"On RC29 phones and lower, anything you type into your keyboard is also being run in a hidden console with root permissions. More information regarding that at the bottom of this post. But, to get root access, do the following:
1. Download recovery.img and copy it to your SD card (see the previous instructions on how to copy from your computer to your Phone's SD card).
2. Download the Hard SPL and copy the zip file to the SD card.
3. All files must be on the root of your SD card.
4. Restart your phone. Wait for your phone to start up fully and show the home screen.
5. After your phone starts up, at the home screen, hit the enter key twice, then type "telnetd" and hit enter again. (Yes, it will start up a contact search, don't worry. Just type it.)
6. Download an Android "Telnet" application from the Market and connect to localhost.
7. If you connect successfully, you will have a root prompt "#".
8. Type the following into Telnet (these commands will give you root access easier in the future):
* mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
* cd sdcard
* flash_image recovery recovery.img
* cat recovery.img > /system/recovery.img
Now you have root!" forum.xda-developers.com