Hello everyone! In this guide I'll show you how to root ZTE's official release of Android Oreo 8.0. This is important if you wanted to upgrade (or downgrade....depending on your view) to ZTE's official release of Android 8.0 by going back to complete stock first and then installing the update zip file in stock recovery. Doing it this way fastboot does not work anymore since Nougat B32 and you do not have a custom recovery anymore, making you stuck on a rootless Android Oreo. Since there isn't a rooted TWRP flashable version of this just yet, this guide will show you how to root your Android and also become unstuck from having a stock recovery without fastboot. This could also help in unbricking with an incompatible recovery or if you accidentally flashed an official release of MiFavor or StockUI+ and the custom recovery is overwritten by stock recovery without root and fastboot.
This could also help if you have trouble with EDL drivers.
This has only been done and tested on an A2017U. If you're attempting this on another model, do so at your own risk! This guide is only for Windows 10!
This is not exactly noob friendly. This guide assumes you have ADB installed and everything.
I attempted this on my own whim. It was certainly a pain in the butt to get this to work for me as well because of EDL driver trouble. But if I managed to figure it out, you can too!
First you're gonna need to download tennear's axon7tool here. Rename is to just axon7tool so it's easier to type.
Download NFound's TWRP 3.2.1-8 for Oreo here and rename it to recovery.bin. Put it in the same directory where axon7tool is.
Download Zadig here. This is for replacing the EDL drivers to some generic ones that this tool can use to connect to your phone in EDL mode.
Download Magisk 16.2 here. Any newer Magisk version especially 17.1 causes a bootloop unfortunately so do NOT update. You can try different versions, but try at your own risk.
We need to get into "proper" EDL mode. It is not recommended to do the "shut down your phone and hold both volume buttons and power on to get into EDL mode" way. This did not work for me. In order to get into proper EDL mode, make sure you're booted into Android and make sure Android Debugging is turned on. Open ADB on your computer and type
Code:
adb reboot edl
and the phone will boot into proper EDL mode.
After your phone is booted into proper EDL mode, connect your usb cable into your phone and go into the Control Panel of Windows and go to Device Manager
In Device Manager, look for either "qualcomm usb loader 9008" or "QUSB_BULK". It doesn't really matter. Once you found it, its probably not necessary but I did it anyway, right click on it and click to uninstall. If it asks to uninstall any software then click that as well.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After it is uninstalled, unplug your phone and plug it back in. It'll probably install some drivers again but that's okay. It might reinstall as QUSB_BULK even if you had "qualcomm usb loader 9008"
It gets kinda tricky after this part, but it should work. If it doesn't, drop a comment below and I will try to help!
Open Zadig. Click on Options and then click List all devices. Look for QUSB_BULK in the drop down menu and select it.
After you've found it and selected it, you'll see on the bottom box it'll display what kind of driver it is loading. We need to replace it with WinUSB. Click on Replace Driver. After a few seconds it'll say it finished successfully. QUSB_BULK should read this now:
This means that we can now use axon7tool.
Open command prompt and navigate to where you downloaded axon7tool. In this case, it is on my desktop. Let's test to see if we have a connection. First we need to backup our recovery image, so we can test that out by typing
Code:
axon7 tool -r recovery
This will read our recovery image and back it up and put it on our directory as "backup-recovery.bin"
If you get an error that says
Code:
Connecting to device...
S: failed to read command
S: Failed to receive hello
terminate called after throwing an instance of 'std::runtime_error'
what(): error: Unknown error
Then you need to go back into EDL mode manually again. Turn off your phone by holding power for 10 seconds and then turn it on back into Android. Once there open ADB and type again
Code:
adb reboot edl
so we can go back to proper EDL mode and try the above axon7tool command again. It should work successfully this time.
If it works, it'll backup recovery and then reboot your phone as shown below.
You'll have a backup-recovery.bin saved into your directory. Now that we know this works, we can write our TWRP recovery image!
Type
Code:
axon7tool -w recovery
and it'll successfully write and reboot as shown below.
While it reboots, go into recovery by holding Volume UP and Power, or while on the unlocked bootloader message press a volume button and select "Recovery" to get into recovery. This is to make sure that the stock rom does not overwrite our custom recovery with stock recovery
You will now be greeted with NFound's custom TWRP recovery!
Well, backup system and data in TWRP and then flash Magisk 16.2 as you would do! Wipe cache/dalvik if you want and then reboot, you should be rooted!
magisk 16.7 can use,how to pass safenet check?
zouyiqiang said:
magisk 16.7 can use,how to pass safenet check?
Click to expand...
Click to collapse
That's the thing. For me, even after factory reset oreo without root it seems like the official release of oreo does not pass safetynet
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.
Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases
Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.
Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.
Unmount the system and persist partitions from the Mounts menu.
Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system
These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).
Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.
Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.
Go into TWRP terminal, type:
reboot disemmcwp
This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).
If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
AnonVendetta said:
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.
Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases
Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.
Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.
Unmount the system and persist partitions from the Mounts menu.
Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system
These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).
Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.
Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.
Go into TWRP terminal, type:
reboot disemmcwp
This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).
If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
Click to expand...
Click to collapse
Do you pass safetynet this way?
Sent from my ZTE A2017U using Tapatalk
@bluenote73: No, SafetyNet check fails (according to Magisk Manager). But I also dont care about passing SN, it is so stupid. SN, Android Pay, Pokemon Go, etc, are all stupid. I dont care for Google or their apps, policies, etc. Or Magisk, for that matter. But it is the only way to root B20. Better to be rooted than unrooted. As soon as I get more free time I will be switching to an AOSP-based Oreo ROM. But I just had to try official Oreo first. Battery life is pretty good, and the near-stock look is a huge improvement over MiFavor. But it just doesnt have the level of customization that I'm used to.
AnonVendetta said:
I was able to install the official B20 zip file on my A2017U, but I already had the latest official TWRP by @jcadduono, so I was able to skip the EDL steps. Yes, it can be installed from TWRP, stock recovery not required.
Steps to success and what you need:
1. TWRP (I would use official version, just download the appropriate *.img file from twrp.me
2. B20 zip (you can download it from the support page on zteusa.com)
3. Magisk 16.7 (don't try to use 17.1 or 17.2, your phone will not boot, you can get it from https://github.com/topjohnwu/Magisk/releases
Copy both of these files to external MicroSD and place it in your phone, internal storage won't work because the installer formats /data. If you don't already have TWRP installed, then use Axon 7 EDL tool to install it. Axon7Tool will also work but it needs Zadig drivers rather than the Qualcomm EDL driver. I won't go into more detail, since the steps for using these are elsewhere on the A7 subforum.
Boot into recovery. Format /system, /data, and /cache as ext4. Make sure to format /data, not just wipe, to remove encryption.
Unmount the system and persist partitions from the Mounts menu.
Then go to TWRP's terminal and do the following commands:
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/boot
dd if=/dev/zero of=/dev/block/platform/soc/624000.ufshc/by-name/system
These will take some time to finish, so just wait. This zeros out the system and boot partitions. Doing this is necessary because B20 uses dm-verity, you will not be able to boot if the dm-verity check fails. This also ensures that you will be able to install future stock OTAs, as long as you don't modify /system in any way (or mount it as read/write from TWRP).
Select the B20 zip file and wait for it to install. Do not touch anything in the mounts menu, other than ensuring that system and persist boxes are unchecked.
Next, select the TWRP *.img and install it to the recovery partition. Don't forget to do this or you will temporarily be stuck with stock recovery! Last, reboot into recovery from TWRP. If a message comes up about mounting system, select the keep read only box (DONT MESS THIS UP!). Check the mounts menu and ensure that system and persist are still unchecked. Select the Magisk zip file and install it.
Go into TWRP terminal, type:
reboot disemmcwp
This will disable ZTE's system write protection, so that you can still modify /system from TWRP in the future if you wish (but system can still not be mounted as writeable while you are booted into Android, because of the bootstack).
If you did everything as I've posted then you should be running B20 with Magisk. I'm using it right now and the above were my steps.
Click to expand...
Click to collapse
Internal storage 0 MB after flashing rom in twrp, how to fix that??
agnn_a said:
Internal storage 0 MB after flashing rom in twrp, how to fix that??
Click to expand...
Click to collapse
Internal storage is corrupted or encrypted. You might have to format data if you don't care about losing your data
Teet1 said:
That's the thing. For me, even after factory reset oreo without root it seems like the official release of oreo does not pass safetynet
Click to expand...
Click to collapse
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
kgptzac said:
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
Click to expand...
Click to collapse
Is it possible to use the same method we using in the Pie GSI thread?
Install MagiskHide Props Config module and reboot
Install Termux app if you don't have it
Run Termux, in terminal type su
Grant root privileges to Termux
Then type props to run the Props config module
Choose 1 to edit device fingerprint
Choose f to pick certified fingerprint
Choose ZTE, then choose Axon
Then choose Yes you're sure and yes to reboot
Hopefully this solves the safetynet issues for those of you on stock too.
Teet1 said:
Internal storage is corrupted or encrypted. You might have to format data if you don't care about losing your data
Click to expand...
Click to collapse
my phone ask me password bro?
kgptzac said:
Ouch. Is there no way to have magisk and root on the latest stock rom that passes safetynet? I think i'll just have to stay on my beta oreo build forever...
Click to expand...
Click to collapse
EBeatFLA said:
Is it possible to use the same method we using in the Pie GSI thread?
Install MagiskHide Props Config module and reboot
Install Termux app if you don't have it
Run Termux, in terminal type su
Grant root privileges to Termux
Then type props to run the Props config module
Choose 1 to edit device fingerprint
Choose f to pick certified fingerprint
Choose ZTE, then choose Axon
Then choose Yes you're sure and yes to reboot
Hopefully this solves the safetynet issues for those of you on stock too.
Click to expand...
Click to collapse
This method should work but use the MagiskHidePropsConf v2.4.0 version as it is compatible for magisks lower then 17.1. From v2.4.1 it's compatible with 17.1+.
Use Termux or Terminal Emulator to run the module as mentioned above.
Let us know if you succeeded this way
agnn_a said:
my phone ask me password bro?
Click to expand...
Click to collapse
If it asks for password and you enter the one you made but says it's wrong or you don't know it you need to format data
To a T...
I'VE TRIED EVERYTHING, YET THIS IS THE OUTCOME! URGH....!!!
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
---------- Post added at 07:22 AM ---------- Previous post was at 07:08 AM ----------
This is just to show the -r recovery worked, but the -w did not...
C:\Users\wiels_xpspro\Downloads>axon7tool -r recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Reading recovery ...
Success!
Reset in 5 seconds ...
Reset in 4 seconds ...
Reset in 3 seconds ...
Reset in 2 seconds ...
Reset in 1 seconds ...
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
@wielluk: Try using @djkuz's Axon 7 EDL Tool to flash TWRP. I have found it to be more reliable than Axon7Tool. Afterwards, you can follow the instructions from my post and you're set to boot up stock Oreo.
Hope that helped!
wielluk said:
I'VE TRIED EVERYTHING, YET THIS IS THE OUTCOME! URGH....!!!
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
---------- Post added at 07:22 AM ---------- Previous post was at 07:08 AM ----------
This is just to show the -r recovery worked, but the -w did not...
C:\Users\wiels_xpspro\Downloads>axon7tool -r recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Reading recovery ...
Success!
Reset in 5 seconds ...
Reset in 4 seconds ...
Reset in 3 seconds ...
Reset in 2 seconds ...
Reset in 1 seconds ...
C:\Users\wiels_xpspro\Downloads>axon7tool -w recovery
Connecting to device...
Sending programmer...
Connecting to programmer...
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke getnumdisksectors
Writing recovery ...
F: failed to open recovery.bin
terminate called after throwing an instance of 'std::runtime_error'
what(): error: No error
Click to expand...
Click to collapse
I get the same error looking to root an existing Oreo install (unlocked), but with stock recovery. Stock Recovery backed up OK, but does not accept the TWRP Recovery. The other tool asks for Android 6 or 7 so I have not attempted it. Any other ideas? Thanks
[deleted]
RockCityGeek said:
After I type props, it says it's not found.
Click to expand...
Click to collapse
Replied to you in Liquid thread.. no need to double post.
People.....stop bothering with Axon 7 Tool, use Axon 7 EDL Tool instead. TWRP will flash just fine with that. A7 Tool is very finicky, and it replaces the Qualcomm EDL drivers with Zadig drivers, which means you cant also use MiFlash or A7 EDL Tool.
EBeatFLA said:
Replied to you in Liquid thread.. no need to double post.
Click to expand...
Click to collapse
Sorry, I thought my post disappeared. I didn't realize I posted it in this thread.
Related
I have clean installed Magisk because of an irregularity. To be specific: when I TWRP>Install systemless_xposed-uninstaller-signed.zip, I get an error: Updater process ended with ERROR: 1. TWRP last_log shows ¨e2fsck: No such file or directory¨while trying to open /data/adb/magisk.img¨. So Magisk seems not to be installed.
While this happens, at the same time, when sytem is booted, I have no issues (seemingly) using Magisk manager and installing and using modules.
Because of this irregularity I clean installed Magisk:
- un-installed Magisk through Magisk manager>Uninstall>Complete uninstall
- flashed stock boot image using ¨fastboot flash ramdisk RAMDISK.img¨
- and re-installed Magisk TWRP>Install Magisk-v16.0.zip
After which the Magisk installation on my device is still broken in some way and regarded as ¨weird¨ by fellow xda members; I was advised to ask about it in the device forum.
I attach last_log-magisk-install.txt & last_log-systemless_xposed-uninstaller-signed.txt
Does anybody have a clue and/or experience in this matter maybe?
It's because /data/adb/ is encrypted after installing Magisk.
Not sure why it does that, that folder used to stay unencrypted after installing.
You can use TWRP file manager and check /data/adb/ for encrypted files, and check while booted too. If it's empty it is indeed not installing correctly.
Why are you running Xposed uninstaller by the way?
ante0 said:
It's because /data/adb/ is encrypted after installing Magisk.
Not sure why it does that, that folder used to stay unencrypted after installing.
You can use TWRP file manager and check /data/adb/ for encrypted files, and check while booted too. If it's empty it is indeed not installing correctly.
Why are you running Xposed uninstaller by the way?
Click to expand...
Click to collapse
/data/adb in twrp filemanager looks encrypted yes. Booted to system however, it shows correctly (screenshot). I do not understand why you expected it to be empty as you say.
What do you advise? Decrypt data partition maybe?
You ask why i run Xposed uninstaller; I just ran this script now to get the log. Before all this investgation started I was advised to run it to get rid of possible Xposed framework leftovers after I had installed Xposed, bootlooped and deletef the module.
lvbaal said:
/data/adb in twrp filemanager looks encrypted yes. Booted to system however, it shows correctly (screenshot). I do not understand why you expected it to be empty as you say.
What do you advise? Decrypt data partition maybe?
You ask why i run Xposed uninstaller; I just ran this script now to get the log. Before all this investgation started I was advised to run it to get rid of possible Xposed framework leftovers after I had installed Xposed, bootlooped and deletef the module.
Click to expand...
Click to collapse
No, I meant if it was empty it would be a reason why it can't find magisk.img. But in this case its encryption thats causing it.
You could decrypt, it would fix it. Though as you probably know you'd have to do this after each update.
You might be able to go back to fastboot directly after update finishes and flash twrp, then to twrp and replace fstab in /vendor/etc/ so it doesn't encrypt again. I haven't tested but should work. As long as you don't boot to system before replacing fstab it should stay decrypted.
I have a feeling it's caused by the FBE bypass that was introduced in v16 (actually 1541 from the custom honor v10 link, but added in 16 to stable). Magisk refused to even install because of encryption before this was fixed.
ante0 said:
No, I meant if it was empty it would be a reason why it can't find magisk.img. But in this case its encryption thats causing it.
You could decrypt, it would fix it. Though as you probably know you'd have to do this after each update.
You might be able to go back to fastboot directly after update finishes and flash twrp, then to twrp and replace fstab in /vendor/etc/ so it doesn'tencrypt again. I haven't tested but should work. As long as you don't boot to system before replacing fstab it should stay decrypted.
I have a feeling it's caused by the FBE bypass that was introduced in v16 (actually 1541 from the custom honor v10 link, but added in 16 to stable). Magisk refused to even install because of encryption before this was fixed.
Click to expand...
Click to collapse
Thanks for your input. I'll keep decrypting in mind. For now, it looks like I can install a module from Magisk manager - greenify4magisk. I could not do this however when I had v16. Now on v16.1 it installs. I will check it's functioning later.
ante0 said:
No, I meant if it was empty it would be a reason why it can't find magisk.img. But in this case its encryption thats causing it.
You could decrypt, it would fix it. Though as you probably know you'd have to do this after each update.
You might be able to go back to fastboot directly after update finishes and flash twrp, then to twrp and replace fstab in /vendor/etc/ so it doesn't encrypt again. I haven't tested but should work. As long as you don't boot to system before replacing fstab it should stay decrypted.
I have a feeling it's caused by the FBE bypass that was introduced in v16 (actually 1541 from the custom honor v10 link, but added in 16 to stable). Magisk refused to even install because of encryption before this was fixed.
Click to expand...
Click to collapse
I'm not sure what alteration in /vendor/etc/fstab is needed to prevent encryption. Can you elaborate maybe? Also, in this regard, can you confirm the following:
when I decide to format internal storage in TWRP with ¨Format Data¨and thus getting rid of encryption(link), will it still be (re-)encrypted if I use the unmodified stock kernel (I'm using stock Emui8)? If so, do you know of a modified kernel without encryption for BLA-L29(C432)?
lvbaal said:
I'm not sure what alteration in /vendor/etc/fstab is needed to prevent encryption. Can you elaborate maybe? Also, in this regard, can you confirm the following:
when I decide to format internal storage in TWRP with ¨Format Data¨and thus getting rid of encryption(link), will it still be (re-)encrypted if I use the unmodified stock kernel (I'm using stock Emui8)? If so, do you know of a modified kernel without encryption for BLA-L29(C432)?
Click to expand...
Click to collapse
This flag: ",fileencryption=aes-256-xts:aes-256-cts" on the /data line needs to be removed. After that you format data in twrp and decryption will stick. As of Oreo fstab is located in /vendor/etc so it doesn't matter what ramdisk you use, only matter is when you update firmware as /vendor is over-written. In theory you should be able to update, go straight to fastboot after and flash twrp, go to twrp and replace fstab. I haven't tested that yet, but as long as you don't boot to system it should stay decrypted.
(TWRP with FBE decryption support is on the horizon so you might want to wait. A fix was pushed a few days ago and it works on Honor 9, we just need a newly built twrp. I can't get the 8.1 tree to build a working one so I will check if it can be done with the 7.1 tree.)
ante0 said:
This flag: ",fileencryption=aes-256-xts:aes-256-cts" on the /data line needs to be removed. After that you format data in twrp and decryption will stick. As of Oreo fstab is located in /vendor/etc so it doesn't matter what ramdisk you use, only matter is when you update firmware as /vendor is over-written. In theory you should be able to update, go straight to fastboot after and flash twrp, go to twrp and replace fstab. I haven't tested that yet, but as long as you don't boot to system it should stay decrypted.
(TWRP with FBE decryption support is on the horizon so you might want to wait. A fix was pushed a few days ago and it works on Honor 9, we just need a newly built twrp. I can't get the 8.1 tree to build a working one so I will check if it can be done with the 7.1 tree.)
Click to expand...
Click to collapse
Hi and thanks for the clarification. As I'm in the process of re-flashing complete stock firmware (131->138 from pro-teammt.ru) I think I will be going for the solution provided by @Didgeridoohan. As I understand it at this moment, both solutions will permanently decrypt my /data, but the your solution does not mention Magisk installation. Does a Magisk installation not have any bearing to the issue then?
lvbaal said:
Hi and thanks for the clarification. As I'm in the process of re-flashing complete stock firmware (131->138 from pro-teammt.ru) I think I will be going for the solution provided by @Didgeridoohan. As I understand it at this moment, both solutions will permanently decrypt my /data, but the your solution does not mention Magisk installation. Does a Magisk installation not have any bearing to the issue then?
Click to expand...
Click to collapse
I'm not sure Magisk can. It could when I pushed a commit that added fileencryptioninline (this was for nougat), and when fstab was located in boot partition.
But that was removed as it broke support for Pixel devices.
This is what it looks for: https://github.com/topjohnwu/Magisk...285d860b4d95db13f7/native/jni/utils/pattern.c
"const char *encrypt_list[] = { "forceencrypt", "forcefdeorfbe", NULL };"
As you see it doesn't contain "fileencryption".
I'm not sure it even looks for fstab in /vendor. That would break the systemlessness of Magisk (doesn't modify /system or /vendor)
Though, it doesn't matter anyway, it does the exact same thing as manually editing /vendor/etc/fstab.kirin970
You can test though, to confirm
When you do Format Data you need to manually flash back the public and hw data zips in TWRP, they give errors but it's the folder "hw_init" that's placed in /data/ that's needed. Themes and stuff are in there.
ante0 said:
This flag: ",fileencryption=aes-256-xts:aes-256-cts" on the /data line needs to be removed. After that you format data in twrp and decryption will stick. As of Oreo fstab is located in /vendor/etc so it doesn't matter what ramdisk you use, only matter is when you update firmware as /vendor is over-written. In theory you should be able to update, go straight to fastboot after and flash twrp, go to twrp and replace fstab. I haven't tested that yet, but as long as you don't boot to system it should stay decrypted.
(TWRP with FBE decryption support is on the horizon so you might want to wait. A fix was pushed a few days ago and it works on Honor 9, we just need a newly built twrp. I can't get the 8.1 tree to build a working one so I will check if it can be done with the 7.1 tree.)
Click to expand...
Click to collapse
Thanks again But I cannot quite picture this; when you say ¨In theory you should be able to update, go straight to fastboot after and flash twrp¨, because when I have flashed the complete stock firmware, I suppose Developper option USB debugging is off and I cannot send command <fastboot flash recovery_ramdisk twrp.img> from PC, or can I?
lvbaal said:
Thanks again But I cannot quite picture this; when you say ¨In theory you should be able to update, go straight to fastboot after and flash twrp¨, because when I have flashed the complete stock firmware, I suppose Developper option USB debugging is off and I cannot send command <fastboot flash recovery_ramdisk twrp.img> from PC, or can I?
Click to expand...
Click to collapse
When you flash on Oreo it will not wipe anything, /data stays.
Basically it does an OTA but with a full fw.
Unless you factory reset after, then it would wipe.
As I said it's in theory as I haven't tested it yet, so you're free to try if you're going to update anyway
Mine has been on everytime I've updated anyway. Only difference was in Nougat where bootloader was locked and you had to unlock it, which meant a mandatory wipe...
ante0 said:
This flag: ",fileencryption=aes-256-xts:aes-256-cts" on the /data line needs to be removed. After that you format data in twrp and decryption will stick. As of Oreo fstab is located in /vendor/etc so it doesn't matter what ramdisk you use, only matter is when you update firmware as /vendor is over-written. In theory you should be able to update, go straight to fastboot after and flash twrp, go to twrp and replace fstab. I haven't tested that yet, but as long as you don't boot to system it should stay decrypted.
(TWRP with FBE decryption support is on the horizon so you might want to wait. A fix was pushed a few days ago and it works on Honor 9, we just need a newly built twrp. I can't get the 8.1 tree to build a working one so I will check if it can be done with the 7.1 tree.)
Click to expand...
Click to collapse
Hello again. I've studied the shell scripts used in the HWOTA8 package and found out that the kernel and stock recovery will be flashed to the device after which it switches to recovery mode and the update zips will be pushed to /data/update along with update commands in /cache/recovery/command. Then it is supposed to reboot to recovery; to apply the updates I presume?. So when I interrupt this flow and do not boot to recovery but to fastboot to flash twrp and replace fstab, how will the updates be applied then?
I attach the script in question.
Any news already on TWRP on the horizon?
lvbaal said:
Hello again. I've studied the shell scripts used in the HWOTA8 package and found out that the kernel and stock recovery will be flashed to the device after which it switches to recovery mode and the update zips will be pushed to /data/update along with update commands in /cache/recovery/command. Then it is supposed to reboot to recovery; to apply the updates I presume?. So when I interrupt this flow and do not boot to recovery but to fastboot to flash twrp and replace fstab, how will the updates be applied then?
I attach the script in question.
Any news already on TWRP on the horizon?
Click to expand...
Click to collapse
First, copy fstab to computer and remove the fileencryption flag.
If course you need to flash update first.
You install update using HWOTA8. After it's done with the update in recovery mode you boot directly to fastboot instead of booting to system. You'd have to watch phone while it's updating as it reboota automatically. You should have USB plugged in already, so just start holding vol down when it says update is complete and it will reboot and you should land in fastboot. Now flash twrp to recovery_ramdisk and type 'fastboot reboot'. Remove USB and hold vol up. Now you should boot to twrp. Adb push the modified fstab to /vendor/etc/fstab.kirin970.
Also check Internal storage in twrp to make sure it's still decrypted. (you would have to decrypt before installing update to make sure this theory actually works ).
I could actually test it tonight on my Mate 9.
As for TWRP, the fix has been pushed to gerrit but it's not merged yet. I've been trying to get the android-8.0/8.1 branch to build a functional twrp but no luck yet. For some reason a bunch of folders are missing, and I'm not sure why. They are there in the source branch for both 8.0/8.1... I will test using git clone instead if repo sync.
ante0 said:
As for TWRP, the fix has been pushed to gerrit but it's not merged yet. I've been trying to get the android-8.0/8.1 branch to build a functional twrp but no luck yet. For some reason a bunch of folders are missing, and I'm not sure why. They are there in the source branch for both 8.0/8.1... I will test using git clone instead if repo sync.
Click to expand...
Click to collapse
I managed to build an Ubuntu based development environment, but using minimal manifest (8.1 branch) to build TWRP throws errors (i don't know if you have the same errors).
Here's the error log - > https://pastebin.com/C6jVg2eY
ante0 said:
First, copy fstab to computer and remove the fileencryption flag.
If course you need to flash update first.
You install update using HWOTA8. After it's done with the update in recovery mode you boot directly to fastboot instead of booting to system. You'd have to watch phone while it's updating as it reboota automatically. You should have USB plugged in already, so just start holding vol down when it says update is complete and it will reboot and you should land in fastboot. Now flash twrp to recovery_ramdisk and type 'fastboot reboot'. Remove USB and hold vol up. Now you should boot to twrp. Adb push the modified fstab to /vendor/etc/fstab.kirin970.
Also check Internal storage in twrp to make sure it's still decrypted. (you would have to decrypt before installing update to make sure this theory actually works ).
I could actually test it tonight on my Mate 9.
As for TWRP, the fix has been pushed to gerrit but it's not merged yet. I've been trying to get the android-8.0/8.1 branch to build a functional twrp but no luck yet. For some reason a bunch of folders are missing, and I'm not sure why. They are there in the source branch for both 8.0/8.1... I will test using git clone instead if repo sync.
Click to expand...
Click to collapse
Actually the ota.sh script boots to recovery after pushing the update. Presumably to apply the update through stock recovery. There fore I issued command adb reboot bootloader in an other powershell window. Then I flashed TWRP rebooted to TWRP to replace replaced fstab but then TWRP decides to apply the update because of input in /cache/recovery/command, so at that point I cannot replace fstab. Therefor I altered the script ota.sh and de-activated writes to /cache/recovery/command, and started over...
[/B]
lvbaal said:
Actually the ota.sh script boots to recovery after pushing the update. Presumably to apply the update through stock recovery. There fore I issued command adb reboot bootloader in an other powershell window. Then I flashed TWRP rebooted to TWRP to replace replaced fstab but then TWRP decides to apply the update because of input in /cache/recovery/command, so at that point I cannot replace fstab. Therefor I altered the script ota.sh and de-activated writes to /cache/recovery/command, and started over...
[/B]
Click to expand...
Click to collapse
Well, it has to apply the update in stock recovery. It can't do it in TWRP.
Basically you:
Format Data in TWRP and replace fstab with one that has fileencryption flag removed.
Boot to system once and then back to TWRP, check that you are decrypted (file manager in TWRP to Internal SD or browse child folders in /data).
Run HWOTA8 and let it update through stock recovery.
When it's done updating and about to reboot back to system, hold vol down so it goes to fastboot mode.
Now flash TWRP and issue 'fastboot reboot', quickly remove usb cable and hold volume up. Or remove usb and hold power+vol up.
Check that you are still decrypted.
Replace Fstab again with the 'fileencryption' flag removed one.
Now you can boot to system.
Edit: I managed to get TWRP source working, will test the decrypt fix soon.
---------- Post added at 08:44 PM ---------- Previous post was at 08:01 PM ----------
Pretoriano80 said:
I managed to build an Ubuntu based development environment, but using minimal manifest (8.1 branch) to build TWRP throws errors (i don't know if you have the same errors).
Here's the error log - > https://pastebin.com/C6jVg2eY
Click to expand...
Click to collapse
You need the full Omni source. Takes a while to sync
It's missing stuff from minimal that's needed.
After it's done syncing, you need to git clone https://github.com/omnirom/android_bootable_recovery to TWRPfolder/bootable/ and replace the recovery folder.
Same with https://github.com/omnirom/android_external_busybox/ to TWRPfolder/external/busybox (folder doesn't exist).
I'm not sure why it does this, the source looks fine when viewed in browser, but it doesn't sync everything...
ante0 said:
Well, it has to apply the update in stock recovery. It can't do it in TWRP.
Basically you:
Format Data in TWRP and replace fstab with one that has fileencryption flag removed.
Boot to system once and then back to TWRP, check that you are decrypted (file manager in TWRP to Internal SD or browse child folders in /data).
Run HWOTA8 and let it update through stock recovery.
When it's done updating and about to reboot back to system, hold vol down so it goes to fastboot mode.
Now flash TWRP and issue 'fastboot reboot', quickly remove usb cable and hold volume up. Or remove usb and hold power+vol up.
Check that you are still decrypted.
Replace Fstab again with the 'fileencryption' flag removed one.
Now you can boot to system.
Edit: I managed to get TWRP source working, will test the decrypt fix soon.
Click to expand...
Click to collapse
When I format data in twrp, replace fstab and boot to system once and then back to twrp to check encryption state in twrp filemanager, will /data not be empty then, so there's noting to check? Or am I missing something here?
lvbaal said:
When I format data in twrp, replace fstab and boot to system once and then back to twrp to check encryption state in twrp filemanager, will /data not be empty then, so there's noting to check? Or am I missing something here?
Click to expand...
Click to collapse
/data will not be empty. Unless you completely wipe it. But I think phone refuses to boot if you Wipe instead of Format Data
ante0 said:
/data will not be empty. Unless you completely wipe it. But I think phone refuses to boot if you Wipe instead of Format Data
Click to expand...
Click to collapse
I took my chances and did as proposed: only booting to system will not happen: it tries 2 times and the third time Huawei eRecovery comes up ¨Data partition was damaged seriously and you are recommended to format it to recover your phone¨ . It recommends Low level format data partition or shutdown. I chose Shutdown and booted to twrp once more to check /data. There's only lost+found and media/0 both empty. So /data turns out to be empty nevertheless. I did not completely wipe it; I did TWRP>Wipe>Format Data and typed ¨yes¨ to continue. Is this not what you meant by Format data in TWRP then?
lvbaal said:
I took my chances and did as proposed: only booting to system will not happen: it tries 2 times and the third time Huawei eRecovery comes up ¨Data partition was damaged seriously and you are recommended to format it to recover your phone¨ . It recommends Low level format data partition or shutdown. I chose Shutdown and booted to twrp once more to check /data. There's only lost+found and media/0 both empty. So /data turns out to be empty nevertheless. I did not completely wipe it; I did TWRP>Wipe>Format Data and typed ¨yes¨ to continue. Is this not what you meant by Format data in TWRP then?
Click to expand...
Click to collapse
Yes. That's where you Format Data.
Hmm.
Unless this twrp actually wipes rather than format.
Did you do update too now or just remove the flag in fstab and Format Data?
To get to Low level format, flash stock recovery OR the nocheck recovery from HWOTA8.
PLEASE NOTE I HAVE ONLY TESTED THIS ON MY PERSONAL DEVICE RUNNING BUILD 58.0.A.10.3 WITH DATA ENCRYPTED. NEWER FIRMWARE VERSIONS HAVE ISSUES THAT I CANNOT PRESENTLY FIX, THAT IS UP TO THE TWRP DEVELOPER.
This requires you to have adb installed on your computer, magisk needs to be installed, and your bootloader needs to be unlocked.
Use this guide for bootloader unlocking and Magisk installation
https://forum.xda-developers.com/sony-xperia-5-ii/how-to/guide-magisk-twrp-recovery-t4177209
Step 1. Download the twrp.img linked in this thread
https://forum.xda-developers.com/showthread.php?t=4185891
Step 2. Place that .img wherever your adb is installed on your pc.
Step 3. Reboot your device to fastboot by any means. Either use
Code:
adb reboot fastboot
when your device is plugged in, or boot your device while holding volume up.
Steps 4 - 8 are optional, as they make a TWRP backup of your stock recovery. I did this just to be safe because this TWRP isn't perfectly stable yet. It does work fine so far but its just a precaution.
Step 4.
Code:
fastboot flash boot_a Twrp-Xperia5II.img
Code:
fastboot flash boot_b Twrp-Xperia5II.img
Step 5.
Code:
fastboot reboot
Step 6. TWRP should boot now. Once in TWRP, be sure to change your language, it should be Chinese by default.
Step 7. Mount all partitions, except op2 and USB. Then create a backup of at least your recovery partition, although you can do all partitions if you would like. The backup will take a couple minutes, but let it runs its course.
Step 8. Reboot back to fastboot, either via TWRP or power button methods.
IF YOU MADE A RECOVERY BACKUP LOOK BELOW STEP 11 FIRST
Step 9.
Code:
fastboot flash recovery Twrp-Xperia5II.img
Step 10.
Code:
fastboot reboot recovery
Step 11. TWRP should now be booted from the recovery partition. You can verify by trying to reboot to system like normal. The easiest way to test once booted to system is to reboot to recovery in Magisk manager. If TWRP boots you are done.
THE FOLLOWING STEPS ARE ONLY NECESSARY IF YOU MADE A RECOVERY BACKUP IN STEPS 4 - 8
Immediately after Step 8 do the following, you will need your patched magisk .img file from the magisk guide I linked above.
Step 1.
Code:
fastboot flash boot_a [your patched magisk img]
Step 2.
Code:
fastboot flash boot_b [your patched magisk img]
Step 3.
Code:
fastboot reboot
Step 4. Go back to step 9 above.
Your system should now boot like normal again, but TWRP should be flashed to recovery. Test by following the steps listed in Step 11 above. Please reply with an questions or issues.
I will attach screenshots of what you should see in some of the steps in the second post.
Special thanks to Miustone and M-Rom for the Magisk guide and TWRP respectively.
Reserved
Reserved for Screenshots.
Very well explained man, thank you ?
Nice Guide! Really well written...
Glad to see the Xperia Community that active again
/data/media/0 is encrypted?
Thank you very much for this guide and the TWRP image file.
I have tried creating the backup of recovery per your instructions but it seems my /data/media/0 is encrypted so I can't create the TWRP backup folder. How do you remove this to create the recovery backup?
Thanks!
TripodKnight said:
Thank you very much for this guide and the TWRP image file.
I have tried creating the backup of recovery per your instructions but it seems my /data/media/0 is encrypted so I can't create the TWRP backup folder. How do you remove this to create the recovery backup?
Thanks!
Click to expand...
Click to collapse
You can wipe everything on the wipe menu, which will decrypt internal storage. This is a factory reset also so you will lose everything! I tried it in hope that I will at least be able to use twrp for future backups and zip flashing, but after rebooting the storage becomes encrypted again.
TWRP on the 5 ii is useless right now imo, you cant backup/restore or even flash anything with encrypted internal storage and no access to sdcard or usb OTG.
why does this need magisk to be installed?
TripodKnight said:
Thank you very much for this guide and the TWRP image file.
I have tried creating the backup of recovery per your instructions but it seems my /data/media/0 is encrypted so I can't create the TWRP backup folder. How do you remove this to create the recovery backup?
Thanks!
Click to expand...
Click to collapse
Did you make sure to allow system modifications when you first booted TWRP, because that is very important. I am running an encrypted internal storage myself and it works fine for backups and flashing.
palamosteliaro said:
You can wipe everything on the wipe menu, which will decrypt internal storage. This is a factory reset also so you will lose everything! I tried it in hope that I will at least be able to use twrp for future backups and zip flashing, but after rebooting the storage becomes encrypted again.
TWRP on the 5 ii is useless right now imo, you cant backup/restore or even flash anything with encrypted internal storage and no access to sdcard or usb OTG.
Click to expand...
Click to collapse
I have been able to run TWRP backups and restore fine on my device, even with encrypted storage. Please make sure you allowed system modification when you booted TWRP, as that is very important. As for SD card and OTG, I cannot help there. I am not the person who ported TWRP, I simply made the guide using the steps I did to make it work.
dgmortal said:
why does this need magisk to be installed?
Click to expand...
Click to collapse
It isn't really necessary, but it makes troubleshooting easier so I recommend it. You can do the same steps I listed but substitute your stock boot .img for the magisk .img steps and it should still work. I can't say for certain, as this guide is simply based on the steps I took to make TWRP work for me.
Jayram2000 said:
Did you make sure to allow system modifications when you first booted TWRP, because that is very important. I am running an encrypted internal storage myself and it works fine for backups and flashing.
Click to expand...
Click to collapse
Thanks for the advice. I wasn't given the option to allow system modifications. I've reflashed multiple times and not once does the option come up. I also notice that when I try to mount system then try a backup that the system mount box becomes unchecked.
I have no idea why it would work for you and not for us others. Maybe you used a different twrp build?
Jayram2000 said:
I have been able to run TWRP backups and restore fine on my device, even with encrypted storage. Please make sure you allowed system modification when you booted TWRP, as that is very important. As for SD card and OTG, I cannot help there. I am not the person who ported TWRP, I simply made the guide using the steps I did to make it work.
Click to expand...
Click to collapse
I remember that prompt from my s10, but I didn't get it here. I installed a twrp in chinese (from another topic here) is yours different?
TripodKnight said:
Thanks for the advice. I wasn't given the option to allow system modifications. I've reflashed multiple times and not once does the option come up. I also notice that when I try to mount system then try a backup that the system mount box becomes unchecked.
I have no idea why it would work for you and not for us others. Maybe you used a different twrp build?
Click to expand...
Click to collapse
I am using the exact same build that M-Rom posted, the one I linked. One thing to try is mounting your partitions manually in the TWRP menu prior to starting a backup. I have those all checked as mounted in my TWRP.
palamosteliaro said:
I remember that prompt from my s10, but I didn't get it here. I installed a twrp in chinese (from another topic here) is yours different?
Click to expand...
Click to collapse
This is the same TWRP M-Rom posted in another thread, and yes it does default to chinese.
Jayram2000 said:
This requires you to have adb installed on your computer, magisk needs to be installed, and your bootloader needs to be unlocked.
Use this guide for bootloader unlocking and Magisk installation
https://forum.xda-developers.com/sony-xperia-5-ii/how-to/guide-magisk-twrp-recovery-t4177209
Step 1. Download the twrp.img linked in this thread
https://forum.xda-developers.com/showthread.php?t=4185891
Step 2. Place that .img wherever your adb is installed on your pc.
Step 3. Reboot your device to fastboot by any means. Either use
Code:
adb reboot fastboot
when your device is plugged in, or boot your device while holding volume up.
Steps 4 - 8 are optional, as they make a TWRP backup of your stock recovery. I did this just to be safe because this TWRP isn't perfectly stable yet. It does work fine so far but its just a precaution.
Step 4.
Code:
fastboot flash boot_a Twrp-Xperia5II.img
Code:
fastboot flash boot_b Twrp-Xperia5II.img
Step 5.
Code:
fastboot reboot
Step 6. TWRP should boot now. Once in TWRP, be sure to change your language, it should be Chinese by default.
Step 7. Mount all partitions, except op2 and USB. Then create a backup of at least your recovery partition, although you can do all partitions if you would like. The backup will take a couple minutes, but let it runs its course.
Step 8. Reboot back to fastboot, either via TWRP or power button methods.
IF YOU MADE A RECOVERY BACKUP LOOK BELOW STEP 11 FIRST
Step 9.
Code:
fastboot flash recovery Twrp-Xperia5II.img
Step 10.
Code:
fastboot reboot recovery
Step 11. TWRP should now be booted from the recovery partition. You can verify by trying to reboot to system like normal. The easiest way to test once booted to system is to reboot to recovery in Magisk manager. If TWRP boots you are done.
THE FOLLOWING STEPS ARE ONLY NECESSARY IF YOU MADE A RECOVERY BACKUP IN STEPS 4 - 8
Immediately after Step 8 do the following, you will need your patched magisk .img file from the magisk guide I linked above.
Step 1.
Code:
fastboot flash boot_a [your patched magisk img]
Step 2.
Code:
fastboot flash boot_b [your patched magisk img]
Step 3.
Code:
fastboot reboot
Step 4. Go back to step 9 above.
Your system should now boot like normal again, but TWRP should be flashed to recovery. Test by following the steps listed in Step 11 above. Please reply with an questions or issues.
I will attach screenshots of what you should see in some of the steps in the second post.
Special thanks to Miustone and M-Rom for the Magisk guide and TWRP respectively.
Click to expand...
Click to collapse
It has come to my attention that users on updated system firmware are encountering decryption issues with the TWRP version listed here, rendering it useless. I am currently running build number 58.0.A.10.3 on my X5II, however flyl0 has brought it to my attention that other build versions could be proving to be the issue.
Please note that this guide is entirely based on the steps I took to do this on my own device, which currently isn't updated to the latest version of stock firmware. I will add a note in the OP as well. Sorry for any confusion.
Jayram2000 said:
This is the same TWRP M-Rom posted in another thread, and yes it does default to chinese.
Click to expand...
Click to collapse
Then I am doing something wrong in my root/twrp process. I am not able to edit (R/W) the system partition anyway after installing magisk, but I think that's expected. When you are just running android, are you able to edit the system? With root explorer for example? Or does it show that the partition is full?
Jayram2000 said:
It has come to my attention that users on updated system firmware are encountering decryption issues with the TWRP version listed here, rendering it useless. I am currently running build number 58.0.A.10.3 on my X5II, however flyl0 has brought it to my attention that other build versions could be proving to be the issue.
Please note that this guide is entirely based on the steps I took to do this on my own device, which currently isn't updated to the latest version of stock firmware. I will add a note in the OP as well. Sorry for any confusion.
Click to expand...
Click to collapse
Thanks for the clarification. Do you have the build number 58.0.A.10.3 from xperiFirm? Would you be able to upload it so I can downgrade and then install TWRP?
TripodKnight said:
Thanks for the clarification. Do you have the build number 58.0.A.10.3 from xperiFirm? Would you be able to upload it so I can downgrade and then install TWRP?
Click to expand...
Click to collapse
XQ-AS72(Hongkong or Tiwan model) is 58.0.A.10.3, I flash that, and I can use TWRP and also able to make backup.
But flash for XQ-AS52 ones (such as for EUver), I cant use TWRP(boot is OK, but cant make backup).
TWRP Encryption don't work on the latest update
WARNING! IF YOU ARE UPDATING TO ANDROID 13 FOR THE FIRST TIME, READ THIS FIRST!
If you are looking for my guide on a different Pixel, find it here:
Pixel 3
Pixel 3XL
Pixel 3a
Pixel 3aXL
Pixel 4
Pixel 4XL
Pixel 4a
Pixel 4a (5G)
Pixel 5
Pixel 5a
Pixel 6 Pro
For best results, use the latest stable Magisk release.
Discussion thread for migration to 24.0+.
Note: Magisk prior to Canary 23016 does not incorporate the necessary fixes for Android 12+.
WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.
Prerequisites:
Latest SDK Platform Tools - if Platform Tools is out of date, you WILL run into problems!
USB Debugging enabled
Google USB Driver installed
I recommend using Command Prompt for these instructions; some users have difficulty with PowerShell.
Make sure the Command Prompt is running from your Platform Tools directory!
Android Source - Setting up a device for development
Spoiler: Downloads
Pixel OTA Images
Pixel Factory Images
Magisk Stable, Magisk Canary - Magisk GitHub
Spoiler: Unlock Bootloader
Follow these instructions to enable Developer Options and USB Debugging.
Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
Connect your device to your PC, and open a command window in your Platform Tools folder.
Ensure ADB sees your device:
Code:
adb devices
If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
If you see "unauthorized", you need to authorize the connection on your device.
If you see the device without "unauthorized", you're good to go.
Reboot to bootloader:
Code:
adb reboot bootloader
Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
Code:
fastboot flashing unlock
Select Continue on the device screen.
Spoiler: Initial Root / Create Master Root Image
Install Magisk on your device.
Download the factory zip for your build.
Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
Copy boot.img to your device.
Patch boot.img with Magisk: "Install" > "Select and Patch a File"
Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
Reboot your device to bootloader.
Flash the patched image:
Code:
fastboot flash boot <drag and drop master root.img here>
Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>
Spoiler: Update and Root Automatic OTA
Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
You should now be updated with root.
Spoiler: Update and Root OTA Sideload
Download the OTA.
Reboot to recovery and sideload the OTA:
Code:
adb reboot sideload
Once in recovery:
Code:
adb sideload ota.zip
When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.
Spoiler: Update and Root Factory Image
Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
Download the factory zip and extract the contents.
Reboot to bootloader.
Spoiler: Update bootloader if necessary
Compare bootloader versions between phone screen and bootloader.img build number
Code:
fastboot flash bootloader <drag and drop new bootloader.img here>
If bootloader is updated, reboot to bootloader.
Spoiler: Update radio if necessary
Compare baseband versions between phone screen and radio.img build number
Code:
fastboot flash radio <drag and drop radio.img here>
If radio is updated, reboot to bootloader.
Apply update:
Code:
fastboot update --skip-reboot image-codename-buildnumber.zip
When the update completes, the device will be in fastbootd. Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
The scripted commands should look like this:
Code:
fastboot flash bootloader <bootloader image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot flash radio <radio image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update --skip-reboot <image-device-buildnumber.zip>
Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.
Spoiler: Update and Root using PixelFlasher <<RECOMMENDED FOR NOVICES>>
PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.
For instructions, downloads, and support, please refer to the PixelFlasher thread.
Spoiler: Update and Root using the Android Flash Tool
Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
When the update completes, the device will be in fastbootd. Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Spoiler: Pass SafetyNet/Play Integrity
SafetyNet has been deprecated for the new Play Integrity API. More information here.
In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.
However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to force basic attestation instead of hardware, meaning that the device will pass BASIC and DEVICE integrity.
Mod available here. Do not use MagiskHide Props Config with this mod.
This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.
Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
Google Play Store
GPay
Any banking/financial apps
Any DRM media apps
Modules:
Universal SafetyNet Fix 2.3.1 Mod - XDA post
To check SafetyNet status:
YASNAC - GitHub
To check Play Integrity status:
Play Integrity Checker - NOTE: MEETS_STRONG_INTEGRITY will ALWAYS fail on an unlocked bootloader.
I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.
Points of note:
The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
"Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
"App" simply shows the version of the app itself.
If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.
Credits:
Thanks to @badabing2003 , @pndwal , @Displax , @Az Biker , @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
This is very interesting but maybe a more accurate/calm title would be better
I posted in another tread but I was on November's patch but used .15's vbmeta to root (before images were available for November)
Can I just flash vbmeta with the disable flags, and not worry about a wipe?
Confirmed working using Flash Tool method coming from 015 to 036. Used Magisk Alpha 23012 to patch boot image and pass SafetyNet on checker apps. GPay still doesn't work, though. It may be identifying that verity and/or verification is disabled. I don't use it, but it's generally what I confirm the SN fix with.
lackalil said:
Confirmed working using Flash Tool method coming from 015 to 036. Used Magisk Alpha 23012 to patch boot image and pass SafetyNet on checker apps. GPay still doesn't work, though. It may be identifying that verity and/or verification is disabled. I don't use it, but it's generally what I confirm the SN fix with.
Click to expand...
Click to collapse
To pass SafetyNet, you have to use Universal SafetyNet Fix 2.2.0, which is currently in beta on Patreon.
V0latyle said:
To pass SafetyNet, you have to use Universal SafetyNet Fix 2.2.0, which is currently in beta on Patreon.
Click to expand...
Click to collapse
Ahh, I see that in the thread now. Not a big deal for me because I don't use any apps that need it—I've just been doing it as a matter of course for a good while. Nonetheless, I'm still passing attestation with USNF 2.1.1 according to Root Checker and YASNAC.
Confirmed root working on Magisk Alpha v23001 (then reverted back to MM 23.0 to keep the old module repository links). Also updated to Nov '21 bootloader and radio at the same time. GPay stopped working for me since the Sept '21 update and all the various requirements to re-enable. I'm not that interested in GPay functionality.
schalacker said:
Confirmed root working on Magisk Alpha v23001 (then reverted back to MM 23.0 to keep the old module repository links). Also updated to Nov '21 bootloader and radio at the same time. GPay stopped working for me since the Sept '21 update and all the various requirements to re-enable. I'm not that interested in GPay functionality.
Click to expand...
Click to collapse
In case anyone is, GPay is working for me on my Pixel 5 with the November build. Magisk 23001 + MagiskHide + Riru + Universal SafetyNet Fix 2.1.1.
V0latyle said:
In case anyone is, GPay is working for me on my Pixel 5 with the November build. Magisk 23001 + MagiskHide + Riru + Universal SafetyNet Fix 2.1.1.
Click to expand...
Click to collapse
where can i get magiskhide, riru universal safety, thanks
when you receive the pixel
I update it with the latest update and then unlock booloader and root.
is this correct?
miss said:
where can i get magiskhide, riru universal safety, thanks
Click to expand...
Click to collapse
Magisk 23001, MagiskHide is in the options
Riru is in the module repo
Universal SafetyNet Fix 2.1.1
miss said:
when you receive the pixel
I update it with the latest update and then unlock booloader and root.
is this correct?
Click to expand...
Click to collapse
This would probably be the best way to do it, yes.
Great write up! Thanks for putting it together.
You talk about booting the patched boot.img as an option instead of flashing it just to make sure everything is working correctly before they flash the patched file. I just want to really suggest to people that they do this anytime they are rooting after an update.
Sure it's an extra step (because you will have to flash the modified boot.img to make root permanent), but being able to simply reboot the phone if something goes wrong to get back to a working OS is priceless. You might think the odds are very low of something going wrong and causing a bootloop if you flash the boot.img before booting it, but experience has taught me this isn't the case. It's possible that there is a Magisk module that doesn't work with the update, or it's possible that user error will cause an issue (I have copied over the wrong patched boot.img from the phone before as an example). Whatever the case, if something goes wrong you will be glad you are only booting the patched boot.img file instead of flashing it!
sic0048 said:
Great write up! Thanks for putting it together.
You talk about booting the patched boot.img as an option instead of flashing it just to make sure everything is working correctly before they flash the patched file. I just want to really suggest to people that they do this anytime they are rooting after an update.
Sure it's an extra step (because you will have to flash the modified boot.img to make root permanent), but being able to simply reboot the phone if something goes wrong to get back to a working OS is priceless. You might think the odds are very low of something going wrong and causing a bootloop if you flash the boot.img before booting it, but experience has taught me this isn't the case. It's possible that there is a Magisk module that doesn't work with the update, or it's possible that user error will cause an issue (I have copied over the wrong patched boot.img from the phone before as an example). Whatever the case, if something goes wrong you will be glad you are only booting the patched boot.img file instead of flashing it!
Click to expand...
Click to collapse
Exactly, I was guilty of not removing a Magisk module on my P5 when installing an update. And learned the hard way.
You really never know if there is some sort of residue left from your previous setup.
sic0048 said:
Great write up! Thanks for putting it together.
You talk about booting the patched boot.img as an option instead of flashing it just to make sure everything is working correctly before they flash the patched file. I just want to really suggest to people that they do this anytime they are rooting after an update.
Sure it's an extra step (because you will have to flash the modified boot.img to make root permanent), but being able to simply reboot the phone if something goes wrong to get back to a working OS is priceless. You might think the odds are very low of something going wrong and causing a bootloop if you flash the boot.img before booting it, but experience has taught me this isn't the case. It's possible that there is a Magisk module that doesn't work with the update, or it's possible that user error will cause an issue (I have copied over the wrong patched boot.img from the phone before as an example). Whatever the case, if something goes wrong you will be glad you are only booting the patched boot.img file instead of flashing it!
Click to expand...
Click to collapse
You don't actually have to flash it. If you boot the patched image and it works, you should be able to use Direct Install in Magisk to patch the image in /boot. Then, next time you reboot, the device loads that image, which should be exactly the same as what you live booted.
But yes, it's very useful to be able to test.
I was able to take the SD1A.210817.019 to SD1A.210817.036 delta OTA via System Update by restoring my boot (via Magisk) and vbmeta (via dd) partitions back to stock, then patching vbmeta in both slots (again via dd) before rebooting. No data wipe required. To simplify that process, I made a tool to patch and restore the vbmeta partitions:
Release v1.0.0-alpha01 · capntrips/VbmetaPatcher
initial commit
github.com
The process should be considered experimental until a few other people have tested it. Should anyone attempt it, I would suggest backing up any critical data.
I'm also considering making a tool to restore the stock boot backup image, in case anyone fastboot flashed, rather than doing a direct install in the Magisk app. It could also be used to download the newly installed boot image from the inactive slot after an OTA, to avoid having to download the full factory image.
Unfortunately, patching boot in the inactive slot in Magisk was disabled for Pixel devices a while back, since it caused issues with starting back up. When the December OTA comes out, I'll probably take the plunge to see if I can figure out a way to make it work.
On a related note, a fix that will allow Magisk to properly detect the current slot on Pixel 6 devices has been approved. Hopefully it'll get merged before the next mainline canary build, so we can stop using custom builds (or having to fastboot flash boot_b when on slot B).
capntrips said:
I was able to take the SD1A.210817.019 to SD1A.210817.036 delta OTA via System Update by restoring my boot (via Magisk) and vbmeta (via dd) partitions back to stock, then patching vbmeta in both slots (again via dd) before rebooting. No data wipe required. To simplify that process, I made a tool to patch and restore the vbmeta partitions:
Release v1.0.0-alpha01 · capntrips/VbmetaPatcher
initial commit
github.com
The process should be considered experimental until a few other people have tested it.
I'm also considering making a tool to restore the stock boot backup image, in case anyone fastboot flashed, rather than doing a direct install in the Magisk app. It could also be used to download the newly installed boot image from the inactive slot after an OTA, to avoid having to download the full factory image.
Unfortunately, patching boot in the inactive slot in Magisk was disabled for Pixel devices a while back, since it caused issues with starting back up. When the December OTA comes out, I'll probably take the plunge to see if I can figure out a way to make it work.
On a related note, a fix that will allow Magisk to properly detect the current slot on Pixel 6 devices has been approved. Hopefully it'll get merged before the next mainline canary build, so we can stop using custom builds (or having to fastboot flash boot_b when on slot B).
Click to expand...
Click to collapse
So, if I use this tool after rooting OTA updates will work and I'll still have root?
Edit: And can you explain more clearly the process on how to do this?
KedarWolf said:
So, if I use this tool after rooting OTA updates will work and I'll still have root?
Edit: And can you explain more clearly the process on how to do this?
Click to expand...
Click to collapse
No, the tool does nothing to maintain root. It simply allows you to take the OTA. You will still need to reboot into fastboot and flash or boot from a patched boot image.
The steps would be:
Restore boot in the Magisk app
Restore vbmeta in Vbmeta Patcher
Take the OTA in System Updater
Patch vbmeta in Vbmeta Patcher
Patch the new boot image in the Magisk app and copy it to your computer
Reboot into fastboot
Boot from the new patched boot image
Direct Install Magisk in the Magisk App
As I noted the quote post, this process should be considered experimental until it has been more thoroughly tested. You should consider backing up any critical data before attempting it, in case something goes wrong.
I'm working on another tool to make it a bit easier to acquire the new boot image in step 5, but that will likely be a few days. Hopefully we'll be able to install Magisk to the inactive slot on Pixel devices again in the future, which would consolidate steps 5-8.
capntrips said:
I was able to take the SD1A.210817.019 to SD1A.210817.036 delta OTA via System Update by restoring my boot (via Magisk) and vbmeta (via dd) partitions back to stock, then patching vbmeta in both slots (again via dd) before rebooting. No data wipe required. To simplify that process, I made a tool to patch and restore the vbmeta partitions:
Click to expand...
Click to collapse
Patch vbmeta how? What does patching the image accomplish?
capntrips said:
On a related note, a fix that will allow Magisk to properly detect the current slot on Pixel 6 devices has been approved. Hopefully it'll get merged before the next mainline canary build, so we can stop using custom builds (or having to fastboot flash boot_b when on slot B).
Click to expand...
Click to collapse
This is good news. Would the same thing be accomplished by flashing the boot image to both slots using --slot=all?
lackalil said:
Confirmed working using Flash Tool method coming from 015 to 036. Used Magisk Alpha 23012 to patch boot image and pass SafetyNet on checker apps. GPay still doesn't work, though. It may be identifying that verity and/or verification is disabled. I don't use it, but it's generally what I confirm the SN fix with.
Click to expand...
Click to collapse
did the flash tool make you wipe when disabling verity and verification? I noticed it allows you to uncheck the wipe device option.... just curious thx
dadoc04 said:
did the flash tool make you wipe when disabling verity and verification? I noticed it allows you to uncheck the wipe device option.... just curious thx
Click to expand...
Click to collapse
If the build you're currently on has verity and verification disabled, you don't have to wipe when you update using the flash tool.
I haven't tried it without wiping from unrooted/stock vbmeta. It could well be possible despite a wipe being required when flashing using adb.
If you are looking for my guide on a different Pixel, find it here:
Pixel 3XL
Pixel 3a
Pixel 3aXL
Pixel 4
Pixel 4XL
Pixel 4a
Pixel 4a (5G)
Pixel 5
Pixel 5a
Pixel 6
Pixel 6 Pro
For best results, use the latest stable Magisk release.
Discussion thread for migration to 24.0+.
Note: Magisk prior to Canary 23016 does not incorporate the necessary fixes for Android 12+.
WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.
Prerequisites:
Latest SDK Platform Tools - if Platform Tools is out of date, you WILL run into problems!
USB Debugging enabled
Google USB Driver installed
I recommend using Command Prompt for these instructions; some users have difficulty with PowerShell.
Make sure the Command Prompt is running from your Platform Tools directory!
Android Source - Setting up a device for development
Spoiler: Downloads
Pixel OTA Images
Pixel Factory Images
Magisk Stable, Magisk Canary - Magisk GitHub
Spoiler: Unlock Bootloader
Follow these instructions to enable Developer Options and USB Debugging.
Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
Connect your device to your PC, and open a command window in your Platform Tools folder.
Ensure ADB sees your device:
Code:
adb devices
If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
If you see "unauthorized", you need to authorize the connection on your device.
If you see the device without "unauthorized", you're good to go.
Reboot to bootloader:
Code:
adb reboot bootloader
Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
Code:
fastboot flashing unlock
Select Continue on the device screen.
Spoiler: Initial Root / Create Master Root Image
Install Magisk on your device.
Download the factory zip for your build.
Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
Copy boot.img to your device.
Patch boot.img with Magisk: "Install" > "Select and Patch a File"
Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
Reboot your device to bootloader.
Flash the patched image:
Code:
fastboot flash boot <drag and drop master root.img here>
Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>
Spoiler: Update and Root Automatic OTA
Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
You should now be updated with root.
Spoiler: Update and Root OTA Sideload
Download the OTA.
Reboot to recovery and sideload the OTA:
Code:
adb reboot sideload
Once in recovery:
Code:
adb sideload ota.zip
When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.
Spoiler: Update and Root Factory Image
Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
Download the factory zip and extract the contents.
Reboot to bootloader.
Spoiler: Update bootloader if necessary
Compare bootloader versions between phone screen and bootloader.img build number
Code:
fastboot flash bootloader <drag and drop new bootloader.img here>
If bootloader is updated, reboot to bootloader.
Spoiler: Update radio if necessary
Compare baseband versions between phone screen and radio.img build number
Code:
fastboot flash radio <drag and drop radio.img here>
If radio is updated, reboot to bootloader.
Apply update:
Code:
fastboot update --skip-reboot image-codename-buildnumber.zip
When the update completes, the device will be in fastbootd. Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
The scripted commands should look like this:
Code:
fastboot flash bootloader <bootloader image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot flash radio <radio image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update --skip-reboot <image-device-buildnumber.zip>
Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.
Spoiler: Update and Root using PixelFlasher <<RECOMMENDED FOR NOVICES>>
PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.
For instructions, downloads, and support, please refer to the PixelFlasher thread.
Spoiler: Update and Root using the Android Flash Tool
Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
When the update completes, the device will be in fastbootd. Reboot to bootloader.
Boot the master root image (See note 1):
Code:
fastboot boot <drag and drop master root.img here>
Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
Reboot your device. You should now be updated with root.
Spoiler: Pass SafetyNet/Play Integrity
SafetyNet has been deprecated for the new Play Integrity API. More information here.
In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.
However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to force basic attestation instead of hardware, meaning that the device will pass BASIC and DEVICE integrity.
Mod available here. Do not use MagiskHide Props Config with this mod.
This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.
Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
Google Play Store
GPay
Any banking/financial apps
Any DRM media apps
Modules:
Universal SafetyNet Fix 2.3.1 Mod - XDA post
To check SafetyNet status:
YASNAC - GitHub
To check Play Integrity status:
Play Integrity Checker - NOTE: MEETS_STRONG_INTEGRITY will ALWAYS fail on an unlocked bootloader.
I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.
Points of note:
The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
"Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
"App" simply shows the version of the app itself.
If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.
Credits:
Thanks to @badabing2003 , @pndwal , @Displax , @Az Biker , @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
no good on verizon 3a. however if you can figure out how to exploit DSU, when trying to load a custom ROM image, it corrupts vbmeta.
also if you check out my threads, there's a variety of other things I managed to dig up that could assist in unlocking a verizon variant, like that i mentioned above.
I also have a Verizon Pixel 3 with AT&T service and just want to tether my unlimited data.Is there a way to do it without root and unlocked bootloader.
AtrixHDMan said:
I also have a Verizon Pixel 3 with AT&T service and just want to tether my unlimited data.Is there a way to do it without root and unlocked bootloader.
Click to expand...
Click to collapse
Share a mobile connection by tethering or hotspot on Pixel - Pixel Phone Help
You can use your phone’s mobile data to connect another phone, tablet, or computer to the internet. Sharing a connection this way is called tethering or using a hotspot.
support.google.com
dcarvil said:
Share a mobile connection by tethering or hotspot on Pixel - Pixel Phone Help
You can use your phone’s mobile data to connect another phone, tablet, or computer to the internet. Sharing a connection this way is called tethering or using a hotspot.
support.google.com
Click to expand...
Click to collapse
I mean without them knowing it.I don't have tethering on my plan.
This only works if you're able to unlock your bootloader, obviously. We should all be well aware by now that certain carrier-specific devices prevent doing so, and there is no workaround or fix.
this doesnt work for me my patch file for magisk just makes it so that my touch screen is unresponsive at boot is there any other method for rooting my pixel 3?
thanks for shareing. when i got the last step on root. i had a Failed . (remote: Failed to write to partition Not Found). how can i fix it . sincerely.
hudsonchris12 said:
this doesnt work for me my patch file for magisk just makes it so that my touch screen is unresponsive at boot is there any other method for rooting my pixel 3?
Click to expand...
Click to collapse
Well I figured it out I followed a tutorial on YouTube that I can't actually find now but as far as I can recall the only difference between that one and this one was that the other guy had me use the Android flash tool to reflash a stock rom with the disable verity and disable verification boxes checked. doesn't seem like much but everything worked flawlessly afterwards. Maybe this will help someone else
This works perfect on my Pixel 3a XL as well. Thanks for sharing. Would be great if you can share how we can keep getting the monthly OS update after the phone is rooted.
works for me, thanks!
daviddooyyyyy said:
thanks for shareing. when i got the last step on root. i had a Failed . (remote: Failed to write to partition Not Found). how can i fix it . sincerely.
Click to expand...
Click to collapse
Make sure you're using the latest Platform Tools.
jackhu said:
This works perfect on my Pixel 3a XL as well. Thanks for sharing. Would be great if you can share how we can keep getting the monthly OS update after the phone is rooted.
Click to expand...
Click to collapse
This has nothing to do with root and everything to do with Google's existing strategy of supporting devices for 3 years. The Pixel 3 / 3XL were sunsetted with the last update in October 2021 and will no longer receive updates. The 3a / 3a XL will meet the same fate in May, as will the 4 / 4XL in October of this year.
Hello, I am currently on the January patch (AKA the last patch) (build SP1A.210812.016.A2), and I installed magisk using the latest canary build (23017) of Magisk. However, after doing "fastboot flash boot [path to file]" (without ""), the phone took spent quite a bit in the booting screen (G logo with bar underneath) and I backed out by flashing the stock boot image back (so I'm back in the unrooted state). How long is it considered "normal" when my phone boots after flashing magisk? If my English looks weird, sorry. I'm not native
PS: I've confirmed that I am using the latest version of platform-tools.
adb version
Android Debug Bridge version 1.0.41
Version 31.0.3-7562133
Installed as C:\My_space\adb\platform-tools\adb.exe
the flashing completed without errors:
fastboot flash boot C:\My_space\magiskFLASH\magisk_patched-23017_Jm013.img
Sending 'boot_a' (65536 KB) OKAY [ 1.682s]
Writing 'boot_a' OKAY [ 0.319s]
Finished. Total time: 2.481s
I've also verified the SHA-256 checksum of the download, and it matched without errors.
Thank you!
Question do I still use the factory image provided? Isn't there a more updated version which is the last?
Lomarnut said:
Question do I still use the factory image provided? Isn't there a more updated version which is the last?
Click to expand...
Click to collapse
Yes, I believe that you use updated method tho, or at least an updated TWRP.
rocketrazr1999 said:
Yes, I believe that you use updated method tho, or at least an updated TWRP.
Click to expand...
Click to collapse
do you know where updated method is. I'm very cautious about rooting because i've bricked at least 3 devices years ago
Deleted
Lomarnut said:
do you know where updated method is. I'm very cautious about rooting because i've bricked at least 3 devices years ago
Click to expand...
Click to collapse
Yes, THIS thread
rocketrazr1999 said:
Yes, THIS thread
Click to expand...
Click to collapse
so this method still works if I'm on jan image?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I would like to thank TeamWin for their amazing work!
I saw that the newer Samsung MediaTek phones were not getting any sort of love, so I bought one myself to kick start the development.
I have already made TWRP for M32 & A41 and thought why not add support for a sister device.
KEEP IN MIND THIS IS A BETA BUILD, expect bugs!
TWRP is the obvious choice as it is reliable and trustworthy with frequent updates and patches.
INSTALLATION:
Odin Method (Windows):
Step 0: Unlock Device Bootloader by toggling the OEM Unlock option in Developer Options. Device will reboot to Odin mode and will prompt you to long press volume up, device will then unlock bootloader and perform a complete factory reset so make sure to backup any data.
Step 1: Download the unofficial TWRP image from the link attached below.
Step 2: Put the device in Odin download mode by holding VolumeUp+VolumeDown and inserting USB cable after the device is completely shut down.
Step 3: Select the downloaded recovery.tar in AP slot and vbmeta_disabled_R.tar in USERDATA slot, connect the device to PC, go to options and untick "Auto-Reboot"
Step 4: Click START and the Device will get flashed, Odin will say SUCESS!.
Step 5. Exit Download mode by holding VolumeDown+PowerButton and then immediately boot
into Recovery mode by pressing VolumeUp+PowerButton.
Step 6: Congratulations, you have installed TWRP latest for your F22 4G, to access the system now, you need to perform some additional steps.
Step 7: Open up TWRP terminal and then type in "multidisabler" and then perform a full factory reset again by going into "Wipe" -> Format Data -> type "yes"
Step 8: Now stock ROM should work fine with TWRP!
Heimdall Method (Linux):
Step 1: Install heimdall tool on linux , google it.
Step 2: Put the device in Odin download mode by holding VolumeUp+VolumeDown and inserting USB cable after the device is completely shut down.
Step 3: Open up terminal in the downloaded TWRP directory, extract twrp image from recovery.tar
Step 4: Enter the command "heimdall flash --RECOVERY recovery.img --no-reboot" where twrp.img is name of the downloaded image
Step 5. Exit Download mode by holding VolumeDown+PowerButton and then immediately boot
into Recovery mode by pressing VolumeUp+PowerButton.
Step 6: Congratulations, you have installed TWRP latest for your F22 4G, to access the system now, you need to perform some additional steps.
Step 7: Open up TWRP terminal and then type in "multidisabler" and then perform a full factory reset again by going into "Wipe" -> Format Data -> type "yes"
Step 8: Now stock ROM should work fine with TWRP!
COMPATIBILITY:
TWRP Recovery is compatible with latest Android 11 firmware
tested on:
E225FXXU4AVB1 by @sunmughan thank you bro.l
First time you boot into TWRP, don't forget to backup your EFS, Secondary EFS and NVRAM! Go into Backup and select "EFS,", "Secondary EFS" and "NVRAM" and backup to preferably MicroSDcard and copy it to your PC in case you need it if IMEI corrupts.
DON'T IGNORE THIS STEP!
All kernel source and device tree below!
Device Tree: TWRP Device Tree
Kernel Tree: TWRP Kernel Tree
DOWNLOADS:
VBMETA DISABLED FOR R: MEGA LINK
TWRP TAR: MEGA LINK
I am getting:
E:Unable to unlock /dev/block/mmcblk0p42 for flashing: (null)
fermi6-626 said:
I am getting:
E:Unable to unlock /dev/block/mmcblk0p42 for flashing: (null)
Click to expand...
Click to collapse
you tried with ODIN or HEIMDAL?
MrVenom. said:
you tried with ODIN or HEIMDAL?
Click to expand...
Click to collapse
i tried with both odin and heimdall
First off, the twrp itself boots. But I couldn't find "System" or "Super" in erase section. I am not sure how useful it will be if I can't erase that before flashing another image.
fermi6-626 said:
I am getting:
E:Unable to unlock /dev/block/mmcblk0p42 for flashing: (null)
Click to expand...
Click to collapse
This error is not from TWRP itself. He just didn't unmount the partitions first. That's all. I didn't get the error when I dismounted first. Without dismounting, I see 16 unable to unlock errors.
Update: Another setback, TWRP can't flash super images. Only way would have been to use fastboot which is botched by uncle sam. Any other way to flash gsi images to this?
This error is not from TWRP itself. He just didn't unmount the partitions first. That's all. I didn't get the error when I dismounted first. Without dismounting, I see 16 unable to unlock errors.
Click to expand...
Click to collapse
Actually, The errors persists even after I unmount the partitions before flashing.
The errors are there whether I mount or unmount the partitions(at least for my device), but the correct procedure is unmounting before flashing.
But I couldn't find "System" or "Super" in erase section. I am not sure how useful it will be if I can't erase that before flashing another image.
Click to expand...
Click to collapse
Beats me.
[edit: /system partition is by default always unmounted before flashing a zip]
I should have heeded the warning. I didn't backup EFS, Secondary EFS and NVRAM.
Now , there is no IMEI and cant use the sim.
Is there any solution to this?
Thank you in advance.
dekisugihidetoshi said:
I should have heeded the warning. I didn't backup EFS, Secondary EFS and NVRAM.
Now , there is no IMEI and cant use the sim.
Is there any solution to this?
Thank you in advance.
Click to expand...
Click to collapse
I am fighting myself real hard not to reply with akhils avatar, but efs (for sure) and nvram (can't say for sure) is included in the stock, flash stock, probably gonna be alright.
fermi6-626 said:
Beats me.
Click to expand...
Click to collapse
There're these packages.... DynaPatch is less known and probably not so much polished and then there's the ChonDoe_Flasher, they can be used to flash gsi and then there was a linux thingy which is used to pack system.img into super.img with vendor.img and others so that twrp can flash it directly.
Akhil99 said:
I would like to thank TeamWin for their amazing work!
I saw that the newer Samsung MediaTek phones were not getting any sort of love, so I bought one myself to kick start the development.
I have already made TWRP for M32 & A41 and thought why not add support for a sister device.
KEEP IN MIND THIS IS A BETA BUILD, expect bugs!
TWRP is the obvious choice as it is reliable and trustworthy with frequent updates and patches.
INSTALLATION:
Odin Method (Windows):
Step 0: Unlock Device Bootloader by toggling the OEM Unlock option in Developer Options. Device will reboot to Odin mode and will prompt you to long press volume up, device will then unlock bootloader and perform a complete factory reset so make sure to backup any data.
Step 1: Download the unofficial TWRP image from the link attached below.
Step 2: Put the device in Odin download mode by holding VolumeUp+VolumeDown and inserting USB cable after the device is completely shut down.
Step 3: Select the downloaded recovery.tar in AP slot and vbmeta_disabled_R.tar in USERDATA slot, connect the device to PC, go to options and untick "Auto-Reboot"
Step 4: Click START and the Device will get flashed, Odin will say SUCESS!.
Step 5. Exit Download mode by holding VolumeDown+PowerButton and then immediately boot
into Recovery mode by pressing VolumeUp+PowerButton.
Step 6: Congratulations, you have installed TWRP latest for your F22 4G, to access the system now, you need to perform some additional steps.
Step 7: Open up TWRP terminal and then type in "multidisabler" and then perform a full factory reset again by going into "Wipe" -> Format Data -> type "yes"
Step 8: Now stock ROM should work fine with TWRP!
Heimdall Method (Linux):
Step 1: Install heimdall tool on linux , google it.
Step 2: Put the device in Odin download mode by holding VolumeUp+VolumeDown and inserting USB cable after the device is completely shut down.
Step 3: Open up terminal in the downloaded TWRP directory, extract twrp image from recovery.tar
Step 4: Enter the command "heimdall flash --RECOVERY recovery.img --no-reboot" where twrp.img is name of the downloaded image
Step 5. Exit Download mode by holding VolumeDown+PowerButton and then immediately boot
into Recovery mode by pressing VolumeUp+PowerButton.
Step 6: Congratulations, you have installed TWRP latest for your F22 4G, to access the system now, you need to perform some additional steps.
Step 7: Open up TWRP terminal and then type in "multidisabler" and then perform a full factory reset again by going into "Wipe" -> Format Data -> type "yes"
Step 8: Now stock ROM should work fine with TWRP!
COMPATIBILITY:
TWRP Recovery is compatible with latest Android 11 firmware
tested on:
E225FXXU4AVB1 by @sunmughan thank you bro.l
First time you boot into TWRP, don't forget to backup your EFS, Secondary EFS and NVRAM! Go into Backup and select "EFS,", "Secondary EFS" and "NVRAM" and backup to preferably MicroSDcard and copy it to your PC in case you need it if IMEI corrupts.
DON'T IGNORE THIS STEP!
All kernel source and device tree below!
Device Tree: TWRP Device Tree
Kernel Tree: TWRP Kernel Tree
DOWNLOADS:
VBMETA DISABLED FOR R: MEGA LINK
TWRP TAR: MEGA LINK
Click to expand...
Click to collapse
hello brother, this unofficial twrp tar cause me bootloop pls can you fix this. on my samsung f22 android 12 E225FXXU4BVF1
fermi6-626 said:
I am getting:
E:Unable to unlock /dev/block/mmcblk0p42 for flashing: (null)
Click to expand...
Click to collapse
Just ignore those errors.
Hello there! Is there any files that I could directly use to flash twrp? I already am root through magisk and didn't find the supported module/device of twrp which I downloaded from play store. Still no support for F22. So how do I install it? Without any desktop or pc. directly through my rooted phone? Thanks!
I haven't tried it yet, but in theory, shouldn't it work with android S & T if the appropriate vbmeta is flashed?
There is a new binary update, u5. Downgrading won't be possible and this device has only this twrp for it, to my knowledge.
dekisugihidetoshi said:
I should have heeded the warning. I didn't backup EFS, Secondary EFS and NVRAM.
Now , there is no IMEI and cant use the sim.
Is there any solution to this?
Thank you in advance.
Click to expand...
Click to collapse
Does this error got solved or not because i want to try custom rom in my samsung f22 please help me