This post describes how to hack a US/CDMA 3G+WiFi Xoom Honeycomb OTA ROM image to be flashable onto a European/UMTS 3G+WiFi Xoom.

First, get a US/CDMA Honeycomb OTA image. I won’t tell you how to get it, but you’d better get it from an authorized source and make sure it hasn’t been compromised or tampered with. Flashing random ROMs downloaded from random Web sites is a recipe for disaster.

Let’s say the OTA image is named xoom-ota.zip. Proceed to unzip its contents:

$ mkdir ota && cd ota
$ unzip /tmp/xoom-ota.zip

Now, one has to edit the update-script to prevent the OTA process from trying to replace the UMTS radio with a CDMA radio:

--- orig/META-INF/com/google/android/updater-script 2008-02-28 18:33:46.000000000 +0100
+++ ota/META-INF/com/google/android/updater-script 2011-07-14 13:40:04.000000000 +0200
@@-53,10+53,6 @@
show_progress(0.200000, 10);
package_extract_file("boot.img", "/dev/block/platform/sdhci-tegra.3/by-name/boot");
show_progress(0.100000, 0);
-assert(package_extract_file("bp.img", "/tmp/bp.img"),
- package_extract_file("rdl.bin", "/tmp/rdl.bin"),
- moto.update_cdma_bp("/tmp/rdl.bin", "/tmp/bp.img"),
- delete("/tmp/bp.img", "/tmp/rdl.bin"));
assert(package_extract_file("bootloader.bin", "/tmp/bootloader.bin"),
moto.set_mbm_update("/tmp/bootloader.bin"),
delete("/tmp/bootloader.bin"));


Now that the patch has been applied, let’s re-zip the modified tree into a new OTA ZIP file:

$ zip -r ../update.zip *

In order to apply the OTA onto the Xoom you’ll likely need to install the ClockWorkMod recovery image, since at the time of this writing Xoom’s stock Android recovery can’t access the contents of the internal SD card partition. It seems, however, that Xoom’s stock Android recovery can access external USB storage devices.

In order to copy the hacked OTA image use:

$ adb push ../update.zip /mnt/sdcard

In order to install ClockWorkMod, you’ll need to download the recovery image. The easiest way is by installing “ROM Manager” into your Xoom from the Android Market. ROM Manager allows one to flash the recovery image on rooted Xooms automatically. If your Xoom isn’t rooted don’t worry as ROM Manager will still download the recovery image and place it somewhere under /mnt/sdcard/clockworkmod. From there, pull the image into your PC:

$ adb pull /mnt/sdcard/clockworkmod/.../recovery-clockwork-4.0.0.4-stingray.img

Then reboot the Xoom into the bootloader:

$ adb reboot bootloader

Once the fastboot protocol has been enabled (as shown on the screen):

$ fastboot flash recovery recovery-clockwork-4.0.0.4-stingray.img

Then reboot into recovery. It is important to reboot into recovery right away. Booting the system normally will likely reflash your recovery partition with the stock one, replacing ClockWorkMod. To boot into recovery, reboot the device:

$ fastboot reboot

Wait for the Motorola Dual-core logo, then tap the Volume Down key several times until the Android recovery option is shown on the top-left of the screen. Then press the Volume Up key to enter the recovery menu.

Once in the ClockWorkMod recovery, request to apply an update.zip image from the internal SD card partition. Navigate the menus using the Volume Up and Volume Down keys, and select an option by using the power button on the back. The update process will start and everything should apply smoothly. Next, wipe the cache and user data partitions, reboot and cross your fingers.

Suffice to say that you’ll lose 3G capabilities on your Xoom. It seems no one cares about Europe, not even Google, so Motorola still has Honeycomb 3.0.1 for us Europeans (instead of 3.1 or something newer like 3.2). And since 3.0.1 is so unstable and slow, I decided to upgrade to the latest Honeycomb build.

Perhaps one day people will take Europe seriously and release synchronized versions for the US and Europe (and also the rest of the world).