Hello, I'm new to the Android hacking/modding scene with this being the first phone I am able to unlock the bootloader for. I recently picked this phone up (Model DE2118 to be specific), and got it's bootloader unlocked and installed Lineage. Now that it is all done and out of the way, would it be possible to lock the bootloader to prevent further modifications and potential security risks? Thank you in advance.
Gateway05184 said:
Hello, I'm new to the Android hacking/modding scene with this being the first phone I am able to unlock the bootloader for. I recently picked this phone up (Model DE2118 to be specific), and got it's bootloader unlocked and installed Lineage. Now that it is all done and out of the way, would it be possible to lock the bootloader to prevent further modifications and potential security risks? Thank you in advance.
Click to expand...
Click to collapse
Under no circumstance should you relock the bootloader. The only OS that I know of that currently lets you do that on any device is Graphene OS on pixel devices. And that is written by extremely gifted developers. So... no... not now or anytime soon. Sorry!
Nope. While you could relock your bootloader now, you'd get an error message the next time you turned on your phone and it would refuse to boot. (And there's no guarantee that you could recover it, though usually the MSM tool works.) In most cases, you should never relock the bootloader unless you're on stock, unmodified firmware. In some cases, it is possible if the custom ROM you're using instructs you to relock your bootloader and provides their own keys for you to flash or if you build and sign your own ROMs yourself, but otherwise, it's just not worth it.
You should read this reddit post for more details as to why you shouldn't relock your bootloader.
Yeah, I kind of figured. I tried locking the bootloader out of curiosity (obviously, you shouldn't do this.) which caused it to brick. I unbricked it using the MSM tools for the specific model. I also tried flashing the public key but it only allows recovery to boot and boot loops if you just leave it sit. lol
Don't' try this ever, you will most probably soft brick the device without being able to recover it.
You can only safely relock the bootloader on stock OS without the risk of bricking the device.
Sprunglicious said:
Under no circumstance should you relock the bootloader. The only OS that I know of that currently lets you do that on any device is Graphene OS on pixel devices. And that is written by extremely gifted developers. So... no... not now or anytime soon. Sorry!
Click to expand...
Click to collapse
Gateway05184 said:
Hello, I'm new to the Android hacking/modding scene with this being the first phone I am able to unlock the bootloader for. I recently picked this phone up (Model DE2118 to be specific), and got it's bootloader unlocked and installed Lineage. Now that it is all done and out of the way, would it be possible to lock the bootloader to prevent further modifications and potential security risks? Thank you in advance.
Click to expand...
Click to collapse
Not entirely true. CalyxOS allows relocking bootloader on Pixels. My own development for Oneplus 6/6T/8/8T/8Pro/9 and 9Pro allows relocking bootloader.
I managed to find a way to relock the bootloader with LineageOS installed by compiling it from source and patching a few files. Then I flashed the avb_custom_key partition via fastboot with the key I used to sign the image I've compiled. This resulted in me getting the yellow error screen (Your device has loaded a different OS.) rather than the usual orange screen you get with the bootloader unlocked. I even used a tool called "avbroot" to patch the image for magisk support.
just use the MSMDownload tool for the firmware you want, it will set it back to factory defaults and factory OS including re-locking the bootloader
NOTE: if you ever want to unlock it again just use the token file/bin file that oneplus sent you originally to unlock. no need to re-apply or ask oneplus again for new token, can just use the original one they sent you.
Gateway05184 said:
Hello, I'm new to the Android hacking/modding scene with this being the first phone I am able to unlock the bootloader for. I recently picked this phone up (Model DE2118 to be specific), and got it's bootloader unlocked and installed Lineage. Now that it is all done and out of the way, would it be possible to lock the bootloader to prevent further modifications and potential security risks? Thank you in advance.
Click to expand...
Click to collapse
I don't like seeing my Nord n200 boot to the unlocked bootloader screen, and found a way to prevent that.
I found the method on the Reddit forum for LineageOS.
From CevicheMixto:
I was able to complete the upgrade (dirty flash from the latest LineageOS 19.1). Here's what I had to do.
First, I upgraded the device firmware, following this guide. Note that the oneplus.com page that is linked from that guide does not appear to actually provide firmware for the Nord N200. The Oxygen Updater app does allow you to download the firmware, once the app's settings have been changed to enable "Advanced mode." It will save the firmware file in the /sdcard directory, and adb can be used to transfer it to your PC. (Alternatively, the firmware can be directly downloaded from https://android.googleapis.com/packages/ota-api/package/6be3f133f8fb9bbcc30d787679bd7b5da5e30995.zip.)
At this point, my phone would not boot into the LineageOS recovery (19.1 or 20); it kept returning to bootloader mode. I fixed this by flashing the LineageOS 20 boot, dtbo, and vendor_boot images onto the device. These images can be extracted from the LineageOS 20 ZIP file with payload-dumper-go, or they can be downloaded from the dre builds page.
fastboot flash boot boot.img
fastboot flash dtbo dtbo.img
fastboot flash vendor_boot vendor_boot.img
(Unlike fastbootd, the bootloader does not appear to support the --slot=all option, but I only needed to flash these for the active slot.)
I was now able to boot into the (installed) LineageOS 20 recovery, choose "Apply update" and "Apply from ADB" to put the device into sideload mode. I then followed the upgrade instructions to flash the LineageOS 20 ZIP file, reboot back to recovery, and flash the MindTheGapps ZIP file.
Do yourself a favor and just load Oxygen Updater onto another Android phone and download the files. It will pop up a notice that the phone isn't the correct one, but just click advanced and download the file, then continue on.
My Nord n200 now boots with the OnePlus logo then directly to LineageOS with Android 13
KeysStickler said:
I don't like seeing my Nord n200 boot to the unlocked bootloader screen, and found a way to prevent that.
I found the method on the Reddit forum for LineageOS.
From CevicheMixto:
I was able to complete the upgrade (dirty flash from the latest LineageOS 19.1). Here's what I had to do.
First, I upgraded the device firmware, following this guide. Note that the oneplus.com page that is linked from that guide does not appear to actually provide firmware for the Nord N200. The Oxygen Updater app does allow you to download the firmware, once the app's settings have been changed to enable "Advanced mode." It will save the firmware file in the /sdcard directory, and adb can be used to transfer it to your PC. (Alternatively, the firmware can be directly downloaded from https://android.googleapis.com/packages/ota-api/package/6be3f133f8fb9bbcc30d787679bd7b5da5e30995.zip.)
At this point, my phone would not boot into the LineageOS recovery (19.1 or 20); it kept returning to bootloader mode. I fixed this by flashing the LineageOS 20 boot, dtbo, and vendor_boot images onto the device. These images can be extracted from the LineageOS 20 ZIP file with payload-dumper-go, or they can be downloaded from the dre builds page.
fastboot flash boot boot.img
fastboot flash dtbo dtbo.img
fastboot flash vendor_boot vendor_boot.img
(Unlike fastbootd, the bootloader does not appear to support the --slot=all option, but I only needed to flash these for the active slot.)
I was now able to boot into the (installed) LineageOS 20 recovery, choose "Apply update" and "Apply from ADB" to put the device into sideload mode. I then followed the upgrade instructions to flash the LineageOS 20 ZIP file, reboot back to recovery, and flash the MindTheGapps ZIP file.
Do yourself a favor and just load Oxygen Updater onto another Android phone and download the files. It will pop up a notice that the phone isn't the correct one, but just click advanced and download the file, then continue on.
My Nord n200 now boots with the OnePlus logo then directly to LineageOS with Android 13
Click to expand...
Click to collapse
That doesn't solve what I was originally attempting to do but I appreciate the suggestion nonetheless. However, the DE2117 OTA update is not meant for the carrier exclusive models (i.e. DE2118 aka the MetroPCs T-Mobile model.) I've already attempted this on my own DE2118 and it resulted in a boot loop. This problem doesn't exist in Lineage 19.1.
Gateway05184 said:
That doesn't solve what I was originally attempting to do but I appreciate the suggestion nonetheless. However, the DE2117 OTA update is not meant for the carrier exclusive models (i.e. DE2118 aka the MetroPCs T-Mobile model.) I've already attempted this on my own DE2118 and it resulted in a boot loop. This problem doesn't exist in Lineage 19.1.
Click to expand...
Click to collapse
I used this to update to LineageOS 20
there is no known way to relock the boot-loader on a custom rom on the nord n200 . However you can re-lock in on the official firmware. You can always go back to the official firmware with the locked bootloader by flashing the official firmware via MSM Download tool
Related
Hello
I have the L22 variant, with TWRP installed and CM12.
Bootloader is unlocked.
I want to upgrade to CM13. It won't flash because I need to upgrade to a marshmallow (MM) bootloader first.
I extracted boot.img from an official MM rom using the update extractor.
Questions:
1. If I flash it, do I need to go again thru the procedure of bootlader unlook? (getting the code from the huawei site)
If so, I'd assume the code I used first will work, for some reason CM12 is now reporting different serial number. Though I saved the original values.
2. If I flash it, will CM12 boot? Or I will need to also flash system.img, which I also extracted.
3. If I flash it, will I loose TWRP? I guess no...
4. What is cust.img for? I am more a Samsung guy, not familiar with that file.
Thanks in advance.
i would restore to latest stock rom available and install from there to be safe, careful when wiping boot.img
Thank you...
Here is how I fixed, and put some answers if helpful for anyone else in the future.
1. Bootloader and Boot are different. During the startup process the bootloader calls either boot for a normal startup or call recovery.
Messing with boot won't touch the bootloader or the recovery areas.
2. I did not flash boot at the end, I used the ResurrectionMix which already comes with its own boot image. It took me to Marshmallow (MM).
In theory, this boot image will support any other MM ROM. I did not try because I ended up liking it.
3. As explained in (1). Flashing boot wont touch recovery
4. I haven't found an answer to this one. Anyway, I did not touch it.
Cheers.
boot only contains kernel and ramdisk , recovery its a separate paritition alternative to boot, at startup depending on what is pressed bootloader either calls boot partition or recovery parition or fastboot
Hello
I have honor 5x KIW-L22 & suddenly my mobile shows no service what should i do.
My sim is working in another phone and since i checked in the phone information option while using the ussd code to dispaly the details radio signal button is not showing
in the menu and when i call someone it shows radio off.
Please help me to sort out this.
EDIT: On a V30 H930 if that matters.
Coming from an S7 Edge and a Jelly Pro (which was fairly open) so my understanding of how LG does things may be off.
If I just want Magisk - not interested in TWRP/custom roms etc.
Can I:
- enable OEM unlock in developer settings (device is encrypted etc)
- use magisk manager to generate a new boot.img
- use fastboot to flash this e.g. fastboot flash boot patched_boot.img
Or am I missing something? (Probably!)
molotov_sh said:
EDIT: On a V30 H930 if that matters.
Coming from an S7 Edge and a Jelly Pro (which was fairly open) so my understanding of how LG does things may be off.
If I just want Magisk - not interested in TWRP/custom roms etc.
Can I:
- enable OEM unlock in developer settings (device is encrypted etc)
- use magisk manager to generate a new boot.img
- use fastboot to flash this e.g. fastboot flash boot patched_boot.img
Or am I missing something? (Probably!)
Click to expand...
Click to collapse
EDIT:
See post #7 below for root on this phone without TWRP.
For root for this phone WITH TWRP, see this post.
ChazzMatt said:
No, what you said won't work. See this thread below.
You need TWRP to root, by the way.
https://forum.xda-developers.com/lg-v30/how-to/wtf-lg-v30-t3790500
Click to expand...
Click to collapse
You don't need TWRP to root (some) other phones with Magisk, hence my original probing question. Originally when I did some poking around this forum I couldn't tell if some of the hackery being used was specifically for network locked phones or for some custom rom needs.
It looks like the subtlety here is that LG doesn't really unlock when you choose OEM unlock, it just lets you then request unlocking from them (or the trick you've linked). What a right pain in the behind.
Thanks for the pointer.
molotov_sh said:
You don't need TWRP to root (some) other phones with Magisk, hence my original probing question. Originally when I did some poking around this forum I couldn't tell if some of the hackery being used was specifically for network locked phones or for some custom rom needs.
It looks like the subtlety here is that LG doesn't really unlock when you choose OEM unlock, it just lets you then request unlocking from them (or the trick you've linked). What a right pain in the behind.
Thanks for the pointer.
Click to expand...
Click to collapse
In my experience, very few phones actually unlock bootloader with simple "OEM unlock". That setting only works if the OEM or carrier wants it to work.
XIAOMI makes you wait TWO months for bootloader unlock:
https://www.xda-developers.com/xiaomi-2-month-wait-unlock-bootloader/
Note I didn't say no phones, I said very few -- compared to the plethora of brands available.
For instance, Motorola makes you request a bootloader unlock code, but Verizon Motorola phones are not eligible.
Sent via open market LG US998 V30/V30+
I'm confused... 10c didn't need TWRP
So I last rooted when I was running 10c on my open market bootloader unlocked US998 V30 (through the official LG method with an LG-generated unlock.bin) and all I had to do was get a boot.img and let Magisk patch it then flash it using adb/fastboot flash.
I have updated to 20d (many thanks ChazzMatt for the KDZ and instructions) and was going to use westwood24's 20d boot.img with Magisk to systemless-ly root again. Since it seems to be asked a lot, I prefer to leave my /data encrypted and never noticed a slowdown without disabling rctd and prefer to have dm-verity on. If there's a way to do that with TWRP and leave stuff encrypted I'm all for it.
Is it no longer possible to flash back a patched boot.img to have just Magisk root and an otherwise completely stock device?
Kakari said:
So I last rooted when I was running 10c on my open market bootloader unlocked US998 V30 (through the official LG method with an LG-generated unlock.bin) and all I had to do was get a boot.img and let Magisk patch it then flash it using adb/fastboot flash.
I have updated to 20d (many thanks ChazzMatt for the KDZ and instructions) and was going to use westwood24's 20d boot.img with Magisk to systemless-ly root again. Since it seems to be asked a lot, I prefer to leave my /data encrypted and never noticed a slowdown without disabling rctd and prefer to have dm-verity on. If there's a way to do that with TWRP and leave stuff encrypted I'm all for it.
Is it no longer possible to flash back a patched boot.img to have just Magisk root and an otherwise completely stock device?
Click to expand...
Click to collapse
You're doing very advanced stuff, and I don't know the answer to that. A developer could give you answers...
I do know I prefer TWRP custom recovery for purposes of having backups. Like having a nifty time machine where you can erase mistakes you make.
TWRP can also let you flash zipped files to install other elements to your phone.
"Stock" recovery is fairly useless in my opinion.
Magisk systemless root without TWRP
ChazzMatt said:
You're doing very advanced stuff, and I don't know the answer to that. A developer could give you answers...
I do know I prefer TWRP custom recovery for purposes of having backups. Like having a nifty time machine where you can erase mistakes you make.
TWRP can also let you flash zipped files to install other elements to your phone.
"Stock" recovery is fairly useless in my opinion.
Click to expand...
Click to collapse
I decided to just 'go for it' again and it still works with Magisk 16 and 17.1 (I didn't dare try 17 with the possible bootloop problems). In the interest of not making something 'advanced' & possibly dangerous too accessible I'll share what I did in broad strokes so molotov_sh and future me can have a rough guide.
The process was:
0. Have an unlocked bootloader (either you have an open market US998 and used the official method or the WTF method)
1. Download the 20d update (what I'm using a newer one will hopefully also work) and the LGUP dev version.
2. Plug in your V30 using a USB2 cable and switch it to File Transfer mode.
3. Open LGUP
4. 'Upgrade' the phone using the KDZ from (1), let it reboot, finish and check that the phone boots, I like throwing in an extra reboot with the phone unplugged from the computer just to be sure. Do any backups of app data, make sure you have 2FA backup codes etc.
5. Reconnect the phone and open LGUP again and choose 'Dump'
5a. It's probably a good idea to dump the whole of your phone excluding 'userdata' just in case. I had a timeout error after about 30-35 minutes but it seemed to get all portions.
6. Choose the 'boot' checkbox for what you want to dump and choose a folder to save it in. The file it dumps is in .img format but does not have a file extension.
7. When its done, unplug the phone, close LGUP, reboot the phone to the regular OS, and plug it back in in file transfer mode.
8. Copy the boot image you dumped in (6) onto the phone, perhaps under Internal SD/Download (I'd add the .img and possibly a version like boot20d.img)
9. Install MagiskManager.
10. Open it, choose Install, Patch Boot Image file, choose the .img file you copied in (8). When its done (without any errors!) you'll have a patched_boot.img file
11. Copy patched_boot.img onto your computer (I like placing it right next to my fastboot executable); you might have to wait a few minutes or restart since the phone can be slow to show newly created files.
12. Unplug your phone & turn it off. Then hold volume down while your plug in the USB cable.
13. Open a terminal/command prompt and navigate to the patched_boot.img file and then run
Code:
fastboot flash boot patched_boot.img
14. It'll take a few tenths of a second and said 'OK'/'Done'. Then enter
Code:
fastboot reboot
and unplug the phone after it starts rebooting. I had mine go through 2 reboot cycles and then it was fine, Magisk works and SafetyNet checks pass.
Recovery is stock and I can have a working hosts file and TitaniumBackup. I use LGBridge for more significant backups.
molotov_sh said:
EDIT: On a V30 H930 if that matters.
Coming from an S7 Edge and a Jelly Pro (which was fairly open) so my understanding of how LG does things may be off.
If I just want Magisk - not interested in TWRP/custom roms etc.
Can I:
- enable OEM unlock in developer settings (device is encrypted etc)
- use magisk manager to generate a new boot.img
- use fastboot to flash this e.g. fastboot flash boot patched_boot.img
Or am I missing something? (Probably!)
Click to expand...
Click to collapse
See @Kakari's post just above this one for root without TWRP, using a patched boot.img.
@Kakari I actually posted a PM to @ChazzMatt about a day after I originally posted here with roughly your procedure (I think he may have seen this thread before that PM). I debated posting it here as I didn't have a clean experience with FOTA 20r to 20y (potential for others to suffer data wipes) - in the end I had to LGUP to go to 20y, see below.
For anyone interested in following my method it will wipe your data.
Let me quote my PM to him here:
Thanks for the pointer the other day
I've used your detailed guides, roms and the rather impressive group discovery thread to come up with a simpler method if you're just after root only and you want the official ROM - "light" root users.
As an aside, I should note that after downgrading to 20r (H930 European here), unlocking the bootloader and hard resetting the FOTA wouldn't bump me to 20y, it'd go through the motions and just wipe the phone each time it rebooted to apply it. So I used LGUP to flash 20y (what I was on before rooting with no updates available) and it's all good for now.
My steps:
- Downgrade to unlockable ROM version using LGUP. EU H930 20r here.
- Flash new_unlock.bin to unlock bootloader in fastboot.
- Hard reset as suggested.
- Flash "latest" official ROM using LGUP. EU H930 20y for me as I wanted what I had originally.
- Get the matching boot image (I pulled boot_6.bin from the 20y kdz)
- Feed to to Magisk Manager's install.
- Flash it in fastboot (fastboot flash boot <patched_boot_6.bin>)
Now I have an entirely stock ROM except for boot, so in theory FOTA capable. Rare use case possibly, but saves TWRP and the funky recovery flashing - which looked like it might also trip safetynet with the LG anti-root stuff (I guessed that might hit system?).
Not sure how FOTA will work going forwards for me, but my hope is that all I'll have to do is reflash a Magisk'ed boot. That'd (hopefully) be the only downside - needing to wait for a boot image to regain root, or (somehow) extract it from the phone.
In reality given my FOTA wipe experience I imagine full backups in advance (titanium in my case, as no twrp) will probably be necessary, just like one should do before flashing any custom ROM or update I suppose. Also as it's a modified boot, if the FOTA does a delta update/verify on it that could get awkward, and would necessitate another trip to LGUP.
Your work on the LG V30 has been invaluable, I hope the above is useful.
Click to expand...
Click to collapse
So yes, I have root with Magisk but no need for TWRP! Thanks for your input anyway, it may help others especially as it has LGUP backup bits.
TO CONTENT FARMS ESPECIALLY GETDROIDTIPS: DO NOT REPOST THIS TOPIC ON YOUR WEBSITE!
点击这里查看中文版(Click here for Chinese Version Guide)
Click to expand...
Click to collapse
If you're looking for how to unbrick the phone that received May 2023 Security Update, you've come to the right place.
You have two options to unbrick your Nokia 8.3
If you prefer not to unlock the bootloader, visit here:
[GUIDE] How to Unbrick Nokia 8.3 affected by May 2023 Security Patch
As I mentioned before, unlocking the bootloader will fix this issue. But if you don't want to unlock the bootloader, then this guide is for you. DO NOT USE THIS METHOD IF JUNE 2023 OR NEWER UPDATE RELEASES IN FUTURE! YOU SHOULD NOT IGNORE...
forum.xda-developers.com
Or if you don't mind unlocking the bootloader, do these steps before you proceed to bootloader unlock:
1. Use volume key to select "Recovery mode", power key to enter.
2. When you see android robot lying on the ground, hold power key and press volume up key once. Then you'll get recovery screen.
3. Download this package: https://android.googleapis.com/packages/ota-api/package/627142c637bf373410e6b8911aeb9b2e65bd5969.zip
4. Select Apply Update from ADB, then sideload it with adb command.
5. Once the sideload procedure finishes, select "reboot to bootloader", then follow this guide to unlock the bootloader.
Existing Android 10 builds has a critical problem, that allowed us to flash or erase any bootloader partition even if the bootloader is not unlocked. However, Android 11 builds blocked this method, but there's a known workaround for this.
Therefore, I think it's time to disclose the unlock method now. It's known working on both TA-1243 and TA-1251.
The critical part for unlocking the bootloader is - the prototype bootloader of this phone. By opportunity, I got the early bootloader from a prototype unit that allows us to unlock the bootloader, thanks to the help of a Canadian people who claimed to have a Nokia 8.3 prototype himself.
Click this for Android 11 or Android 12 users
Your warranty will be void as bootloader unlock is not reverseable - you cannot relock it. Prototype ABL for normal Nokia 8.3 and 8V 5G UW are not interchangeable, flashing wrong ABL image will cause your phone hard brick.
To use this method, you need to ensure your phone has Android 10 installed - the latest build that we can use this method is 00WW_1_150-B01, you can confirm this by dialing *#*#7837#*#*.
If your phone has Android 11 installed (00WW_2_180-B01 or newer), then this bootloader unlock method has been blocked, but there's known workaround for this. Check 2nd reply for details.
UPDATE: Russian version Nokia 8.3 5G cannot be downgraded yet. If you're using Russian version Nokia 8.3 5G (Software version has RU tag), use EDL method for bootloader unlock.
Please download the prototype bootloader from here:
Click here for Nokia 8.3 5G (BGT TA-1243/1251)
Click here for Nokia 8V 5G UW (RAV TA-1257)
If you see Error code 00000101 during download - please use industrial standard web browser to download it, like Google Chrome.
SHA256
Code:
Nokia 8.3 5G: e253b67fa028b1ea9ca714bee6d95902e2b340ae201e0c88adc12781279b8fd5
Nokia 8V 5G UW: 70391abce694c95d7bb9d2c3fa1bcbfd66f26f42a766bc8d8c4d222caf8a62d4
Root Key Hashes
Code:
Nokia 8.3 5G: E3B22179CCBFB91730E233C4162E2D9DD33D02C97289EC1E9F787AC52CBDE3E0
Nokia 8V 5G UW: C3CEDC3A4612C85DD70EEDFA8ABA75621D579CEA62BB9A8D805DD4E9C542A6F0
(For Nokia 8.3 5G only), flash it under fastboot mode, and unlock the bootloader - pretty simple:
Code:
fastboot flash abl BGT-abl.elf
fastboot reboot-bootloader
fastboot oem unlock-go
Confirm unlock on your phone and it's all done. You can safely update the phone to Android 11 right after unlocked. Since we cannot perform critical unlock properly, we can only do regular unlock, but this should be enough.
Video demonstration:
For Nokia 8V 5G UW only:
1. Ask someone who has access of HDK to grant service permission for you.
2. Execute these commands (please download frp_oemunlock.img from https://forum.xda-developers.com/t/...rom-nokia-xr20-for-bootloader-unlock.4455845/ ):
Code:
fastboot flash abl RAV-abl.elf
fastboot reboot-bootloader
fastboot flash frp frp_oemunlock.img
fastboot reboot-bootloader
fastboot flashing unlock_critical
(confirm unlock)
fastboot flashing unlock
(confirm unlock)
Have fun for modding this device!
If you don't mind take apart your phone, you can use EDL method - but you know doing so will definitely void the warranty, and the stubborn triple-color company could remove these pads in later batches.
Firehose programmer for this phone is attached here.
Since we didn't grab downgrade OTA package for Russian variant, they cannot pass full OTA package verification and has to use EDL method for downgrading ABL. Thanks to Russian users for providing info.
In case Android 12 update from future cannot be downgraded, you'll have to use EDL method as well.
Example of using edl.py from bkerler (https://github.com/bkerler/edl):
Code:
edl.py w abl_a abl_proto_e253b67f.elf --memory=ufs --loader=prog_firehose_ddr.elf
edl.py w abl_b abl_proto_e253b67f.elf --memory=ufs --loader=prog_firehose_ddr.elf
edl.py reset
Keep in mind doing so will 100% void your warranty, and you cannot relock the bootloader.
For archiving purposes:
00WW_1_150-B01 full OTA zip: https://android.googleapis.com/packages/ota-api/package/627142c637bf373410e6b8911aeb9b2e65bd5969.zip
00WW_2_180-B01 full OTA zip: https://android.googleapis.com/packages/ota-api/package/12a35835cf4034f539ae7d03ffecd0682bef1b66.zip
You can use them for OS rooting.
Also after @jnappert 's testing, the workaround works great.
1. Sideload 00WW_1_150-B01 OTA package under recovery. You may see downgrade not allowed prompt but it will install anyway.
2. Reboot to bootloader under recovery mode. Although Anti-Rollback protection is triggered, the abl is not protected and is now downgraded to vulnerable build.
3. You can now follow the guide to unlock the bootloader.
I hope this will help everybody to bring up custom rom development for this phone.
hikari_calyx said:
Existing Android 10 builds has a critical problem, that allowed us to flash or erase any bootloader partition even if the bootloader is not unlocked.
Click to expand...
Click to collapse
Does that mean that they forgot to blow eFUSE of secure boot in this model? On a different device, once I flashed tampered ABL image after unlocking (and unlock_critical) the blootloader, XBL refuses to load ABL because of tampering. It hard bricked the device, but EDL mode was working.
It could be that ABL_proto image that you extracted might be signed by the OEM.
Volski_ said:
Does that mean that they forgot to blow eFUSE of secure boot in this model? On a different device, once I flashed tampered ABL image after unlocking (and unlock_critical) the blootloader but XBL refuses to load ABL because of tampering. It hard bricked the device, but EDL mode was working.
It could be that ABL_proto image that you extracted might be signed by the OEM.
Click to expand...
Click to collapse
It's signed by OEM - you can compare it yourself.
In demonstration video, the secure boot is already enabled as you can see.
Can anybody tell does it pass CTS with Magisk hide?
mingkee said:
Can anybody tell does it pass CTS with Magisk hide?
Click to expand...
Click to collapse
It will pass - at least that's the situation on 00WW_1_150-B01.
Now I have mine turn off to avoid further update.
I was unaware and it went up to 11, so I have to use different bootloader to root.
mingkee said:
Now I have mine turn off to avoid further update.
I was unaware and it went up to 11, so I have to use different bootloader to root.
Click to expand...
Click to collapse
If bootloader unlocked, it will be safe to update to Android 11.
Hello everybody. I was minding: because i've upgraded my nokia 8.3, is it possibile to roll back to android 10, unlock bootloader and install superSU?
I tried downgrading to Android 10 yesterday und sucessfully unlocked bootloader (which deletes user-data). Then the OTA Update to 00WW_2_200 installed without problem.
jnappert said:
I tried downgrading to Android 10 yesterday und sucessfully unlocked bootloader (which deletes user-data). Then the OTA Update to 00WW_2_200 installed without problem.
Click to expand...
Click to collapse
can you please type here the steps you've made to downgrade your phone?
For Nokia 8 V 5G UW users:
I suspect devices with 00VPO_1_260-B01 or older should be vulnerable, but I think many users should have the phone updated to 00VPO_1_280-B01 already.
Need further investigation whenever I got firmware.
I tried to downgrade mine from Android 11 to 10. Anyways, when i sideload the "update", the recovery text "downgrade not allowed". When it finishes the install, my phone just boot in fastboot mode and the only way to get it back is to install the Android 11 update. Still waiting any tips to downgrade
TheDuke94 said:
can you please type here the steps you've made to downgrade your phone?
Click to expand...
Click to collapse
I downgraded from 00WW_2_180 to 00WW_1_150-B01:
- installed adb and drivers
- enabled USB Debug
- bootet to stock recovery: "adb reboot recovery"
- in recovery "apply update from adb"
- adb sideload 00WW_1_150-B01 from post #3
- rebootet to fastboot and continued with steps from post #1 to unlock bootloader
- after reboot device updated directly to 00WW-2_200
Now i am looking for working custom recovery...
jnappert said:
I downgraded from 00WW_2_180 to 00WW_1_150-B01:
- installed adb and drivers
- enabled USB Debug
- bootet to stock recovery: "adb reboot recovery"
- in recovery "apply update from adb"
- adb sideload 00WW_1_150-B01 from post #3
- rebootet to fastboot and continued with steps from post #1 to unlock bootloader
- after reboot device updated directly to 00WW-2_200
Now i am looking for working custom recovery...
Click to expand...
Click to collapse
Thanks for sharing the tip. But apparently the triple-color company will block this
hikari_calyx said:
Thanks for sharing the tip. But apparently the triple-color company will block this
Click to expand...
Click to collapse
Looks like it already happened, 'cause mine says "downgrade not allowed" gonna try again friday. I'll update you
I was lucky enough to get this phone from bh photos as shelf stock and it shipped with android 10. They are currently on sale there for $320. I installed and unlocked bootloader. I may get a pixel as a backup so id be willing to test recovery,roms etc...when someone comes up with something. Ive been out of the Android scene for a while and im curious if root is possible at this time or if that would require 3rd party recovery and/or a kernel
A little update
Bootloader unlocked
This time is a bit tricky
I tried to enter recovery and got "no command". Press volume up + power together every 2 seconds and I got actual recovery
Tried update from SD...no go
Tried update from adb... downgrade is not allowed
Somehow I went to fastbootd and nothing worked
I chose bootloader and this time elf file from post 1 worked (it didn't work when I enter bootloader normal way)
Now I have to find out where I can get boot to patch
mingkee said:
A little update
Bootloader unlocked
This time is a bit tricky
I tried to enter recovery and got "no command". Press volume up + power together every 2 seconds and I got actual recovery
Tried update from SD...no go
Tried update from adb... downgrade is not allowed
Somehow I went to fastbootd and nothing worked
I chose bootloader and this time elf file from post 1 worked (it didn't work when I enter bootloader normal way)
Now I have to find out where I can get boot to patch
Click to expand...
Click to collapse
You can extract boot image from OTA package via payload dumper.
Note: This process is shown for OnePlus Nord 2 and work for any MTK device just replace files as per your model you need to Serch for that)
Credits @Raygen @TheWing
After relocking bootloader you can do safety net pass check to confirm by using following app:
https://play.google.com/store/apps/details?id=org.freeandroidtools.safetynettes
Download Re LiveDVD mtk. Client ( this is ready mtk client ubuntu os no need to Install python, drivers ready to go iso)
re_livedvdV3.iso
drive.google.com
Download Rufus for windows 32/64bit)
https://github.com/pbatard/rufus/releases/download/v3.17/rufus-3.17.exe
Note:Relocking has been done on OOS 11.1 v13 so stock boot img of v13, vbmeta from update zip of v13 is required, recovery must be given below.
Your need to replace files as per oxygen os version you are using.
FOLLOWING are images of DN2101 A13 OOS UPDATE IMAGES EXCEPT RECOVERY IMAGE IT WILL WORK IN ANY PHONE, U NEED YOUR AS PER YOUR REGION I WILL UPDATE THREAD AFTER COLLECTING ALL HERE
Boot img (This is stock A13 indian, other regions must use there current OOS version boot img)( other mtk devices must use there boot img here)
https://forum.xda-developers.com/attachments/boot-img.5460945/
Stock recovery(in zip unzip it you will get img file this will work for any region)( other mtk devices must use there recovery img here)
https://forum.xda-developers.com/attachments/recovery_stock-zip.5464685/
Vbmeta:must have correct vbmeta of current OOS Rom. Version (from stock A13 indian update.zip if U r using EU, OR GLOBAL region NORD replace it with the current OOS version you are for which you want to relock)(other mtk devices must use there vbmeta img here)
vbmeta.img
drive.google.com
All files for EU DN2103 ON A12 UPDTAE :
EU varient v12 files:
Boot. Img:
https://forum.xda-developers.com/attachments/boot_stock_a12-img.5461083/
Vbmeta. Img/
vbmeta.img
drive.google.com
Recovery same link for all)
recovery_stock.zip
drive.google.com
Terminal emulator commands :
1) BOOT TO FASTBOOT connect phone to pc in on condition)
adb reboot fastboot
2)to relock bootloader in terminal emulator connect phone to pc in fastboot mode and type)
fastboot flashing lock
MTK client commands:
1)Flash boot img:
python mtk w boot boot.img
2) Flash recovery img:
python mtk w recovery recovery.img
3) Flash Vbmeta :
python mtk w vbmeta vbmeta.img
wifi is not working. everything working after relock bootloader but wifi is not working
farhansaeeddnp3021 said:
wifi is not working. everything working after relock bootloader but wifi is not working
Click to expand...
Click to collapse
Factory reset u r phone and reboot see
pankspoo said:
Factory reset u r phone and reboot see
Click to expand...
Click to collapse
i did it. but it's not working
farhansaeeddnp3021 said:
i did it. but it's not working
Click to expand...
Click to collapse
Update yourbphone to latest v14
Is there any way to relock the phone just through fastboot? After installing an OTA update, the partitions should match the vbmeta partition, right? So could just relock the bootloader using fastboot flashing lock or would the phone not start then?
NetSoerfer said:
Is there any way to relock the phone just through fastboot? After installing an OTA update, the partitions should match the vbmeta partition, right? So could just relock the bootloader using fastboot flashing lock or would the phone not start then?
Click to expand...
Click to collapse
Your device will go in to boot img corrupt after that.......
PLEASE NOTE: This isnt working if you are on a custom rom! My Bootloader ist broken and locked and I have to figure out how to fix this ****.
Hello Pankspoo.
I reset my Nord 2 again with an A11 image.
Now I wanted to lock the bootloader again. I have implemented your instructions one to one.
After that, the Nord 2 will boot normally and start.
But in the developer options I can still unlock the bootloader. So the option is not greyed out. The OTA cannot be installed but does not lead to a bootloop either.
I used the appropriate boot.img recovery & vbmeta.img.
Do you have any idea?
Best regards
7tyjupiter said:
Hello Pankspoo.
I reset my Nord 2 again with an A11 image.
Now I wanted to lock the bootloader again. I have implemented your instructions one to one.
After that, the Nord 2 will boot normally and start.
But in the developer options I can still unlock the bootloader. So the option is not greyed out. The OTA cannot be installed but does not lead to a bootloop either.
I used the appropriate boot.img recovery & vbmeta.img.
Do you have any idea?
Best regards
Click to expand...
Click to collapse
Check YASNAC app from play store if it's showing safety net check passed your locked.
While installation of OTA what's errors u r getting.
After locking OEM unlock not grates off actually now it's available to unlock again with switchable tab
Sorry for crossposting a lot today, but I am really stuck and it seems that this may be the tool I need. I am on A15, cannot lock bootloader and cannot update.
So, to be sure, for this to work I need the boot.img, recovery.img and vbmeta.img for A15 stock rom? If yes, where can I get those files?
I found the files! Thank you for this guide! It worked perfectly. I really thought my phone was completely bricked. Coming from a Pixel, the root/restore process on this thing is a complete nightmare!!
https://forum.xda-developers.com/attachments/boot-img.5460945/
this link says like this
Oops! We broke the matrix. Someone call Neo!You do not have permission to view this page or perform this action.
Ok. So I think if f-ed up big time! only message I get now is a big red "!" and: "the current image have been destroyed please flash te correct image....
HELP!
Hi, I have a question. I have an unlocked bootloader, if I have my mobile service serviced and I have the original rom reinstalled there will the botloader be locked?
lachatol said:
Hi, I have a question. I have an unlocked bootloader, if I have my mobile service serviced and I have the original rom reinstalled there will the botloader be locked?
Click to expand...
Click to collapse
Definitely, no doubt about that. But the rooting-proces after that is easy and well described here. Don't forget to FIRST take you OTA's, that makes things easier!
exis_tenz said:
Definitely, no doubt about that. But the rooting-proces after that is easy and well described here. Don't forget to FIRST take you OTA's, that makes things easier!
Click to expand...
Click to collapse
I want to lock the botloader, I don't want root anymore. I just need to be sure that if I service the phone for reinstallation to the original firmware, then the bootloader will be locked. Will be? thank you for answer
No worries, it'll be locked after a factory flash!
farhansaeeddnp3021 said:
wifi is not working. everything working after relock bootloader but wifi is not working
Click to expand...
Click to collapse
This happened to me. It turns out that I had version A10 and flashed the A12stock_boot.img and when rebooting I had no wifi. I had no twrp either, since I had just flashed the stock recovery too.
So, I figured "did this actually updated to A12?" I checked the build version on the settings and no, it did not. So maybe thats the reason the system gets confused and some functions (I only noticed wifi) don't work properly.
Anyway, this is how I solved it:
1) restored my A10 version (flashing the file I got from a link on this post)
2) rebooting to A10, I did have wifi. I tried to update to A19 through Software Updater, but even though it did download the update.zip, it failed to update ("didn't pass the verification"). So, I:
3) flashed TWRP again, rebooted into it and installed the update.zip file (in data/ota_package/) that had just been downloaded by Software Updater.
4) Rebooted.
5) Fastboot flashing lock
6) Rebooted again. Congrats, its a brand new phone!!
P.S. Don't forget to lock the OEM unlocking option in Settings.
extranoob said:
This happened to me. It turns out that I had version A10 and flashed the A12stock_boot.img and when rebooting I had no wifi. I had no twrp either, since I had just flashed the stock recovery too.
So, I figured "did this actually updated to A12?" I checked the build version on the settings and no, it did not. So maybe thats the reason the system gets confused and some functions (I only noticed wifi) don't work properly.
Anyway, this is how I solved it:
1) restored my A10 version (flashing the file I got from a link on this post)
2) rebooting to A10, I did have wifi. I tried to update to A19 through Software Updater, but even though it did download the update.zip, it failed to update ("didn't pass the verification"). So, I:
3) flashed TWRP again, rebooted into it and installed the update.zip file (in data/ota_package/) that had just been downloaded by Software Updater.
4) Rebooted.
5) Fastboot flashing lock
6) Rebooted again. Congrats, its a brand new phone!!
P.S. Don't forget to lock the OEM unlocking option in Settings.
Click to expand...
Click to collapse
If u gets wifi issue just flash boot image of OOS version u r using via fastboot
I've just received today the 10T 5G CPH2415.
I unlocked the bootloader in the same way as the Oneplus 10Pro
in settigs OEM unlock and ADB Debug.
by Powershell:
adb devices
Adb reboot bootloader
fastboot devices
fastboot flashing unlock
in case of issue on installing the driver, in fastboot mode, on win11, you need to reboot Windows in the mode "Disable driver signature enforcement"
when the phone is started, reboot again in fastboot then I booted it with the boot.img of the indian version which I found (I patched it with Magisk 25.2).
fastboot devices
fastboot boot patched_boot.img
when it stared, I patched it with Magisk directly.
____________________________
Firmware updating (Full update) keeping the Root:
by using "oneplus local update for android 12" the root can be kept.
Install the firmware with oplocal, dont reboot, open magisk flash it on the second slot; only now you can reboot.
DON'T REBOOT after the FW installation.
The firmware can be downloaded through the app Oxygen Updater. (Full update)
---------------------------
Attachment:
Boot Patched 10T from Indian version img
OPLocal Update for Android 12 apk
Stock boot A06 CPH2415 img
Patched Boot A06 CPH2415 (Magisk 25.2) img
Marco589 said:
I've just received today the 10T 5G CPH2415.
I unlocked the bootloader in the same way as the Oneplus 10Pro
in settigs OEM unlock and ADB Debug.
by Powershell:
adb devices
Adb reboot bootloader
fastboot devices
fastboot flashing unlock
in case of issue on installing the driver, in fastboot mode, on win11, you need to reboot Windows in the mode "Disable driver signature enforcement"
when the phone is started, reboot again in fastboot then I booted it with the boot.img of the indian version which I found (I patched it with Magisk 25.2).
fastboot devices
fastboot boot patched_boot.img
You followed this guide
https://www.droidwin.com/root-oneplus-10t-via-magisk-patched-boot-img/
or did you only flash the patched boot.img?
Click to expand...
Click to collapse
You followed this guide
https://www.droidwin.com/root-oneplus-10t-via-magisk-patched-boot-img/
or did you only flash the patched boot.img?
slavekve said:
You followed this guide
https://www.droidwin.com/root-oneplus-10t-via-magisk-patched-boot-img/
or did you only flash the patched boot.img?
Click to expand...
Click to collapse
Don't follow that guide. You just need to boot (not flash) a patched boot image and then run direct install. This also creates backups of your stock images which you'll need when you OTA.
EtherealRemnant said:
Don't follow that guide. You just need to boot (not flash) a patched boot image and then run direct install. This also creates backups of your stock images which you'll need when you OTA.
Click to expand...
Click to collapse
It is true that when rooting the OnePlus 7 pro I only flashed the repaired boot.img. I was surprised that Sadique Hassan recommends otherwise for this model.
slavekve said:
It is true that when rooting the OnePlus 7 pro I only flashed the repaired boot.img. I was surprised that Sadique Hassan recommends otherwise for this model.
Click to expand...
Click to collapse
Again, DON'T flash the patched image! You must use the direct install method in Magisk after booting the patched image.
EtherealRemnant said:
Again, DON'T flash the patched image! You must use the direct install method in Magisk after booting the patched image.
Click to expand...
Click to collapse
I understand that, but in the instructions, the repaired vendor_boot.img is also flashed. Oneplus 7 Pro does not contain vendor_boot.img file in payload.bin
slavekve said:
I understand that, but in the instructions, the repaired vendor_boot.img is also flashed
Click to expand...
Click to collapse
Are you not listening to me? I just told you how to do it. Boot the patched image and run the direct install. Magisk installer will do what needs to be done for you. This is also the same thing the OP has done. Ignore those other instructions you found, they are incorrect and pose problems when you take OTA updates as OnePlus is moving away from full OTAs to incremental ones that will not flash to a phone with modified images.
For the record, patched dtbo and vendor_boot are needed as well but Magisk does this for you.
Ok, I will follow the instructions above when my phone arrives
any way to activate 5g & volte on non supported carriers - countries?
akaloith said:
any way to activate 5g & volte on non supported carriers - countries?
Click to expand...
Click to collapse
Unlock the bootloader, Install the Global ROM that supports 17 5G Bands both SA & NSA. Which Country you are in ?
Marco589 said:
I've just received today the 10T 5G CPH2415.
I unlocked the bootloader in the same way as the Oneplus 10Pro
in settigs OEM unlock and ADB Debug.
by Powershell:
adb devices
Adb reboot bootloader
fastboot devices
fastboot flashing unlock
in case of issue on installing the driver, in fastboot mode, on win11, you need to reboot Windows in the mode "Disable driver signature enforcement"
when the phone is started, reboot again in fastboot then I booted it with the boot.img of the indian version which I found (I patched it with Magisk 25.2).
fastboot devices
fastboot boot patched_boot.img
when it stared, I patched it with Magisk directly.
Click to expand...
Click to collapse
I have 10T Global, Indian and Chinese ROM Full Package ZIP file, I want to try Global & Chinese ROM on Indian 8/128GB Version
already unlocked bootloader, if I Flash Global or Chinese ROM will my device brick ?
As previously I was using MSM Download Tool which was free now it need authentication, so shifted to Fastboot Enhance
Will the process of flashing via payload.bin brick my device ?
Today it is possible to download EU full package CPH2315_11_A.06 using Oxygen updater
slavekve said:
Today it is possible to download EU full package CPH2315_11_A.06 using Oxygen updater
Click to expand...
Click to collapse
I already root mine OP10T Model CPH2415 which is international ROM but i tried to flash that CPH2315 in Oxygen Updater it was a success but the model of my phone was change also from CPH2415 to CPH2315.
I have OP8T Cyberpunk Edition Which Is Chinese ROM and i Flash Global ROM the thing is it change only the Build number which is right and the model Number still The same KB2000 but this OP10T is different including the model was change when i flash. Anyway it was a success but it shouldn't be like that.
ryu091 said:
I already root mine OP10T Model CPH2415 which is international ROM but i tried to flash that CPH2315 in Oxygen Updater it was a success but the model of my phone was change also from CPH2415 to CPH2315.
I have OP8T Cyberpunk Edition Which Is Chinese ROM and i Flash Global ROM the thing is it change only the Build number which is right and the model Number still The same KB2000 but this OP10T is different including the model was change when i flash. Anyway it was a success but it shouldn't be like that.
Click to expand...
Click to collapse
So that mean all 10T devices are China made and later flashed with region specific firmware's.
slavekve said:
It is true that when rooting the OnePlus 7 pro I only flashed the repaired boot.img. I was surprised that Sadique Hassan recommends otherwise for this model.
Click to expand...
Click to collapse
Hi @slavekve , Sadique this side, sorry for the confusion. Till the OnePlus 9, you only needed to flash the patched boot.img for root.
But with the OnePlus 10 series [10 Pro], flashing patched vendor_boot and vbmeta for disabling verity seems to have become an additional requirement in numerous instances.
But thanks to @Marco589 for letting us know that he has already achieved root without the vbmeta and vendor. Henceforth I have updated my post accordingly as well.
Guys, I have a CPH 2413 device and have tried several times to unlock bootloader... But fastboot commands do not work on my device. Have tried "OEM unlock" as well "flashing unlock" through fastboot. Updated the fastboot and adb drivers, tried to do it through platform tools as well... Got my device replaced as well after the first one didn't get unlocked...
Help needed please
gonetask said:
Unlock the bootloader, Install the Global ROM that supports 17 5G Bands both SA & NSA. Which Country you are in ?
Click to expand...
Click to collapse
I am in greece and carrier vodafone
will i sure have 5g and volte? cause device is not supported by vodafone greece
SREEPRAJAY said:
Guys, I have a CPH 2413 device and have tried several times to unlock bootloader... But fastboot commands do not work on my device. Have tried "OEM unlock" as well "flashing unlock" through fastboot. Updated the fastboot and adb drivers, tried to do it through platform tools as well... Got my device replaced as well after the first one didn't get unlocked...
Help needed please
Click to expand...
Click to collapse
I came across to the same issue, I solved by adding ".\":
.\fastboot devices
.\fastboot flashing unlock
PS
did the OS install the driver of the phone in fastboot mode?
Marco589 said:
I came across to the same issue, I solved by adding ".\":
.\fastboot devices
.\fastboot flashing unlock
PS
did the OS install the driver of the phone in fastboot mode?
Click to expand...
Click to collapse
.\ does not work. Can you please explain which tool you used? or how you managed?