. So the system thinks it's copying the md5sum to the cache when it bounces off the symlink and overwrites the /data/local.prop, giving adb root on next reboot
    originally posted by bhigham /beh
    Since all these devices (Droid 2/R2D2/D2G/DX2 and DX seem to be vulnerable to the same exploit found by phifc at
    I have assembled rooting methods for all of them in EzSbf style CD. I have tested it on my D2G, and the same method has been tested by multiple users on the D2/R2D2, and has worked fine.
    Credit for this method go to phifc, djrbliss, and the others who developed the method.
    I have simply taken the method, and assembled the tools.
    Credit for the idea behind the CD method should go to 1KDS, as I have mostly patterned this CD after his method.
    Credit should also go to Skrilax_CZ, as without his Motorola Android Firmware (De)packer, we wouldn't be able to have a 55 meg CD that covers multiple devices.
    Special thanks also to themib for testing and troubleshooting on the DroidX2. In fact, since I don't have a DX2, he actually did a majority of the work in finding a method that would work (the method for the D2 and D2G doesn't quite work), and then we worked together to get it assembled and working.

    This CD is for the D2,R2D2, D2G, and DX on Android version 2.3.4, and the DX2 on 2.3.5.
    One note if you have troubles with it not working. It might be necessary to disconnect the phone after it flashes the preinstall and reboots. It seems that some phones may not complete the reboot process before being rebooted by ADB, so you may need to disconnect the phone when it starts booting, and let it boot fully before hooking it back up. when hooked back up, it will be rebooted, and should go on with the process like normal.

    Of course, like all other things here, I have done my best on this, but there are no guarantees, and anything you do on your phone is at your own risk.
    So, without further ado, here is a link for the CD
    and the md5 is
    How to verify the file was downloaded correct with
    MD5/SHA-1 Hash Checksums

    has options for D2, D2G, DX, and DX2
    burn image to cd with imgburn , (Instructions, Window 7 - Vista and XP )
    or flash drive use UNetBootin for Windows (Instructions from pendrivelinux.com )

    basically read onscreen directions

    Reboot PC
    Hit F12 (sometimes F8 or esc) during boot to go to boot menu
    Select drive image is on
    wait for yellow "boot baby... boot" screen
    You will see yellow dots for 3-5 minutes then the script will start

    select DX
    don't use numbers on right side of you keyboard, just use the ones above qwerty

    turn phone on, connect to pc with usb cable

    check usb debugging (settings/apps/development)
    select charge only usb mode

    press continue
    adb will push
    data/local.prop /data/preinstall_md5/magic.md5
    reboot phone to bootloader (Hold volume up+down buttons and power button, or hold Vol.Down and Camera and wait for the screen to flash)
    repacked sbf will be flashed (less than 50mb)
    phone will, reboot twice, very important (reboot just replaces the local.prop, but the old local.prop is still in memory, till second reboot)
    adb pushes su,superuser, and busybox
    reboot to recovery, wipe cache (should auto reboot to recovery, at android andy press both volume buttons, if it doesn't press home button and hold it in then press your power button, hold it in also till you see a triangle on the screen w/ android andy then press both volume buttons)
    then select reboot

    if you have a mac
    try How to burn an .iso on mac
    and Boot your Mac from CD, DVD, external drive, or USB flash drive

    thread list Magic MD5 Root 2.3.4 for D2, R2D2, D2G, DX and 2.3.5 for DX2

    Links to FAQs, SBF, ROMs, Guides...
    10-04-2012 12:18 AM
  2. sd_shadow's Avatar
    01-17-2013 12:31 AM
  3. sd_shadow's Avatar
    motorola system versions 4.5.62X, can now be rooted with
    [ROOT] Framaroot, a one-click .APK to root
    I have verified it works with these Motorola devices running android 2.3.4
    Droid 2 (a955), Droid 2 Global (a956), R2D2 (a957), & Droid X (MB810)
    05-03-2013 03:25 PM

Similar Threads

  1. [GUIDE] How To Root/Unroot The Thunderbolt with Revolutionary
    By Cyber Warrior in forum Thunderbolt Rooting, ROMs, and Hacks
    Replies: 774
    Last Post: 11-15-2013, 12:55 PM
  2. SBF & Root 2.3.4/4.5.621 with magic md5 method
    By sd_shadow in forum Droid 2 Rooting, ROMs, and Hacks
    Replies: 14
    Last Post: 05-03-2013, 03:24 PM
  3. How to root the Optimus S with a Mac?
    By enrigayboy in forum LG Optimus S Rooting, ROMs, and Hacks
    Replies: 20
    Last Post: 04-08-2012, 11:49 PM
  4. how to root droid with 2.1
    By mrwest1990 in forum Motorola Droid Rooting, ROMs and Hacks
    Replies: 9
    Last Post: 04-01-2010, 07:14 PM