Rooting the Kyocera Milano

I have the Kyocera Milano and am looking to root it. The phone has been rooted before, back when it was first released last fall, but the same approach doesn't work with new firmware releases. Here is the link to the approach I have taken:


When I run Zerg Rush, it sends 149 zerglings, then 189 zerlings, then gives me this error: "Hellions with BLUE flames!"


I am unaware of how to progress, as I do not know anything about rooting devices myself, only following tutorials on how to root devices. In the mean time, googling "zerg rush" is very distracting...


Thanks to anyone who can help.



  • I would say to make sure you have the latest version of zergRush. Another option is to try a one-click root script to make sure you aren't missing a step. There are a couple mentioned in this thread:

    Comment actions Permalink
  • The zergRush exploit doesn't seem to work on the Ting Milano.  I have tried several versions, including v1 and v4 with results identical to the OP.

    Hellions with Blue Flames is an error from the zergRush exploit indicating a failure of some sort.  The steps before its execution simply move it to the phone and set it as executable.  Depending on your one click version, some temporary files are also cleared.

    It's not much help, but the Milano does have a 'recovery mode' accessible by holding volume down and power when turning the phone on.  If you just see a yellow triangle, try pressing the 'home' key.  Volume up and down seem to select between the options, as do the left and right cursor keys on the slide out keyboard (which point up and down if you're holding the phone in portrait).  The only key I've found to activate a choice is the enter key on the slide out keyboard.

    When booting into recovery it seems the phone searches for some file and complains it can't find it.  If there's anything useful to be had from the stock recovery that would lead to root, this is probably it.

    The options in recovery are to reboot, reset, or clear the cache partition, if I recall correctly.  This basically useless information is surprisingly hard to find.  It is reproduced here just in case someone else either wants to use it as a springboard for something actually useful, or to spare others the agony of trying to google for it and finding out recovery doesn't do what was hoped for.

    Comment actions Permalink
  • From what I can tell, the software version that the phone shipped with was an earlier version of android maybe 2.3.3. And that version is exploitable via the zergRush with is zerglings and overlords. However, around Febuary or March Kyocera pushed out an update to android 2.3.4 and it has been patched against the zergZush and all known exploits.

    But that has not stopped me from doing some leg work. I found that I could not do the volume down + power button combo as above but I could use some command line magic to get the phone to reboot into recovery.

    Make sure that you have a usb cord connected, adb, and usb debugging enabled. The run the following:

    #Works, Reboots into Android System Recovery

    adb reboot recovery

    Then you should see the same recovery screen as stated above.

    Also started poking around the partition structure to see about building ClockworkMod so I dumped the following:

    adb shell cat /proc/mtd

    dev: size erasesize name

    mtd0: 00600000 00040000 "boot"

    mtd1: 08e00000 00040000 "system"

    mtd2: 02780000 00040000 "fota"

    mtd3: 00100000 00040000 "pltable"

    mtd4: 00100000 00040000 "splash"

    mtd5: 00600000 00040000 "recovery"

    mtd6: 09640000 00040000 "userdata"

    mtd7: 06f00000 00040000 "cache"

    Partition Sizes in Megabytes

    mtd0: 6

    mtd1: 142 (System)

    mtd2: 39.5

    mtd3: 1

    mtd4: 1

    mtd5: 6

    mtd6: 150.25

    mtd7: 111

    Thats right, the System partition is only 142 MB and that is to contain the whole filesystem of the linux kernel, kernel modules, drivers, android framework, and android system files. Its no wonder why when I first activated the device and ran all the updates that I immediately got a "LOW SPACE" error message. It would be so nice if I could achieve root. As then I would start work on trying to build CWM for the Milano and then, fingers crossed, compile CM7 rom. That would allow for formatting part of your SD Card as ext3 and use it as app storage so you could install as many apps as you want with out it running out of space all the time. 

    But alas, I have all but given up as I can't get root. I tried my hand at searching the linux vulnerabilities database for the arm kernel And even tried to run a few scripts and compiled a few proof of concept root attacks but they were all geared for desktop Linux'. This phone is running an older kernel that has been vetted and matured so many of the bugs are out. Also since its older many of the exploit groups have also moved on to newer code lines. So I think that its unlikely that this phone will achieve root again.

    Comment actions Permalink
  • Doh, I am stupid. You can boot into recovery by using vol down + power. You just need to press and hold for like 4 seconds before you let go. In my previous attempts I was letting go too soon.

    Comment actions Permalink
  • It has been a while since anyone has posted on this thread, did anyone determine a solution? I would like to root this phone in order to remove some apps that I do not need (such as google books). Any assistance would be appreciated.

    Comment actions Permalink
  • I just got my phone a couple weeks ago and rooted it yesterday.

    This works:

    Not sure why the guide says "Enable usb debugging in Settings, Applications, Development" since you never use the PC, I enabled it anyway, and also enabled to install third party apps, or else Poot won't install, not sure why that isn't on the guide. (Maybe they got mixed up?)

    A few things you might want to know:

    After hours I finally found the solution. But the terminal still doesn't work for uninstalling ("pm uninstall" = Failure), you have to do everything though your phone (I'm using the app "RootAppDelete"). The phone roots itself with a third party app called "Poot" using libraries from "Ministro 2"

    Before doing this you're gonna need something like 25MBs of storage or so (Can delete everything afterwards with the exception of SuperUser (Can't delete that) to get the space back (Also, you need a app to actually use root actions). - The "Ministro 2" packages are huge for this phone's tiny internal storage! 11MB around)

    Make sure to install anything small first and anything big right before the phone gets over 15MB full, because at that time you can't install anything else, with low memory errors.

    Another thing that might have helped me when I did this is - back when I couldn't root I made all apps default install to the phone with the [I]android sdk platform-tools/I

    "adb shell"

    "pm SetInstallLocation 2"

    Know its been said elsewhere, but this works with the Milano. Wanted to say that in case you needed the space to use Poot.

    And the last problem is after I did all this, now my headphone jack wants to think it has headphones plugged in all the time, If I move the phone around it starts playing on the phone's speaker. It seems like something is lose. Not sure if that was caused by the root (since it wasn't doing it before, and I've never used the headphone jack before) or because there was lose hardware, not sure. Still working on a solution to that, which I found something similar, almost looks like a common problem: [url][/url]


    And as I've read a million times before this, here's a disclaimer: I'm not responsible and use at your own risk.

    Comment actions Permalink

Please sign in to leave a comment.