Devices that started to be received today have Oxygen OS 10.5 out of the box.
No flashable zip for that software release is publicly available, meaning its stock boot.img cannot be extracted.
You then need to update to a newer build first. You can do so from my OxygenOS builds repo thread.
Once done, enable developers options and enable OEM unlock.
Reboot to fastboot (enable USB debugging in dev options and use adb reboot bootloader)
Type fastboot oem unlock and accept to unlock bootloader (warning: as a safety measure Android will wipe your userdata)
Go through OxygenOS setup
Install Magisk Manager from https://github.com/topjohnwu/Magisk/releases/download/manager-v7.5.1/MagiskManager-v7.5.1.apk
Move stock boot.img to your phone internal storage (please open spoiler)
For your convenience, 10.5.2 stock boot.img for EU and India have been extracted
EU download: https://drive.google.com/file/d/18aPqErEMbRqmN4BpdvHE4OKgizDcEbou/view?usp=sharing
India download: https://drive.google.com/file/d/1ZIEYWH2PYkKyojq_S_i_onBstejHKDTJ/view?usp=sharing
For future builds, you can use payload dumper (Windows) , (Linux ) to extract stock boot.img
Click on Install
Choose "Select and patch a file"
Select your stock boot.img
Wait until Magisk patches your boot.img, and once patched it can be found in the Downloads folder
Copy that patched boot.img (which should be named magisk_patched.img) to your computer
Boot into fastboot again
Type fastboot getvar current-slot into your terminal window and press Enter.
If the output is a , type fastboot flash boot_a magisk_patched.img into your terminal window and press Enter.
If the output is b , type fastboot flash boot_b magisk_patched.img into your terminal window and press Enter.
Reboot to OxygenOS
Open Magisk Manager and your device should now be rooted.
TIPS:
- Ensure you got latest platform tools installed from https://developer.android.com/studio/releases/platform-tools
- Backup your /persist once rooted (dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img) and save it somewhere on your cloud/computer, this might save you from a broken fingerprint sensor and an RMA in the future if it turns out this device has same issue as 8-series when it comes to crossflash regional builds of OOS.
Credits:
@topjohnwu for making Magisk
/u/Jisifus for testing on his device and for screenshots
Some_Random_Username said:
TIPS:
- Ensure you got latest platform tools installed from https://developer.android.com/studio/releases/platform-tools
- Backup your /persist once rooted (dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img) and save it somewhere on your cloud/computer, this might save you from a broken fingerprint sensor and an RMA in the future if it turns out this device has same issue as 8-series when it comes to crossflash regional builds of OOS.
Click to expand...
Click to collapse
Great to see it works this way and thanks for the tip.:good:
do u lose all data while rooting?
#edit1
nevermind, cannot read right
OK, will give this a try asap,have the device here now...
I gave it a try, works like a charm! Thanks for this! Small tip, unlock bootload before u copy your files
now my phone is a bit laggy. with magisk on it.. i will test it later if its getting better
Some_Random_Username said:
Type fastboot getvar current-slot into your terminal window and press Enter.
If the output is a , type fastboot flash boot_a magisk_patched.img into your terminal window and press Enter.
If the output is b , type fastboot flash boot_b magisk_patched.img into your terminal window and press Enter.
Click to expand...
Click to collapse
You can simply type "fastboot flash boot magisk_patched.img" - it flash boot to current active slot. Just for note.
Can confirm that it works, just tried it myself
If WiFi/data does not work (usually happens when you flash wrong version, but can also happen if you flash correct one), fastboot boot the image, then do a direct install in Magisk Manager.
Also, big thumbs up for adding tips for persist backup, I see too many people needing to send their device back because they messed it up somehow.
Failed for me
Hi and thanks for the tips.
Running 10.5.2 (latest build) and Bootloader is unlocked.
1: Downloaded EU BootImage File suggested (10.5.2.AC01BA.boot.img - 101MB)
2: Went to Magisk Manager, Advanced Settings, Recovery Mode Ticked, Install Magisk, Install, Select and Patch a File - Browse to 10.5.2.AC01BA.boot.img in Downloads and select.
3: Command Window appears detailing successful patching of ramdisk and also location of the newly created magisk_patched.img (37.52MB???????????????)
4: Size of new boot image looks suspiciously small.
5: Copied magisk_patched.img to PC and rebooted phone into fastboot.
6: Issued the fastboot getvar current-slot command - mine is reported as b
7: Issued the fastboot flash boot_b magisk_patched.img - File flashed OK - Reboot (Start) Phone.
8: 30 seconds of unlocked bootloader warning screen followed by 10 secs black screen followed by Qualcom Crash Dump. Rebooted phone three times - same result.
9: Rebooted phone into fastboot mode, reflashed the stock boot image and all now OK (but obviously not rooted).
Would be grateful if anyone could advise - the magisk_patched.img looks suspiciously small to me at 37.52MB compared to 101MB for the original boot image.
Thanks
10: Double checked the patching process again in Magisk and again, patched bootimage filesize is on 37.52MB.
11: I have saved log from patching process and on reading, all looks OK.
jmwengineering said:
Hi and thanks for the tips.
Running 10.5.2 (latest build) and Bootloader is unlocked.
1: Downloaded EU BootImage File suggested (10.5.2.AC01BA.boot.img - 101MB)
2: Went to Magisk Manager, Advanced Settings, Recovery Mode Ticked, Install Magisk, Install, Select and Patch a File - Browse to 10.5.2.AC01BA.boot.img in Downloads and select.
3: Command Window appears detailing successful patching of ramdisk and also location of the newly created magisk_patched.img (37.52MB???????????????)
4: Size of new boot image looks suspiciously small.
5: Copied magisk_patched.img to PC and rebooted phone into fastboot.
6: Issued the fastboot getvar current-slot command - mine is reported as b
7: Issued the fastboot flash boot_b magisk_patched.img - File flashed OK - Reboot (Start) Phone.
8: 30 seconds of unlocked bootloader warning screen followed by 10 secs black screen followed by Qualcom Crash Dump. Rebooted phone three times - same result.
9: Rebooted phone into fastboot mode, reflashed the stock boot image and all now OK (but obviously not rooted).
Would be grateful if anyone could advise - the magisk_patched.img looks suspiciously small to me at 37.52MB compared to 101MB for the original boot image.
Thanks
10: Double checked the patching process again in Magisk and again, patched bootimage filesize is on 37.52MB.
11: I have saved log from patching process and on reading, all looks OK.
Click to expand...
Click to collapse
The size is normal.
When patching your image you have to select "Preserve Force Encryption" and "Preserve AVB 2.0/dm-verity" under advanced settings in the main screen where you patch the image.
jmwengineering said:
Hi and thanks for the tips.
Running 10.5.2 (latest build) and Bootloader is unlocked.
1: Downloaded EU BootImage File suggested (10.5.2.AC01BA.boot.img - 101MB)
2: Went to Magisk Manager, Advanced Settings, Recovery Mode Ticked, Install Magisk, Install, Select and Patch a File - Browse to 10.5.2.AC01BA.boot.img in Downloads and select.
3: Command Window appears detailing successful patching of ramdisk and also location of the newly created magisk_patched.img (37.52MB???????????????)
4: Size of new boot image looks suspiciously small.
5: Copied magisk_patched.img to PC and rebooted phone into fastboot.
6: Issued the fastboot getvar current-slot command - mine is reported as b
7: Issued the fastboot flash boot_b magisk_patched.img - File flashed OK - Reboot (Start) Phone.
8: 30 seconds of unlocked bootloader warning screen followed by 10 secs black screen followed by Qualcom Crash Dump. Rebooted phone three times - same result.
9: Rebooted phone into fastboot mode, reflashed the stock boot image and all now OK (but obviously not rooted).
Would be grateful if anyone could advise - the magisk_patched.img looks suspiciously small to me at 37.52MB compared to 101MB for the original boot image.
Thanks
10: Double checked the patching process again in Magisk and again, patched bootimage filesize is on 37.52MB.
11: I have saved log from patching process and on reading, all looks OK.
Click to expand...
Click to collapse
And that's why it's recommended to boot the patched image first.
Thanks
Lossyx said:
The size is normal.
When patching your image you have to select "Preserve Force Encryption" and "Preserve AVB 2.0/dm-verity" under advanced settings in the main screen where you patch the image.
Click to expand...
Click to collapse
Thanks for confirming file size - Preserve Force Encryption and Preserve AVB 2.0/dm-verity were ticked during the patching process. Guess I'll have to wait until TWRP is verified as Nord compatible.
---------- Post added at 07:06 PM ---------- Previous post was at 06:59 PM ----------
Kollachi said:
And that's why it's recommended to boot the patched image first.
Click to expand...
Click to collapse
Thanks for the reply. Not sure what you mean by booting the patched image first. You have to create the patched image on the phone first before you can flash and then boot it. Step 7 in my post above details the flashing of the patched image and subsequent attempt to reboot Oxygen OS. I can't boot the patched image until I've created and flashed it!
jmwengineering said:
Thanks for the reply. Not sure what you mean by booting the patched image first. You have to create the patched image on the phone first before you can flash and then boot it. Step 7 in my post above details the flashing of the patched image and subsequent attempt to reboot Oxygen OS. I can't boot the patched image until I've created and flashed it!
Click to expand...
Click to collapse
Nah, instead of flash the patched boot image you can boot it only. Not sure why it's not working for you. But usually it should work.
Command: fastboot boot "patched boot image"
Edit: that's also what lossyx said. Boot image and than install it with magisk manager.
And if you boot the image and something went wrong you aren't bricked or anything. It's a safe way to test something.
Thanks for the advice - will boot the image file on my PC rather than flashing first.
Sent from my AC2003 using Tapatalk
Does unlocking the bootloader break widewine L1 on this device like it did with 7/7T/7P/7TP/8/8P
..
CryllicBuster273 said:
Does unlocking the bootloader break widewine L1 on this device like it did with 7/7T/7P/7TP/8/8P
Click to expand...
Click to collapse
Yeah I guess when you unlock your phone it will break L1 as always.
---------- Post added at 12:17 PM ---------- Previous post was at 12:15 PM ----------
DIR49DNOR0N said:
I will try this unless twrp is cooked on release. Where did you get the OTA zips from actually?
I want to, extract boot.img, save it, patch boot.img, boot it, use some apps that require root and remove some packages, uninstall magisk, power down, use normal image, relock bootloader. Does this work how i expect it to work ?
Click to expand...
Click to collapse
https://forum.xda-developers.com/oneplus-nord/how-to/oneplus-nord-repo-oxygen-os-builds-t4138085
DIR49DNOR0N said:
I will try this unless twrp is cooked on release. Where did you get the OTA zips from actually?
I want to, extract boot.img, save it, patch boot.img, boot it, use some apps that require root and remove some packages, uninstall magisk, power down, use normal image, relock bootloader. Does this work how i expect it to work ?
Click to expand...
Click to collapse
No, keep the bootloader unlocked if your phone is modified, else it can cause some issues.
Btw when you lock/unlock the bootloader, data will be wiped. apps will be reinstated again so that's useless
The guide worked perfectly and I'm up and running with Root!
One thing I have noticed is that the Google Play store is no longer Play Protect Certified.
I've tried registering my device with Google using this XDA guide but I haven't found any change to the Play Store certification.
I should probably wait for a while to see if the registration takes some time. I also couldn't use the adb commands that Google recommends and I had to use the Device ID app to get the Google Service Framework (GSF).
I've read in a few places that it may be because the Bootloader is unlocked and I'm wondering if I should re-lock it now that I have root. Not sure how/if that will affect my ability to keep root when future updates come out though.
Anyone have any thoughts/experience with this?
Possible TWRP without waiting?
Can anyone use this and try? Might be used as an alternate Method for Rooting via TWRP
https://forum.xda-developers.com/an...g/guide-how-to-port-twrp-to-qualcomm-t3420013
Related
Hi. I've been rooted with Magisk ever since I got this phone but now I got tired of having to wipe everything, every time I tried to take OTA.
I've tried unroot and flash stock boot.img, but that wasn't enough to take OTA. I've tried factory reset from within settings and not even that worked.
OTA still failed at step 3.
So this is what I finally did, and it worked.
DISCLAIMER
I AM NOT RESPONSIBLE FOR ANY LOSS OF DATA. IT SHOULD WORK FINE, BUT
IF YOU HAVE INVALUABLE PICS OF YOUR KITTEN, PLEASE MAKE A BACKUP TO BE SAFE
Uninstall any substratum overlays you have installed and unroot from within Magisk Manager.
Reboot your phone.
Unpack your current firmware in the same location where you have adb/fastboot and unzip the "XT-1941-flash_No-wipe.bat" to same directory.
Boot your phone to fastboot mode, plug the cable in, open cmd and drag the "XT-1941-flash_No-wipe.bat" in to the cmd window.
It will automaticly flash all files in the firmware, without wipe. Just wait for it to finish.
Reboot and take the OTA.
After that I booted TWRP and made a backup of boot.
Booted to system, installed Magisk Manager, renamed the backup to boot.img and patched it with Magisk Manager, then flashed it in TWRP. (fastboot works too)
Now I'm updated to PPKS29.68-16-21-3 without having to go through the painfull process of backing up and restoring all data.
Been waiting for something like this. Thanks.
Tested on XT1941-4 DEEN RETEU PPKS29.68-16-21-2, update to PPKS29.68-16-21-3
Used script and update gone past step 3 and rebooted successfully.
Thanks for your guide. Just two questions
1. What's the right fastboot command?
fastboot flash boot_a patched_boot.img
or
fastboot flash boot_b patched_boot.img
2. There is an extra file named "system.img_sparsechunk.9" in the stock firmware PPKS29.68-16-21-2, but there is no command for flashing this file in your .bat file. Is this not important?
vrezaei said:
Thanks for your guide. Just two questions
1. What's the right fastboot command?
fastboot flash boot_a patched_boot.img
or
fastboot flash boot_b patched_boot.img
2. There is an extra file named "system.img_sparsechunk.9" in the stock firmware PPKS29.68-16-21-2, but there is no command for flashing this file in your .bat file. Is this not important?
Click to expand...
Click to collapse
Hmm that's strange. I just had a look at the PPKS29.68-16-21-2 but I don't have any.
View attachment 4782745
For the boot you can just use fastboot flash boot patched_boot.img
It will flash the active slot if you don't specify.
tys0n said:
Hmm that's strange. I just had a look at the PPKS29.68-16-21-2 but I don't have any.
View attachment 4782745
For the boot you can just use fastboot flash boot patched_boot.img
It will flash the active slot if you don't specify.
Click to expand...
Click to collapse
Sorry about my mistake
My current and planing to update build numbers are PPKS29.68-16-36-2 & 3, respectively and the first one (my current stock firmware) contains system.img_sparsechunk.9 file. So, I think I must edit your .bat file and add the appropriate command for flashing this file.
vrezaei said:
Sorry about my mistake
My current and planing to update build numbers are PPKS29.68-16-36-2 & 3, respectively and the first one (my current stock firmware) contains system.img_sparsechunk.9 file. So, I think I must edit your .bat file and add the appropriate command for flashing this file.
Click to expand...
Click to collapse
Oh ok. I'll take another look when I get home, but yeah, you'll have to add the additional file if there is any.
Sent from motorola one.
If I understand correctly, after that step:
tys0n said:
Reboot and take the OTA.
Click to expand...
Click to collapse
Do I just need reinstall Magisk?
damiann69 said:
If I understand correctly, after that step:
Do I just need reinstall Magisk?
Click to expand...
Click to collapse
Ya
tys0n said:
Hi. I've been rooted with Magisk ever since I got this phone but now I got tired of having to wipe everything, every time I tried to take OTA.
I've tried unroot and flash stock boot.img, but that wasn't enough to take OTA. I've tried factory reset from within settings and not even that worked.
OTA still failed at step 3.
So this is what I finally did, and it worked.
DISCLAIMER
I AM NOT RESPONSIBLE FOR ANY LOSS OF DATA. IT SHOULD WORK FINE, BUT
IF YOU HAVE INVALUABLE PICS OF YOUR KITTEN, PLEASE MAKE A BACKUP TO BE SAFE
Uninstall any substratum overlays you have installed and unroot from within Magisk Manager.
Reboot your phone.
Unpack your current firmware in the same location where you have adb/fastboot and unzip the "XT-1941-flash_No-wipe.bat" to same directory.
Boot your phone to fastboot mode, plug the cable in, open cmd and drag the "XT-1941-flash_No-wipe.bat" in to the cmd window.
It will automaticly flash all files in the firmware, without wipe. Just wait for it to finish.
Reboot and take the OTA.
After that I booted TWRP and made a backup of boot.
Booted to system, installed Magisk Manager, renamed the backup to boot.img and patched it with Magisk Manager, then flashed it in TWRP. (fastboot works too)
Now I'm updated to PPKS29.68-16-21-3 without having to go through the painfull process of backing up and restoring all data.
Click to expand...
Click to collapse
I am new to this, could you please give us step by step process or a video will help, Thanks for the efforts
Thanks tys0n for sharing this! I've updated a few times using this way.
But from time to time Motorola is changing files or commands and I had allways to check, if the commands in the bat file match those of the servicefile.xml and to adapt it accordingly.
First I thought about to write a small 'servicefile2bat' converter tool - but since almost everything already exists, I did a search and found this one:
https://sourceforge.net/projects/flashfile2batchfile/
I've tested it with today's update to DEEN_QPKS30.54_22_7 and it works perfectly.
There's a ton of information out there, but finding it can sometimes be a challenge, especially for a newbie. And then there's posts to read through, in case a process has changed and it's only talked about in a single place, buried any number of pages back. So this is my attempt to put all Pixel 3 how-to's into a single thread. Everything below is what worked for me, from start to finish, with a fresh phone directly from Google that was bootloader-locked, unrooted, and running stock Android. Comments are welcome and encouraged: if something doesn't work for you, or you have a better/quicker/more reliable way of doing something, or maybe I made a mistake...let me know!
A few things:
Everything in this guide was tested on a "regular" Pixel 3 (blueline). It should all work exactly the same on a Pixel 3 XL (crosshatch), as long as you download the appropriate files (specifically the factory/OTA images and TWRP). I'm posting this in both blueline and crosshatch forums.
This first post will have links to files and the tools you need, as well as general things (like how to enable debugging and boot into recovery). The second post has how-to's for the big stuff (flashing images, TWRP, unlocking, etc).
I'm not responsible for anything you do. Follow these guides at your own risk. Doing so may also void your warranty.
Files and URLs
Official Android files
Factory (wipes device and requires unlocked bootloader): https://developers.google.com/android/images
Full OTA (leaves data intact, can be done via ADB sideload): https://developers.google.com/android/ota
Preview/beta OTA: https://developer.android.com/preview/download-ota.html
TWRP
XDA thread: https://forum.xda-developers.com/pixel-3/development/twrp-3-2-3-0-pixel-3-t3861622
Download: https://dl.twrp.me/blueline/
Magisk
XDA thread: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
GitHub: https://github.com/topjohnwu/Magisk/releases
ADB and Fastboot
Google USB drivers: https://developer.android.com/studio/run/win-usb
SDK platform tools: https://developer.android.com/studio/releases/platform-tools
Download the ZIP and open (no need to extract the whole thing)
Copy the files below to their own directory (you will use this directory for all ADB/Fastboot commands):
adb.exe
AdbWinApi.dll
AdbWinUsbApi.dll
fastboot.exe
General
Enable USB debugging
Download Google USB drivers (see above)
Download SDK platform tools and copy required files to their own directory (see above)
Enable USB debugging (Settings > About > tap Build 7 times > back > Developer options)
Plug phone into computer and when "Allow USB debugging" box comes up, check the box and allow (may need to have adb daemon running on the computer already, see below)
Fastboot mode (using hardware keys) aka bootloader
Power off
Hold VOL- and press/hold PWR until bootloader (fastboot) comes up
Recovery mode (using hardware keys)
Get into Fastboot mode (see above)
Use VOL buttons to find Recovery in the list, use PWR to select (should boot to broken android image)
Hold PWR and press VOL+ once to get into recovery
Useful ADB and Fastboot commands
Enable USB debugging (see above)
ADB (used while phone is "on" and booted up):
Use "adb devices" to ensure the computer is authorized
Use "adb reboot bootloader" to get into Fastboot
Fastboot mode
Use "fastboot devices" to verify computer can see your phone
Update #1: Items below marked through were removed since they don't really apply to Android 10.
Update #2: Edited to reflect changes in root with Android 11.
A quick note: everything below is assuming you're using Windows 10. When it says "Type...", this assumes you've opened a command window in the location of adb/fastboot and that all files referenced are in the same directory and (in some cases) renamed as I reference them (short names without spaces simplifies things). If you're using Powershell, you will probably need to change "adb" and "fastboot" to read ".\adb" and ".\fastboot" so Powershell will use the local files.
Unlocking the bootloader
THIS WILL WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
In Developer Options, enable OEM unlocking and confirm (it may ask you to input fingerprint or PIN/pattern/password)
Boot into Fastboot mode (see above)
Type to unlock:
Code:
fastboot flashing unlock
Use VOL+ key to get the options on the screen to read "Unlock the bootloader" and use PWR button to select
Type to reboot:
Code:
fastboot reboot
Locking the bootloader
THIS WILL WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
Boot into Fastboot mode (see above)
IMPORTANT: restore stock recovery if you replaced it with TWRP (this should prevent the "Can't find valid operating system" issue)
Type to lock:
Code:
fastboot flashing lock
Use VOL buttons to find "Lock the bootloader" and use PWR to select
Type to reboot:
Code:
fastboot reboot
Factory reset via fastboot (can also do this without wiping data)
THIS COULD WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
Download factory image ZIP and unzip all files into their own folder
Unlock bootloader (see above)
Reboot into Fastboot mode
You have 2 options:
Register the location of fastboot.exe with the PATH system variable and run "flash-all.bat"
Wipe data: just run "flash-all.bat" and call it a day
Do not wipe data: open "flash-all.bat" in a text editor (careful not to double-click and run it!), remove the "-w" from the last line to disable the wiping of data, then save, close, and run
Move the 3 files (bootloader IMG, radio IMG, image ZIP) into the ADB folder, rename for simplicity if you want, launch cmd or Powershell, and run the commands below (which come from "flash-all.bat")
Wipe data: type out commands below, but at last line, add "-w" flag: fastboot -w update image.zip
Do not wipe data: type out commands below as written (no "-w" flag)
The commands:
Code:
fastboot flash bootloader bootloader-blueline-XXXX.img
fastboot reboot bootloader
[wait for reboot]
fastboot flash radio radio-blueline-XXXX.img
fastboot reboot bootloader
[wait for reboot]
fastboot update image-blueline-XXXX.zip
Note: The last command (update image) will launch the red "fastbootd" screen, so don't worry and be patient while the command line tells you what's happening. The phone will reboot on its own into the Android system (not fastboot) afterward.
Root Android 10+ using Magisk (Canary channel)
This must be done after every update, and you cannot use the patched file from a different phone!
Unlock bootloader (see above)
Download factory image (not OTA, see link above)
Download and install Magisk Manager Canary (see link above)
In Magisk Manager settings, set Update Channel to "Canary"
Extract boot.img from image-blueline-XXXX.zip found in the factory image you downloaded
Place boot.img on your phone's internal storage
Open Magisk Manager and do:
tap "Install" button (next to "Magisk" in first block on the main screen)
"Select and Patch a File" option
Find boot.img file you just placed on your phone
tap "Let's Go"
When finished, move the newly-created magisk_patched.img file over to your computer's ADB directory
Reboot into bootloader
Type:
Code:
fastboot flash boot magisk_patched.img
fastboot reboot
Open up Magisk Manager and make sure everything's good!
Note : if you get stuck in fastboot mode or in a boot loop, flash the stock boot.img to both slots and try again
Code:
fastboot flash boot boot.img --slot all
Optional:
for adblocking, tap "Systemless hosts" in Magisk Manager, then install AdAway using F-Droid
install a performance kernel like Kirisakura for Bluecross (R)
Updating Android 10+ while rooted
You can't take an OTA while rooted, so updating Android 10+ (as in monthly updates) can be one of two ways.
Method #1 (faster, but more chance for issues)
Download OTA ZIP and move it to ADB folder (don't unzip it)
This does not require an unlocked bootloader, but does require USB debugging (see above)
Get boot.img from the factory image (see first post on where to download this) and place your ADB directory
Reboot into bootloader / fastboot and type to restore stock boot to both slots:
Code:
fastboot flash boot --slot all boot.img
fastboot reboot bootloader
[wait for reboot]
Use VOL buttons to select "Apply update from ADB"
Type (where filename is the name of the file you want to sideload):
Code:
adb sideload filename.zip
Wait for it to finish, will take you back to Recovery when it's done
Reboot using menu
Method #2 (takes longer, but best bet for minimal issues)
Follow "Factory reset via fastboot" instructions (see above, make sure you don't wipe your data!)
Take the OTA in the official way (through Android)
Follow "Root Android 10+ using Magisk Canary" instructions (see above)
Boot into TWRP (3.3.0-0 or higher)
Download TWRP IMG and place in ADB folder (rename the file to twrp.img)
If not already done, unlock the bootloader (see above)
Reboot into bootloader
Type to boot TWRP (it will restart and should boot into TWRP):
Code:
fastboot boot twrp.img
OPTIONAL: Replace recovery by installing TWRP
Your phone should automatically mount, so move twrp.img from PC to Download folder on phone's internal storage
Advanced > Install Recovery Ramdisk > choose TWRP IMG > Swipe to install
Back > Fix Recovery Bootloop > Reboot System > Do Not Install when asked if TWRP should install app
Root using Magisk (18.1 or higher)
Download Magisk ZIP and move to device
Boot into TWRP (see above)
Enter your PIN/pattern/password to decrypt (unnecessary if you are not using security on your phone)
Swipe to Allow Modifications (to system)
Install > find and select the Magisk ZIP > Slide to install
Wipe cache > Reboot system > Do Not Install when asked if TWRP should install app
Open Magisk Manager to verify latest and to install modules
"Can't find valid operating system" booting issue
Unlock your bootloader again (see above)
Follow steps for "Factory reset via fastboot" (see above) and keep the wipe flag
After it reboots, power off (press PWR and select "Power off" from menu)
Follow steps for "Locking the bootloader" (see above)
After it reboots into Fastboot mode, have it start using the PWR button
Android Recovery / "Cannot load Android system" booting issue
This can happen for a number of reasons, but the fix is the same: "Factory reset via fastboot" (see above). You probably do not need to wipe user data, so you can omit the "-w" flag.
If you still get the error message, select the "Try again" option. If it still doesn't work, try "Factory reset via fastboot" again, as well as "Try again". If it doesn't work this time, you probably have no choice but to do a factory reset (in which you will definitely lose your data).
If it happens after flashing Magisk in TWRP, though, you've got a slightly different issue and the problem will persist no matter how many times you flash the factory images and re-install Magisk. This is probably due to something leftover in the previous Magisk installation that conflicts with the new installation. There are two ways to handle this.
First and easiest: uninstall Magisk Manager app before rebooting into the bootloader and running fastboot commands. Then proceed as usual (sideload OTA or flash factory images via fastboot, boot TWRP, and flash Magisk). All guides for this are above. This method preserves any modules you have installed.
Second and more complete (if the above method still gives you trouble):
download to your phone the Magisk ZIP, Magisk Uninstaller ZIP, and Magisk APK from this XDA thread
uninstall the Magisk Manager app
reboot to bootloader
using fastboot, boot into TWRP using IMG (you don't need to replace boot with TWRP)
flash Magisk Uninstaller ZIP
wipe Dalvik
flash Magisk ZIP
wipe Dalvik
reboot system (do not install TWRP)
install Magisk Manager APK and re-install any modules
Number 3 in "Applying OTA via ADB sideload" should be flash stock boot.img I think.
wangdaning said:
Number 3 in "Applying OTA via ADB sideload" should be flash stock boot.img I think.
Click to expand...
Click to collapse
I wrote it like that because the file isn't actually called "boot.img", but rather "bootloader-blueline-blahblahblah.img" where "blahblahblah" is the release. Since it changes, I figured just calling it the "bootloader IMG" would make more sense.
rczrider said:
I wrote it like that because the file isn't actually called "boot.img", but rather "bootloader-blueline-blahblahblah.img" where "blahblahblah" is the release. Since it changes, I figured just calling it the "bootloader IMG" would make more sense.
Click to expand...
Click to collapse
Was my misunderstanding. I thought you were implying people should go back to stock recovery to flash ota. You are talking about flashing ota in twrp. You might clear that up a little bit in that section.
Great post.
Unfortunately, if you are writing a process, then writing everything out is a requirement. Especially with item numbers or using an outline format. Not everyone understands shortcuts taken or abbreviated words, unless they are spelled out in the beginning. IMO, wrote and read too many processes. Including software requirement documentation.
Hi,
thanks for the thread :good:
wangdaning said:
Number 3 in "Applying OTA via ADB sideload" should be flash stock boot.img I think.
Click to expand...
Click to collapse
Yes, I think so too.
rczrider said:
I wrote it like that because the file isn't actually called "boot.img", but rather "bootloader-blueline-blahblahblah.img" where "blahblahblah" is the release. Since it changes, I figured just calling it the "bootloader IMG" would make more sense.
Click to expand...
Click to collapse
The boot.img is into "image.zip"
Then I suggest to flash into a and b (or both)
Code:
fastboot flash boot_a boot.img
fastboot flash boot_b boot.img
or
fastboot flash boot --slot all boot.img
Edit
be careful here: Factory reset via ADB sideload (can also do this without wiping data)
bootloader is bootloader, boot is boot, bootloader.img isn't boot.img
so, maybe better to write:
fastboot flash bootloader nameofbootloader.img or if simply renamed fastboot flash bootloader bootloader.img
deleted, bug.
trouble flashing files
When I try to flash twrp.img or boot.img this is what I get back " FAILED (Write to device failed in Send Buffer() (Too many links)) fastboot: error: Command failed.
Any thoughts?
fyrmd said:
When I try to flash twrp.img or boot.img this is what I get back " FAILED (Write to device failed in Send Buffer() (Too many links)) fastboot: error: Command failed.
Any thoughts?
Click to expand...
Click to collapse
Please read the instructions carefully. You cannot flash twrp directly. "fastboot boot twrp.img" then when twrp boots you can use it or make it permanent by flashing the install zip or the internal twrp option. I go with the install zip as it seems more stable to me (placebo I suppose).
wangdaning said:
Please read the instructions carefully. You cannot flash twrp directly. "fastboot boot twrp.img" then when twrp boots you can use it or make it permanent by flashing the install zip or the internal twrp option. I go with the install zip as it seems more stable to me (placebo I suppose).
Click to expand...
Click to collapse
Thanks, but still no luck.
fyrmd said:
When I try to flash twrp.img or boot.img this is what I get back " FAILED (Write to device failed in Send Buffer() (Too many links)) fastboot: error: Command failed.
Any thoughts?
Click to expand...
Click to collapse
Turns out it was the cable, it is an expensive one from Amazon so not sure what I should be purchasing for next time.
fyrmd said:
Turns out it was the cable, it is an expensive one from Amazon so not sure what I should be purchasing for next time.
Click to expand...
Click to collapse
I always buy Anker cables and chargers. All have been good so far.
Now,my pixel 3 can not work,the bootload is locked.when I select recovery by fastboot,The phone noticed me can not find vaild operating system,the device will not start.
xiaowei666 said:
Now,my pixel 3 can not work,the bootload is locked.when I select recovery by fastboot,The phone noticed me can not find vaild operating system,the device will not start.
Click to expand...
Click to collapse
Are you able to get into recovery? If so, download the full ota to your pc and side load it with adb.
xiaowei666 said:
Now,my pixel 3 can not work,the bootload is locked.when I select recovery by fastboot,The phone noticed me can not find vaild operating system,the device will not start.
Click to expand...
Click to collapse
i same issue
rczrider said:
[*]Copy the files below to their own directory (you will use this directory for all ADB/Fastboot commands):
adb.exe
AdbWinApi.dll
AdbWinUsbApi.dll
fastboot.exe
Click to expand...
Click to collapse
why not copy all files?
---------- Post added at 11:58 AM ---------- Previous post was at 11:55 AM ----------
fyrmd said:
Thanks, but still no luck.
Click to expand...
Click to collapse
boot to the twrp.img and flash the twrp.zip, unless you are on android 10 you should have no problem unless you are doing it wrong. not exactly hard to do.
How to enable oem unlock in this case?
pedro5148 said:
How to enable oem unlock in this case?
Click to expand...
Click to collapse
There are a few suggestions at https://www.theandroidsoul.com/how-to-fix-oem-unlock-greyed-out-or-oem-unlock-disabled-problem/
However, if the network carrier has locked the bootloader, you cannot unlock it. In the U.S., Verizon and AT&T phones generally cannot be unlocked due to locked bootloaders.
Dear Community,
I'm trying to root my Ulefone Armor X7 Pro using Magisk and so far I've experienced several issues, starting with unlocking the bootloader.
I hope you can help me somehow.
Here's what I've done and seen so far:
- OEM Unlock enabled and USB Debugging enabled
- Using ADB from latest Google SDK to reboot in FASTBOOT mode
- Now 'fastboot oem unlock' returns FAILED (remote: 'unknown command'). I've tried to wipe cache partition, it doesn't help, I've tried a few workarounds found on this forum with no luck so far...
- I've read that sometimes this command doesn't work so I used 'fastboot flashing unlock' instead --> that one worked
With this done, and stock boot.img, the phone will display an Orange State warning saying that the device can't be trusted. However it will boot anyway (with the stock boot.img).
Also, the OEM Unlock option will be greyed out in developer options after performing this command.
- However, after flashing the boot image that Magisk Manager generated (from the stock boot.img from Ulefone website), the phone goes into a boot loop with a Red State saying that the boot signature is wrong and verified boot should be disabled. (However I don't know how to do this.)
So I flashed back the stock boot.img and could reboot my phone again (at least it is not bricked -- but that was scary).
Now, here are my questions and thoughts:
- Is it normal that 'fastboot oem unlock' won't work? Is it fine to use 'fastboot flashing unlock' instead?
- The boot image generated by Magisk is only 10 MB while the stock one is 32 MB. I've read the thread of issue #2005 Pad Images to Original Size With Zeros on Github and I thought maybe that's why the phone won't boot with the Magisk image. But I don't know exactly what I should do about it. (I'm on Windows.)
- Finally, if the solution is to disable verified boot, how should it be done? Is there anything to do with the 'Preserve AVB 2.0/dm-verity' option in Magisk Manager?
I hope you'll be able to help me and I wish you all the best anyway.
Thank you.
same deal
- It's never been an issue for me if 'fastboot oem unlock' doesn't work. In fact, in my experience (which isn't really that much), it never works. I've always had to use 'fastboot flashing unlock'
- I tried padding the image with zeroes using
Code:
dd if=/dev/zero of=magisk_patched.img bs=1 count=1 seek=33554431
(on a linux box), but it produces the same bootloop. I've tried this same thing with recovery, no such luck.
- I tried flashing via SP Flash Tools, as well. Both the padded and non-padded magisk_patched.img; neither worked. I updated checksum.ini so that flash tools would accept the scatter file. I've tried formatting the section, as well as the 'write memory' tab. SPFT flashes it just fine, but the bootloop continues.
- I even tried patching and flashing boot-debug.img (because why the hell not?) and again, the loop goes on and on.
- I opened up the preloader....bin file in hex editor and removed all instances of 'verify' and flashed via SPFT. Do not do this. The phone will no longer turn on or anything. Luckily, SPFT flashes before anything else in the phone does anything, so it was recovable.
- I tried sideloading my rom as an 'update' but oddly enough adb won't recognize the phone in sideload.
I haven't tried reflashing the whole phone with magisk_patched.img as my boot. I may attempt this. I'll get back to you if I have any luck.
I plan on using mine as a media device (music, video, camera, etc) that I can bring with me on excursions, because I'm terrified to bring my pixel 4xl.. As such, I don't have a SIM card in mine. I have no idea if this would make any difference, but I'm not receiving the 'red state' status saying that verified boot is the issue. I have tried it with unchecking dm-verify, but maybe this hasn't worked. I'm thinking that it may have something to do with vbmeta*.img files. Like I said, I'll let you know if I have any luck
lunalsmojo said:
Like I said, I'll let you know if I have any luck
Click to expand...
Click to collapse
I'll do the same. Thank you for your feedback!
0
success!
vbmeta.img was the issue! I have successfully rooted via magisk!
What you need to do is first flash an empty vbmeta.img file. You can download one by doing a Google search for "mtk empty vbmeta.img"
Just ignore the stuff for TWRP (unless you want to go that route too). Down toward the bottom of the tutorial, there is a link to download an empty vbmeta.img. Move the image into your adb/fastboot folder (or whichever directory you are working from) Then,
Code:
adb reboot bootloader
fastboot flash vbmeta vbeta.img
fastboot flash boot magisk_patched.img
fastboot reboot
I used the tutorial from hovatek.... I'm too much of a newb to post outside links
replace "magisk_patched.img" if you changed the name. I did mine with my padded magisk_patched.img. Let me know if you have issues with yours not being padded
THANK YOU!
lunalsmojo said:
vbmeta.img was the issue! I have successfully rooted via magisk!
What you need to do is first flash an empty vbmeta.img file. You can download one by doing a Google search for "mtk empty vbmeta.img"
Just ignore the stuff for TWRP (unless you want to go that route too). Down toward the bottom of the tutorial, there is a link to download an empty vbmeta.img. Move the image into your adb/fastboot folder (or whichever directory you are working from) Then,
Code:
adb reboot bootloader
fastboot flash vbmeta vbeta.img
fastboot flash boot magisk_patched.img
fastboot reboot
I used the tutorial from hovatek.... I'm too much of a newb to post outside links
replace "magisk_patched.img" if you changed the name. I did mine with my padded magisk_patched.img. Let me know if you have issues with yours not being padded
Click to expand...
Click to collapse
Yes, that worked for me as well!
So, first I tried to uncheck 'Preserve AVB 2.0/dm-verity' before patching the boot.img in Magisk but this didn't work (same bootloop).
Then I patched the boot.img in Magisk with the 'Preserve AVB 2.0/dm-verity' checked, and edited the file in HxD but found no trace of '2C 76 65 72 69 66 79' or 'verify'.
Finally I resigned myself to flash the empty vbmeta.img found on Hovatek's website (blog post 'DM_Verity is probably why that TWRP flash ends in a bootloop') and flashed the non-padded boot image produced by Magisk.
And this last option worked! So THANK YOU so much for your help!
Thank you sooo much! I finally got my brand new x7 pro rooted!
Have to ask
What os is does this refer to, I take it it's android 9?
What size is your bootloader/recovery in stock folder?
What mtk version?
lecrocq said:
... Thank you.
Click to expand...
Click to collapse
Hi May I ask if after rooting did you install a custom ROM?
Does the stock android that you get contains any personalization, like MUI or similar?
phaleg said:
Hi May I ask if after rooting did you install a custom ROM?
Does the stock android that you get contains any personalization, like MUI or similar?
Click to expand...
Click to collapse
I didn't install a custom rom, but I did eventually flash the Vanilla Bless GSI by @eremitein. Magisk still worked with patched boot, runs super smooth, and offers a ton of great customizations.
The stock rom is lackluster; it's the phone itself that has a ton of cool features like the underwater camera. I haven't really checked if all of those features are still usable with the GSI. To be honest, haven't really thought of it. Haven't gotten much of my intended use out of it during coroneumonia times. Sounds like a fun investigation, though. If it doesn't work straight out, I'm sure it can be made to work with a little tinkering.
@Pachacouti sorry for response forever later.... It's Android 10 with a MT6761 (Helio A22)
Hello boys. Thanks for how to root. I have rooted, but i had to reinstall system complete. Now i have root and new system and i have sms issue. Sometimes sms is coming, sometimes no..
Hello,
I'm trying to unlock my bootloader for my new Armor 7X but i'm struggling with the fastboot command.
First, there is two "fastboot" mode with this phone :
- the first when you do an : adb reboot bootloader. There is "=> FASTBOOT mode" in the screen. In this mode I can't detect my phone with "fastboot devices" command...
- the second mode is when you power on the phone with the volume "-"and you select "enter fastboot" in the menu. In this mode the phone is detected by "fastboot devices" ! But, the command "fastboot flashing unlock" always fails.
The error :
"FAILED (remote: 'Unrecognized command flashing unlock')
fastboot: error: Command failed
I've tried severals adb/fastboot tools without any succes. I think it's a driver issue but I'm not sure.
If someone have an idea, I will be greatful !
https://www.getdroidtips.com/unlock-bootloader-ulefone-armor-x6/ but i dont make this command fastboot flashing unlock. On phone you must chose unlock and confirm.
Probleme Solved, Use the NON-EU ROM !
I've find the problem ! It was the EU version of the ROM that blocked fastboot, so use the NON-EU version for that.
I've have succesfully rooted my phone, thank you for this thread !
I don't know exactly what are the differences between the two versions but everything seems to work normally.
Очень интересная тема. Наконец-то дошли руки до рутизации. Чрезвычайно долго описывать свой петь не буду, но скажу одно- знаю способ получения root до перезагрузки. Оранжевое предупреждение навсегда. Я допереведу ваш способ и попроьую сделать так-же. Спасибо!
Thanks for this guide
I got root now, has anyone got TWRP installed? Or another custom recovery
Does anyone have a problem receiving SMS?
Hi all, I've got a question.
I am trying to flash the boot.img but when I download the rom files from the ulefone website for the note 8, it does not include a boot.img. I can only see boot-debug.img and boot-sign.img . Which one should I select?
CupidAlaska said:
Hi all, I've got a question.
I am trying to flash the boot.img but when I download the rom files from the ulefone website for the note 8, it does not include a boot.img. I can only see boot-debug.img and boot-sign.img . Which one should I select?
Click to expand...
Click to collapse
This is not about Note 8.
lecrocq said:
THANK YOU!
Yes, that worked for me as well!
So, first I tried to uncheck 'Preserve AVB 2.0/dm-verity' before patching the boot.img in Magisk but this didn't work (same bootloop).
Then I patched the boot.img in Magisk with the 'Preserve AVB 2.0/dm-verity' checked, and edited the file in HxD but found no trace of '2C 76 65 72 69 66 79' or 'verify'.
Finally I resigned myself to flash the empty vbmeta.img found on Hovatek's website (blog post 'DM_Verity is probably why that TWRP flash ends in a bootloop') and flashed the non-padded boot image produced by Magisk.
And this last option worked! So THANK YOU so much for your help!
Click to expand...
Click to collapse
I would also like to confirm
lunalsmojo said:
success!
vbmeta.img was the issue! I have successfully rooted via magisk!
What you need to do is first flash an empty vbmeta.img file. You can download one by doing a Google search for "mtk empty vbmeta.img"
Just ignore the stuff for TWRP (unless you want to go that route too). Down toward the bottom of the tutorial, there is a link to download an empty vbmeta.img. Move the image into your adb/fastboot folder (or whichever directory you are working from) Then,
Code:
adb reboot bootloader
fastboot flash vbmeta vbeta.img
fastboot flash boot magisk_patched.img
fastboot reboot
I used the tutorial from hovatek.... I'm too much of a newb to post outside links
replace "magisk_patched.img" if you changed the name. I did mine with my padded magisk_patched.img. Let me know if you have issues with yours not being padded
Click to expand...
Click to collapse
I would also like to confirm that this approached worked for me without issue. Some tips that may prove useful for someone, ensure that you have the correct drivers, adb, fastboot, vcom, and cdc. I had issues using fastboot because I did not have the correct drivers, a day was wasted on this.
I also used the tutorial from hovatek, his blog post is where you will find the vbeta.img, I could not correctly flash my patched magisk without first patching the vbeta.img.
Thanks again.
Attached is the stock boot image pulled via payload dumper for the OnePlus Nord N200 5G. It is from the full OTA zip - Official Build 11.0.2.0.DE17AA dated September 2nd 2021.
It seems quite a few folks are trying to get ahold of this. *Download link at the bottom*
I AM NOT A DEVELOPER!! I am just posting this for those who need the image file.
The guide to install this is pretty simple. If you have previously rooted the device then you most likely have installed the partially functional version of TWRP for the device. If you have, then you can use the same method for installing TWRP to install the factory boot image. Keep in mind that if you have installed Magisk to the device then you may encounter problems. The following pre-requisites should be followed prior to flashing.
1.) Do a complete uninstall of Magisk if you wish to no longer retain root. There are no guarantees this will work if you keep Magisk on the device. Since Magisk changes the system binaries, stock recovery may not work properly.
2.) Make sure the bootloader remains UNLOCKED! Attempting to lock the bootloader WILL cause an error message that the "Device is corrupt and will NOT BOOT"
3.) Make sure you have enabled USB debugging and your PC can recognize the device. You can do this by booting up the device normally and use the command prompt
adb devices
If the device is recognized it will return with your device ID and "device". If you see anything other than the ID and device (such as unauthorized) then please check to make sure you have enabled USB debugging, the device is plugged to the PC and the path to your platform tools of ADB and Fastboot tools is proper in your command prompt sequence
HOW TO INSTALL:
1.) With the device on and plugged in, open a command prompt in the path that your ADB and Fastboot platform tools are located and type:
adb devices
If properly read, ADB should return with the device ID and "device" as stated above.
2.) Now execute the ADB command:
adb reboot bootloader
Wait a few seconds. The device should now boot into Fastboot Mode.
3.) Now execute the fastboot command:
fastboot devices
The device should now read like earlier with the device ID and "fastboot". If true, fastboot commands will be accepted. Also please double check the device state on the phone screen. Make sure the device is UNLOCKED. If so, stop reading this step and go to step 4. If it is not unlocked DO NOT proceed and reboot the device using the volume keys when the word "START" is in green letters at the top and pressing the power key. DO NOT proceed any further. If your device is functioning in a locked state then stop reading this guide and go back to playing minecraft or flappy bird or whatever it is you do with your phone.
4.) VERY IMPORTANT!! Execute the following fastboot command:
fastboot getvar current-slot
The device will give a letter, either a or b. PLEASE remember the letter as the next step will require that letter after the underscore in the next fastboot command. If slot a, type a; if slot b, type b after typing the underscore.
5.) Make sure this boot image file is located in the same folder as your adb and fastboot for your platform tools and execute the fastboot command:
fastboot flash boot_a boot.img (this is for those who are on slot a from step 4) OR
fastboot flash boot_b boot.img (this is for those who are on slot b from step 4)
6.) You are welcome to flash to both slots if you like as no harm will come from doing this, but only the current slot is necessary for it to work. You can also flash it as many times as you like but that's just dirty flashing over TWRP over and over. Finally wipe the cache and reboot by typing the following fastboot commands:
fastboot -w (this wipes the cache - not necessary but helpful)
fastboot reboot
7.) Enjoy stock recovery. You can also use the volume keys to navigate to "Start" and reboot the device or even try "Recovery Mode" to ensure it worked. I would highly suggest that you boot into recovery and factory reset the device, wiping everything.
*This has been tested and works on the UNLOCKED US variant (Basically, if you can update via the OnePlus website and the build number is DE17AA you're good to go.) DO NOT ATTEMPT THIS ON ANY OTHER CARRIER LOCKED MODEL!!
**While the device is back to stock recovery, the chances are very high that any future OTA's (Full or partial) may not load or install if binaries were altered by Magisk. The best thing to do here is to wait for a full package and install via Oxygen Updater or attempt a partial via Oxygen Updater.
LINK TO IMAGE FILE:
https://www.androidfilehost.com/?w=files&flid=330195
I know I'm replying to an old thread, sorry. I'm wondering if any has the stock T-Mob boot image for Android 12, I flashed a boot.img for the unlocked one and now my phone is boot looping. Has anyone pulled the stock Android 12 boot image for T-Mob yet? Or have a link for the full T-mob Android 12 OTA?
Replying to my own reply here, but I found a link to the T-Mobile Android 12 OTA here: https://community.oneplus.com/thread?id=1599362
Using this, I flashed the correct boot image which fixed the bootloop and now I've rooted it with Magisk.
Can you use this method to flash to de2117_11_c.15?
Hi this was a good guide. Is there a stock boot image for N200 Unlocked Android 12?
rick909 said:
Hi this was a good guide. Is there a stock boot image for N200 Unlocked Android 12?
Click to expand...
Click to collapse
You need to look at the dates of the messages you are replying to as this is a very old thread.
I maintain a thread with the latest boot image to root with guide here:
Root latest US OEM (DE2117)C_23/T-Mobile-Metro(DE2118) C_21 OTA for dummies
I have posted all the boot.img files for N200 A12 to AFH for DE2117 US OEM firmware and now latest for DE2118 (Tmobile/metro) I have posted both the original file as well as pre-patched with Magisk v25.2 for each. The T-Mobile/Metro image...
forum.xda-developers.com
Rooting the POCO M4 Pro 4G (fleur) turned out to be quite straightforward. Note, I have a 2201117PG (EEA), you may have a different experience, it's not my fault if you brick your phone etc. Backup before you start as this will wipe your phone.
The process can be broken down into 4 steps:
Unlock Bootloader
Source boot.img
Patch boot.img (using Magisk)
Flash patched boot.img (using adb)
1. Unlock BootloaderNote: This step will wipe your phone.
This can be done using the official tool from MIUI, using MediatekBootloaderUnlock (Windows 10/11, which reportedly does not wipe your user data), or using mtkclient (Any OS but requires Python). I will explain the mtkclient option as I'm on Linux and don't trust MIUI with more personal data than I have to.
Step-by-step (adapted from this How to Guide):
Install mtkclient and its dependencies (easier if familiar with installing python packages etc., straightforward for me on Linux)
On your phone activate developer mode and turn on USB debugging and OEM unlocking
Turn off phone and disconnect from computer
In the directory where you installed mtkclient run:
python mtk e metadata,userdata,md_udc
This erases your data
At this point plug your phone in (still turned off)
python mtk da seccfg unlock
This unlocks the bootloader
python mtk reset
This reboots the phone
Disconnect USB cable and reboot phone
When it boots a message is displayed warning that dm-verity is corrupted. Click the power button to dismiss and continue booting.
2. Source boot.img
Find your MIUI version in Settings -> About phone -> MIUI Version and look for the version number (e.g. 13.0.6.0(RKEEUXM))
Visit the MIUI Updates Tracker and download the matching Stable Fastboot update (if you can't find it scroll down to Extracting boot.img from Payload)
Unzip the TGZ and the TAR that it contains then navigate to the images directory and find the boot.img file
3. Patch boot.imgWe need to patch the boot.img to give it root powers. We do this on the phone using Magisk.
Step-by-step (adapted from the Magisk installation instructions):
On your phone, download Magisk and install it
Connect your phone to your computer and put the boot.img you extracted on your phone somewhere
Open Magisk and in "Magisk" section tap "Install"
Choose the "Select and Patch a File" option and select your boot.img in the file browser and let Magisk patch it
Find the patched boot image in Downloads (called magisk_patched_*.img) and copy it to your computer in the same directory as the vbmeta.img we extracted earlier
4. Flash patched boot.imgFinally we need to replace the current boot.img on the phone with our patched one that has root powers. This is called flashing and is done using adb.
Step-by-step:
Install the Android SDK platform tools which contains adb and fastboot
Install a USB driver that supports fastboot mode (you cannot use fastbootd for this or you'll bootloop)
Ensure your phone is connected, USB debugging is enabled and working, and OEM Unlocking is enabled
In the directory you copied the magisk_patched_*.img to run:
adb reboot bootloader
This reboots your phone into fastboot mode. Wait until "FASTBOOT" is displayed on the screen
fastboot flash boot magisk_patched_*.img
This flashes the patched boot.img to give you root
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
This flashes the vbmeta.img, disabling the dm-verity corruption message at startup
Once it's done reboot your phone by pressing and holding the power button
That's all there is to it! This took me about an hour as I was working out all the steps as I've not rooted in a phone in nearly a decade - I reckon with a fast internet connection you could get it done in about 15 minutes.
Extract boot.img from PayloadIf you can't find a fastboot image (boot.img) for your version then you might be able to extract it from the full firmware package. This will require the use of a third party tool such as payload-dumper (python) or payload-dumper-go. Note that you may be better off just waiting for the fastboot image to be released to the public.
Tidying upYou can delete all the stuff you downloaded onto your computer and the boot.img and magisk_patched_*.img from your phone.
It's a good idea to disable automatic OTA updates (Settings -> Additional settings -> Developer options -> Automatic sytem updates) so that you can update through Magisk.
Some apps will be able to tell that you have rooted your phone, and may stop you from using them. You can check this by downloading YASNAC onto your phone and seeing if it passes. If not (which it won't) the most straightforward solution is to add the Universal SafetyNet Fix module to Magisk, then enable Zygisk in Magisk settings and restart your phone, which will be enough to pass SafetyNet Attestation. If they're clever and still detect the root then in Magisk toggle Enforce DenyList and add the problematic apps to the DenyList.
Updating Magisk
You cannot update Magisk via the Magisk app, as this device does not allow writing to the boot partition at runtime.
Instead, update the Magisk app, then use it to patch your stock boot.img and flash it manually using fastboot, as if you were installing it from scratch (as above). This will not wipe your user data, but be sure to backup first in case something goes wrong.
aricooperdavis said:
Rooting the POCO M4 Pro 4G (fleur) turned out to be quite straightforward. Note, I have a 2201117PG (EEA), you may have a different experience, it's not my fault if you brick your phone etc.
The process can be broken down into 4 steps:
Unlock Bootloader
Source boot.img (using payload_dumper)
Patch boot.img (using Magisk)
Flash patched boot.img (using adb)
1. Unlock BootloaderThis can be done using the official tool from MIUI or using mtkclient. I went for the mtkclient option as I don't want to send more of my personal data to MIUI than I have to.
Step-by-step (adapted from this How to Guide):
Install mtkclient and its dependencies (easier if familiar with installing python packages etc., straightforward for me on Linux)
On your phone activate developer mode and turn on USB debugging and OEM unlocking
Turn off phone and disconnect from computer
In the directory where you installed mtkclient run:
python mtk e metadata,userdata,md_udc
At this point plug your phone in (still turned off)
python mtk da seccfg unlock
python mtk reset
Disconnect USB cable and reboot phone
When it boots a message is displayed saying it is corrupted. Click the power button to dismiss and continue booting.
2. Source boot.imgThe boot.img needs to be extracted from the official MIUI firmware package using payload_dumper.
Step-by-step:
Download the firmware package for your device (you can check what version you need in Settings -> About phone -> MIUI version (For POCO)
Extract the .zip and find the payload.bin file
Download the payload dumper, extract the zip, and place the payload.bin file in the payload_dumper folder
In the payload_dumper directory run:
python payload_dumper.py payload.bin
This will extract lots of files from the firmware package. You only need to keep boot.img and vbmeta.img
3. Patch boot.imgWe need to patch the boot.img to give it root powers. We do this on the phone using Magisk.
Step-by-step (adapted from the Magisk installation instructions):
On your phone, download Magisk and install it
Connect your phone to your computer and put the boot.img you extracted on your phone somewhere
Open Magisk and in "Magisk" section tap "Install"
Choose the "Select and Patch a File" option and select your boot.img in the file browser and let Magisk patch it
Find the patched boot image in Downloads (called magisk_patched_*.img) and copy it to your computer in the same directory as the vbmeta.img we extracted earlier
4. Flash patched boot.imgFinally we need to replace the current boot.img on the phone with our patched one that has root powers. This is called flashing and is done using adb.
Step-by-step:
Install the Android SDK platform tools which contains adb and fastboot
Install a USB driver that supports fastboot mode
Ensure your phone is connected, USB debugging is enabled and working, and OEM Unlocking is enabled
In the directory you copied the magisk_patched_*.img to run:
adb reboot bootloader
This reboots your phone into fastboot mode. Wait until "FASTBOOT" is displayed on the screen
fastboot flash boot magisk_patched_*.img
fastboot flash vbmeta --disable-verity --dsable-verification vbmeta.img
Once it's done reboot your phone by pressing and holding the power button
That's all there is to it! This took me about an hour as I was working out all the steps as I've not rooted in a phone in nearly a decade - I reckon with a fast internet connection you could get it done in about 15 minutes.
Tidying upYou can delete all the stuff you downloaded onto your computer and the boot.img and magisk_patched_*.img from your phone.
It's a good idea to disable automatic OTA updates (Settings -> Additional settings -> Developer options -> Automatic sytem updates) so that you can update through Magisk.
Some apps will be able to tell that you have rooted your phone, and may stop you from using them. You can check this by downloading YASNAC onto your phone and seeing if it passes. If not (which it won't) the most straightforward solution is to add the Universal SafetyNet Fix module to Magisk, then enable Zygisk in Magisk settings and restart your phone, which will be enough to pass SafetyNet Attestation. If they're clever and still detect the root then in Magisk toggle Enforce DenyList and add the problematic apps to the DenyList.
Click to expand...
Click to collapse
Wow, Thank you very much!
Very details!
Will try it in my spare time.
MarkLev said:
Wow, Thank you very much!
Very details!
Will try it in my spare time.
Click to expand...
Click to collapse
Good luck, let us know how it goes and what you do with your root! So far I've installed AdAway and De-Bloater
aricooperdavis. hi!I buy phone Poco M4 Pro (4G) (fleur). Please help me get ROOT rights for this phone.
I do not have PYTHON, but I have mtkclient - the bootloader is unlocked, and there is an Android SDK for fastboot firmware.
Global 13.0.7.0 RKEMIXM now. You have 2 file 1.magisk_patched_*.img and 2. vbmeta.img for Global 13.0.7.0 ? Can I save them for download?
After unlocking the bootloader, using the mtkclient method, a new notification appeared
- dm-verity coruption
You device is corrupt/
It can't be trusted and may not work properly
Press power button to contime
Or, device will power off in 5 sec. Always need PRESS POWER for contime again How to fix it?
It sounds like you've done everything right so far.
Lark5 said:
Global 13.0.7.0 RKEMIXM now. You have 2 file 1.magisk_patched_*.img and 2. vbmeta.img for Global 13.0.7.0 ? Can I save them for download?
Click to expand...
Click to collapse
Sorry, I have the EEA firmware; RKEEUXM.
If you want to extract the boot.img and vbmeta.img from your firmware package you will have to install python. This is worth doing as installing updates in the future may require you to do this extraction process again.
Alternatively you may be able to use mtk to dump these images directly from the phone, but I don't have any experience with this. To perform updates this way you would have to completely unroot and relock the bootloader, update the firmware, then re-dump the new boot and vbmeta images and root again. I think just installing python is probably easier...
The error message you're seeing is dm-verity, and we disable this when flashing the vbmeta.img in step 4, which I've edited to clarify. You can see that we disable it in the final fastboot command:
aricooperdavis said:
fastboot flash vbmeta --disable-verity --dsable-verification vbmeta.img
This flashes the vbmeta.img, disabling the dm-verity corruption message at startup
Click to expand...
Click to collapse
Good luck with your rooting!
Unlock Bootloade and Root and RECOVERY for Poco M4 Pro (4G) with out Pyton (on Windows 10\11):
Unlock Bootloader:
1.Download the MediatekBootloaderUnlock archive. Unpack the archive ZIP.
2. Open the Driver folder and right-click the cdc-acm.inf file, select "Install"
3.Now go back to the main folder and install the USBDK (x64 for 64-bit OS, x86 for 32-bit OS) on your PC (also right click - install).
4. Reboot the PC.
5.Turn off the phone.
6.Run the UnlockBootloader.bat file to start the bootloader unlock process. We keep it on, it is in a state of response from the phone, if the firewood, the cable is connected, then everything is ok, I’ll tell you right away that it turned out 3 times.
7.Now connect the phone to the computer with a cable by holding down the volume up + down + power button. (If the volume up button doesn't work, try using volume up or volume up + volume down or all three hardware buttons) while the UnlockBootloader.bat file is open.
8.Once the phone is detected, some commands will be run in the UnlockBootloader.bat file. Let the commands finish and as soon as the window closes. Your bootloader will be unlocked.
BY THE WAY! - You can lock the bootloader again by following the same steps without clearing. Just use LockBootloader.bat with the same steps.
Root:
Downloading the official firmware for the phone, I took fleur_global_images_V13.0.7.0.RKEMIXM_20220419.0000.00_11.0_global (approximately 5.6GB in weight)
Unpacked it ZIP, pulled out 2 files from there fleur_global_images_V13.0.7.0.RKEMIXM_20220419.0000.00_11.0_global\images
boot.img and vbmeta.img
Downloaded Magisk STABLE Version: 24.3 - download on telephone, setup APP
Launch Magisk Manager. When a pop-up window appears asking you to install Magisk, select INSTALL and select install again.
Click on "Fix Boot Image File".
Connect your device to PC via USB cable. Make sure USB debugging is enabled.
Download ADB \ fastoot (I took tools_r29.0.6-windows)
Run CMD as Administrator
We write -
adb devices - the phone must be determined (QX ********* device - so all drivers are correct)
adb reboot bootloader - The phone reboots into fastboot mode - an inscription on the screen if dm-verity corruption messages appear - press POWER to continue
fastboot flash boot boot_PATCH.img (file name how to change)
fastboot flash vbmeta --disable-verity --dsable-verification vbmeta.img - will remove the inscription dm-verity corruption
OrangeFox-R11 RECOVERY:
Downloads for : -Android- Generic Device/Other | AndroidFileHost.com | Download GApps, Roms, Kernels, Themes, Firmware and more. Free file hosting for all Android developers.
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
androidfilehost.com
Download, and Run CMD as Administrator
We write -
fastboot flash boot XXXXNAMEXXXX.img
Flash !boot! not fastboot flash recovery XXXXNAMEXXXX.img
Well done, glad you've got it sorted!
To clarify, this essentially follows the same 4 steps outlined in my post but using different tools that don't require python:
Unlock Bootloader
- Used MediatekBootloaderUnlock rather than mtkclient
Source boot.img
- Managed to find the images online without having to extract them from a ROM. @Lark5, where?
Patch boot.img (using Magisk)
- Same
Flash patched boot.img (using adb)
- Same
I think there's also a custom recovery install too (OrangeFox [not yet officially supported]) at the end. I tend not to bother with custom recoveries as I stick with the stock MIUI ROM and a custom recovery would complicate applying OTA updates. However, if you wish to install a custom ROM (anything other than a stock MIUI signed boot.img) then a custom recovery would be necessary, and they can also facilitate taking device backups etc.
aricooperdavis said:
Well done, glad you've got it sorted!
To clarify, this essentially follows the same 4 steps outlined in my post but using different tools that don't require python:
Unlock Bootloader
- Used MediatekBootloaderUnlock rather than mtkclient
Source boot.img
- Managed to find the images online without having to extract them from a ROM. @Lark5, where?
Patch boot.img (using Magisk)
- Same
Flash patched boot.img (using adb)
- Same
I think there's also a custom recovery install too (OrangeFox). I tend not to bother, but it can be convenient.
Click to expand...
Click to collapse
2. Find ROM on this link: https://mirom.ezbox.idv.tw/en/phone/fleur/roms-global-stable/
Fastboot Download V13.0.7.0.RKEMIXM
Explanations:
For fastboot (~5.6Gb) - firmware version, just unzip the ZIP, inside there is boot.img and vbmeta
For recovery (-2.5Gb) needed to extract boot.img Through Pyton for example
thanks for the help aricooperdavis
Lark5 said:
Find ROM on this link: https://mirom.ezbox.idv.tw/en/phone/fleur/roms-global-stable/
Click to expand...
Click to collapse
That's a great resource - the files it links to seem to be hosted on MIUIs servers too, so they're verifiably official
The more general link for all regions (not just global) for this phone would be: https://mirom.ezbox.idv.tw/en/phone/fleur/
I've updated the instructions to reflect your experience, thanks @Lark5!
aricooperdavis said:
Rooting the POCO M4 Pro 4G (fleur) turned out to be quite straightforward. Note, I have a 2201117PG (EEA), you may have a different experience, it's not my fault if you brick your phone etc. Backup before you start as this will wipe your phone.
The process can be broken down into 4 steps:
Unlock Bootloader
Source boot.img
Patch boot.img (using Magisk)
Flash patched boot.img (using adb)
1. Unlock BootloaderNote: This step will wipe your phone.
This can be done using the official tool from MIUI, using MediatekBootloaderUnlock (Windows 10/11), or using mtkclient (Any OS but requires Python). I will explain the mtkclient option as I'm on Linux and don't trust MIUI with more personal data than I have to.
Step-by-step (adapted from this How to Guide):
Install mtkclient and its dependencies (easier if familiar with installing python packages etc., straightforward for me on Linux)
On your phone activate developer mode and turn on USB debugging and OEM unlocking
Turn off phone and disconnect from computer
In the directory where you installed mtkclient run:
python mtk e metadata,userdata,md_udc
This erases your data
At this point plug your phone in (still turned off)
python mtk da seccfg unlock
This unlocks the bootloader
python mtk reset
This reboots the phone
Disconnect USB cable and reboot phone
When it boots a message is displayed warning that dm-verity is corrupted. Click the power button to dismiss and continue booting.
2. Source boot.imgNote: if your MIUI version (Available at: Settings -> About phone -> MIUI version) has a "Fastboot" file listed here then you can download that file and unzip it to find the boot.img and vbmeta.img, then skip to step 3.
Otherwise you'll have to extract them from the official MIUI firmware package using payload_dumper as follows.
Step-by-step:
Download the firmware package for your device (you can check what version you need in Settings -> About phone -> MIUI version (For POCO))
Extract the .zip and find the payload.bin file
Download the payload dumper, extract the zip, and place the payload.bin file in the payload_dumper folder
In the payload_dumper directory run:
python payload_dumper.py payload.bin
This will extract lots of files from the firmware package. You only need to keep boot.img and vbmeta.img
3. Patch boot.imgWe need to patch the boot.img to give it root powers. We do this on the phone using Magisk.
Step-by-step (adapted from the Magisk installation instructions):
On your phone, download Magisk and install it
Connect your phone to your computer and put the boot.img you extracted on your phone somewhere
Open Magisk and in "Magisk" section tap "Install"
Choose the "Select and Patch a File" option and select your boot.img in the file browser and let Magisk patch it
Find the patched boot image in Downloads (called magisk_patched_*.img) and copy it to your computer in the same directory as the vbmeta.img we extracted earlier
4. Flash patched boot.imgFinally we need to replace the current boot.img on the phone with our patched one that has root powers. This is called flashing and is done using adb.
Step-by-step:
Install the Android SDK platform tools which contains adb and fastboot
Install a USB driver that supports fastboot mode
Ensure your phone is connected, USB debugging is enabled and working, and OEM Unlocking is enabled
In the directory you copied the magisk_patched_*.img to run:
adb reboot bootloader
This reboots your phone into fastboot mode. Wait until "FASTBOOT" is displayed on the screen
fastboot flash boot magisk_patched_*.img
This flashes the patched boot.img to give you root
fastboot flash vbmeta --disable-verity --dsable-verification vbmeta.img
This flashes the vbmeta.img, disabling the dm-verity corruption message at startup
Once it's done reboot your phone by pressing and holding the power button
That's all there is to it! This took me about an hour as I was working out all the steps as I've not rooted in a phone in nearly a decade - I reckon with a fast internet connection you could get it done in about 15 minutes.
Tidying upYou can delete all the stuff you downloaded onto your computer and the boot.img and magisk_patched_*.img from your phone.
It's a good idea to disable automatic OTA updates (Settings -> Additional settings -> Developer options -> Automatic sytem updates) so that you can update through Magisk.
Some apps will be able to tell that you have rooted your phone, and may stop you from using them. You can check this by downloading YASNAC onto your phone and seeing if it passes. If not (which it won't) the most straightforward solution is to add the Universal SafetyNet Fix module to Magisk, then enable Zygisk in Magisk settings and restart your phone, which will be enough to pass SafetyNet Attestation. If they're clever and still detect the root then in Magisk toggle Enforce DenyList and add the problematic apps to the DenyList.
Click to expand...
Click to collapse
When I gave this command fast boot flash dm verify it always unknown option in my cmd any solution ? can anybody help me??
Daafafagsgsgs said:
When I gave this command fast boot flash dm verify it always unknown option in my cmd any solution ? can anybody help me??
Click to expand...
Click to collapse
Make sure you're copying the command exactly - it's fastboot rather than fast boot and verity not verify. Did you install the Android SDK platform tools that contain fastboot? You may need to restart after this install to make the command available in your command prompt/shell.
aricooperdavis said:
Make sure you're copying the command exactly - it's fastboot rather than fast boot and verity not verify. Did you install the Android SDK platform tools that contain fastboot? You may need to restart after this install to make the command available in your command prompt/shell.
Click to expand...
Click to collapse
Yeah i copied the same command but how to install Android sdk tools can you suggest me a video?
Daafafagsgsgs said:
Yeah i copied the same command but how to install Android sdk tools can you suggest me a video?
Click to expand...
Click to collapse
Go to this link, scroll to the downloads section, and select the right download for your OS, then follow the instructions.
This video shows the process, but has very annoying music!
aricooperdavis said:
Make sure you're copying the command exactly - it's fastboot rather than fast boot and verity not verify. Did you install the Android SDK platform tools that contain fastboot? You may need to restart after this install to make the command available in your command prompt/shell.
Click to expand...
Click to collapse
I installed and tried everything this error comes
Interesting, that sounds like you've got an outdated version of fastbook. What does fastboot --version give you?
Can i flash it with my phone ??
Adb otg app??
I don't know, I can't help you with that.
aricooperdavis said:
Interesting, that sounds like you've got an outdated version of fastbook. What does fastboot --version give you?
Click to expand...
Click to collapse
Fastboot version
That's not an official version of fastboot, so it looks like it's missing the command you need. Download the proper Android SDK tools from Android (the same as the original link) and replace your "Minimal" version with it.
aricooperdavis said:
That's not an official version of fastboot, so it looks like it's missing the command you need. Download the proper Android SDK tools from Android (the same as the original link) and replace your "Minimal" version with it.
Click to expand...
Click to collapse
After many tries i found that the command given is wrong
fastboot flash vbmeta --disable-verity --dsable-verification vbmeta.img
This is given
It will be
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
I is Missing Now i have flashed vb meta and problem is solved with the fastboot version i have
By the way thanks