Rooting your Rogers E911 Magic or Dream using exploid script.

In my quest to make rooting your E911 updated Rogers Magic/Dream easier for everyone, I’ve come up with a script that should take much of the guesswork out of it for you. This procedure is based on the exploid script that was originally used to root the Droid X the procedure was modified by @xdaterry to recently break the perfect SPL on the Rogers E911 Dream.

The exploit that it’s using should be compatible with the magic as well and I’ve written the script as if it was. However, I don’t have an uprooted device to test it with. My script is written on a Windows XP box but if you have ADB working on a Vista/Win7 box it should be fine there as well. This will wipe all the data from your phone, so make sure that you back everything up before attempting it.

OK, Here are the instructions for you……

1. Download the RogersRoot zip file and extract it anywhere you would like to.

2. Open the Readme.txt file and read it!!!!!!!!!

3. Run the RootMe.bat file and follow the instructions.

Included in the package are all the required files to perform a Root and ROM change to CyanogenMod 6.0.0



74 Responses to “Rooting your Rogers E911 Magic or Dream using exploid script.”

  1. Tweets that mention Rooting your Rogers E911 Magic or Dream using exploid script. « The GreatBigDog Report -- Says:

    […] This post was mentioned on Twitter by Puleen Patel, Don Rayner. Don Rayner said: Rooting your Rogers E911 Magic or Dream using exploid script.: […]

  2. JR Says:

    Probably a silly question, but I haven’t been following the Rogers Magic threads for some time. I have a rooted Magic running CM 5.0.7 sitting on my desk with the radio and the original SPL (1.33.0009). I’m also flashed the RA-sapphire-1.7.0H recovery image.

    In order to get to a point where I can follow your guide correctly, could I just apply the Rogers Magic E911 update to my phone in its current state? Or do I have to revert back to the Rogers Android 1.5?

    • GreatBigDog Says:

      I’m not sure why you would want to follow my guide if your already rooted. Could you let me know what your trying to accomplish?

      • JR Says:

        Rogers nukes my data as I am not compliant with their E911 update checks (i didnt want to sign their waiver). So I was considering following your guide in order to maintain root, but get past the Rogers E911 checks. know what i mean?

      • GreatBigDog Says:

        Hey JR,

        You don’t need to run an entire rooting process to get the Dream radio on your Magic. It just looks like you’re using the pre E911 Magic radio on your phone so all you have to do is replace the radio. The Hboot and Recovery that you have are already compatable with the Dream radio.

        Here’s what you need to do.

        1. Download the Radio
        2. Copy the file to your Tools folder where your adb.exe file is
        3. Enable usb-debugging on your phone “settings-applications-development”
        4. Connect your phone to the pc via usb
        5. Open up a cmd window on your PC and navigate to your tools folder
        6. Enter the following commands
        a) adb devices (you should see the phones serial number)
        b) adb shell reboot bootloader (wait until phone boots into fastboot)
        c) fastboot devices (you should see the phones serial number)
        d) fastboot flash radio Radio_HTC_PVT_32A_3.22.26.17.img
        7. After the radio has finished flashing, reboot your phone back to fastboot
        a) fastboot reboot-bootloader
        8. Check that you now have Radio
        9. Reboot your phone normally and you’re good to go.

  3. Benlg Says:

    Onfortunately, on Windows Seven, It stopped at :

    then I get the prompt and no other activity
    (911 updated Magic on Rogers)

    “adb devices” returns :
    list of devices attached
    HT95RN… device

    Guess I will re-root using UniversalAndroot 1.5.3 and do the full procedure when I have the time…

    • Benlg Says:

      Just realized that the adb process runs in 32 bit and I’m running Win7 x64 if it might explain the problem since adb push does work with my current setup

    • Benlg Says:

      Stucked at step 14 (it generated two step 14) of the generated procedure

      –path–\RogersRoot>adb reboot bootlaoder
      error: closed

      adb devices was listing “000000000000000 recovery” and the phone last line ended with “CACHE:…” (the “…” dont represent anything else)

      happy to say it did not break anything up to that step but after I successfully rebooted when all activity was stopped for an hours, I was not root and was running my old stock rom with antenna 6.35.x

      • GreatBigDog Says:

        In the generated procedure.txt file did you get End Line 14 or just the Begin Line 14?

        You may be rooted but the procedure failed to proceed past that point. Try booting into fastboot (Volume down + Power) and post back with your hboot. If it’s 1.76.2007, that’s the unlocked engineering SPL. Try to boot into recovery (Home + Power), if you can it should be RA-hero-v1.6.2.

        If it ends up that you’re Hboot is 1.76.2007 and Recovery is RA-hero-v1.6.2 then you can manually finish the rest of the procedure from Line 15.

      • Benlg Says:

        Like I said, the script did not got far at all…

        Begin Line 1
        End Line 1
        Begin Line 2
        End Line 2

      • Benlg Says:

        script stoppe before starting line 3
        Manually it stopped working at line 14

        Hboot now 1.76.2007
        radio still

        I can run root apps (backup for root actually) that do not require ‘su’ and I can run root command in connectbot using rootshell

        my ercovery is RA-hero-v1.6.2

        while in recovery and connect to usb, this windows shell command “adb reboot bootlaoder” returns “error: closed” and this command “fastboot flash radio Radio_HTC_PVT_32A_3.22.26.17.img” locks in a “waiting for device” indefinitely

      • Benlg Says:

        just realized the procedure as a possible spelling error, could that be my problem for being stuck at step 14?
        should I reboot in recovery and try “adb reboot bootloader” in place of copy-pasting “adb reboot bootlaoder” from the procedure.txt

      • GreatBigDog Says:

        Yep there’s a typo there.

        You can just boot right into the bootloader directly and skip that step. Boot your phone by holding the volume down & power key until you get hboot screen with the 3 androids at the bottom. Press the back key and the phone should show Fastboot in the middle of the screen somewhere. If it’s plugged into the USB it’ll show Fastboot USB.

        You can then carry on from step 15


    • Benlg Says:

      Thanks, your supplemental instructions worked perfectly, and step 19 took just under 5 minutes for my HTC-Magic now running Android 2.1 update 1

      thanks again!

      Can’t wait for a stable Cyanogen froyo ROM to be available!

  4. Benlg Says:

    3G worked for the first 10 minutes… but now it looks cut of.

    Do I need to call them and bull shit them to get it back?

    • GreatBigDog Says:

      Hey Benlg,

      Boot your phone into fastboot and post back with the Hboot and Radio information, I just want to check it to make sure.

      If it’s the correct Radio, you’ll just need to call Rogers tech support and do exactly that “Bullshit them”. Just tell them that your phone was working perfectly fine and then 3G stopped working. Yes you have the E911 update and have had it running ok for months that way. You’ve tried rebooting your phone, pulling the battery but 3G just won’t work. Ask for a network refrech.


  5. Honz Says:

    Hmm. I too seem to be having difficulties now with my data. I’m with Fido (although most things say rogers, and I even have a subsidy locked rogers phone which works(ed) just great with fido).

    I rooted and installed CM6 RC2 last week on the 13th of August and everything ran just great for a few days (on radio Now I’ve got no data. I’ve tried the radio posted above ( but still, no data.

    I will try hacking around with different radios but I doubt that will work as 26.17 is the “highest” (version?) number I’ve seen.

    Anyone with any ideas?
    Does anyone know what the required/minimum radio versions are for rogers?

    • GreatBigDog Says:

      You lost your data because if the first radio. Once you switched to the radio you need to call rogers tech support and get them to do a network refresh.

      You should be good after that.

  6. Filk Says:

    I have rooted 3 phones now. One Dream and Two Magics. The first two are working perfectly. The last one (a magic and the one I use regularly) has a problem with updated Google Maps force closing all the time. I can never run it for more than a minute or two with the updates. It runs fine prior to the update.

    Is anyone else seeing this? Can I try the CM6 RC?

  7. John Says:

    Right away it tells me it’s “Waiting for Device” after I type in “Magic” What driver am I supposed to have? Is it supposed to be the Dream drive or one specifically for the Magic?

  8. Alex Says:

    Hi GreatBigDog

    I’m trying to use your script to root my Magic on WinXP and looks like it’s stuck on “WAITING FOR DEVICE”.

    Have I done anything wrong? Phone is ON, set on USB debugging, connected to the PC with HTCSync installed.

    • Alex Says:

      …and sometimes the script exists with “DEVICE FOUND”

    • GreatBigDog Says:

      Hi Alex, I was on Vacation and am just getting back into it now. Are you still having your problem with the script?


      • Alex Says:

        Hi GBD,

        No problem at all, I figured in the end that the script only works with all files are in C:. I have rooted my Magic using the manual procedure included in zip file with one comment that I remember there is an omission at one step – “shell” needs to be added.

        Now I have a question for you, I am according to your comments using the Dream radio on my Magic and that has some issues. I do have moments when my phone is not receiving calls or text messages and /or is in an undefined state that can be fixed with Airplane Mode on/off or reboot.

        Is there a version of radio that I can install and use with the current rooted configuration that has been written for my Magic?

        My phone is at this stage now:

        Sapphire PVT 32A Eng S-OFF H
        HBOOT-1.33.2010 (SAPP50000)

        Thanks! and welcome back 🙂

      • GreatBigDog Says:

        I did have problems with missing calls and texts with CyanogenMod 5.0.8 on my HTC Dream. I never did have any problems on my HTC Magic. I solved the problem with the Dream by updating the OS to CyanogenMod 6.0.0RC3. The phone runs much better under Android 2.2 now than it ever did under 2.1.

        Both my Dream and Magic are now running CM6, My Daughter uses the Dream with RC3 as her only phone and is not having any problems with it now like she did with CM5.0.8. I run the latest nighly builds of CM6 on my Magic and use it about 25% of the time (Remainder is with Xperia X10). I don’t have any issues with it and I’ve not missed any calls or texts with it.

        Let me know if you want to go the CM6 route and I’ll let you know how to go about it.


      • Alex Says:

        Hi GBD

        Thanks for the fast reply!

        What would I need to change so that I can install CM6 RC3 or newer on my Magic? I’ve heard people complaining that CM6 is worse for battery life and that is really lagging while in the launcher…is that true? No unexpected reboots or other problems.

        You have the configuration I am at the bottom of my previous message.


      • GreatBigDog Says:

        Your current settings are great for running CM6 and as of Friday it now has a stable release. You can find the files that you need to to flash on the CyanogenMod form, the link to the post is below. I find that CM6 is much better with battery performance than CM5 ever was.

        – Download the three files in the post and copy then to the root of your sd card

        – reboot your phone into recovery (Home + Power)

        – Do a nand backup

        – Perform a wipe (Sorry you’ll have to setup the phone again)

        – Flash Zip from SD card in this order 1) 2) 3)

        – Reboot the phone. If the phone boot loops on you, just boot back into recovery and flash the first two files again.


      • Alex Says:

        I’ll try that right now! Is there a way to backup my SMS messages and applications? Especially that I have just bought Smart Keyboard?

        Thanks a lot!

      • GreatBigDog Says:

        You can download sms backup & restore from the market to backup sms messages.

        You’re purchased apps will be available for download again once you log back on with your gmail account. You won’t have to purchase then again.

      • Alex Says:

        Successful installation! Thank you GBD! 🙂
        Works fine so far…but it’s too early to say much.

      • Alex Says:

        Hi GBD,

        CM6 is great and I love it but my phone is still getting into that state where it shows that its radio is connected to the GSM/3G carrier when it’s not and I can’t call/sms 😦

        Do you know of any other radio I could try? I don’t mind signing the waiver and getting the newest written for my phone (I understand that the one I’m using now – Radio_HTC_PVT_32A_3.22.26.17.img, was written for the Dream.


      • GreatBigDog Says:

        So strange, I’ve not had any problem with not being able to make calls or send/receive SMS messages on that Radio, I’ve been using it since CM5.0.7. If anything, I find that at times my signal strength will show 0 bars and I can still make calls.

        You could try wiping the system and then reflashing CM6

        1. Boot phone into recovery and perform a nand backup
        2. Plug your phone into your PC via USB
        3. Open up a cmd prompt and navigate to where you extracted my script files
        4. Enter the following
        Adb Devices (you should see device s/n lited)
        Adb shell reboot bootloader (wait for phone to boot to fastboot)
        Fastboot Devices (You should see devices s/n listed)
        Fastboot erase system -w

        5. After the erase is complete reboot the phone into recovery (Home + Power) and flash the three files you download from the CyanogenMod forum, flash the CM update first, then EBI1 port then finally the gapps file.

        If you are still having problems with reception on your phone then you can sign the waiver on Rogers site, sorry I don’t have a link. After the waiver is filled out you can then download and flash the pre E911 magic radio.

        Here is a link to Radio

        To change the radio copy the radio to the folder where you extracted my script files and follow steps 1 to 3 above, then

        4. Enter the following
        Adb Devices (you should see device s/n lited)
        Adb shell reboot bootloader (wait for phone to boot to fastboot)
        Fastboot Devices (You should see devices s/n listed)
        Fastboot flash radio Radio_HTC_PVT_32A_3.22.20.17OldRadio.img

        Reboot your phone and you’re not using the HTC Magic Pre E911 EBI1 Radio.

        Hope this helps!! gbd

    • Alex Says:

      Hi GBD,

      I’ve decided to sign Rogers’ waiver and switch to the old radio because this is not acceptable. I literally don’t know when my phone is working (accepting calls or not) and because I don’t want to give up CM6 I will do that.

      I have a problem thou…cannot complete the waiver application at, when I click submit it keeps saying ” Please enter a valid serial number. ” – I have tried both IMEI and S/N and also while I was and wasn’t logged in into My Rogers account.

      Any idea about this? Can people still sign that waiver? Maybe at their end they don’t accept this anymore.

      On a different note what is the difference between EBI0 and EBI1?

      Thanks a lot!

  9. Kyle Says:

    So on both my magic and dream the script dies as soon as the device is found… :s

  10. Mike Says:


    When I tell the program that my phone is a Magic (First step), it says waiting for device, then quickly shows, “device found” and then closes the window. Nothing happens after this. Can you please help?


    • Filk Says:


      I got that, too. But if you look in the directory there is a new file in there called “Procedure” (I think). You can open that up and follow the steps to root the phone. I think the script fails because it is looking for the files in C:\

      If I’m wrong GBD01 can correct me.


      • mike Says:

        Thanks. I have tried it manually and have issues when I try to push the files to phone. Either says permission denied or could not copy because of read only file system. I’ve tried so many methods and still can’t get it rooted!! Driving me crazy


  11. Mikes Says:

    Hi, I tried rooting with this method manually but when I try to push the files to phone, it wont let me and says it is a read only file system. Do you know what might be wrong?

    thank you

  12. CR Says:

    Hey guys!
    Just got an used HTC Magic from Rogers.
    When I boot it using the back+power key this is what I see:

    HBOOT-1.76.0010 (SAPP50000)
    Jan 12 2010,00:14:58

    Is it possible to use this batch file to root/upgrade this phone to Froyo CyanogenMod?

    Thanks much!


  13. Slav Says:

    Thanks so much for this guide…Finally running 2.1 on my Magic! One question for GBD. Prior to rooting my data icon showed “H” now only “3G”. Am I still getting the same speed as prior to rooting and its a icon issue or is the data slower now?


    • GreatBigDog Says:

      Because of complaints from some CyanogenMod users (I guess G1 & MT3G didn’t have the H) it has been removed. Now both 3G and HSPA are shown as 3G on the phone. If HSPA is available the phone will still use it but only show the 3G icon.


      PS. Sorry for the delay, Vacation 🙂

  14. slc334 Says:

    This was great! I’m one of those medium skill users who want the latest and greatest, but find it hard to understand the upgrade process. I have been looking to update for a few months and all I can find online is that it’s really hard to do… but then I come across this! Thank you sooo much! I can’t begin to say how exciting this has made my phone again! Thanks.

  15. Mikes Says:

    Unbelievable, it finally worked!!
    Much Thanks!!!

  16. Faraz Says:

    It worked for me! Using a Magic with the E911 update, I was able to quickly and successfully root, using CM6-stable instead. So far, everything looks fine, including data. I was tired of waiting for Rogers to push their 2.1 update.

    Many thanks!

  17. Forts Says:

    Excellent info on here, thanks GreatBigDog! I followed your original instructions several weeks back to root a stock Rogers Magic to Cyanogen 5, and just finished upgrading it to 6. No problems at all! Thanks for all your hard work here!

  18. J-dog Says:

    WAITING FOR DEVICE…. nothing happens.

    Also, adb.exe will just sort of sit there doing nothing until I kill it. I’m using Vista 32-bit. HTC sync is installed and connects to Magic.

    Sept 1st, still no 2.1 so I figured it was time to try this. Too bad.

    • J-dog Says:

      Update: I ended up doing it the manual way following Procedure.txt.

      Some thoughts:
      -Even though I have a Magic, the instruction are to install recovery-RA-hero-v1.6.2.img, the hero part threw me off but apparently this is fine

      -The second step 14 (there are two), make sure you go back into the shell (adb shell) and then type “reboot bootloader” (typo bootlaoder)

      The rest went pretty smooth, now running Cyanogen 6.0.

      Final thoughts: F!#k you Rogers! And thanks GBD!

  19. Scott Says:

    Hi GBD,

    So I’m having this major issue that is driving me crazy. I had previously rooted my Magic, no problem when the Magic was finally re-rooted after mandatory update. Last night I ended goofing and ran the mandatory update RUU again.

    So now, when trying to re-root I run into two problems:
    1) Your script bombs when it finds the device (Windows 7 64-bit)
    2) No matter what root instructions I look at, they all seem to require the hero recovery (RA-hero-v1.6.2) which doesn’t seem to be working for me. I can boot into the recovery, but anytime I try to flash and image, it returns this:

    E:Can’t mount /dev/block/mmcblk0p1 (or /dev/block/mmcblk0)
    (No such file or directory)
    E:Can’t mount SDCARD:

    This happens when I try to select the option of “Flash zip from sdcard”.

    I have tried three different micro SD cards: two 2gb cards, on 8gb card.

    Any light you can shed on my situation would be extremely helpful. Thanks,


    • Scott Says:

      Nevermind that. I found that by going into other, and clicking to move the log file to sd it allowed me to access the sdcard and all is golden now.

      Thanks GBD!

  20. Jonathan Says:

    Mine crashes at “device found”. Then nothing else happens!

    Im running Win7 64bit.
    Google USB driver (ADB component). But I cant run adb commands in command prompt.

  21. Stephan Says:

    Is there a way to restore 1.5 ?
    I did a nandroid backup after step 14 and i’m trying to restore the backup to get the data back before putting back froyo.

    I did a restore and a wipe but after the reboot , the phone is stuck at the rogers screen.

    adb devices shows nothing.


  22. Mark Says:


    I think I *may* have bricked my E911 Magic 😦

    I successfully followed all of the steps up until I got to flashing the radio but I was unable to get past “writing to radio” – fastboot freezes. I was able to launch fastboot again and see that the device was still connected, but after half an hour the radio still does not write…is this normal?

    Now when I boot up my phone the phone doesn’t get past the screen where it shows “HTC MAGIC”

    Here is the information from Fastboot:
    HBOOT-1.33.2005 (SAPP50000)
    Apr 20 2009,15:30:43

    Am I toast? Can I somehow revert to my old radio and hboot version? I wouldn’t even know which versions to revert to…fml can anyone help 😦


  23. Mark Says:

    Nevermind it’s fixed. I basically installed the new SPL BEFORE the radio was successfully written to the phone. Everything works now 🙂 🙂 🙂

  24. The Rogers Magic 2.1 Thread - Page 3 - Android Forums Says:

    […] That's his username here on the forums. The script, and all the files needed can be found here: CLICK ME! If you're using Windows XP it should work. I'm using Windows 7 and at first the script wasn't […]

  25. PCHTC Says:

    was already rooted but on 6.35 radio
    performed downgrade using your radio
    as well as the 2010 SPL
    went 4 days without any issues
    now rogers is cutting off my data

    are you sure that from the dream is ok
    could they be looking at somewthing else?

    maybe the build.prop

    what should i do?

    i realy dont want to return to the 6.35 radio
    the roms are no good

  26. PCHTC Says:

    Is this not happening to anyone else
    this is the 3rd day in a row that i wake up and rogers has cut off my data
    luckily if i turn off data and wait a minute and turn back on it returns
    but this is exactly what used to happen on .20.17
    then after a few days of that it would not return at all
    plus i have no data for that time

    my rom is good as my wife uses the same one on her rogers dream
    its CM6.0.0 final

    i have tried rebooting
    data seems to cut out arround 6am

    on another forum someone mentioned that the build.prop could affect it
    but what needs to be changed?

    • GreatBigDog Says:

      I don’t have that problem with mine. I thought I was the other day, but I was just in a bad signal area. Did you wipe the phone before you applied the cyanogenmod ROM?

      • PCHTC Says:

        yes i did
        full wipe
        my wifes phone is fine
        but its an actual dream
        mine is the magic
        its the same kind of data cuts i was experiencing on .20.17
        before it went out completely
        it was fine the first 4 days
        its now been doing this every morning for the last 3 days
        restarting the phone or the data connection fixes the issue

      • PCHTC Says:

        just noticed something, could it be the problem
        cm6 has 3 different apn settings

        old rogers apn (
        new rogers apn (….appl1..)
        mms only settings

        the new rogers setting had .’s instead of -‘s
        is it possible it was switching connections
        from old one to new one which was invalid

        i have removed all 3 and added only the newest all in 1 setting

        do you think this could be the issue

      • GreatBigDog Says:

        I’m using the all in one setting and my data is not getting cut off. I’ve actually used my magic exclusively for the last couple of days without any problems.

      • PCHTC Says:

        data was ok this morning with the all in 1
        but. rogers just released the official 2.1
        and rom cookers already released striped versions of it
        so i have returned to new radio
        the new rom is really fast

      • Alex Says:

        Hi PCHTC

        Do you have a link to the new radio/ROM stripped from Rogers’ new 2.1 update?


      • PCHTC Says:

        hey Alex

        the rom is cooked by Capychimp
        over at xda developers

        he now has 2 versions
        working on a third

        1- stock rom, with root, and super user
        2- without rogers apps, with root and superuser, and a bunch of goodies

        3- comming soon
        same as 2 but a bit less goodies, people felt there was toomuch in it

        anyways you can find it here
        dont forget you need to be on new radio and spl to use it

  27. Update: 2.1 OS upgrade for Rogers HTC Magic+ - Page 7 - Android Forums Says:

    […] can, GreatBigDog of these forums has a very slick method down: Rooting your Rogers E911 Magic or Dream using exploid script. The GreatBigDog Report Bewarned tho, some of those people having issues in this thread are trying to move to the official […]

  28. Joel Says:

    I’m getting a problem at step 8, flashing recovery-RA-dream-v1.7.0R.img

    It gives me repeated errors of:
    mtd:read error at 0x00000000 (Out of memory)
    mtd:read error at 0x00020000 (Out of memory)
    mtd:read error at 0x00040000 (Out of memory)
    and so on until it reaches:
    mtd:read error at 0x0004e000 (Out of memory)
    Then it proceeds to try to write block 0x00000000 and fails.

    Any ideas?

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: