Android root guide on Mac OS X Step #4 (Final): Unlock, Recovery and Root

You can now root (almost) any Android device on Mac OS X! (For caveats regarding the Samsung Galaxy S3 and (most) HTC devices, please see further down the description)

The series is now complete!!! This is the 4th and final installment of my fail-proof guide to rooting (almost) any Android device on Mac OS X. Make sure you have performed the first 3 steps beforehand. Here is the complete series!!

Step #1, Android SDK:
Step #2 Android File…


  1. Sir, your videos are really good, I am facing problem to unlock my zenfone 4 (ZD553KL) but no any command effects except fastboot devices. Please suggest me any solution if possible. Thanks in advance ūüėä

  2. I can't seem to fastboot my phone any hints? I keep getting ERROR: Unable to create a plug-in (e00002be) and everything freezes and I have to unplug the battery of my android but it starts normal.

  3. Question on an OLD Samsung SGH-A927 that's LOCKED! I've done all the steps through 3. Once in terminal, the ./adb devices command doesn't show any device. When I turn phone on in boot mode, it says … "DEMSBL BOOT Loader for MSN6290 More than Downloader v5.43". At this point, I could really use your help to get to the phone. I've opened Android transfer and it doesn't recognize phone either. If I turn the phone on just as normal, it takes me to the lock screen only. HELP? Thanks much for all your video work. Also, I'm sorry for ignorant comments by some who have never been outside of USA (it appears) and don't understand cultures. I total appreciate your input, advice and help. Looks like HK in the background. Though it could be Singapore too. ūüôā Enjoy both place and have been to 55 countries at this point. THANKS AGAIN and any feedback would be helpful.

  4. Can someone help me ?!! When i type in terminal this command " ./adb reboot bootloader " my phone restart automatically… and i don't see the bootloader interface… please help ^^

  5. Thank you so damn much, I thought I had no chance of successfully rooting with my Mac and thanks to your videos I've just done it.

  6. Hi Alex,
    I don't understand why I download a .zip file instead of a .img file about the "recovery clockwork touch". Is there something wrong from me?
    I try the same process but the smarthphone (samsung S2) just restart at point "./adb reboot bootloader"
    Thanks in advance for your help.

  7. @macgeekalex i have a prob with my my nexus 7 2013 3G. stuck on bootlogo. I can't mount cache or restore to factory settings. Can't fast boot oem unlock either! can you help?

  8. MacBook-Air-van-jelle:platform-tools Jelle$ ./adb devices
    adb server is out of date. ¬†killing…
    * daemon started successfully *
    List of devices attached 

    MacBook-Air-van-jelle:platform-tools Jelle$ 

    it said this too,
    Out of date. killing
    i don't know what it means but, i can connect to LGPCSuite, thats an program that you need to install from the LG website if you want to share music, photos, and documents to your phone, plz help

  9. hey, can someone plz help me, I've got an Lg Labello, also known as Lg L80+, i can't do that all with terminal, is just says:
    Last login: Sun Jun 21 12:11:00 on ttys000
    MacBook-Air-van-jelle:~ Jelle$ cd /Users/Jelle/Library/Android/sdk/platform-tools 
    MacBook-Air-van-jelle:platform-tools Jelle$ ./adb
    Android Debug Bridge version 1.0.32

     -a                            Рdirects adb to listen on all interfaces for a connection
     -d                            Рdirects command to the only connected USB device
                                     returns an error if more than one USB device is present.
     -e                            Рdirects command to the only running emulator.
                                     returns an error if more than one emulator is running.
     -s <specific device>          Рdirects command to the device or emulator with the given
                                     serial number or qualifier. Overrides ANDROID_SERIAL
                                     environment variable.
     -p <product name or path>     Рsimple product name like 'sooner', or
                                     a relative/absolute path to a product
                                     out directory like 'out/target/product/sooner'.
                                     If -p is not specified, the ANDROID_PRODUCT_OUT
                                     environment variable is used, which must
                                     be an absolute path.
     -H                            РName of adb server host (default: localhost)
     -P                            РPort of adb server (default: 5037)
     devices [l]                   list all connected devices
                                     ('-l' will also list device qualifiers)
     connect <host>[:<port>]       Рconnect to a device via TCP/IP
                                     Port 5555 is used by default if no port number is specified.
     disconnect [<host>[:<port>]]  Рdisconnect from a TCP/IP device.
                                     Port 5555 is used by default if no port number is specified.
                                     Using this command with no additional arguments
                                     will disconnect from all connected TCP/IP devices.

    device commands:
      adb push [-p] <local> <remote>
                                   Рcopy file/dir to device
                                     ('-p' to display the transfer progress)
      adb pull [-p] [-a] <remote> [<local>]
                                   Рcopy file/dir from device
                                     ('-p' to display the transfer progress)
                                     ('-a' means copy timestamp and mode)
      adb sync [ <directory> ]     Рcopy host->device only if changed
                                     (-l means list but don't copy)
                                     (see 'adb help all')
      adb shell                    Рrun remote shell interactively
      adb shell <command>          Рrun remote shell command
      adb emu <command>            Рrun emulator console command
      adb logcat [ <filter-spec> ] РView device log
    ¬† adb forward –list ¬† ¬† ¬† ¬† ¬† – list all forward socket connections.
                                     the format is a list of lines with the following format:
                                        <serial> " " <local> " " <remote> "n"
      adb forward <local> <remote> Рforward socket connections
                                     forward specs are one of: 
                                       localabstract:<unix domain socket name>
                                       localreserved:<unix domain socket name>
                                       localfilesystem:<unix domain socket name>
                                       dev:<character device name>
                                       jdwp:<process pid> (remote only)
    ¬† adb forward –no-rebind <local> <remote>
                                   Рsame as 'adb forward <local> <remote>' but fails
                                     if <local> is already forwarded
    ¬† adb forward –remove <local> – remove a specific forward socket connection
    ¬† adb forward –remove-all ¬† ¬† – remove all forward socket connections
    ¬† adb reverse –list ¬† ¬† ¬† ¬† ¬† – list all reverse socket connections from device
      adb reverse <remote> <local> Рreverse socket connections
                                     reverse specs are one of:
                                       localabstract:<unix domain socket name>
                                       localreserved:<unix domain socket name>
                                       localfilesystem:<unix domain socket name>
    ¬† adb reverse –norebind <remote> <local>
                                   Рsame as 'adb reverse <remote> <local>' but fails
                                     if <remote> is already reversed.
    ¬† adb reverse –remove <remote>
                                   Рremove a specific reversed socket connection
    ¬† adb reverse –remove-all ¬† ¬† – remove all reversed socket connections from device
      adb jdwp                     Рlist PIDs of processes hosting a JDWP transport
      adb install [-lrtsd] <file>
    ¬† adb install-multiple [-lrtsdp] <file…>
                                   Рpush this package file to the device and install it
                                     (-l: forward lock application)
                                     (-r: replace existing application)
                                     (-t: allow test packages)
                                     (-s: install application on sdcard)
                                     (-d: allow version code downgrade)
                                     (-p: partial application install)
      adb uninstall [-k] <package> Рremove this app package from the device
                                     ('-k' means keep the data and cache directories)
      adb bugreport                Рreturn all information from the device
                                     that should be included in a bug report.

    ¬† adb backup [-f <file>] [-apk|-noapk] [-obb|-noobb] [-shared|-noshared] [-all] [-system|-nosystem] [<packages…>]
                                   Рwrite an archive of the device's data to <file>.
                                     If no -f option is supplied then the data is written
                                     to "backup.ab" in the current directory.
                                     (-apk|-noapk enable/disable backup of the .apks themselves
                                        in the archive; the default is noapk.)
                                     (-obb|-noobb enable/disable backup of any installed apk expansion
                                        (aka .obb) files associated with each application; the default
                                        is noobb.)
                                     (-shared|-noshared enable/disable backup of the device's
                                        shared storage / SD card contents; the default is noshared.)
                                     (-all means to back up all installed applications)
                                     (-system|-nosystem toggles whether -all automatically includes
                                        system applications; the default is to include system apps)
    ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬†(<packages…> is the list of applications to be backed up. ¬†If
                                        the -all or -shared flags are passed, then the package
                                        list is optional.  Applications explicitly given on the
                                        command line will be included even if -nosystem would
                                        ordinarily cause them to be omitted.)

      adb restore <file>           Рrestore device contents from the <file> backup archive

      adb disable-verity           Рdisable dm-verity checking on USERDEBUG builds
      adb keygen <file>            Рgenerate adb public/private key. The private key is stored in <file>,
                                     and the public key is stored in <file>.pub. Any existing files
                                     are overwritten.
      adb help                     Рshow this help message
      adb version                  Рshow version num

      adb wait-for-device          Рblock until device is online
      adb start-server             Рensure that there is a server running
      adb kill-server              Рkill the server if it is running
      adb get-state                Рprints: offline | bootloader | device
      adb get-serialno             Рprints: <serial-number>
      adb get-devpath              Рprints: <device-path>
      adb status-window            Рcontinuously print device status for a specified device
      adb remount                  Рremounts the /system and /vendor (if present) partitions on the device read-write
      adb reboot [bootloader|recovery] Рreboots the device, optionally into the bootloader or recovery program
      adb reboot-bootloader        Рreboots the device into the bootloader
      adb root                     Рrestarts the adbd daemon with root permissions
      adb usb                      Рrestarts the adbd daemon listening on USB
      adb tcpip <port>             Рrestarts the adbd daemon listening on TCP on the specified port
      adb ppp <tty> [parameters]   РRun PPP over USB.
     Note: you should not automatically start a PPP connection.
     <tty> refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
     [parameters] РEg. defaultroute debug dump local notty usepeerdns

    adb sync notes: adb sync [ <directory> ]
      <localdir> can be interpreted in several ways:

      РIf <directory> is not specified, /system, /vendor (if present), and /data partitions will be updated.

      РIf it is "system", "vendor" or "data", only the corresponding partition
        is updated.

    environmental variables:
      ADB_TRACE                    РPrint debug information. A comma separated list of the following values
                                     1 or all, adb, sockets, packets, rwx, usb, sync, sysdeps, transport, jdwp
      ANDROID_SERIAL               РThe serial number to connect to. -s takes priority over this if given.
      ANDROID_LOG_TAGS             РWhen used with the logcat option, only these debug tags are printed.
    MacBook-Air-van-jelle:platform-tools Jelle$ ./adb devices
    adb server is out of date. ¬†killing…
    * daemon started successfully *
    List of devices attached 

    MacBook-Air-van-jelle:platform-tools Jelle$ ./adb reboot bootloader
    adb server is out of date. ¬†killing…
    * daemon started successfully *
    error: device not found

    so, no devices found, i did plug it in and out a few times but it won't

  10. I successfully reached till step 3, then step 4, the first command just reboots the device, and the second command i get this message below.
    " ERROR: could not get pipe properties
    < waiting for device >
    ERROR: could not get pipe properties
    ERROR: could not get pipe properties
    ERROR: could not get pipe properties
    ERROR: could not get pipe properties
    ERROR: Unable to create a plug-in (e00002be)
    ERROR: could not get pipe properties
    ERROR: could not get pipe properties

    i have a samsung tab 3 SM-T210 with version 4.4.2

    I am a iPhone guy, i just got this coz it was laying in the house and my sis wasn't using it.
    I must say that, in iPhone to jailbreak, it was the easiest thing ever, restore firmware and your done, but for samsung, till date i have spent more than 24hours now, trying almost all apps , black mart, iroot, kingoroot, framatech, and what not, finally i was happy that i found a nice detailed video, but again, i am stuck. 
    i am thinking that maybe android 4.4.2 is hard, so i am trying to revert it back to the factory android which was android 4.1 or 4.2 ,  i don't remember, but that also i can't see an easy way to find.  

    I am really fed up, but unfortunately i cannot give up…….. ¬†ūüėź

  11. I am glad that pros like you take time to share your knowledge with us ! Thank you very much !

  12. Does LG G3 S ( Beat ) has a bootloader because my Reboot and doesn't get to bootloader
    Plz Help!!!

  13. Thank You for Your videos. I have two questions:1. ./fastboot oem unlock fails with a message: remote: unknown oem command. However, ./adb root end with a message: adbd is already running as root. Does this mean that I can skip this step? 2.What do I need to do if my device is not on the list at clockworkmod ROM manager and sending flash recovery for other devices ends with an error: flash_cmds error. 

  14. I know that it is not an easy question but I have a noname P8510 3G WCDMA Quad Core MTK8389 Tablet. Do you know which superSU is right for it? 

  15. Hey MGALEX, great tutorial, super clear instructions. Hope to see more from you. Thanks

  16. Hello Sir, This is the response I am getting:
    Johns-Mac-mini:platform-tools JohnFinney$ ./adb reboot bootloader
    Johns-Mac-mini:platform-tools JohnFinney$ ./fastboot oem unlock

    OKAY [  0.020s]
    finished. total time: 0.020s
    Johns-Mac-mini:platform-tools JohnFinney$ ./fastboot reboot bootloader
    usage: fastboot [ <option> ] <command>

      update <filename>                        reflash device from
      flashall                                 flash boot, system, vendor and if found,
      flash <partition> [ <filename> ]         write a file to a flash partition
      erase <partition>                        erase a flash partition
      format[:[<fs type>][:[<size>]] <partition> format a flash partition.
                                               Can override the fs type and/or
                                               size the bootloader reports.
      getvar <variable>                        display a bootloader variable
      boot <kernel> [ <ramdisk> [ <second> ] ] download and boot kernel
      flash:raw boot <kernel> [ <ramdisk> [ <second> ] ] create bootimage and 
                                               flash it
      devices                                  list all connected devices
      continue                                 continue with autoboot
      reboot                                   reboot device normally
      reboot-bootloader                        reboot device into bootloader
      help                                     show this help message

      -w                                       erase userdata and cache (and format
                                               if supported by partition type)
      -u                                       do not first erase partition before
      -s <specific device>                     specify device serial number
                                               or path to device port
      -l                                       with "devices", lists device paths
      -p <product>                             specify product name
      -c <cmdline>                             override kernel commandline
      -i <vendor id>                           specify a custom USB vendor id
      -b <base_addr>                           specify a custom kernel base address.
                                               default: 0x10000000
      -n <page size>                           specify the nand page size.
                                               default: 2048
      -S <size>[K|M|G]                         automatically sparse files greater
                                               than size.  0 to disable
    Johns-Mac-mini:platform-tools JohnFinney$ ./fastboot reboot-bootloader
    rebooting into bootloader…
    OKAY [  0.020s]
    finished. total time: 0.020s
    Johns-Mac-mini:platform-tools JohnFinney$ ./fastboot flash recovery /Users/JohnFinney/Downloads/adt-bundle-mac-x86_64-20140702/sdk/platform-tools/recovery-clockwork-touch- 
    sending 'recovery' (6932 KB)…
    OKAY [  2.760s]
    writing 'recovery'…
    FAILED (remote: (InvalidState))
    finished. total time: 5.634s
    Johns-Mac-mini:platform-tools JohnFinney$ 

  17. hi , help me please .. i use htc one M8 ( 4.4.2)

    Last login: Wed Nov  5 01:44:48 on ttys000
    Applications Documents Library Music Public
    Desktop Downloads Movies Pictures
    -bash: desktop: command not found
    KAMALLITOO:desktop KAMALLITOO$ cd dossier sans titre
    -bash: cd: dossier: No such file or directory
    KAMALLITOO:desktop KAMALLITOO$ cd "dossier sans titre"
    KAMALLITOO:dossier sans titre KAMALLITOO$ ./adb devices
    List of devices attached 
    0123456789ABCDEF device

    KAMALLITOO:dossier sans titre KAMALLITOO$ ./adb reboot bootloader
    KAMALLITOO:dossier sans titre KAMALLITOO$ ./fastboot oem unlock
    ERROR: could not clear input pipe; result e000404f, ignoring…
    ERROR: could not clear output pipe; result e000404f, ignoring….

  18. Wassup Hack! I`am trying to root a Moto G aka Falcon, but when i try to unlock terminal just says: (bootloader) fastboot oem unlock [ unlock code ]
    OKAY [  0.007s]
    finished. total time: 0.008s

    any help please?

  19. need ur immediate attention on 
    Akifs-MacBook-Pro:platform-tools akifqadeer$ ./fastboot flash recovery recovery-clockwork-touch- 
    target reported max download size of 299892736 bytes
    sending 'recovery' (7880 KB)…
    OKAY [  0.372s]
    writing 'recovery'…
    (bootloader) Preflash validation failed
    FAILED (remote failure)
    finished. total time: 0.416s

Leave a Reply

Your email address will not be published. Required fields are marked *