How To Hack the Motorola XOOM Android Tablet

Whether it’s the new iPad Killer or not, one thing’s for sure—the Motorola XOOM is hackable. Just hours after its release last week, Verizon’s new Android-based tablet (running Honeycomb) was rooted by hacker Koushik Dutta, which seems easy enough.

“Since it’s another Google experience device, and ships with fastboot support (albeit, limited), it really does come rooted out of the box. Just needed to figure out the board kernel base, and compile up a new kernel.”

To learn how to root your new Motorola XOOM tablet, just follow Koushik’s directions below. If you prefer to keep your XOOM as is, take a gander at all the XOOM has to offer with the Android 3.0 operating system.

Warning

• If you root your device now, you will NOT be able to upgrade to 4G LTE from Verizon. Rooting the XOOM will void your warranty and it will not be upgradable to their upcoming 4G LTE service. Click here for information on upgrading your XOOM.

In order to root the Motorola XOOM, you will need adb (Android Debug Bridge) and fastboot installed on your computer.

Step 1 Download USB drivers

To get started, you’ll need to first install the Motorola XOOM’s USB drivers, which you can get here or here.

Step 2 Download the Android SDK

adb is contained within the Android SDK, and is a tool that lets you manage the state of an emulator instance or Android-powered device.

It is a client-server program that includes three components:

• A client, which runs on your development machine. You can invoke a client from a shell by issuing an adb command. Other Android tools such as the ADT plugin and DDMS also create adb clients.
• A server, which runs as a background process on your development machine. The server manages communication between the client and the adb daemon running on an emulator or device.
• A daemon, which runs as a background process on each emulator or device instance.

Download the Android SDK for your operating system (Windows, Mac OS X or Linux). If you need help on installing the SDK, check out the step-by-step instructions.

Once installed, you can find theadb tool in<sdk>/platform-tools/. Or directly in the tools folder of the Android SDK folder.

Step 3 Download fastboot

In addition to the adb tool above, you’ll also need to get the command-line fastboot tool to flash the system image of the device. Flashing your device in this way is useful if you need to install the radio and system images independently or you are already familiar with fastboot and are using it successfully in your environment. To use this method, your device must have a fastboot-compatible bootloader. Having the original factory bootloader included on ADP devices is not required.

If you insist on compiling the code yourself, the fastboot source code is available in the Android open source repository and is compiled whenever you build from that tree. If you’ve built from the Android open source tree, you will find the fastboot executable in this location:

<build-dir>/out/host/<platform>/bin/

But if you don’t want to bother with that, just download the fastboot executable directly at the HTC Developer website.

Step 4 Download the XOOM root file

You can get XOOM root ZIP file right here, which is built with the tegra: stingray kernel.

Step 5 Unzip the package

Use an un-zipper tool like WinZip or Apple’s built-in support for unpacking ZIP files. It includes three files: rootboot.img, su, and Superuser.apk.

Step 6 Power Off the XOOM

Make sure your XOOM is connected via USB and then power if off.

Step 7 Reboot

In order to reboot, press the volume down and power buttons at the same time. Don’t release the buttons until you see “Starting Fastboot protocol support” in the upper left-hand corner of the XOOM display.

Step 8 Open up a terminal window

Open up a terminal window (or command prompt if on Windows) and navigate to your Android SDK “tools” folder (inside the Android SDK folder, where you installed that to) where fastboot resides. Then enter the command:

fastboot oem unlock

Step 9 Unlock the XOOM

On your XOOM’s display, you should see a warning message asking if you want to continue unlocking your device. Doing so will void the warranty. Press the volume down button until it states “Yes“, then press the volume up button to beginning unlocking. Wait for a reboot.

Step 10 Enable USB Debugging and reboot

Once your Motorola XOOM has rebooted, connect to a Wi-Fi network or Verizon’s network, but avoid setting up a Google account on your new Android tablet. Then, go to Settings > Applications > Development and enable USB Debugging.

Reboot your device using this command in your terminal window:

adb reboot bootloader

Step 11 Flash the boot image

In the command prompt, use this command to flash the new boot image with fastboot:

fastboot flash boot rootboot.img

Step 12 Reboot

In the command prompt, reboot your device using this command:

fastboot reboot

Step 13 After rebooting…

Wait for the XOOM to reboot to the lock screen. In the terminal window, input the following commands (hitting Enter after each one):

adb remount
adb push su /system/bin/
adb shell
ln –s /system/bin/su /system/xbin/su
chmod 4755 /system/bin/su
exit
adb push Superuser.apk /system/app/

Step 14 Verify

To check and make sure you had a successful reboot, enter adb shell into the command prompt and you’ll get a # prompt.

And that’s it—the Motorola XOOM is now rooted with the Superuser app.

Warnings

• The Motorola XOOM’s microSD card slot is not active. A future software upgrade
  will enable this device to support microSD cards up to 32GB. So keep in mind, due to nonfunctional microSD card slots in the device, you won’t be able to recover your device, at least not until they release a firmware update that enables the slot. I’m guessing it won’t get the firmware update until it’s ready for 4G LTE.
• For updates on a working recovery, check on Koushik Dutta’s website.
• ROM Manager support will come as soon as the microSD card slot is updated, free and premium versions.
• Never accept a Verizon or Motorola update after rooting!