SamFail presents...
PartCyborgRom
BQL1
A Rooted Custom Rom
For G950U/W, Bootloader Revisions 1 or 2 only any higher are not currently rootable or vulnerable to this exploit
Updates
New Release and a new OP that I hope is easier to read.
Send feedback or suggestions on improvements to me via pm here or on telegram.
Heads Up
You may notice that the BL version of this release is different than the system rom part.
The rom version is in fact BQL1, but the BL is a new version of AQK2. The reason for this is because
the latest combination, ARA1, has a number of sensors not working. I figured out a fix but it requires splicing
stuff in from other versions, and it didnt feel like the battery lasted as well. I am still testing though and
the next release if its ready will come with ARA1. This is not the same BL as the previous
release though, so if you upgrade also flash this new BL!
Thanks!
Featured Modifications
Deodexed
Deodexed for all devices.
I found a way that works!
It should keep working as long as nougat
(is that a haiku?)
Xposed Preinstalled
PCR now comes out of the flasher with xposed pre-installed!
NOTE: Xposed Installer may crash on first boot. It will not crash after setup finishes and you reboot
New Boot Animation
Another great one from @Ryan-refoua.
This one is my favorite so far.
JamesDSP
I added another DSP style audio mod. JamesDSP is similar to V4A in how it operates and what features it has, but it has some really awesome features that have made me a fan and a regular user. Among other things, it has a better convolver (IRS processing) implementation, and its bass boost is significantly better than v4a. If there are things you like about V4A you can use both at the same time.
ITYBP Modded YouTube
A last minute addition, this is a really nice youtube mod brought to you by @laura almeida, @Razerman and @ZaneZam. It features some cool additions like native adblocking (no more xposed module), overriding your max youtube resolution (you can watch 4k videos on your phone, but not 4k hdr). I have been using it for a while and really like it. A big thanks to them for letting me include it with PCR
Improved Debloating
Found better stuff to delete. Added back some stuff I took out before that some of you asked for.
If you find something missing that you want back, pull it from the stock rom and install it in /system/app or /system/priv-app, wherever you got it from.
Improved Battery Life
Thanks to some battery sleuthing by @TheMadScientist, this release comes with a nice big bump in efficiency. With just some very minor tuning using amplify and a service disabler, I can get around 1%/h drain.
Performance Improvements
That increased battery life does not come at the cost of performance. In fact performance is better too. Part of that is due some personally tested build.prop tweaks. Another part is some data optimisation scripts that now run at boot. You wont notice those, but they are there doing their thing.
Other Features
New for first time flashers
- Pre-Rooted with SuperSU installed
- CSC OYN pre-installed. Tested working on several carriers
- RCS and VoLTE icons removed from status bar.
- High quality audio mods, including
- Viper Audio (V4A)
- Dolby Atmos from the Axon 7
- Pandora hifi audio framework
- Native Google Dialer & Contacts support, including local search, spam call blocking
- Oreo 8.1 Emoji Icon Set
- Custom Lockscreen Clock font
- Stock system display fonts replaced with Apple's original San Francisco Font
Special Thanks
- @ahiron and @Zackptg5 for the killer sounds from V4A and Dolby Atmos Mods!
- The Aiur crew for Pandora (now a legacy mod but works great on the s8)
- @syndre for the Google Dialer and Contacts framework mod
- @rayan-refoua for the beautiful Tech Lines Custom boot and shutdown animations!
- Last but not least, my new friend @laura almeida, along with @Razerman amd @ZaneZam for letting me include the iYTBP - injected YouTube Background Playback Mod
- everyone who tested
Warnings/Disclaimers/Known Issues
- 80% Battery life like every other rooted US snapdragon device
- Flashing on a USB 3.0 port will likely cause corruption in your flash that can cause kernel panics, loss of root, and occasionally very strange other errors. If you get something like this, its not the rom its a hardware conflict that can only show up with larger images like are used in SamFail flashing. See the section below on Kernel Panics for more.
- If there is an app or apk from the stock rom that you wish you had installed, the best solution is to extract it from your stock rom image and copy it to the same place in /system using a root file manager.
SamFail Rooting Process
and Rom Installation
WARNING: THE FOLLOWING WILL ERASE YOUR WHOLE PHONE
If you have a SDCard, remove it from your device. Occasional firmware incidents have wiped SDCards in the past. It has neer happened to me, but I have a backup of my sdcard so I can be a little more risky. Better safe than sorry.
Prepare the Following:
- complete stock rom at your bootloader rev in case things dont work
- Everything backed up
- Both Prince Comsy Odin, and Regular Odin for flashing stock
- A USB 2.0 Port. If you attempt to flash with a USB 3.0 port it may work, but if you get kernel panics, or unexpected bad behavior and/or crashes your usb3 is absolutely to blame. some people get lucky and suceed after a few tries, YMMV. If you can not acquire a machine with a usb2.0 port, get a usb2.0 hub and run your phone into that & that into your machine. Reports are that has made things work for some, but we get few reports back.
What is my Bootloader Revision?
Your bootloader revision is part of the baseband build number of the firmware you are currently running. Lets use this rom as our example. The full build number is as follows: G950USQS2BQL1
Start from the right and count 5 characters back. See that 2? That is the bootloader revision for the firmware that came with this rom. But we are not flashing the BQL1 firmware (or Baseband), We are using an older version because it works better. The version we are flashing is: G950UEU2AQK2. Can you tell which revision it is?
Is my Phone Compatible?
Is it a G950U? Is it a G950W? If you answered "yes" to one of those questions, then the answer is "yes". That being said, flashing this rom if you are on bootloader revision 1 will upgrade your bootloader revision to 2, which means that any previous rom you were running wont work, so be prepared by having a copy of stock for bootloader version 2. If you don't want to move to version 2, you can still run the latest PartCyborgRom though, just use the G950UEU1AQk1 BL_ tar under Old Downloads in place of the one that came with this one. It will work just fine. However if you are unsure I suggest you go ahead and upgrade, there are not really any benefits to staying on 1 at this point.
Steps to Root
1) Download and unzip AP Part 1 and BL Part 2 zip files.
2) Download and unzip Prince Comsey Odin and start it up
3) Reboot device into Download mode and connect it to your pc
4) Open Comsy Odin and only add the AP Part1.tar.md5 file. Select only the following options:
- "Auto-Reboot"
- "F-Reset Time"
- "Nand Erase All"
NOTE: Odin will freeze while checking the AP tar.md5 hash.
Be patient, it will come back. If your computer is old this will take even longer.
5) Click "Start" and wait for the system.img.ext4 file to flash fully to your device. This will take a while too.
ATTENTION
When the flash finishes, this is when the SamFail magic happens. Instead of saying "Failed (Auth)" like it should, the device will crash into upload mode with "Unknow Error".
If your device does not do this, and just says "Failed (Auth)" or something similar and stays in download mode, you need to start again from the beginning, but using a different set of usb ports as you have suffered from the usb3 corruption.
When you see the upload mode page, do the 3 button salute to reboot into download mode again.
WARNING: When you reboot from upload mode, it wont look like download mode. You will see an error.
When you reboot back into download mode, your screen will say that you had a failed update and you need to do emergency repair or take your device to a service center.
Rest assured, your phone is actually in download mode, and Odin will have recognized it and said "Added!" along with the com port lighting up underneath the progress bar. Just continue the process. It is safe to do so and that error will go away after the next step.
6) Close and re-open Comsy Odin or hit the reset button, and add BL_PartCyborgRom-BootLoopEdition-<version>.tar.md5 to the BL section.
7) Leave the default checkboxes for "F Reset Time" and "Auto Reboot" checked. Uncheck "Nand erase all". Click "Start" and flash the BL (part 2) to your device.
Note: If you forgot to uncheck nand erase all, don't worry. You are just wasting time doing something again that you already did, the outcome is the same. "All" in "Nand Erase All" means "all userdata", which means cache and, well, userdata. Nothing else is deleted.
8) Wait for the flash to finish . It won't take very long at all as the files are small.
9) When it has finished, Odin will say PASS and your device will reboot into recovery.
From this point forther the scary download error message will be gone for good (or until next flash). Don't go looking yet though, you have more work to do to get root.
Warning: Failure to follow this step could lead to a corrupted instance with no cell coverrage
10) When in recovery issue a factory reset. This ensures that your device has a userdata and cache partitions that are valid, and that the csc is processed correctly. Failure to do the reset could cause issues with either.
11) Boot the device as normal. Wait for it to come up. Its deodexed so it will take longer than even your average odexed rom.
All done!
FlashFire Instructions
- Get the ROM on your phone and unzip it
- Open up FlashFire
- Add a Wipe task, select the top 3 items only
- Select Flash Firmware and load up the AP_PartCyborgRom-BootLoopEdition-<version>.Part1.tar.md5 file to flash your new system
- Select Reboot to Recovery
- Make sure "Inject Root" is NOT checked
- Press go. Wait for the rom to flash and your device to reboot into recovery
- From recovery do a factory reset
- Then select reboot to Download Mode
- When device reboots into Download mode, flash BL_PartCyborgRom-BootLoopEdition-<version>.Part2.tar.md5
You have to use odin for the BL file because flashing bootloaders in FlashFire is a bad idea.
Dirty Flashers
Yes, you can dirty flash this rom to upgrade, however it is problematic and can cause issues. I did it for a long time, but my install was a mess by the time I gave up and reset.
To dirty flash, follow your preferred method of flashing above, but skip the Wipe step.
Odin
Skip "Nand Erase All" during the Part 1 flash. Do everything else the same
FlashFire
For the first Wipe task, instead of selecting the top 3, select only Dalvik like the second wipe task.
NOTE: This procedure is ONLY for people upgrading from an earlier PartCyborgRom version. If you are coming from stock you can not dirty flash because you userdata is encrypted which is not supported by the Factory firmware. If you are coming from other rom, or stock, I have no idea man but don't look at me if it blows up.
ANOTHER NOTE: This method of flashing is unsupported! If you do this and you have issues, you are on your own. If you think they are the rom, then back up your entire rom, wipe and reproduce them.
Help! I Got a Boot loop!
If you get a boot loop or your device hangs at boot, try the following:
1) Reboot to recovery and factory reset again.
To get to recovery hold power+vol-down until screen goes black, then wait till upload mode (press power key for 7+ secs) comes up. Then press vol-down+power again and hold it till it reboots and as SOON as the screen goes black switch to holding vol-up+power+bixby. Hold it for 5-7sec then let go and you will wind up in recovery mode. If this doesnt help, or you can't get to recovery because you cant press the buttons right, proceed to the next step.
2) Try flashing just Part 2 (the BL) again. not only will this get you back in recovery, it will also format your cache again. Its worth a shot and doesnt take long.
Kernel Panic, Invalid Argument
Start Over
Go back to the beginning and do everything again. If it fails again, even in a slightly different way this time, bad interaction between the s8 and your USB port/controller/cable/etc are causing the image to be corrupted as its being written to disk. Try the following:
1) New USB Ports. If you have them, use a different set of usb ports (not the one next to it, but one further away). Its possible that that will be your "good" port, and that will be enough. Lots of machines also have some USB3 ports and some USB2.
2) New Cable. Its less likely, but maybe a new cable will help. Do the whole thing over with a new cable.
3) Try a few times. It sounds silly, but people who have had this issue have reported that eventually it just works. Try a few times until you get sick of trying. If you try like 10 times it probably wont work on the 11th though.
I Dont Have Another USB Port!
Try to borrow your partner/spouse/roommate/friends computer for a quick flash. Ask about the USB ports though, because another 3.0 port may not help you.
If you can't get someones computer, you can purchase a USB2.0 Hub online or at your friendly neighborhood electronics store. They arent very expensive, and I have heard positive reports from people saying it did the trick.
None of that Worked! I'm Screwed!
No you probably arent. I can count on one hand the number of people who someone couldnt get this working eventually. Some of us will be here to help. Check out our telegram channel, where people will be around that can help you. Its right here!.
And they all rooted happily ever after.
The End.
XDA:DevDB Information
PartCyborgRom, ROM for the Samsung Galaxy S8
Contributors
partcyborg
ROM OS Version: 7.x Nougat
ROM Kernel: Linux 4.x
Based On: TouchWiz/Samsung Experience
Version Information
Status: Stable
Current Stable Version: BQL1
Stable Release Date: 2017-12-10
Created 2017-12-11
Last Updated 2018-2-10
Downloads
BQL1 (G950U and G950W)
AP_PartCyborgRom_G950U_BQL1.Part1.zip
[Alternate Mirror]
BL_PartCyborgRom_G950U_BQL1.Part2.zip
[Alternate Mirror]
Other Downloads
Remove OTA apps, downloads and debug messages
Remove RCS and VoLTE Icons Zip (Flash in FlashFire)
Odin3-v3.12-PrinceComsy-.zip
[/SIZE]
Previous Versions
G950USQU2BQK5
Bootloader Version 2
AP_PartCyborgRom-G950USQU2BQK5_Part1.zip
BL_PartCyborgRom-G950USQU2BQK5_Part2.zip
Alternate Download Links
Bootloader Version 1
AP_PartCyborgRom-BootLoopEdition-G950USQU1AQK3.Part1.zip
BL_PartCyborgRom-BootLoopEdition-G950USQU1AQK3b.Part2.zip
SM-G950W
AP_PartCyborgRom_G950WVLU1AQJ4.Part1.tar.md5.zip
BL_PartCyborgRom_G950WVLU1AQJ4.Part2.tar.md5.zip
SM-G950U AQI6v2
AP_PartCyborgRom-AQI6_Part1.tar.md5.zip
[This was updated from the original Part2]
Download BL_PartCyborgRom-AQI6_Part2r3.tar.md5
Flashed fine through flashfire(AP only) was a bit worried because after I flashed the bootloader I got a kernel panic upload mode, but I reflashed the bootloader and it worked out fine. Running it for a few hours now and I noticed right away the difference in battery drain, as in, amazing job at extending the battery life. Thanks for your work, look forward to Future updates :good:
Update: only bug I've found is auto rotate doesn't really work, and internet connection issues(might be my network)
I'm new to SIM unlocked and haven't rooted since s4 so possible newb question but
Can I use this rom to root unrooted AQH3?
I'm on sim-unlocked G950U.
Thanks for any help.
Sent from my SM-G950U1 using Tapatalk
Followed everything and when it went to go reboot the SAMSUNG GALAXY S8 logo popped with the little custom lock but its almost as if its just there like its not really rebooting just a screenshot of it it wont go away after a certain time period or anything,I also tried re-flashing the BL and it still didn't boot up as it should of. Any idea on what I should do?
I will test this with my unlocked g950u1 on tmobile
OMEGAHORSE said:
Followed everything and when it went to go reboot the SAMSUNG GALAXY S8 logo popped with the little custom lock but its almost as if its just there like its not really rebooting just a screenshot of it it wont go away after a certain time period or anything,I also tried re-flashing the BL and it still didn't boot up as it should of. Any idea on what I should do?
Click to expand...
Click to collapse
Same here.
I tried the first method (fully stock) and it failed badly to where download mode did not work, had to use Smart Switch emergency recovery
First attempt without flashing CSC on TMo resulted in Kernel Panic after reboot from Download mode. I ended up flashing the CSC and now the Tmobile boot splash is showing up and seems to be working, will update to confirm in a few minutes.
Update: booted just fine now into Setup Wizard...
Will someone upload the files elsewhere? I cannot download it tells me that the OP has reached daily traffic limit on website
TimelessPWN said:
Will someone upload the files elsewhere? I cannot download it tells me that the OP has reached daily traffic limit on website
Click to expand...
Click to collapse
Sorry about that! I'm taking care of it now
@partcyborg.
So... I just got an S8 from Boost Mobile after my LG Optimus f7 started FINALLY failing. Had it rooted and cwm thanks to the genius and hard work of devs like GameTheory and PlayfulGod!
1. Should it be safe to use this method and flash this particular ROM?
2. Do I need to do anything special because it's Boost n not vzw?
3. It was mentioned that in spite of 80% battery issue, battery life is extremely well optimised. Anyone else with S8 on Boost try this? Worth it to take the plunge?
Don't care about Knox, Safety Net, etc. I don't use my device for transactions via Samsung/Android Pay, nor Gaming. Wondering if this will nix Playstore purchases via credit card on file? NOT a deal beaker by any means. Just curious.
I desperately miss having root and custom recovery. siiiiiigggghhhh...
Anyway, Thanks for any info and THANK YOU @partcyborg for all the time and hard work you've put into trying to help us get the most out of these phones!
This is my first $700 phone and I'll probably have her as long as I did my f7. ( as log as battery doesn't die or I can have it replaced at a repair shop when the time comes, for less than a fortune. lol)
Attached is a screen of my phone's specs if it helps.
Thanks again,
- TheJackalsMARK
TimelessPWN said:
Will someone upload the files elsewhere? I cannot download it tells me that the OP has reached daily traffic limit on website
Click to expand...
Click to collapse
The links work again. Sorry for the temp issue!
thejackalsmark said:
@partcyborg.
So... I just got an S8 from Boost Mobile after my LG Optimus f7 started FINALLY failing. Had it rooted and cwm thanks to the genius and hard work of devs like GameTheory and PlayfulGod!
1. Should it be safe to use this method and flash this particular ROM?
2. Do I need to do anything special because it's Boost n not vzw?
3. It was mentioned that in spite of 80% battery issue, battery life is extremely well optimised. Anyone else with S8 on Boost try this? Worth it to take the plunge?
Don't care about Knox, Safety Net, etc. I don't use my device for transactions via Samsung/Android Pay, nor Gaming. Wondering if this will nix Playstore purchases via credit card on file? NOT a deal beaker by any means. Just curious.
I desperately miss having root and custom recovery. siiiiiigggghhhh...
Anyway, Thanks for any info and THANK YOU @partcyborg for all the time and hard work you've put into trying to help us get the most out of these phones!
This is my first $700 phone and I'll probably have her as long as I did my f7. ( as log as battery doesn't die or I can have it replaced at a repair shop when the time comes, for less than a fortune. lol)
Attached is a screen of my phone's specs if it helps.
Thanks again,
- TheJackalsMARK
Click to expand...
Click to collapse
This is about all we have as far as ROMs go. We don't have a custom recovery because our bootloader is locked and it's not looking like it's going to be unlocked ever. You can flash this on any G950U phone, carrier doesn't matter.
thejackalsmark said:
@partcyborg.
So... I just got an S8 from Boost Mobile after my LG Optimus f7 started FINALLY failing. Had it rooted and cwm thanks to the genius and hard work of devs like GameTheory and PlayfulGod!
1. Should it be safe to use this method and flash this particular ROM?
2. Do I need to do anything special because it's Boost n not vzw?
3. It was mentioned that in spite of 80% battery issue, battery life is extremely well optimised. Anyone else with S8 on Boost try this? Worth it to take the plunge?
Don't care about Knox, Safety Net, etc. I don't use my device for transactions via Samsung/Android Pay, nor Gaming. Wondering if this will nix Playstore purchases via credit card on file? NOT a deal beaker by any means. Just curious.
I desperately miss having root and custom recovery. siiiiiigggghhhh...
Anyway, Thanks for any info and THANK YOU @partcyborg for all the time and hard work you've put into trying to help us get the most out of these phones!
This is my first $700 phone and I'll probably have her as long as I did my f7. ( as log as battery doesn't die or I can have it replaced at a repair shop when the time comes, for less than a fortune. lol)
Attached is a screen of my phone's specs if it helps.
Thanks again,
- TheJackalsMARK
Click to expand...
Click to collapse
I'm happy enough with the battery. Bonus is that you won't wear it out charging to 80% only apparently.
It's a multi CSC so you should be fine on boost. I can't test it though I only have VZW. Worst case flash the CSC but only do that if it fails to boot.
adj998 said:
This is about all we have as far as ROMs go. We don't have a custom recovery because our bootloader is locked and it's not looking like it's going to be unlocked ever. You can flash this on any G950U phone, carrier doesn't matter.
Click to expand...
Click to collapse
Yeah, Bootloader's a major buzzkill.
Root and decent custom ROM would be a nice consolation prize.
What's your take on the battery afterwards? I practically live on my phone and with not being able to swap batteries, a major hit to battery life is pretty much a deal breaker. BTW, thx for the quick reply!
- TheJackalsMARK
Sent from my Samsung SM-G950U using XDA Labs
reggie cheeks said:
I'm new to SIM unlocked and haven't rooted since s4 so possible newb question but
Can I use this rom to root unrooted AQH3?
I'm on sim-unlocked G950U.
Thanks for any help.
Sent from my SM-G950U1 using Tapatalk
Click to expand...
Click to collapse
No but you can install rooted aqi6 with it. This literally flashes /system and replaces what you have installed. I find aqi6 much improved TBH
OMEGAHORSE said:
Followed everything and when it went to go reboot the SAMSUNG GALAXY S8 logo popped with the little custom lock but its almost as if its just there like its not really rebooting just a screenshot of it it wont go away after a certain time period or anything,I also tried re-flashing the BL and it still didn't boot up as it should of. Any idea on what I should do?
Click to expand...
Click to collapse
Factory reset. Sorry I should have mentioned that in the op. I will update
partcyborg said:
I'm happy enough with the battery. Bonus is that you won't wear it out charging to 80% only apparently.
It's a multi CSC so you should be fine on boost. I can't test it though I only have VZW. Worst case flash the CSC but only do that if it fails to boot.
Click to expand...
Click to collapse
Thx, man!
And Great Work, again, on this!
- TheJackalsMARK
Sent from my Samsung SM-G950U using XDA Labs
Related
This is a custom Rom I made for the Samsung Galaxy Tab A 7.0 LTE (SM-T285), which suits my tastes.
If you have suggestions, send me a PM.
UPDATE 09/07/2016
================
A newer version that runs "root" (sepolicy constrained) scripts can be found here:
http://forum.xda-developers.com/android/development/rom-samsung-galaxy-tab-7-0-lte-2016-sm-t3455788
Use the above version instead if you want to experiment with features like apps 2 sdcard.
Modifications:
* Based on LMY47V.T285XXU0APCN
* Stock Boot and Recovery (Not much choice since the bootloader is locked)
* Removed Touchwiz launcher and redundant samsung apps (Hancom office, Kidzone), replaced with Trebuchet
* Enabled r/w to the external SD Card
Installation Instructions:
Odin or Heimdall Required.
--FLASH AT YOUR OWN RISK--
1. Make sure to backup of your data and have a copy of your stock Rom in case something goes wrong.
2. Make sure your device is OEM unlocked. (Enable Developer settings and Enable the OEM unlock settings)
3. Extract ZIP file below and flash the tar.md5 file using ODIN, for details on this kindly look for instructions in the xda site.
4. For Heimdall you can use 7zip to extract the system.img from the tar.md5 and just flash the system.img itself.
Link:
Download from Mega
jaritico said:
thanks, but what does after download zip? recovery mode or download mode? and how got it? this root t285?
Click to expand...
Click to collapse
Thanks, but what does after download zip? recovery mode or download mode? and how got it? this root t285?
Click to expand...
Click to collapse
You have to go to download mode and then use Odin to flash. Unfortunately this does not root the T285.
jedld said:
This is a custom Rom I made for the Samsung Galaxy Tab A 7.0 LTE (SM-T285), which suits my tastes.
If you have suggestions, send me a PM.
Modifications:
* Based on LMY47V.T285XXU0APCN
* Stock Boot and Recovery (Not much choice since the bootloader is locked)
* Removed Touchwiz launcher and redundant samsung apps (Hancom office, Kidzone), replaced with Trebuchet
* Enabled r/w to the external SD Card
Installation Instructions:
Odin or Heimdall Required.
--FLASH AT YOUR OWN RISK--
1. Make sure to backup of your data and have a copy of your stock Rom in case something goes wrong.
2. Make sure your device is OEM unlocked. (Enable Developer settings and Enable the OEM unlock settings)
3. Extract ZIP file below and flash the tar.md5 file using ODIN, for details on this kindly look for instructions in the xda site.
4. For Heimdall you can use 7zip to extract the system.img from the tar.md5 and just flash the system.img itself.
Link:
Download from Mega
Click to expand...
Click to collapse
Says I need the encryption key and if I do not have it to contact the developer ......
TopTongueBarry said:
Says I need the encryption key and if I do not have it to contact the developer ......
Click to expand...
Click to collapse
Sorry, updated links, try again and see if it works.
jedld said:
Sorry, updated links, try again and see if it works.
Click to expand...
Click to collapse
Yes, downloading now. Thanks.
Hi,
Anyone tried Pokemon Go update 0.37 with this ROM? The update fails to start for me. It prompts device/os version is incompatible.
I reverted back to version 0.35 and it works fine.
venomrat said:
Hi,
Anyone tried Pokemon Go update 0.37 with this ROM? The update fails to start for me. It prompts device/os version is incompatible.
I reverted back to version 0.35 and it works fine.
Click to expand...
Click to collapse
Yeah the newest version checks for xposed and a bunch of other things. Actually a lot of people were pissed that they did this. You'd probably need to revert back to stock if you want to play. Only systemless root and xposed with magisk works for Pokemon go now.
jedld said:
Yeah the newest version checks for xposed and a bunch of other things. Actually a lot of people were pissed that they did this. You'd probably need to revert back to stock if you want to play. Only systemless root and xposed with magisk works for Pokemon go now.
Click to expand...
Click to collapse
Also if you want more details on what is going on search google for "pokemon go safetynet". Basically most custom roms and not just this device should fail the test.
jedld said:
This is a custom Rom I made for the Samsung Galaxy Tab A 7.0 LTE (SM-T285), which suits my tastes.
If you have suggestions, send me a PM.
UPDATE 09/07/2016
================
A newer version that runs "root" (sepolicy constrained) scripts can be found here:
http://forum.xda-developers.com/android/development/rom-samsung-galaxy-tab-7-0-lte-2016-sm-t3455788
Use the above version instead if you want to experiment with features like apps 2 sdcard.
Modifications:
* Based on LMY47V.T285XXU0APCN
* Stock Boot and Recovery (Not much choice since the bootloader is locked)
* Removed Touchwiz launcher and redundant samsung apps (Hancom office, Kidzone), replaced with Trebuchet
* Enabled r/w to the external SD Card
Installation Instructions:
Odin or Heimdall Required.
--FLASH AT YOUR OWN RISK--
1. Make sure to backup of your data and have a copy of your stock Rom in case something goes wrong.
2. Make sure your device is OEM unlocked. (Enable Developer settings and Enable the OEM unlock settings)
3. Extract ZIP file below and flash the tar.md5 file using ODIN, for details on this kindly look for instructions in the xda site.
4. For Heimdall you can use 7zip to extract the system.img from the tar.md5 and just flash the system.img itself.
Link:
Download from Mega
Click to expand...
Click to collapse
Hello and thank you for your work with this device. Currently I am looking for a bypass for the factory reset protection on my sm t280. I have flashed the stock md5 file 3+ times attempting to do a complete data wipe and reset, and this doesnt remove the lock. Any ideas?
BadReligion420 said:
Hello and thank you for your work with this device. Currently I am looking for a bypass for the factory reset protection on my sm t280. I have flashed the stock md5 file 3+ times attempting to do a complete data wipe and reset, and this doesnt remove the lock. Any ideas?
Click to expand...
Click to collapse
To FRP unlock you have to go to developer settings and switch oem unlock to false. The stock rom should have it unless you are using a carrier locked version that I a! not aware of.
jedld said:
To FRP unlock you have to go to developer settings and switch oem unlock to false. The stock rom should have it unless you are using a carrier locked version that I a! not aware of.
Click to expand...
Click to collapse
please excuse my ignorance, but am i able to do this with out being able to login? the person i purchased it from doesnt have the original owners gmail and pw.
---------- Post added at 05:59 PM ---------- Previous post was at 05:57 PM ----------
BadReligion420 said:
please excuse my ignorance, but am i able to do this with out being able to login? the person i purchased it from doesnt have the original owners gmail and pw.
Click to expand...
Click to collapse
I just downloaded a stock recovery for a sm t285, and was going to attempt to flash to the 280. havent yet, do you feel that would be a safe thing to attempt? not looking to brick.
BadReligion420 said:
please excuse my ignorance, but am i able to do this with out being able to login? the person i purchased it from doesnt have the original owners gmail and pw.
---------- Post added at 05:59 PM ---------- Previous post was at 05:57 PM ----------
I just downloaded a stock recovery for a sm t285, and was going to attempt to flash to the 280. havent yet, do you feel that would be a safe thing to attempt? not looking to brick.
Click to expand...
Click to collapse
FRP is specifically designed to prevent flashing if you can't login to the device. You won't be able to flash unless the person has turned off oem unlock beforehand. I am not aware of any method to bypass this on this device.
Also the T280 and T285 have slightly different hardware so using a different recovery image is not recommended. Also since both devices have a locked bootloader, I highly doubt you can even change the recoveries from stock as I would imagine samsung using different keys for both. At the worst case it still always possible to reflash them back to stock if you do want to try
AARGH! If I had only waited and not sold my so difficult to get SM-T285M (to TTB)....sheesh never thought there would be this much progress
bang head live and keep learning
mac231us said:
AARGH! If I had only waited and not sold my so difficult to get SM-T285M (to TTB)....sheesh never thought there would be this much progress
bang head live and keep learning
Click to expand...
Click to collapse
And thank you so much for selling it. I don't speak enough Spanish to make the ordeal of getting one of the T285M's from so america worthwhile. I was planning on sticking with my T239M for awhile, then I saw your T285M on ebay.
I've dirty flashed jedld's T285 debloated rom, then dirty flashed his T285 tinker rom on top of that. Both onto my T285M. Working flawlessly. Wished he'd kept the mail app, but without touchwiz I guess that wasn't possible.
Something else they blocked in the kernel or with SElinux on the T285M is screen mirroring. Can only cast directly from apps.
Still I am happy overall. Now looking for a castrated version of daemonsu!
TTB
TopTongueBarry said:
And thank you so much for selling it. I don't speak enough Spanish to make the ordeal of getting one of the T285M's from so america worthwhile. I was planning on sticking with my T239M for awhile, then I saw your T285M on ebay.
I've dirty flashed jedld's T285 debloated rom, then dirty flashed his T285 tinker rom on top of that. Both onto my T285M. Working flawlessly. Wished he'd kept the mail app, but without touchwiz I guess that wasn't possible.
Something else they blocked in the kernel or with SElinux on the T285M is screen mirroring. Can only cast directly from apps.
Still I am happy overall. Now looking for a castrated version of daemonsu!
TTB
Click to expand...
Click to collapse
no need for a castrated version. Full ROOT is available soon now.
http://forum.xda-developers.com/showpost.php?p=68777842&postcount=27
Double Aargh...salt on my wounds ttb
Now my contact in S. America will not even reply to me
Contemplating on getting the Samsung J max 7.0 dual sim...yes no U.S lte but has an 8mp camera and a flash...similar to the T285 otherwise...can't say how many times I needed the flash for photos or even if for looking at labels peering into dim areas behind a monitor or tv..maybe end up in same pickle of no root...will see (number is SM-T285YD so it is based off the T285 it seems-maybe a Latin American version soon?)
Also trying to get the T705M from another source but taking forever...low hopes think it will come through
TopTongueBarry said:
And thank you so much for selling it. I don't speak enough Spanish to make the ordeal of getting one of the T285M's from so america worthwhile. I was planning on sticking with my T239M for awhile, then I saw your T285M on ebay.
I've dirty flashed jedld's T285 debloated rom, then dirty flashed his T285 tinker rom on top of that. Both onto my T285M. Working flawlessly. Wished he'd kept the mail app, but without touchwiz I guess that wasn't possible.
Something else they blocked in the kernel or with SElinux on the T285M is screen mirroring. Can only cast directly from apps.
Still I am happy overall. Now looking for a castrated version of daemonsu!
TTB
Click to expand...
Click to collapse
got another one - white color ...as a gift...God Bless - great device battery life is just incredible - nothing fancy but does its job...keeping this one (had it since early November) gave up on the 705m
Is this ROM compatible with Google Safetynet? I can't seem to log into Pokemon GO since I installed Tinker edition, so I'm thinking to switch to this one instead.
Haven't tried it but it should work.
Is the root part contained in boot.img or in system.img? In other words, when using Heimdall I should flash both system.img and boot.img, isn't it?
I'm getting bootloops with CM13, Omni and I don't know how I got Tinker working, I kind of remember flashing boot.img, then wiping, then flashing system.img, then wiping again.
EDIT: got this one working too by flashing boot.img (Heimdall complains it cannot receive confirmation msg) reboot into download again, then flashing system.img (this time heimdall does reboot the phone). however, pokemon go still wont connect due to google's safetynet compliance.
I'll try flashing recovery in case it is TWRP the one clashing with Safetynet.
PD: I didn't backup stock at the beggining of the process so I'm pretty much screwed with Pokemon until I can afford a new phone. But if someone has a stock ROM for T285MUBU0API2, please ping me.
EDIT2 Got pokemon working. I reinstalled TWRP (this ROM's recovery is the stock one, of course), then flashed unSU. It removed SuperSU binary and Google SafeNet got working again. I can't believe that, after so much hours I've put into finding the best custom ROM for this crappy phone, 95% of the time was spent in trying to get Pokemon GO running. I'm close to 40, FML.
I've been waiting for a custom ROM, haven't quite learned to make one myself. I've tried finding a compatible Xposed with no luck. The only things I have been able to do are debloat and add Viper/Dolby sound mods that added volume boosts. Please feel free to add any trials and errors you guys have had trying to mod this phone here.
packydavis said:
I've been waiting for a custom ROM, haven't quite learned to make one myself. I've tried finding a compatible Xposed with no luck. The only things I have been able to do are debloat and add Viper/Dolby sound mods that added volume boosts. Please feel free to add any trials and errors you guys have had trying to mod this phone here.
Click to expand...
Click to collapse
There are plenty of tutorials for making your own rom and kerenel. There are plenty in xda university and an excellent one by my colleague jackeagle, if you want something device specific then it maybe better to add the phone title in your op rather than just adding a tag
Regards
Sawdoctor
LG Aristo
No ROMs, no real mods and the only progress we have towards a kernel is KyleBryant's work delivering us the kernel source itself.
JustLee said:
Dang Any tips for editing the power button on the back of the phone
Click to expand...
Click to collapse
What do you mean by editing the power button? Like how it functions or it's response upon being held down?
Substratum
Hey, just so you guys know, Substratum works once you're rooted. Just go to the Play Store and download the Substratum app along with a theme of your liking. I'll post some screenshots of my Aristo all theme translucent.
mustangtim49 said:
Hey, just so you guys know, Substratum works once you're rooted. Just go to the Play Store and download the Substratum app along with a theme of your liking. I'll post some screenshots of my Aristo all theme translucent.
Click to expand...
Click to collapse
I'd recommend against using it with certain themes.
I ended up breaking my status bar so now when I hit the settings button from the pull down, it activated gps instead.
MODS
Changed BootAnimation .zip to Cyanogenmod version
Added Viper4Divine FX + DivineEQ + Dolby Atmos
Apps Added into system:
AdAway
Camera FV-5
ES File Explorer
EvolveSMS
FlySo
GhostKik
Instagram
Kik
NovaLauncher
PowerManager
Pulsar+
Removed from system:
All LG Home Apps (FIRST replace with Launcher of your choice E.G. Nova or ADW)
Lookout
All Google but Play Store, Play Services, Play Games, Gmail, YouTube, Maps, and Drive.
All LG apps but SmartWorld (yes including Messaging)
And removed more but they were minor and cant remember...
DivineEQ is blank when loaded so far.
ES File Explorer clears its "history" every time i exit the app. But major settings stick.
I know its nothing major. If I knew Android Developing, I would create a custom rom.
https://forum.xda-developers.com/android/development/rom-ipioneer-stock-10i-v1-t3637393
xtremelora said:
https://forum.xda-developers.com/android/development/rom-ipioneer-stock-10i-v1-t3637393
Click to expand...
Click to collapse
Good look, but the is for the lv3. I've already tried and it won't work due to twrp doing a check on model version and build version sadly.
ninjasinabag said:
Good look, but the is for the lv3. I've already tried and it won't work due to twrp doing a check on model version and build version sadly.
Click to expand...
Click to collapse
As I said on the OP of that thread, check the specifications at the end.
Of course, it is for the MetroPCS version, I make it clear where it says:
Carrier: MetroPCS
And I also mention the twrp limitations and the fix.
Besides that, I am going to start building an slim version (very slim) and at the same time if anyone can provide me a T-mobile/Other Carrier Nandroid I can build slim versions of that for you guys.
xtremelora said:
As I said on the OP of that thread, check the specifications at the end.
Of course, it is for the MetroPCS version, I make it clear where it says:
Carrier: MetroPCS
And I also mention the twrp limitations and the fix.
Besides that, I am going to start building an slim version (very slim) and at the same time if anyone can provide me a T-mobile/Other Carrier Nandroid I can build slim versions of that for you guys.
Click to expand...
Click to collapse
Ooh sh#t, my bad homie.
Well now that I've made a fool of myself, I'mma back up and give this a test.
ninjasinabag said:
I'd recommend against using it with certain themes.
I ended up breaking my status bar so now when I hit the settings button from the pull down, it activated gps instead.
Click to expand...
Click to collapse
That's when you boot into recovery and flash the Substratum.rescue zip and all good, plus, you should have a good nandroid to restore also. So nobody should be afraid to use Substratum, it's perfectly safe if you know your back up plans. Anyone has questions, just reply in this thread and I'll do my best to help anyone.
mustangtim49 said:
That's when you boot into recovery and flash the Substratum.rescue zip and all good, plus, you should have a good nandroid to restore also. So nobody should be afraid to use Substratum, it's perfectly safe if you know your back up plans. Anyone has questions, just reply in this thread and I'll do my best to help anyone.
Click to expand...
Click to collapse
Yeah, I already had that panned out. My comment was a simple heads up about one of the possibilities.
snafu
starting over from scratch currently. everything was correct and working when i first rooted and progressively i messed up. i have no idea how it got so bad or why Ive put up with it for weeks now. i have several nandroid back-ups if anyone wants a headache. but i think my problem is deeper than just the ROM.
Laptop recognizes my LGMS210 as a LGMS550 when in recovery. Code 10 -broken drivers.... *re-flashed the recovery from fastboot [ADB version 1.0.32 Revision eac51f2bb6a8-android] and laptop gave me access to internal and SD but only seeing 9.95g available (6g for sys? is that right)
Google play is broke af. Nothing will install (error -504) even after cleaning data/data. data/apps .. even after dalvik/cache wipe.... even after praying. Not even apps Ive never installed before. LG smart world ie themes,fonts,whatever gives install error.
cant even install apks i have on SD (error-package seems corrupt)
Magisk wont update from ver 2.*.* to ver 16. begins to work but alas error -1 ?
I still have root tho lol
no super su present
and i have xposed framework API 26 installed but i think when using magisk and xposed modules this whole cluster nut began.
android Easter egg wont even work. its stuck with a fish selected, cant change the food offering. and NO cat has ever came.
Boot-loops 3-4 times if not shutdown properly... ie rebooter app or terminal reboot. i changed the default MPCS boot animation so i can see if its looping or chooching. gets thermo-nuclear hot and eventually boots after 4-5 minutes.
i'm gonna go ahead and re-flash stock FW.
*on a side note i keep confusing my PC software like fastboot and adb for my gf's galaxy tab A. Caught a security error brick when i accidentally used its fastboot for something like to unlock bootloader.... i have way too many devices being worked on at once. eh, never a dull moment.
₥ike_grips said:
starting over from scratch currently. everything was correct and working when i first rooted and progressively i messed up. i have no idea how it got so bad or why Ive put up with it for weeks now. i have several nandroid back-ups if anyone wants a headache. but i think my problem is deeper than just the ROM.
Laptop recognizes my LGMS210 as a LGMS550 when in recovery. Code 10 -broken drivers.... *re-flashed the recovery from fastboot [ADB version 1.0.32 Revision eac51f2bb6a8-android] and laptop gave me access to internal and SD but only seeing 9.95g available (6g for sys? is that right)
Google play is broke af. Nothing will install (error -504) even after cleaning data/data. data/apps .. even after dalvik/cache wipe.... even after praying. Not even apps Ive never installed before. LG smart world ie themes,fonts,whatever gives install error.
cant even install apks i have on SD (error-package seems corrupt)
Magisk wont update from ver 2.*.* to ver 16. begins to work but alas error -1 ?
I still have root tho lol
no super su present
and i have xposed framework API 26 installed but i think when using magisk and xposed modules this whole cluster nut began.
android Easter egg wont even work. its stuck with a fish selected, cant change the food offering. and NO cat has ever came.
Boot-loops 3-4 times if not shutdown properly... ie rebooter app or terminal reboot. i changed the default MPCS boot animation so i can see if its looping or chooching. gets thermo-nuclear hot and eventually boots after 4-5 minutes.
i'm gonna go ahead and re-flash stock FW.
*on a side note i keep confusing my PC software like fastboot and adb for my gf's galaxy tab A. Caught a security error brick when i accidentally used its fastboot for something like to unlock bootloader.... i have way too many devices being worked on at once. eh, never a dull moment.
Click to expand...
Click to collapse
You're using the wrong recovery if it's still showing the ms550.
Drivers are universal inside of company devices. (LG for LG, Samsung for Samsung) so they don't conflict.
Adb and fastboot are both universal drivers and shouldn't matter for your device. (I'm using the same fastboot I installed for my Galaxy note 4 that I am for my aristo, my V10, my htc desire 610, and my uncle's v20)
Just do what you said and start fresh.
Unlock the bootloader.
Install the proper twrp and remove encryption.
Flash the stock boot partition and wipe data (this is sneakily pertinent if you're gonna use magisk)
Do not install system mods before using magisk.
After that, use twrp's file explorer to remove and stock apps that you won't need.
DEPRECATED
This firmware is old and deprecated.
See the below link for new firmware and a better root method.
https://forum.xda-developers.com/galaxy-s8/development/root-partcyborgrom-aqi6-deodexed-t3702988
You can just flash the BL_ tarball if you don't want to install a new system
but want the better screen and modem drivers.
PART 2: FIRMWARE RELOADED
I have done extensive research into the issues reported by those of you who are still experiencing screen issues.
I was unable to reproduce the screen issue on my then-current firmware with this update.
Not being content to leave people with buggy screens, I learned as much as I could about the s8 firmware.
This is what I did with that information.
Flashable Custom Firmware Package For ALL SM-G950U/U1 ON US CARRIERS
If you have a non-us G950U and want to install this pm me or ask in the thread and ill make one. Its very simple but I wanted to get this out to everyone else ASAP
NOTICE!
This an UPDATE (and More) to the Green/Garbled Screen Issue firmware.
There is NEW firmware to download below, and everyone who is rooted should read on, even if you installed the previous version.
Background
At the core of the issue with the garbled screen, modem panics, and sd card issues are two central themes: Bugs, and Incompatibilities. The S8 family of phones was fraught with issues early in its release, including the infamous "Red Tint', Fingerprint scanner malfunctions, mysteriously poor battery life, and surely a bunch of smaller others. Many of these bugs were caused by issues in the device's underlying firmware. Like most devices, Samsung has worked to fix these bugs and improve device performance throughout the phones lifetime for sale in public.
Root Bugs
The problem was unfortunately worse for users of one of the rooting methods for the S8. The biggest reason for this is that in order to relax security constraints enough to make rooting possible, a "non-user oriented", "factory" combination firmware was used. This firmware, being designed apparently for configuration/repair processes inside a factory, was not tuned to the normal level as the public firmware, likely did not go through the same testing, and ultimately any bugs unique to this "Combination" firmware that did not directly affect basic functionality or also stock were probably largely initially ignored.
This is where most of the issues that you all have had come from.
Finding a Solution
As I was unable to reproduce the issue on my device without resorting to the original firmware shipped out with the root method I used, I decided to think about what made my device different than the other devices reporting these issues. While sure we may have slightly varying hardware and that may contribute to these issues as well. What I am absolutely certain of is that most of us have different releases of software from each other. Not only have people essentially ad-hoc upgraded from the original firmware they rooted with until now, many have not upgraded at all or, only partially upgraded (such as with the pervious version of this).
While I could have simply packaged up my firmware/bootloader flashfire backup, I decided to take it a step further.
THE GOODS
Without further ado, I present to you:
S8Root Improved: A SM-G950U1 Custom Firmware Package for Root Users
This package contains a custom mix of the latest AQH3 STOCK (not combination) firmware used wherever possible with the Necessary boot/kernel images from the combination firmware necessary to keep root working with permissive SELinux. It contains all of the improvements from the previous version, and many more.
RESULTS
I can only speak for myself, but the results I experienced were amazing:
- Better UI Responsiveness.
Things surprise me how they move
- Sharper/brighter screen colors
I thought it couldn't get better than the last version but it has! Everything just looks crisper and are super bright without being oversaturated like with the Adaptie Mode.
- POSSIBLY Improved LTE network connectivity.
Note I said POSSIBLY. I personally regularly experienced 8-10Mb/s download bumps and 2-3Mb/s upload bumps in LTE while moving back and forth from this new firmware. I have my LTE radio locked to a specific channel (there are two i pick up at my place and one is terrible) and I carefully measured -107 to -112 dBm RSRP and -13 to -14 dB RSRQ prior to each measurement. I almost left this out but I figured it would be better to give you the information with no conclusion either way. It ABSOLUTELY could be Atmospheric changes, Traffic level changes, or any other of a million thins. YMMV
- Could POTENTIALLY still any remaining fix long-standing SDCard issues
I did not experience this, but had a few reports from users that did. The same pieces used in that version that would touch SDcard usage are used here, so that fix/improvement will carry over.
DISCLAIMER
Unfortunately proving beyond any shadow of a doubt that this package fixes the issue was impossible . I have TRIED AND TRIED AND TRIED to trigger the screen issues, including tweaking on and off every setting (auto brightness, multiple DPIs, different graphs modes, etc) I could get my hands on and it just was not happening. I used every software/systems trick I could think of to break this again, and I was completely unable to tickle the bug on this firmware, despite being able to reliably trigger it almost on command using my previous firmware.
The only thing left to do is either:
- Get the source from samsung, fix the bug myself, and get them to sign my new kernel image with their key so our locked bootloaders would allow it (HAHA I DOUBT IT)
- Acquire a large fleet of S8s (and S8+s) to run distributed integration testing (like the kind Android use at Google). Well if someone wants to buy me a few dozen s8s and s8+s (each) sure I'll take a month off work and squash this, but otherwise not gonna happen either.
If it STILL happens for you, I'm sorry.
I have done everything I can think of, and if it happens to you and you have suggestions, I'm all ears.
BUT HEY, but this is XDA right? Land of mods like Xposed which will brick one persons device and work flawlessly on the identical one next to it. And we love Xposed don't we?
Despite absolutely hilarious comments to the contrary, this package absolutely meets the (aka "BugFix") as well as just about any android update ever does, given the wide variety of environments, usecases and software configurations out there. I surely hope that this works for you.
Instructions
1) Download the package from the link above.
- Here it is Again for good measure.
2) Reboot into download mode and flash using Comsy Odin
Thats it! I packaged this in a way to make the process as smooth as possible.
There is NO reinstall, NO wipe of any kind, nor ANY further work on your part needed to install and use this.
The file size is small so the download is fast, and again, there is NO WIPE or config change needed.
if (for some inexplicable reason) you want to roll back, or go to 100% stock sans root, that process should not be made any more difficult as well.
Legacy Information
If you were here before and either looked at or downloaded the previous version, AND YOU HAVE NO QUESTIONS you can skip this part.
If you have questions, please read through to the end of the post before asking them, as I tried to answer as many as I could before hand and all of this information still applies.
WHAT IT IS NOT:
I wanted to outline a few things it is NOT about, to make a valliant effort to stem off the flow of questions before they begin (ha!):
NOT: A new Stock ROM for Your Phone
THIS IS NOT A FULL OS BUILD! DO NOT DOWNLOAD THE WHOLE THING AND FLASH IT EXPECTING AN ENTIRELY UPGRADED OS.
There is no full stock AQI1 image I have found. Believe me I looked a bunch of places after I found it
NOT: Oreo Early Preview
Given the predictions that the next release from Samsung would likely be Oreo, there was some initial over excitement. This wound up being NOT the case and if you read at least current Samsung Oreo projections they are predicting AQB now.
NOT: A Fix for the 80% Battery Issue
I know this is completely futile to hope for but:
THIS DOES NOT FIX THE 80% BATTERY ISSUE!!!!
NO WE DO NOT HAVE A FIX FOR THAT OR ONE COMING ANY TIME SOON!
YES SOME PEOPLE ARE STILL TRYING!
PLEASE DO NOT ASK! OFF TOPIC FOR THS THREAD
NOT: Currently Tested by ANYONE but ME
Since the moment I installed this I have not had ONE SINGLE screen issue, where previously I would have them several times throughout the day (at least 3 sometimes upwards of 6). For the case of ME and MY device, I am confident in declaring that this boot ROM does not have the same kernel bug that was causing the issue on the boot.img provided as part of your traditional root method.
NOTE: This is for the s8 G950 US Snapdragon models ONLY! Do NOT Flash this on your exynos, your Chinese/HK S8, your N8, your MOTO RAZR flip phone, whatever else you have. Kernels/boot.img files are very device specific and you will surely break it if not completely brick it.
DISCLAIMER:
YOUR WARRANTY IS ALREADY VOID if you are paying attention and are doing this to fix bugs with the existing sampwnd root.
HOWEVER IT IS EVEN VOIDER NOW. FLASH THUS TO YOUR DEVICE AT YOUR OWN RISK!
and if you break it I AM NOT RESPONSIBLE! FLASH AT YOUR OWN RISK!
As I said I have not tested this anywhere but my phone as I dont have any other s8s nor do I have access to any locally. I hope it works for you as well as it has for me.
STEPS
Download Boot Image
Use the URL here to Download the AQI1 boot.img file: Go Download the New Hotness
Prepare Phone for Flashing in FlashFire
If you did not download it on your phone, copy it somewhere FlashFire can see it.
Flash it
Open up FlashFire
Hit the "+" button
Select the "Flash Firmware Package" option, NOT the "Flash Zip or OTA" option!
You should see a popup window thing that has a checkbox next to the word BOOT, with "boot.img, 22MiB" underneath.
Make sure the checkbox is checked.
Make sure that it says BOOT above boot.img.
I have no idea if its possible for this to get messed up, but BOOT implies flashing the BOOT partition so if it says something else you are headed towards brick town, abort immediately.
Press the Check mark at the top right corner once you have confirmed the two things above.
MAKE SURE EVER ROOT IS DISABLED!!!
Click on the "Reboot" box, and choose "Recovery". MAKE SURE PRESERVE RECOVERY IS NOT CHECKED!
Back at the main menu, click the lightening bolt next to the word FLASH. Confirm.
Wait for FlashFire to do its thing. Sometimes it takes a minute for FF to wake up and start flashing. Occasionally for me it never happens, if this happens DO NOT PANIC ITS FINE. Hold down power+volDown until you eventually wind up in upload mode, then just reboot normally and everything will come back fine.
When FlashFire finishes (it will go really fast, the image is only 22MB we arent flashing a 5GB system here), it will auto-reboot your device into the recovery men
Select Wipe Cache and Confirm
This will wipe cache which is fine and safe. Again maybe not needed, feel free to skip if you know what you are doing. If you mess up and accidentally click factory reset instead, please tell me so I can laugh at you.
Reboot into a Clear New World
Select reboot and boot the system normally. If you formatted the cache partition above, it will take a little longer to start your phone. This is just the first time per normal.
Thats it! Welcome to the world of clear screens and bright colors. It could be a total placebo effect but I actually think this kernel drives the display better sometimes.
Please let me know what you think, and if this works for you. I wi;; be here for a while to answer questions or fix anything i typoed above or whatever.
FYI: A s8+ thread is coming too, as I sprung for purchasing both downloads to be an equal opportunity XDAer (at least with US flagship Samsung devices lol) but since I have an s8 and thus had the files locally already I made this one first
@jhofseth for nerding out with me the last few nights on trying crazy **** to get a bootloader unlock which prompted me to dig at this in the first place
Most of all, all of the tons of you who have made so many aewesome mods, themes, apps, what have you that I use every day and that make me enjoy my device all the more. I could not be happier to have the opportunity to give back a little.
Here is the restof the s8 combo firm if you are interested, but don't just flash this as its not a full OS:
EDIT: DOWNLOAD THE NEW ONE ABOVE
Can I Get The Link To The S8+ Boot im willing to try it
Mark805 said:
Can I Get The Link To The S8+ Boot im willing to try it
Click to expand...
Click to collapse
Coming very soon I promise! 10m max
Ok thanks
Mark805 said:
Can I Get The Link To The S8+ Boot im willing to try it
Click to expand...
Click to collapse
Its up now! https://forum.xda-developers.com/ga...sampwnd-root-green-screen-corruption-t3673815
whats the bootloader verison? it can be found by booting into download mode manually.
Cameron581 said:
whats the bootloader verison? it can be found by booting into download mode manually.
Click to expand...
Click to collapse
This isn't a bootloader change, it's boot.img which is the kernel and root filesystem essentially
Hey, btw this does not void warranty. I understand it's a standard disclaimer but it doesn't void it. It doesn't trip knox, so warranty is still very intact.
mweinbach said:
Hey, btw this does not void warranty. I understand it's a standard disclaimer but it doesn't void it. It doesn't trip knox, so warranty is still very intact.
Click to expand...
Click to collapse
Uh just because their service does not catch you does not mean that technically you are not violating your warranty contract thus making using technically illegal
That would be like saying "it's not murder if you leave no forensics!" Lol
wildermjs8 said:
Uh just because their service does not catch you does not mean that technically you are not violating your warranty contract thus making using technically illegal
That would be like saying "it's not murder if you leave no forensics!" Lol
Click to expand...
Click to collapse
i mean legally a warranty can not be void through software modifications unless it causes physical damage to the device. Since the efuse was not tripped no physical damage has been caused and no warranties have legally been void.
I had the green screen/graphics corruption after flashing this still...
goliath714 said:
I had the green screen/graphics corruption after flashing this still...
Click to expand...
Click to collapse
Apparently this happens to some people. I am fairly certain it is a firmware combination issue but I haven't been able to track it down. One thing you can do to eliminate it if you have the issue still (please let me know if this does not work) is to disable auto brightness.
wildermjs8 said:
Apparently this happens to some people. I am fairly certain it is a firmware combination issue but I haven't been able to track it down. One thing you can do to eliminate it if you have the issue still (please let me know if this does not work) is to disable auto brightness.
Click to expand...
Click to collapse
I have auto brightness off and still get it here and there.
goliath714 said:
I had the green screen/graphics corruption after flashing this still...
Click to expand...
Click to collapse
Please check out the OP again and download/flash the new version. Rather than just a few files, its a whole new entire bootloader/kernel package that I assembled piece by piece to have as much latest stock firmware as possible while maintaining what we need for root.
My primary suspect for why some people experience this regression is having older parts of their system. Rather than push everyone to upgrade, I made a painless upgrade process for all of their firmware instead
This includes the Radio drivers and bootloaders, kernels and flash layer libraries. Its all either latest stock or its AQI1 Combination because it was absolutely necessary.
wildermjs8 said:
Please check out the OP again and download/flash the new version. Rather than just a few files, its a whole new entire bootloader/kernel package that I assembled piece by piece to have as much latest stock firmware as possible while maintaining what we need for root.
My primary suspect for why some people experience this regression is having older parts of their system. Rather than push everyone to upgrade, I made a painless upgrade process for all of their firmware instead
This includes the Radio drivers and bootloaders, kernels and flash layer libraries. Its all either latest stock or its AQI1 Combination because it was absolutely necessary.
Click to expand...
Click to collapse
We flash the tar in the AP slot correct?
CloudyxVision13 said:
We flash the tar in the AP slot correct?
Click to expand...
Click to collapse
Yep
---------- Post added at 08:29 PM ---------- Previous post was at 08:28 PM ----------
Seems to be running better to me. Thanks bro
CloudyxVision13 said:
We flash the tar in the AP slot correct?
Click to expand...
Click to collapse
It actually does not matter, as Odin will do the right thing no matter what.
Sorry I should have made that clear. I will update the op to make that clear
Just wanna make sure of something. First, I flash the first download files through modded doin, then afterwards, flash the second file in ff?
AngelIsL33T said:
Just wanna make sure of something. First, I flash the first download files through modded doin, then afterwards, flash the second file in ff?
Click to expand...
Click to collapse
Nope, only need the tar file bud. The old boot.img file is just basically the previous version of this.
AngelIsL33T said:
Just wanna make sure of something. First, I flash the first download files through modded doin, then afterwards, flash the second file in ff?
Click to expand...
Click to collapse
The old image is actually part of the new tar, do you will have it anyway . I packaged it in Odin this time because there are some pieces of firmware FF either can't or warns against using it for. Plus one clean simple tar seemed easier, no?
Do you see the boot.img in the op? I thought I nixed all the instances of the link but I may have missed one.
I almost rewrote all the old text to reflect now but it felt like editing history so I tried to preserve what made the most sense still. It sounds like it's still a little confusing sobrskr another crack at it shortly.
Please let me know if you have any trouble! I'll be here to help all evening
SamFail presents...
PartCyborgActiveRom
ARA1
A Rooted Custom Rom
For SM-G892A/U on V1 and V2 Bootloaders
FAQ
What is my Bootloader Revision?
Your bootloader revision is part of the baseband build number of the firmware you are currently running. For example, let's consider this firmware version: G892ASQS2BQL1
Start from the right and count 5 characters back. See that 2? That is the bootloader revision for the firmware that came with this rom. All Samsung firmware follow this formula for all devices.
Using this formula, What is the bootloader version for G892UEU4GHK1?
Answer: Bootloader revision is 4
Updates
Please see below for a a new update to both the V1 and V2 releases.
It is a new BL "part 2" tarball that contains a fix for the issues reported by
many of you with the finger print and other various sensors. It has replaced
the original firmware Part2 link in the following post .
Featured Modifications
Deodexed
Deodexed for all devices.
I found a way that works!
It should continue working as long
as we care about nougat
Xposed Preinstalled
Forget that extra flash, PCR now comes out of the flasher with xposed pre-installed.
NOTE: Xposed Installer may crash on first boot. It will not crash after setup finishes and you reboot
New Custom Boot Animation
Another great one from @rayan-refoua himself.
This one is my favorite so far.
JamesDSP
I added another DSP style audio mod. JamesDSP is similar to V4A in how it operates and what features it has, but it has some really awesome features that have gotten me using it for a while. Specifically it has a better convolver (IRS processing) implementation, and its bass boost is WAY better than v4a. However you can use both at the same time to get the best of both worlds.
ITYBP Modded YouTube
A last minute addition, this is a really nice youtube mod brought to you by XXXXXX ADD SOURCE XXXXX. It features some cool features like native adblocking (no more xposed module), override your max youtube resolution (so you can watch 4k videos on your phone), and, not as important to us, spoofing different device types to get true hdr videos. I have been using it for a while and really like it. A big thanks to them for letting me include it with PCR
Improved Debloating
I did a lot more digging this round, and was able to add back a few things that I had taken out without loading the system more. This rom feels snappier than any before it. As usual, if you find something missing that you want back, pull it from the stock rom and install it in /system.
Improved Battery Life
Thanks to some fine battery sleuthing work by @TheMadScientist, this release comes with a nice big bump in efficiency. With just some very minor tuning using amplify and a service disabler, I can get around 1%/h drain.
Performance Improvements
That increased battery life does not come at the cost of performance. In fact performance is better too. Part of that is due to a large batch of personally tested build.prop tweaks make the ui a lot more responsive. Part of that is the data optimisation scripts that now run at boot to make sure things are cleaned up and in tip top shape. You wont notice those, but they are there doing their thing.
Other Features
- Pre-Rooted with SuperSU installed
- CSC OYN pre-installed. Tested working on several carriers
- RCS and VoLTE icons removed from status bar.
- High quality audio mods, including
- Viper Audio (V4A)
- Dolby Atmos from the Axon 7
- Pandora hifi audio framework
- Native Google Dialer & Contacts support, including local search, spam call blocking
- Oreo 8..1 Emoji Icon Set
- Custom Lockscreen Clock font
- Stock system display fonts replaced with Apple's original San Francisco Font
Special Thanks
- @ahiron and @Zackptg5 for the killer sounds from V4A and Dolby Atmos Mods!
- The Aiur crew for Pandora (now a legacy mod but works great on the s8)
- @syndre for the Google Dialer and Contacts framework mod
- @rayan-refoua for the beautiful Tech Lines Custom boot and shutdown animations!
- Last but not least, my new friend @laura almeida, along with @Razerman amd @ZaneZam for letting me include the iYTBP - injected YouTube Background Playback Mod
- everyone who tested
Warnings/Disclaimers/Known Issues
- 80% Battery life like every other rooted US snapdragon device
- Flashing on a USB 3.0 port will likely cause corruption in your flash that can cause kernel panics, loss of root, and occasionally very strange other errors. If you get something like this, its not the rom its a hardware conflict that can only show up with larger images like are used in SamFail flashing. See the section below on Kernel Panics for more.
- If there is an app or apk from the stock rom that you wish you had installed, the best solution is to extract it from your stock rom image and copy it to the same place in /system using a root file manager. If a large number of people want something back, I will include it in the next version, but by now I think we have covered all those possibilities and now the list will only get shorter. No I will not put Bixby back
SamFail Rooting Process
and Rom Installation
WARNING: THE FOLLOWING WILL ERASE YOUR WHOLE PHONE
If you have a SDCard, remove it from your device. Occasional firmware incidents have wiped SDCards in the past. Better safe than sorry.
Prepare the Following:
- complete stock rom at your bootloader rev in case things dont work
- Everything backed up (see above)
- Both Prince Comsy Odin, and Regular Odin for flashing stock
- A USB 2.0 Port. If you attempt to flash with a USB 3.0 port it may work, but if you get kernel panics, or unexpected bad behavior and/or crashes your usb3 is absolutely to blame. some people get lucky and suceed after a few tries, YMMV. If you can not acquire a machine with a usb2.0 port, get a usb2.0 hub and run your phone into that & that into your machine. Reports are that has made things work for some, but we get few reports back.
[/size]
Steps to Root
1) Download and unzip AP Part 1 and BL Part 2 zip files.
2) Download and unzip Prince Comsey Odin and start it up
3) Reboot device into Download mode, connect to your pc
4) Open Comsy Odin and add ONLY the AP Part1.tar.md5 file. Select the following options only:
- "Auto-Reboot"
- "F-Reset Time"
- "Nand Erase All"
NOTE: Odin will freeze while checking the AP tar.md5 hash.
Be patient, it will come back.
5) Click "Start" and wait for the system.img.ext4 file to flash fully to your device. This will take a while too.
ATTENTION:
When the flash finishes, this is when the SamFail magic happens. Instead of saying "Failed (Auth)" like it should, the device will crash into upload mode with "Unknow Error".
If your device does not do this, and just says "Failed (Auth)" or something similar and stays in download mode, you need to start again from the beginning, but using a different set of ub ports as you have suffered from the usb3 corruption.
When you see the upload mode page, use the 3 button reboot to go back to download mode.
WARNING: When you reboot from upload mode, your phone will show an error instead of download mode.
When you reboot back into download mode, your screen will say that you had a failed update and you need to do emergency repair or take your device to a service center.
Rest assured, your phone is actually in download mode, and Odin will have recognized it and said "Added!" along with the com port lighting up underneath the progress bar.
It is safe to continue
6) Close and re-open Comsy Odin or hit the reset button, and add BL_PartCyborgRom-BootLoopEdition-<version>.tar.md5 to the BL section.
7) Leave the default checkboxes for "F Reset Time" and "Auto Reboot" checked. Click "Start" and flash the BL (part 2) to your device.
8) Wait for the flash to finish . It won't take very long at all all the files are small.
9) When it has finished, Odin will say PASS and your device will reboot into recovery.
Warning: Failure to follow this step could lead to a corrupted instance with no cell coverrage
10) When in recovery issue a factory reset. This ensures that your device has a userdata partition that is valid, and that the csc is processed correctly. Failure to do the reset could cause issues with either.
All done!
Donations/Root Bounty
Pledged a donation for the root bounty? Send it here. Thank you!
IF YOU GET A BOOT LOOP:
If you get a boot loop or your device hangs at boot, try the following:
1) Reboot to recovery and factory reset again.
To get to recovery hold power+vol-down until screen goes black, then wait till upload mode (press power key for 7+ secs) comes up. Then press vol-down+power again and hold it till it reboots and as SOON as the screen goes black switch to holding vol-up+power+bixby. Hold it for 5-7sec then let go and you will wind up in recovery mode.
Kernel Panic, Invalid Argument
Start the process over
Go back to the beginning and do everything again. If it fails in a new way this time, you may have hardware caused corruption, or maybe you missed a step. Change hardware, and keep trying.
Help
If you get stuck, some of us will be here to help. Check out our telegram channel, where people will be around that can help you. Come Check it out.
Enjoy!
XDA:DevDB Information
PartCyborgRom, ROM for the Samsung Galaxy S8
Contributors
partcyborg
ROM OS Version: 7.x Nougat
ROM Kernel: Linux 4.x
Based On: TouchWiz/Samsung Experience
Version Information
Status: Stable
Current Stable Version: BQL1
Stable Release Date: 2017-12-10
Created 2017-12-11
Last Updated 2018-2-10
Downloads
V1 Bootloader Revision
PartCyborgRom.G892A-ARA1.Part1.zip
[Alternate Mirror]
PartCyborgRom.G892A-ARA1.Part1b.zip
[New: Fingerprint/Sensors all working]
V2 Bootloader Revision
PartCyborgRom.G892A-2ARA1.Part1.zip
[Alternate Mirror]
PartCyborgRom.G892A-2ARA1.Part2b.zip
[New: Fingerprint/Sensors all working]
(New!) V3 Bootloader Revision
SM-G892A: PCR_G892A_BLV3.7z
SM-G892U: PCR_G892U_BLV3.7z
Odin
Prince Comsy Odin
One more time
I'm gonna celebrate it
Oh boy I'm first in the thread lol. No bagsssss.
I'm outa thanks for the day but they is comin
How to I know what version of Bootloader I have?
Yu-Ra said:
How to I know what version of Bootloader I have?
Click to expand...
Click to collapse
What is your baseband version
Mine has the u2 in it means I'm v2 look in pic
Can't unzip part 1, re DLed it multiple times can only extract 518mbs then crc error.
Pjs187 said:
Can't unzip part 1, re DLed it multiple times can only extract 518mbs then crc error.
Click to expand...
Click to collapse
I will let him know this was a issue the other day as well
That would be the AP part right
TheMadScientist said:
I will let him know this was a issue the other day as well
That would be the AP part right
Click to expand...
Click to collapse
Yes sir. TY.
Pjs187 said:
Yes sir. TY.
Click to expand...
Click to collapse
He may be busy I dropped him a note It happened a while back while he did the reg s8 betas also something with the zip file is corrupt
The downloads worked for me, no issues. If you're on a tmobile variant this rom will work fine also if you're on BL 1 att you'll be fine not sure about sprint, my fingerprint scanner, iris scanner & face recognition don't work but everything else running perfect.
Purest said:
The downloads worked for me, no issues. If you're on a tmobile variant this rom will work fine also if you're on BL 1 att you'll be fine not sure about sprint, my fingerprint scanner, iris scanner & face recognition don't work but everything else running perfect.
Click to expand...
Click to collapse
Hmmm the download extract was broken for me as well. But should be fixed sometime soon.
TheMadScientist said:
Hmmm the download extract was broken for me as well. But should be fixed sometime soon.
Click to expand...
Click to collapse
What mirror did you use? Some of the mirrors were giving me issues, the Texas mirror was the only one working properly for me.
Purest said:
What mirror did you use? Some of the mirrors were giving me issues, the Texas mirror was the only one working properly for me.
Click to expand...
Click to collapse
Lol that's the one I used
Purest said:
What mirror did you use? Some of the mirrors were giving me issues, the Texas mirror was the only one working properly for me.
Click to expand...
Click to collapse
TheMadScientist said:
Lol that's the one I used
Click to expand...
Click to collapse
Pjs187 said:
Can't unzip part 1, re DLed it multiple times can only extract 518mbs then crc error.
Click to expand...
Click to collapse
Sorry for the trouble folks! The zip extracts fine on my end, so it must be an AFH issue. Ill do what i can as im s paying customer, but we will see. In the meantime, i posted another link under "Alternate Mirror", so download from there if you are having issues.
ill reupload it to afh as well
Bootloader V2 support is now up in the OP!
Hey what version of xposed did you use, note 8 xposed isn't working wondering if you used a modified version or what you might have used?
partcyborg said:
Sorry for the trouble folks! The zip extracts fine on my end, so it must be an AFH issue. Ill do what i can as im s paying customer, but we will see. In the meantime, i posted another link under "Alternate Mirror", so download from there if you are having issues.
ill reupload it to afh as well
Click to expand...
Click to collapse
Awesome work OP thank you very much, got everything up and running now very nice, let me know where to send money for the bounty.
Pjs187 said:
Awesome work OP thank you very much, got everything up and running now very nice, let me know where to send money for the bounty.
Click to expand...
Click to collapse
I knew I forgot something!!!
https://www.paypal.me/partcyborg is the link. I will add it to the op too.
Important notice! : iLLNiSS made me aware of a serious risk!
If you play with the firmwares manually and not with the flash all bat then DO NOT flash the blobs!
These are the actual bootloader files and stuffing up here will cause a hard brick!
I have to stress this out as it is serious thanks to not having working APX drivers a flshing programs for the Shield!
For starters, I uploaded a copy of the 7.2 developer firmware here:
7.2 developer ZIP on Dropbox
It is the full 1.1Gb update and not the 422mb block based one.
I have done some extensive tests since the first block based update wrecked my rooted Shield.
Some of it will end up in this post as info for everyone.
But lets start with what seems to be the problem for a lot of users right now who run a rooted Shield : Fixing the problem
A downgrade is officially not supported by Nvidia but my tests showed it works just fine if you only go back to the 7.1.
So far my tests showed differen sources for a Shield no longer working after the OTA.
1. The device had an unlocked bootloader and you got the 422mb block update.
This would have stuffed your bootloader and the Shield won't go past 1/4 on the progress bar for the update.
You are in luck as just flashing the 7.1 bootloader will fix it.
After that just dismiss the update and change the settings to manual updates.https://forum.xda-developers.com/editpost.php?do=editpost&p=78466377
2. Your device was already fully rooted and you got the full update that resulted in your Shield doing all sorts of thing but nothing properly anymore.
As long as your apps are still there and the Shield is still somhow usable you are lucky again.
A downgrade to 7.1 will fix it, I will explain the steps required further down.
3. You made bid mods, used Magisk or other rooting tools and now your Shield complains that your system is corrupt.
Bad luck if your bootloader is locked as you loose it all.
Lucky if the bootloader is unlocked as you might be able to keep most if not all during the downgrade.
General words of warning:
Even if your bootloader was unlocked from day one I can not garantee that the downgrade will keep all settings, apps, databases and so on.
For me it works fine as I kept all vital databases on external storage.
The procedures are all based on the developer firmware, on the stock firmware some things can still be done but then again you should not have more than software problems.
On the stock firmware the bootloader is locked by default and you can use some things required to owngrade due to the restrictions of a stock system.
General downgrade procedure for the developer firmware to get back to 7.1 :
If the update did get stuck on the progess bar early on and a reboot won't fix it so you can dismiss the update you just follow the steps.
If you can reboot into the 7.1 then just dismiss the update.
Trust issues or curruption warnings at boot but an otherwise working shield on 7.1 require to flash the 7.1 bootloader again.
In some cases it is possible to skip the corruption warning with a connected controller.
A reboot once you got to the homescreen will determine how bad it is.
Reboot goes fine: You are good.
Reboot keeps nagging with warnings other than the unlocked bootloader: Downgrade.
The downgrade is only required if you have problems or the Shield already runs on the 7.2!
In almost all other cases just flashing the 7.1 bootloader is sufficient.
Fixing a stuffed Shield by sideloading the 7.1 firmware while keping all apps and things:
Enable USB debugging and allow the connections for the computer if you still have access to the settings.
Otherwise you need to flash the 7.1 fresh and might loose vital things that need to install again.
Reboot into the stock recovery, if you use TWRP flashed on the Shield already then please flash the recovery from the 7.1 firmware first.
Hook up the controller and pressing A or B should get you into the normal recover screen past the dead droid.
ADB sideload XXX - where the xxx stands for the filename you have for the developer ZIP.
After the rebbot you should be back on your 7.1 homescreen and can dismiss the 7.2 update.
Also change the update settings while at it
Fixing a fully stuffed Shield and then downgrading to the 7.1 firmware:
If all went down south then you tried a few things and realised there is no way to get your data back and even less to prevent the 7.2 update.
Installing the 7.1 from scratch forces the setup wizard and before you can get anywhere you need to update to 7.2
So much easier to use the linked 7.2 update from above until Nvidia provides it on their download servers.
A vital thing to do is to keep the bootloader locked!!
Same for NOT having TWRP installed on the Shield!
If in doubt flash the 7.1 boot and recovery partitions first then go back into the stock recovery and wipe the cache.
Coming from a stock developer firmware with just an unlocked bootloader you are good to go.
Sideload the 7.2 update.
Unplug when the reboot starts and go into fastboot to lock the bootloader: Fastboot oem lock.
This is a vital step as the new kernel otherwise could ruin the completion of the install.
Ignore the double hassles and go through the wizard so you can enter the settings again to enable the developer mode and USB debugging.
Unlock the bootloader so you can do it all again Last time I promise!
Once you have both the bootloader unlocked AND the Shield in a usable condition past the setup wizard:
Reboot into the recovery to sideload the 7.1 firmware.
After the next reboot you are back on the 7.1 homescreen drirectly and can dismiss the update.
Possible tricks that can help you to prevent the installation of the 7.2 update if you come from a fresh 7.1 install instead:
Don't allow the reboot and instead use ADB to reboot into the recovery.
Wipe the cache - this will remove the scripts required to start the update after the reboot.
The next reboot should bring you back to the homescreen where you can stop the new download of the update and change the update settings.
TWRP, full root and new security measures in 7.2:
The 4.9 kernel used also makes use of a Fstab configuration that no longer includes the system partition.
This and other restrictions currently make the normal use of Magisk impossible.
With no system partition available to Magisk the changes in the boot process come to a stop and the Shield gets stuck during boot.
The added restrictions also make it very, very hard to manually add SU and busybox.
At least without getting the currupt system popup on every boot and finding out that a lot of things still don't work properly.
A final 7.2 firmware is said to be available on the download servers today.
If this final is no different from the current OTA then it will not be of any use for users requiring a fully rooted devices.
With the stock recovery still using the old kernel all attempts to use recovery functions to alter the system for rooting fail as well.
Can't blame the company as all this is part of Google revamp og security and closing backdoors and loopholes for possible attackers.
Personally I think it is Googles way of keeping control over devices they don't actually own.
Anyways I did make some little progress:
Plans for the near future:
Security is good but I like to know what my Android devices are doing and especially what Google likes to collect if I can not find ways to stop it.
So I will not try to use any backdoors or secrurity vulnerablilites in the new kernel to allow a full root on my Shield.
I will go the route I know best: Manual labour
The bootloader is already fixed to allow what we are used to from previous developer firmwares.
As SU and busybox can not be manually entered at this stage I will try to include them directly in the stock 7.1 firmware while renaming the OTA updater to have it a bit easier.
Assuming that works as expected I will do the same on the 7.2 firmware and compare the corresponding scripts and so on.
If the standard SU still works on an "unlocked" 7.2 I should be able to adjust the Magisk ZIP accordingly to implement it into the bootloader.
Only need to figure out if Magisk then has enough rights to work and the system is still happy to accept the changes.
I noly have the 16Gb 2017 model to work with but since the bootloader seems to be same for all Shield models I think if it works then it should do so for all models.
In the meantime I hope the infos here will help some pople to get their shield back without the need to sent it in.
Update 25/12/18: I got TWRP working on 7.2
This is only true for the 2017 model though as I have only this for testing.
Currently creating a backup to the internal storage.
If the restore works then I will upload the new TWRP - for the said model only!
Give me a day or two to fix it for the other models too.
There is progress on the rooting front as well.
Created new scripts for my kitchen to be able to handle the new file_context thing.
A fully pre-rooted and totally unsecure (in terms of ABD, DM-verity and such) is already cooked, just did not dare yet to try it out as I have a real life job too.
As for the pre-rooted firmware:
Things have changed quite a bit with the new kernel in terms of "just adding SU or Magisk".
Magisk might see an update for this problem soon, SU however seems to tally fail on two levels.
So far I was unable to do a full install of the modded firmware.
Flashed all at once and the boot just hangs.
Bootloader, reboot, then the rest seems to work.
At least for the basic install of the system.
If I add SU and busybox the system still ends up with a corrup notice during boot and then it fails.
Tune in over the next few days for progress updates at the end of the thread.
Major developments will be added right here.
Just a matter of finding the last restrictions.
Once that is done Magisk should be possible as well.
Ok, TWRP boot fine, does a backup but fails to restore the system to a bootable state.
Will now check if at least installing a zip works.
Well, it did not, so TWRP has to wait a few more days
I edited post 3 with instructions on how to "unbrick" and go back to 7.1.
Update 27/12/18: A friend of mine found some intersting stuff.
A 7.2 firmware offering a pure Android without any TV stuff but also a full root possible.
I hope he will share his finding here soon or allow me post it all in his name.
For now lets just say: It really works if done the rght way!
Full write rights, installing Magisk modules and all.
All thanks to an undocumented flaw in the device security structures, so even without any hidden backdoors or such LOL
Update: Whiteak was so kind to provide a working root solution in post 36, please check it.
I can confirm it is working as promised.
So the credits for this one go to Whiteak and the credits for the idea and use of the DTB file to Zulu99 - great idea!
To prevent any problems I advise to perform a factory wipe after the install and before the first boot.
Switch to the stock recovery to do this then boot as normal an enjoy.
A complete firmware with the required mods is sitting on my PC just waiting for idiot behing the keyboard to figure out how to pack it properly for flashing.
Once that problem is sorted and also TWRP working again things will get a lot easier.
Annoying update:
I was not able to confirm my web findings on the 7.2 firmwares bootloader but it seems other devices running the same type of kernel and bootloader and a bit lost now.
AVB is fully implemented on the latest level.
(Again I am working on confirming or denying these findings!)
This means any alteration to vital parts of the system will fail with a corruption warning or worse.
Custom recovery access is limited if not fully restricted.
But even if it works you still need a firmware to flash that either is able to disable all this crap, hoping the bootloader alone will allow it, or
to hope Nvidia will provide a future bootloader update with these restrictions removed.
We can not downgrade the bootloader and even if there is some old one out there that would actually be flashable the risk is high to end with a brick anyway.
The DTB, at least in my tests gives us the required system wide write access but I have no information about the AVM verfified boot other than that Zulu99's firmware works.
But if it was compiled with the NVidia developer suite then it will be signed accordingly so the bootloader accepts it.
Could not find any info on how his firmware was actually created.
It gives me the hope though that once I have a fully working TWRP again that my modded 7.2 will work as expected and with no restrictions anymore.
Thanks for the info.
Edit: Will use this post to list options to recover the Shield is all seems lost.
As a result of far too much rom cooking and mods I needed a 100% working way to recover the Shield in case things turn very ugly.
So lets sum up what I define as very ugly when playing with firmwares:
1. Firmware installed but the Shield just hangs on the logo.
2. Firmware installed and now the system is corrupt and even it is boots it takes forever to get around the nag screens.
3. Firmware downgrade attempted but now the Shield won't even boot anymore.
4. Anything that would qualify for a soft brick.
My worst case when I only got a flashing white screen after trying to restore a TWRP backup under 7.2.
There any many way that work for a variety of boot problems but it takes too long to list all cases I encountered with a list of fixes that work or a comment that only the below way works.
So just to be clear here: This is not for any recovery purpose other than fixing what can't be fixed through a factory reset or fresh flashing of the firmware!
1. Get the Shield into Fastboot mode: Connect wired controller and male to male USB cable.
2. Power the Shield up while holding A and B on the controller.
Keep holding until you see the fastboot menu on the screen.
3. Install the 7.1 recovery firmware for your Shield type after unpacking it.
With Fastboot connection working type: flash-all.bat and hit enter.
4. Keep an eye on the progess!
5. Once the Shield is finnished and reboots, hold the A and B buttons on the controller again to enter fastboot mode!
Do not let the Shield boot up other than into the fastboot mode!
6. Lock the bootloader! Fastboot oem lock
Confirm with the controller, then go down and select the recovery kernel.
7. Once the dead droid is on the screen press B on the controller to enter the real recovery.
If B does not work try A
8. Select the factory reset option to wipe all!
9. Once the wipe is done you can boot into 7.1 as normal again.
10. With a bit of chance you might even get directly to the homescreen if the previous setup was completed.
If you need the full seup wizard again and are forced to update to 7.2 then at least the update will work fine this time around.
In case you desire to go back to the 7.1:
If you just finnished the above only to end with the 7.2 then set it up and flash the 7.1 - you won't get the setup wizard again and can skip the update.
If you are on a working 7.2 that was update the OTA way but want to go back:
1. Install the 7.1 firmware.
2. Lock the bootloader.
3. Boot and then skip the update to 7.2.
Any idea what to do if the Shield sticks at the NVidia logo when you select Recovery from Fastboot? I reflashed boot and got the same result.
psycho_asylum said:
Any idea what to do if the Shield sticks at the NVidia logo when you select Recovery from Fastboot? I reflashed boot and got the same result.
Click to expand...
Click to collapse
It won't work from fastboot.
Fastboot operates on a different level and calling the recovery from there lets it end up in nowhere with no access to the system.
You need to boot into recovery through ADB as (for the new model) without a power button and usable hardware buttons we can't get into it otherwise.
Having said that, the fastboot way should still work with an unmodified bootloader.
When the dead droid is on the screen the recovery should be available after pressing the A button on the wired up controller.
But during my tests on 7.2 it did not always work, so you might have to try a few times and also try the B button.
Downunder35m said:
It won't work from fastboot.
Fastboot operates on a different level and calling the recovery from there lets it end up in nowhere with no access to the system.
You need to boot into recovery through ADB as (for the new model) without a power button and usable hardware buttons we can't get into it otherwise.
Having said that, the fastboot way should still work with an unmodified bootloader.
When the dead droid is on the screen the recovery should be available after pressing the A button on the wired up controller.
But during my tests on 7.2 it did not always work, so you might have to try a few times and also try the B button.
Click to expand...
Click to collapse
I have not been able to get to the dead droid screen.
Downunder35m said:
For starters, I uploaded a copy of the 7.2 developer firmware here:
7.2 developer ZIP on Dropbox
It is the full 1.1Gb update and not the 422mb block based one.
(snip)
Click to expand...
Click to collapse
Thanks for posting this, but please note that this firmware is only for the 2017 16GB model and cannot be used with a 2015 or Pro model.
I just got a 7.2.1 update that forced me to update. Wouldn't give me an option to skip it... As soon as I turned on my Shield, it said something about the 7.2.1 update and then rebooted and installed.
I was holding off on updating too so I didn't lose root. Now I'm unrooted and am unable to get Magisk working again until I can get my hands on a 7.2.1 bootloader... Bleh.
Weird, I am not getting the 7.2.1 at all here.
And since yesterday the OTA only tries the block based but not the full image.
AthieN said:
I just got a 7.2.1 update that forced me to update. Wouldn't give me an option to skip it... As soon as I turned on my Shield, it said something about the 7.2.1 update and then rebooted and installed.
I was holding off on updating too so I didn't lose root. Now I'm unrooted and am unable to get Magisk working again until I can get my hands on a 7.2.1 bootloader... Bleh.
Click to expand...
Click to collapse
I was able to downgrade using the 7.2 image after setting up the device on 7.2.1 OTA just make sure you disable automatic updates
Thanks downunder this kind of in-depth info is always appriciated man........i like to learn these kind of things, having bits here and bits there gives a better picture of the whole, while also giving us upto date current info.
Thanks for taking the time to write this :good:
---------- Post added at 07:35 AM ---------- Previous post was at 07:27 AM ----------
Edit
Hi downunder, could you confirm i have this correctly
With no access to fastboot thus no twrp or root, are you implying, assuming your able to inject root into stock firmware, that, i'd be able to flash this stock+root rom in STOCK recovery, which i do have access to?
Edit: im under the impression that stock firmware zips are checked by stock recoveries, so modifying a stock firmware zip tends to fail this check and thus wont install/flash.......which makes me think im misunderstanding here......or just hoping im not
If so, im interested
Edit
i just read your second post which near enought answers my curiousity, so that'll teach me to read beyond the first post before asking answered questions ........even if the post excites me............ahhh, who am i kidding, ill probabably do it again........the equivelancy of a mental post boner........not controllable
Sorry for the disgusting analogy
SyberHexen said:
I was able to downgrade using the 7.2 image after setting up the device on 7.2.1 OTA just make sure you disable automatic updates
Click to expand...
Click to collapse
Did I understand it correctly? You successfully downgraded from 7.2.1 to 7.2?
ErAzOr2k said:
Did I understand it correctly? You successfully downgraded from 7.2.1 to 7.2?
Click to expand...
Click to collapse
Yes,
Just ran flash all from the bootloader. For the newly released 7.2 developer_rooted factory image.
As long as we don't jump to Android 9 we should always be able to downgrade through a full factory firmware.
Once Android 9 comes this might not work anymore due to the massive changes involved for the boot and system checks.
@banderos101: Unless you really did something bad you should always be able to enter the fastboot mode to flash a full firmware.
If I have some time after xmas I will have another look on the options of signing the zip properly or simply to fake it.
Biggest problem will be to generate the corret SHA checksums ince all is installed so I can use the same checksums in the check files.
The bootloader needs them to identify the system and vendor as genuine.
The system needs them to confirm all is actually unmodified as otherwise all fails to boot at some stage.
Modding a proper userdebug firmware is not really that hard, but converting a release version that also is a true and secure user release...
Lets just say that it won't be an easy task.
As it looks like the kernel is a keeper I might have to figure something out unless TopJohnWu won't enjoy a break after his exams and works on a way to get Magisk working with out kernel.
At least I figured out why the recovery trick isn't working for me.
The system partition is not mounted for the sideload mode.
To apply an update the stuff is written directly onto the partition, so no file level access left to play with and break things
In comparison you could say the shield is now like a modern car with keyless operation only.
You know you can start it with ease, if you only could the remote that you left in the drivers seat when you locked the door
SyberHexen said:
Yes,
Just ran flash all from the bootloader. For the newly released 7.2 developer_rooted factory image.
Click to expand...
Click to collapse
Just wondering what is achieved by going back to 7.2?
What do you mean "going back"?
Right now the 7.2 is the official and latest firmware.
I was unable to get my hands in the 7.2.1 but guess it might have been a testversion for certain models only.
I wasted a few hours trying to fix the system image.
First stage was only to get the basic "features" back, like full ADB support, enabling the support to use SU and busybox....
Just what is required to actually allow these nice apps we like to gain root to work.
This backfired badly as right after the start the bootloader complained about the system being corrup and no override to get past this worked.
So of course I then removed the known restrictions from the bootloader...
As you guessed it the damn thing then did not even boot at all, just jumped right into the (locked) recovery mode.
A half decent comparision with my last manual root on a tv box that was a success showed I still did the right things...
If anyone wondered why we needed a new bootloader for the support of smart helpers an some codes stuff:
We didn't as all this could have been done with the 7.1 bootloader as well.
Since my root attempts so far all ended either in disaster or in a root access that failed shortly after/corrupted the system, I took a look of the general kernel changes that were published for other devices.
Before I could find anything meaningful I realised the 4.9 kernel is actually a requirement for Android Pie!
With that info sorted I started digging inti the new "security" features Pie can offer.
I will try to keep it simple and to the stuff that actually concerns us for rooting purposes:
The new boot process with Pie is aimed at being secure from the hardware level up and all the way into the system partion once the boot is completed.
So the hardware checks if the bootloader is actually usable - we had that for a long time, nothing new.
Once the bootloader starts and reaches the point of actually getting somewhere, all partitions required will be checks by either a hash check or a trusted certificate gererated at boot time that is compared to the previous certificate.
Only if that is fine the bootloader will call upon the system and vendor partitions.
The handover of control from bootloader to the system is made far more secure as well.
SELinux is called early on to ensure that only trusted apps and tasks can work but also to all a new control level.
System related apps no longer run as root or with special permissions.
Instead every single app and service runs as its own user!
And under SELinux conditions this means nothing can access anything that it is not entitled to unless included as a user for the other app.
And with that sorted the vendor stuff is called to ensure all hardware and vendor related stuff is still genuine - this include the required certs but also the recovery and bootloader hash codes and certs.
So if something is fishy either SELinux will stop us or the vendor stuff will just overwrite it all.
Once we finally reach the system stage the recovery is checked if called from within the system, if fully implemented it could mean that using an official update on a modded firmware will delete all data as the encryption from the old system is declared invalid.
Sadly it does not stop there because even with full rigths (faked or otherwise) to access the system partition with write access we still can not just change things.
If something belongs to a user (a secure app) than a change will corrupt the system.
To overcome all this without using vulnerabilities that so far no one has found, a compatible userdebug release has to be created from the official user firmware.
DM-Verity needs to be disabled as well as all partition encryption stuff.
The bootloader needs to be adjusted to reflect these changes and the required turst certificates generated and included in both system and boot images.
The only problem here is that the kernel won't allow these changes unless it itself is a userdebug kernel.
After that it is only the little efford to go through about 60 different scripts to remove or redirect the calls for all boot and system security related things.
If then by some chance all this actually boots up and goes all the way into a usable homescreen the entire stuff needs to be secured again.
This time so that the final system has a correct cert and checksum that matches those we need to include in the bootloader.
Anyone knows how to gain full access to the trusted keystore on the 4.9 kernel? LOL
For the moment I don't really care about all the stuff above.
I would be happy to figue out what to make out of these new fstab configurations without the vital partitions listed.
The real aprtitions used have not changed but it is impossible include them in the fastab, doing so causes the bootloader to fail.
Presumably because the kernel realised we try to get around the verification process.
This and some other minor things are also the reason TWRP fails so badly, same for the stock recovery by the way.
Since TWRP is toy a lot us like:
TWRP and 7.2....
Without a system partion in the bootloader fastab TWRP can not mount it.
Same for all other things TWRP needs to mount as it simply does not have the right to access these areas.
To make things worse, we need system access to even start TWRP through fastboot.
So, now matter if we flash or start it through fastboot: The bootloader and system will realise our recovery does not match the checksum.
What does al this now mean in terms a lot more people are able to understand?
Let me try...
Imagine the 7.2 in a running version would be just some encrypted file with a lot of folders in it.
And like PGP or other encryptions software we know there is a private and a public key.
With the public key you can see a lot and use most the encrypted file - but only to a level that is required, nothing above your low level clearance.
For every attempt to write into this file or to make changes we need the private key.
If you follow so far then lets just say the recovery (stock) and Fastboot can be, to some extent, used for this access.
But since every folder in the encrypted file also uses private and public keys it is like tracing a tree.
Although it is getting too long, let me give you the example of just adding SU to the sytem partition:
Adding SU into the system image is no big deal.
Singing this image to get a usable key and including this key into the keystore is.
Assume we would just be able to do it....
SU needs to be called quite early in the boot process.
It then elevates the access level for certain things and also intercepts all root related requests from apps and services.
Except of course those that already had these rights by default.
Problem here is that adding the scripts we need plus changing some others means violating the tree of trust on the device and we get locked out.
Finding a spot to add the required rights for SU might be still possible.
On the other hand it will be impossible to give SU any rights or access to "trusted user" owned parts, files, folders, partitions....
The entire concept of SU just fails.
I will have to check how much of the new features are active in the 7.2 kernel that hinder us.
If I find enough it might be possible it enough to call for a Magisk update.
But I guess it is of little use for just one set of devices, so maybe once more devices on the 4.9 kernel fail to work with Magisk it will be easier to spot a usable pattern.
In case someone else if already working ona mdified system: Please let me know how you made it boot after the changes
Shield Tv 16 2017 - OTA update 7.2.1 Ready for updating
Im on 7.1. I have been waiting for 7.2 developer image, which is now out and just noticed 7.2.1 is available OTA. I'm really confused what to do. I want to keep root without bricking my Shield. Should I Stay with what I have as it is running well.
I am not even sure if it is safe trying to update to dev 7.2 image (or if I would want to) by hooking to computer and using ADB Fastboot tools.
Is there any good reason to update to 7.2 or 7.21? and if so how would I go about doing it? Which program is good for flashing developer images or OTA updates. I used to use flash-fire, which seems to be obsolete now and have heard TWRP is incompatible rooting with SU with OREO updates????
Should I play it safe and stay with what I have rather than experiment and end up with a brick? (wouldn't be the first time)
Anyone know if 7.21 is some-kind of bug fix?
Alot of questions but hope someone has some answers.
Thanks for any info.
"You know you can start it with ease, if you only could the remote that you left in the drivers seat when you locked the door "
My fastboot issue
Yeah, i think i busted the microusb somehow with a faulty usb hub, whenever i plug the usb to my raspberrypi/windows box(for adb/fastboot) now, it turns off all usb ports on the pi aswell as the windows box, even when the shield is unplugged, some sort of earth problem maybe
......all i have is adb over network, adb reboot bootloader simply reboots back to system, adb reboot recovery works though.
ive read that fastboot over tcp(ethernet) had been introduced a couple of android versions ago, but i dont think its been implemented in our shields
infact heres a link
https://www.androidpolice.com/2016/...-capabilities-wireless-flashing-isnt-far-off/
Looks like it needs to be specifically added onto a build
As far as you making a stock root build, if you can, that would awesome, more then awesome, but if it becomes more work then you thought dont worry about it, its not like their making it easy
Also, sounds like 4.9/future android is gonna be a nightmare for root......... having the ability to root so that the option is there to see whats going on in the background of these devices, these devices posessing cameras/microphones/old+latest sensors/personal files/personal info, which reside on our personal beings or in our homes........is just one reason why i dont want to see root go away
So what is the purpose of the developer image of 7.2?
Rather, I know the stated purpose of the developer image, but if it is locked in the way described it sounds like the benefit is negated for typical developers.
(e.g. sometimes I debug an application without permissions in order to benchmark or debug a problem).
For casual users of the shield, using ad blockers and whatnot, is there any benefit to derive from installing the developer rom over stock? Does "adb root" still work?
What is left as the difference. It doesn't sound like they produced a userdebug build of the OS.
Thanks
The 2 new updates are horrible. I have gone back to 7.1. They have crippled my shield. I'll wait for a new update.