Rooting a Broken Android Phone

I love the Nexus 4. It was an exceptional phone for its time. I had mine for 3 years before upgrading to the Nexus 6P, but it is still a great phone. Sure it wasn't without its flaws, but what phone is? I got my hands on a Nexus 4 with a broken screen. Like, really broken screen. It was bad. Only the top quarter of the screen was touch sensitive. The crack had gone all the way through. The only way to control it would be to root it so that we could use a mouse with it. But how do you do that with a phone that only has a quarter of its screen usable (so we can't unlock it with the pattern) and USB Debugging Off? I guess the real question here is "is it possible?" We're about to find out.

Here's the specimen. The back is in even worse condition with nothing but the Zagg Cover (useless things until your glass shatters) keeping it together. It took a while to get enough charge in it to start the phone, but it finally started. I couldn't do anything except change the brightness on the screen when booted into Android, so we went to the next best thing: recovery mode. To get into the recovery mode, turn your phone on whilst holding the "volume down" button. You'll be dropped into the bootloader menu.

Now this is where you search deep inside yourself and make sure everything you want off of this phone is backed up. This is the point of no return. The device will be wiped. Are you ready? Okay, good.

Now we need to unlock the bootloader. For this, we'll need Fastboot (it comes with the Android SDK). In the case of the Nexus 4, fastboot oem unlock does the trick. The phone prompts asks you if you really want to do this. Select yes if you really do.

It will then proceed to erase your phone and unlock your bootloader, allowing you to boot into a custom OS. It took mine about a minute to complete. But then the phone will say "LOCK STATE - unlocked" which is what we want. Now whenever we boot the phone up, under the white Google logo there will be an unlocked padlock which means the bootloader has been unlocked. Tada!

You can't go straight into recovery from here. The phone will force you to boot into normal mode after it reflashes itself. It'll take a while to boot. But once it does. turn it off and go back to the bootloader. We need to flash our own recovery image.

Next, I was going to get the TWRP recovery image, but once I flashed it, I realized it requires a touch screen. So I went to ClockworkMod instead. Regardless of which one you use, to flash it, run fastboot flash recovery <your_recovery_image.img> while your phone is in bootloader mode. 

Then, if you had an Android version greater than 4.3, you need to flash some different radio software because anything newer than that will make the radio incompatible with CyanogenMod. This part is super simple. Grab the Nexus 4 Factory Image and extract the radio-mako-m9615a-cefwmazm-2.0.1700.84.img file. Then, while the phone is still in bootloader mode, run fastboot flash radio radio-mako-m9615a-cefwmazm-2.0.1700.84.img. 

Then tell it to boot into recovery mode by using the volume keys. You'll then be in ClockworkMod Recovery. Select "Install ZIP" with the power button then select "Install zip from sideload". 

Next, type adb sideload <CM Image File.zip> and let ADB send the file over. As soon as its done, Android will install the "update". Once the Android goes away from the center of the screen, go back to the main menu and select "reboot system now". The phone may take a while to load at the bootloader, but that's to be expected. After a while, you'll see the CyanogenMod loading animation. You'll see it for a long time. Don't lose hope, everything probably went well! If CyanogenMod finally boots, then congrats! The easy part is done!

No you're met with another problem. Say you have no way to control your device because you don't have a powered USB hub to use a mouse over USB OTG? Not a problem. We just need to force ADB to always be on on the phone. To do that, enter ClockworkMod again, and navigate to "mounts and storage" and select "mount /system" and "mount /data". On your computer do adb shell and in an ADB Shell, run echo persist.service.adb.enable=1 >> /system/build.prop.

Next, mount the data partition and adb pull /data/data/com.android.providers.settings/databases/settings.db. Using your favorite SQLite editor, change the adb_enabled field to 1. Save and push it back to where you found it, overwriting the original. 

Next, I added my computer's public key to /data/misc/adb/adb_keys so that it wouldn't ask for something I couldn't press. I ran an adb push \Users\<username>\.android\adbkey.pub /data/misc/adb/adb_keys or something else for Linux. Now it knows to start ADB and to also trust my computer without asking. Unmount the data and system partitions the same way you mounted them, and reboot the phone.

Now when the phone boots up, you should have access to ADB on the phone which allows you to simulate touches using the shell. As an easy in between step, you can use adbcontrol (which is a really cool piece of software) to struggle through pairing a bluetooth mouse or keyboard. Just a heads up on the configuration, even if you're on Windows, you still use forward slashes.

So there you have it! Your phone with a destroyed screen is somewhat usable now! What you do with it is up to you! Have fun!