Last Updated: May 7th, 2011

Neither z4root nor SuperOneClick is currently working on the Charge (though I'm sure someone will come up with a one-click method soon enough), but guess what - Gingerbreak sure does. Follow these instructions, and you should have root and full /system unlock on your Droid Charge in a few minutes. Credit goes to the Exploid Crew and unnamed testers.

No custom recovery, such as ClockworkMod or RA, is available yet, but it is surely going to arrive very soon.


  • Permanent root
  • Read/write access to /system
  • The bootloader is factory unlocked, so no additional fiddling is required
  • All Droid Charges survived testing
  • No data wipe is needed


  • Voids warranty
  • Could brick your phone if you aren't careful


Android Police and Team AndIRC disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.

The instructions below assume you already have a strong familiarity with adb command lines.

The instructions were created using Linux, but should work the same way on Windows, Mac, etc. You may require additional USB drivers on Windows - check with Samsung and Verizon if you can't see the phone in adb.

If you’re unfamiliar with some of the terms, hit up our primers here:

Step 1

Download the zip archive containing the exploit and other needed files (MD5: c6f2f4119f4a640571c3ab50c3287aae).

Step 2

Unpack the downloaded zip - you should now have 3 files:

  • GingerBreak
  • su
  • Superuser.apk (Update: use the one off the market instead of this one)

Step 3

Enable USB debugging on your phone - go to Settings > Applications > Development > USB debugging and put a checkbox there.

Step 4

Push the files to the phone:

adb push GingerBreak /data/local/
adb push su /data/local/

Step 5

Gain root (this can take upwards of 10 minutes, and if it fails, reboot and try again):

adb shell

Now the shell should display "$".



At this point, the shell should display "#".

Step 6

When your prompt changes from $ to #, you have temp root. Now let's make it a permanent root:

At this point, the shell should display "#".


mount -o remount,rw -t rfs /dev/block/stl10 /system
cat /data/local/su > /system/xbin/su
chown 0:0 /system/xbin/su
chmod 6755 /system/xbin/su

Now install SuperUser off the market. Your Charge should now reboot. Enjoy permanent root!


If you have a problem, and need to run GingerBreak a second time, delete the tmp files by running:

adb shell rm /data/local/tmp/*


If you have questions, use our webchat or go to irc.andirc.net and join #charge.

Justin Case
Justin Case is a 30yr old father of four. He has an ever changing array of Android devices, and an eye for mobile security.
  • Justin

    Don't have this phone but more great work from team ANDIRC as always. Thanks for spending your time working on this stuff and helping out the community.

    • djbjrb

      Dude. ...this didn't work. .I got as far as getting the $ sign and thats it....fail

  • breon

    I get this when i get to step 6

    # cat /sdcard/su /system/xbin/su
    /sdcard/su: No such file or directory

    • Justin Case

      Typo on my fault,
      These lines are wrong
      cat /sdcard/su /system/xbin/su
      cat /sdcard/Superuser.apk /system/xbin/Superuser.apk
      and should be
      cat /data/local/su > /system/xbin/su
      cat /data/local/Superuser.apk > /system/xbin/Superuser.apk
      Fixed in original post, tis what I get for late night tinkering.

  • Chainfire

    Why not use the GingerBreak APK variant ?


    • Justin Case

      I tried to contact you on freenode last night before I decided to write this up.

      The APK simply wasn't working for us. Ran it on two different devices with no luck. After running a brand new phone, the sdcard became corrupted. I believe the sdcard corrupt was likely a fluke and unrelated to your app.

  • Raptor007

    I read that Z4Root also works, is that the case?

    • http://www.AndroidPolice.com Artem Russakovskii

      It wasn't working at the time of this writing, as the first sentence in the post says.

  • Moondrius

    What drivers are you guys using? I am unable to find any on samsungs site and the fascinate drivers are not working.

    • jcase

      Was done on linux, sorry I am unfamiliar with windows.

  • droidmark

    I also had driver problems. Found a post on another forum that the drivers are actually on the phone itself, which will mount as a virtual CD drive when you first plug it in to USB (with USB debugging OFF). I still had problems, until I was able to get it to mount as a virtual drive, opened the "drive" and grabbed the USB driver package, which I then installed from the desktop. Now all is well and I have it rooted. The driver package is an 8.1MB .exe file which I can email if someone needs it.

    • pecman

      any1 have the driver that's 8.1mb from the phone? can't access mine.

    • http://www.kc9aop.net kc9aop

      I've been going crazy trying to get the driver. Can you mail it?

    • bag

      can u send me email or package to root my charge

    • Ang

      Can u send me the 8.1 Droid file?

  • sumcogitovolo

    Getting Permission Denied after running GingerBreak:
    /data/local/GingerBreak: permission denied

    I did let the phone run an update from Verizon last night do you have any info on what Build number this was run on?

    Any Ideas?

  • Justin

    I'm also getting permission denied when trying /data/local/GingerBreak

  • chaserx

    Permission denied here also...

  • Jasper

    I'm in the same boat as the previous 3 people. Any thoughts or suggestions?

  • http://www.twitter.com/aBrixxx aBrixx

    At step 5 after adb shell you will need to input chmod 755 /data/local/GingerBreak before doing /data/local/GingerBreak this enables the permissions :D You're welcome.

  • Eric R

    I know you said above there is no way to recover the Droid Charges Boot records but there is an article at: http://www.android-advice.com/2011/droid-charge-recovery-too/ that show how to do it if you want to add that to your post. Its a small tool for recovery.

    Hope it helps :)

    • jcase

      At the time of writing there was no custom recovery. That link you sent is still not a custom recovery.

  • Darren

    GingerBreak starts to execute fine for me but then hangs after displaying the following. I let it run more than an hour and nothing changed. Any ideas?

    [+] Detected Froyo!
    [+] Found system: 0xafd1452d strcmp: 0xafd1d7ed
    [+] Found PT_DYNAMIC of size 264 (33 entries)
    [+] Found GOT: 0x000162e8
    [+] Using device /devices/platform/s3c-sdhci.2/mmc_host/mmc2
    [*] vold: 2385 GOT start: 0x000162e8 GOT end: 0x00016328

    • Jay

      I'm getting the same thing when I tried the steps above.

    • ryan

      same problem here

    • Saman Sadeghi

      Same for me! I can't get past this step.

  • George P.

    Same for me. Verizon update may have broken this exploit.

  • George P.

    kernel se.infra@SEP-42 #1

  • New Charge

    Does anybody do this 3rd party? I'd like to try to maximize my new charge's capability, but I'm not familiar with the programs etc that are necessary to do it myself (and I don't want to kill my new phone...which would likely be the result). If not can anyone tell me how I might be able to adjust the outgoing email settings: fonts, font size, signatures. The factory defaults are terrible and aside from basic text changes to my signature I don't seem to be able to change them.

    Oh, one last thing...I drive a ford and the music player automatically starts when I get in the car. Even if I'm listening to sirus or the radio (other that that it's pretty sick the way it works through the blue tooth though). Is there anyway I can stop this as the default setting?

    Thanks for any help.

  • Burl

    My last line was slightly different:

    vold: 2382 GOT start: 0x000162e8 GOT end: 0x00016328

    Anybody have an update on this?

    • jcase

      Verizon issued a patch to prevent this method.

  • s

    is there any way around the patch? trying to root now, having same problem: no #

  • http://www.polkadotninja.com sam

    Looks like the ED2 update broke this method (thanks Verizon / Samsung). Looks like there's no way to root atm without using odin, more info in this thread:


  • JacknJoe

    ... tried to install the Verizon Update for Samsung Droid Charge after rooting. Dind't work. Had to downgrade and root again :-P

  • aaron

    Once you do this can you do a restore to go back to oem?

  • http://me.com robot pirate

    This worked for me:

    Steps to Root:

    Part 1 Reset to ED1:

    Open Odin, then pull the battery on your phone, hold volume down, and plug it into the computer to put it in download mode. Pick the tar.md5 file in the PDA section of Odin (NOT the phone section!) and then hit start, let it do its thing, unplug when it's done, and you'll boot into the Android recovery. Reboot and you're back in ED1. Then root via GingerBreak.

    Part 2 Root:

    In Cmd:

    1) adb push /Gingerbreak /data/local
    2) adb shell
    3) Should show “$”
    4) “$” /data/local/GingerBreak
    5) Should show “#”
    6) mount -o remount,rw -t rfs /dev/block/stl10 /system
    7) Install SuperUser off the market.
    8) sync “Root explorer” with “superuser” (allow)
    9) click “mount RW” tab in root explorer for system/xbin
    10) chown 0:0 /system/xbin/su
    chmod 6755 /system/xbin/su
    11) If you have a problem, and need to run GingerBreak a second time, delete the tmp files by running:
    adb shell rm /data/local/tmp/*
    Part 3 Block OTAs:

    Block OTAs by renaming /system/etc/security/otacerts.zip to something like /system/etc/security/otacerts.zip.bak. Go back into the recovery by downloading Quick Boot from the Market and "Wipe cache partition" because the phone is very quick on downloading a copy of the OTA, caching it, and bothering you CONSTANTLY.

    • SmacRoc

      I want to try this method but what tar.md5 file are you talking about using in part 1?

  • http://rootandroid.net Root Android

    If a one click tool like superoneclick was out, things would have been more easier.

  • Brittany
  • http://www.AndroidPolice.com Artem Russakovskii

    Please be respectful of each other or you'll earn a ban. I've just cleaned up about 20 comments full of hatred and filth. Let's not let this happen again, guys, OK?

  • John S.

    The file can't download. I get a 500 internal server error when I click the zip archive. It's been like that for the last 3 days now. Is this file anywhere else on the internet?

  • John S.

    @robot pirate

    I found the files and I've gotten to step 4 of your procedure above but it won't go. I type /data/local/tmp/GingerBreak and in return I get /data/local/tmp/GingerBreak: 3: Syntax error: ")" unexpected

    What do I do? This is my first root so please, if anyone knows what to do, leave VERY DETAILED instructions.


  • http://androidpolice Jordan

    Why the F**K does this link continue to say ERROR! Fix this!!!!! I am trying to access it and I am unable to due to a faulty link. Why has no one posted anything about this broken link!


    Update to Gingerbread

    1. Root your device with the instroctions above.

    2. Update to Gingerbread. Instructions @ http://androidadvices.com/update-samsung-droid-charge-gingerbread-ep1f-23-firmware/3/

    3. Install Superuser over market

    4. Install Root Chekcer over market

    Your device is still rooted!

  • jamese
  • Amdion

    Here a video on youtube that shows you how to root the Charge, it worked on mine so might work on yours

  • Mark

    This guide is outdated. This one worked for me! I was on the EE4 build too!


  • vinniray73

    Does anyone know where i can send my devices to get rooted i have a samsung charge and a moto xoom i would appriciate it very wish i was more computer lit. lol have a great one people :)

  • https://twitter.com/brentwhopkins Brent W. Hopkins

    I am not having any luck with this, is there any update?

  • country coyote

    I just rooted (15 minutes) my DC EP4 Gingerbread 2.3.6 with Odin successfully. Then installed Fileslick(awesome progam-manages right to the root) & got rid of all my bloatware, preinstalled factory crap apps.

  • Matthew

    After running /data/local/GingerBreak I sit at the resulting screen for hours (or until I decide to terminate). I can't determine if there is any progress.

    Here's the output I see. Am I missing something?

    C:\Program Files (x86)\ClockworkMod\Tether\win32>adb shell
    $ /data/local/GingerBreak

    [**] Gingerbreak/Honeybomb -- android 2.[2,3], 3.0 softbreak
    [**] (C) 2010-2011 The Android Exploid Crew. All rights reserved.
    [**] Kudos to jenzi, the #brownpants-party, the Open Source folks,
    [**] Zynamics for ARM skills and Onkel Budi

    [**] donate to [email protected] if you like
    [**] Exploit may take a while!

    [+] Plain Gingerbread mode!
    [+] Found PT_DYNAMIC of size 232 (29 entries)
    [+] Found GOT: 0x000183b0
    [+] Using device /devices/platform/s3c-sdhci.2/mmc_host/mmc2
    [*] vold: 0000 GOT start: 0x000183b0 GOT end: 0x000183f0

    • jcase

      This only worked on the initial firmware, it was patched in the first week. Try newer methods, look on rootzwiki or xda

  • Justin

    Can i root my charge without a computer?

  • chuck u. farley

    Easily Root my phone, it would be easier for a blind man with one leg to get to another planet on a broken skate board! I wonder how easy it is to brick the dam thing. nothing on how not to brick it though is there. probably instructions on how to brick it just to fuck you over.