1. Run rwflash.lin. This will load rwflash.o
2. Leave the phone alone and wait. When the screen blanks out wait 30secs longer, there's a good chance the phone entered low power mode.
3. Telnet to the phone
(by connecting usb cabel --> clicking acmattach.lin --> open command prompt --> telnet to 169.154.142.2 --> login as root)
4. Type cat /proc/rwflash_status and press enter. If it shows "unlocked", your flash is writable!! If not, unplug phone and go to step 2
5.
continue command below in sequence
6. cd /mmc/mmca1/flashkit
7. ./start.sh
8. The script will start killing the phone's apps and mount the miniroot. After which, your telnet connection will be terminated.
9. Telnet back to the phone at port 10000
using 169.254.142.2 10000 and login as root. You are now in the miniroot. All phone applications should be killed by now (Except for mmcsdapp, for some reason, it is stuck in an uninterruptible sleep. This means we can't unmount the original root. Well, too bad.)
10. cat /proc/mtd to see what partitions you have. You should be able to flash the "R/W" partitions:
mtd4: 000e0000 00020000 "R/W Kernel"
mtd5: 018e0000 00020000 "R/W RootFS"
mtd6: 00020000 00020000 "R/W Setup"
mtd7: 00020000 00020000 "R/W Logo"
11.
CD to the directory where we have placed our rootfs (in this case we placed it at /mmc/mmca1/flashkit) and then give following command:
flashcp -v cg33.smg /dev/mtd5
12. sync
13. Pull out battery. Reboot.
14. Don’t worry if flashcp gives an error at end. It does. But your work is done.