• Welcome to Overclockers Forums! Join us to reply in threads, receive reduced ads, and to customize your site experience!

How to Gain Root Access on a Sprint Htc Hero CDMA phone Using a Mac.

Overclockers is supported by our readers. When you click a link to make a purchase, we may earn a commission. Learn More.


Nov 4, 2003
Ill post this here since i had the worst time trying to find out how to do this.

I repeat myself alot, but its to reiterate points. I dont post many build logs on here because i really dont have time to constantly check all the forums im on and the forums that i run, but i want the information to be readily available to everyone. Ill do my best to help troubleshoot issues.

This guide will work for anyone running Mac OSx 10.6.1 and attempting to root a Sprint HTC Hero CDMA phone running the Android OS as of December 15th.


A couple things to add to this guide, for the complete noob, as I can try to explain it a little more clear.

This should be done prior to doing anything within the guide.

First, connect your phone to your computer and mount your sd card. This can be done by connecting the usb cable, then on your phone, drop down the menu and chose, connect to p.c., Mount SD card. Make a folder and backup your entire sd card to this folder. Once done, delete everything off the card. if you don't, you will run into format and partitions errors later in the guide.

Eject the sd card on the computer, and end usb sharing on the phone. remove the USB cable from the computer.

Next, on the phone Go to Settings > Applications > Development>USB Debugging

Make sure that USB debugging is NOT CHECKED. If its checked later in the guide you will run into errors pushing the files onto the phone.

Rooting The HTC HERO Process

Plug in your phone

Download Android SDK: http://developer.android.com/sdk/index.html

Unpack, Rename the extracted folder to "AndroidSDK" (This is case sensitive!), and Move it to "Applications" (I consider the Android SDK a set of applications.)

Open TextEdit, Click Format>Make Plain Text, then copy and paste the following:

export PATH=${PATH}:/Applications/AndroidSDK/tools

Save as: ".bash_profile"

This file should be saved in your user folder.

/Users/USERNAME where USERNAME is the name of your user account.

For instance my User account is Hamspiced so my user folder is:


when saving the file, uncheck "if no extension is provided, use .txt".

On Phone: Go to Settings > Applications > Development>USB Debugging and make sure the option is checked.

On your Mac: Download asroot2: http://zenthought.org/tmp/asroot2
Save this file into: /Applications/AndroidSDK/tools

Open Terminal and run the following commands (You can copy and paste):

cd /Applications/AndroidSDK/tools

./adb push asroot2 /data/local

./adb shell chmod 0755 /data/local/asroot2

./adb shell

 /data/local/asroot2 /system/bin/sh

mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system

cd /system/bin

cat sh > su

chmod 4775 su



At this point, the phone has root access.

you can verify this by downloading Terminal emulator from the Market, then running the app. Once inside the app if you hold Menu, you should bring up the onscreen keyboard. if you type in "su" (stands for super user) it will change the prompt from $ to #. If yours does not change, start over, something went wrong. If it did change then you can proceed to the next part of this guide.

Next part of this guide, we are going to put the recovery Image to your phone. This doesnt restore your phone, it just puts the recovery portion to it, and it allows you to do all the cool things to your phone, like allow you to create backups, restore backups, and load customs roms.

Download: http://rapidshare.com/files/30379752...roc-v1.2.3.img
Save this file into: /Applications/AndroidSDK/tools

Go back to your terminal it should still be open, if not yur going to have to navigate back to your tools folder.

type or copy/paste :

./adb push recovery-RA-heroc-v1.2.3.img /sdcard/

./adb shell


flash_image recovery /sdcard/recovery-RA-heroc-v1.2.3.img



adb shell reboot recovery

If you get an access denied error pushing the recovery image, its because you had debugging turned on prior to connecting your phone to the computer. it must be off, then turned on once the phone is connected.

This will result in headaches, and endless google searching with no results.

Follow the rest of the guide regarding the Nandroid backup this backs up the entire phone settings. you want to save the raw phone backup as well as the backup after you load the rom. both are incredibly important!

Nandroid Backup

*NOTE: These steps assume that you have already entered Recovery Mode on the phone through Terminal "adb shell reboot recovery" or the "Quick Boot" app.*

On phone: Using the trackball, scroll down and select "Nandroid v2.2 backup". This will create a backup of the phone in its freshly rooted state to your SD card, under the nandroid directory.

After it completes the backup, we want to make sure that we have the backup "backed up" by copying it to our Mac (Just in case anything happens to the SD card!).

Select "USB Mass storage on"

After your SD Card appears, copy the contents of the "nandroid" folder to anywhere you wish on your Mac (You are using Time Machine right?)

Once the copy is complete, eject the sdcard in mac and select "USB Mass storage off" on the phone.

NOTE: Nandroid does not backup the contents of your SD card. If you don't want to lose what's on your SD card, MAKE A BACKUP COPY!

From this point forward, if you do something that seems to really mess with the phones functionality, you can simply go back to your Nandroid backup!

Restore Nandroid Backup

Select "Nandroid v2.2 restore" *THIS WILL ERASE EVERYTHING ON YOUR PHONE*

Your phone will be returned to the condition it was in as of the last Nandroid backup. You can control which backup is restored by deleting the unwanted, time-stamped folders within the "nandroid" directory on your SD card. If you leave only one time-stamped backup folder, that is the backup that will be restored.

Note that this will leave the custom Recovery ROM we loaded (recovery-RA-heroc-v1.2.3.img) in place.

I actually perform a Restore after every Backup. While this takes extra time, you know your Backup is intact and not corrupted in any way!

If you are looking for a complete factory reset, you will need to scroll up to "TRUE FACTORY RESET (UN-ROOT)"


For those unaware, apps2sd allows you to save internal phone memory by placing after-market applications onto your SD card. Most users notice a speed benefit from this.

Select "USB Mass storage on"

The mounted drive should now be empty. Double-check that it was partitioned correctly by opening Disk Utility and verifying 3 partitions on the sdcard: NONAME, disk1s2, and disk1s3. Close Disk Utility.

If when you checked Disk Utility and your SD card didnt partition properly follow these steps. if it has partitioned properly, you may continue to the next section

You must erase everything on your sd card for these steps to work. I ran into errors creating the partition. What i had to do was in the recovery mode chose factory recovery. when the phone restarted i had to go to Settings>Security>Factory Data Reset.

This restored EVERYTHING. THe phone, Sd Card, Etc. Everything was lost, however since in the begining, we made a backup of the SD card, and then we made a backup of our phone, we are fine.

Restart the phone in recovery mode once this finishes and restarts. (Hold Home and Power to turn on)

Next chose Part SD: fat32+ext2+swap this will partition the card properly. Then choose restart phone.

Once the phone restarts, we have to go through the normal steps that we did once we first received the phone for its first bootup. connect it to the computer, transfer over the Nandroid backup that should be saved from the first time you saved it on your phone. then restart the phone again in recovery mode.

Now you need to restore the nandroid backup. since you transferred it over, its the only nandroid backup there is, it will restore the phones origional settings. from here you can load the official MoDaCO rom fine on the SD card that is now formatted properly.

LOAD Unofficial MoDaCo 1.2c Core ROM

Download: http://www.mediafire.com/file/jtubddzod1o/update.zip

Save this file into: your SD card. (the root of your SD card, probably named "NONAME" if you didn't change it. You can change it to whatever you want though.)
Save the file as: "update.zip" (Or rename it)

Eject your sdcard and Select "USB Mass storage off"

Select "Apply sdcard:update.zip"
Select "Reboot system now"

If it successfully loaded, you now have a fresh load of the Unofficial MoDaCo 1.2c ROM! Congrats!

I would recommend that you create another Nandroid backup. Scroll back up to "NANDROID BACKUP" and follow the steps over again and come back to this point.

Your phone is now rooted, you installed the SDK and the unofficial rom to allow you to store Apps to your flash card. this frees up alot of space on the hero, allows the card to store the cache, and speeds up the phone quite a bit. However, the Flash card is now part of the OS. As a result you need to make sure you have a speedy flash card. I reccomend a Class 6 in the largest size you can get.

but thats me. I ran into so many issues following guides from everyone else. So i put this guide together from 3 other guides i followed, and copy pasted my own terminal executions. you can follow all of the other guides i did from these urls


they arent very organized and have seperate threads for each persons rooting experience.

The reason im posting this here, is because i posted the issues you will run into, and the resolutions, as well as the guides i followed. this took me about three days of searching, one day without use of my phone. You all know better then to come to me if you brick your own phone, Google search like i did or post up here if you have specific parsing errors. but for the most part it should be direct copy pastes.

TJ 123

New Member
Nov 15, 2010

Hey so I did all the steps (and double-checked them) and when I got to typing the things into Terminal, I got this:

$ mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount: Operation not permitted
$ cd /system/bin
$ cat sh > su
cannot create su: read-only file system

Why does it say "operation not permitted" and "read-only file system"?? I am sure I've done everything correctly, so what should I do?