Related
I recently purchased a used Galaxy tab 10.1 I/O, and it had already received the 3.1 OTA update.
Now i want root access for various reasons, and can't seem to find a clear guide on how to do so.. I've found plenty about how to do so on the original 3.0 rom, and that it will carry through the 3.1 update, or for the regular version Galaxy Tab 10.1, but it's my understanding the ROMs were fairly different between the I/O and the retail version and that attempting to cross-pollinate root methods may not be a good idea
although I've rooted and ROMed my fair share of HTC devices and Nooks i'm a little more apprehensive with this unit, as it's my first android device to lack an SD card slot of some sort, so bricking seems like a much worse possibility
The best guide ever is in the development section, it works for your device.
http://forum.xda-developers.com/showthread.php?t=1239185
follow the guide its very easy and worked fine for me
I Return triumphant, and gentlemen, i must say you were incorrect.
The I/O edition does not give you the option to access recovery at any point, even with the Pwr+VOL DN boot.
You can put it into download mode, and certianly use ODIN to install the recovery rom, but you will have no method to actually access recovery to push zip files.
thanks to some quick self education on using fastboot, i was able to root successfully.
To those of you in a similar situation who stumble upon this thread, i invite you to visit:
http://droidbasement.com/db-blog/?p=2439
There you can download CWM in a .img format for use with fastboot.
This link is where you can download fastboot:
http://forum.xda-developers.com/attachment.php?attachmentid=596615&d=1305443483
and you'll need to install PDANet for Android to get the fastboot drivers:
http://junefabrics.com/android/
I belive you'll also need ADB installed from the Android SDK. i do have it installed on this computer, but did not use the ADB command at any point, just fastboot.
Instructions:
1. Download fastboot, PDANet for android, and the recovery image. You'll also need "Samsung_Galaxy_Tab_10.1_root.zip" found in Root.zip from the retail version instructions.
2. Copy the "Samsung_Galaxy_Tab_10.1_root.zip" to the tablet, and and power it off. Disconnect the USB connection
3. Unzip fastboot zip into it's own folder, and then copy your recovery.img file into the same folder.
4. Start the install of PDANet. It will ask you if you want to install drivers about half way through. say yes, and select "Samsung" when the time comes. it will install some drivers and then ask you to try and connect. windows may flare up and say they're unsigned. accept anyway.
5. watch this friendly video on how to start fastboot on your tablet:
http://www.youtube.com/watch?v=sR7vE4IueaU
"fastboot!"
Basically the same as the steps outlined for the retail version, but you will go to the usb icon instead of the box.
6. once the tablet is in fastboot, connect the USB cable. PDA net will recognize it as an ADB connection and try and load itself. it will fail, that's fine. Let the installer exit completely.
7. Open a command line in windows, and get it to the directory fastboot.exe and your recovery image are in.
8. run your fastboot command. i only used it temporarlily, so my command was:
"fastboot boot recovery-cwm_5.0.2.7-sam-tab-10.1.img"
9. the tablet should now boot into the recovery image presented. hooray! follow the remaining instructions from the retail version root, using recovery to load the "Samsung_Galaxy_Tab_10.1_root.zip" and reboot.
10. Once you've done all that, select to reboot. The tablet will reboot. i took the opportunity to disconnect the cable.
11. "Superuser" should now be in your apps, and you're rooted!
Extra Step: Download "Rom Manager" by clockwork from the android market, and install it. from here, opt to flash recovery. Once that's complete, you can now access recovery by launching that program and simply hitting "Reboot into Recovery"
I have no use for this myself but it's not often someone comes back and posts a complete howto on solving their own initial issue. I wish more people would do this. Thanks button clicked.
I just ran into this exact problem and only found this thread after figuring it out on my own. I figured my IO tab just didn't like having clockwork mod installed, but it certainly booted it. I nearly ruined it by accidentally wiping my rom trying to get it to boot at all. I had to repush my install files to the insternal memory using adb after I was able to boot into recovery with fastboot.
I haven't looked around too much (seeing as I only JUST got the damn thing to boot a rom) but is there a fix to that, perhaps installing the retail bootloader?
I'd hate to have to use fastboot everytime my rom doesn't boot. I've gotten used to wiping and installing roms from wherever I am on my other android devices.
I'm not familiar enough with the device to be able to give you a definite answer, but i imagine adding a bootloader from the retail version would give you the recovery option instead of fastboot.
personally, i'm a little more fond of having fastboot around right now, as it's easy enough to get into recovery when flashing things with it, and the bootloader for the I/O is unlocked... i can think of a few fun things to do in the future if i can load any ROM i want into memory, test it, and move on if it's no good... i may even give some of the ICS dailies a try thanks to this.
Always several ways of doing things... glad you got it worked out.
http://forum.xda-developers.com/showpost.php?p=15735928&postcount=2
RootzFan,
that method is flashing an entirely new rom, down to 3.0, just to gain root access and open recovery so you can then return to 3.1.. it has the added byproduct of installing touchwiz.
IMHO, my way is a little cleaner as there is actually zero flashing needed, and you get to keep everything active and installed.
i recommend just going for custom roms - it comes already rooted - yBoot into recovery and flash a custom ROM
I have the IO tab myseldf and have been flawlessly running GalaxyTask custom ROM - http://forum.xda-developers.com/showthread.php?t=1340064
shane86 said:
I recently purchased a used Galaxy tab 10.1 I/O, and it had already received the 3.1 OTA update.
Now i want root access for various reasons, and can't seem to find a clear guide on how to do so.. I've found plenty about how to do so on the original 3.0 rom, and that it will carry through the 3.1 update, or for the regular version Galaxy Tab 10.1, but it's my understanding the ROMs were fairly different between the I/O and the retail version and that attempting to cross-pollinate root methods may not be a good idea
although I've rooted and ROMed my fair share of HTC devices and Nooks i'm a little more apprehensive with this unit, as it's my first android device to lack an SD card slot of some sort, so bricking seems like a much worse possibility
Click to expand...
Click to collapse
oh, def not the best method... just saying it is nice that there are alternatives.
self delete
Fun Stuff.
Important notice! : iLLNiSS made me aware of a serious risk!
If you play with the firmwares manually and not with the flash all bat then DO NOT flash the blobs!
These are the actual bootloader files and stuffing up here will cause a hard brick!
I have to stress this out as it is serious thanks to not having working APX drivers a flshing programs for the Shield!
For starters, I uploaded a copy of the 7.2 developer firmware here:
7.2 developer ZIP on Dropbox
It is the full 1.1Gb update and not the 422mb block based one.
I have done some extensive tests since the first block based update wrecked my rooted Shield.
Some of it will end up in this post as info for everyone.
But lets start with what seems to be the problem for a lot of users right now who run a rooted Shield : Fixing the problem
A downgrade is officially not supported by Nvidia but my tests showed it works just fine if you only go back to the 7.1.
So far my tests showed differen sources for a Shield no longer working after the OTA.
1. The device had an unlocked bootloader and you got the 422mb block update.
This would have stuffed your bootloader and the Shield won't go past 1/4 on the progress bar for the update.
You are in luck as just flashing the 7.1 bootloader will fix it.
After that just dismiss the update and change the settings to manual updates.https://forum.xda-developers.com/editpost.php?do=editpost&p=78466377
2. Your device was already fully rooted and you got the full update that resulted in your Shield doing all sorts of thing but nothing properly anymore.
As long as your apps are still there and the Shield is still somhow usable you are lucky again.
A downgrade to 7.1 will fix it, I will explain the steps required further down.
3. You made bid mods, used Magisk or other rooting tools and now your Shield complains that your system is corrupt.
Bad luck if your bootloader is locked as you loose it all.
Lucky if the bootloader is unlocked as you might be able to keep most if not all during the downgrade.
General words of warning:
Even if your bootloader was unlocked from day one I can not garantee that the downgrade will keep all settings, apps, databases and so on.
For me it works fine as I kept all vital databases on external storage.
The procedures are all based on the developer firmware, on the stock firmware some things can still be done but then again you should not have more than software problems.
On the stock firmware the bootloader is locked by default and you can use some things required to owngrade due to the restrictions of a stock system.
General downgrade procedure for the developer firmware to get back to 7.1 :
If the update did get stuck on the progess bar early on and a reboot won't fix it so you can dismiss the update you just follow the steps.
If you can reboot into the 7.1 then just dismiss the update.
Trust issues or curruption warnings at boot but an otherwise working shield on 7.1 require to flash the 7.1 bootloader again.
In some cases it is possible to skip the corruption warning with a connected controller.
A reboot once you got to the homescreen will determine how bad it is.
Reboot goes fine: You are good.
Reboot keeps nagging with warnings other than the unlocked bootloader: Downgrade.
The downgrade is only required if you have problems or the Shield already runs on the 7.2!
In almost all other cases just flashing the 7.1 bootloader is sufficient.
Fixing a stuffed Shield by sideloading the 7.1 firmware while keping all apps and things:
Enable USB debugging and allow the connections for the computer if you still have access to the settings.
Otherwise you need to flash the 7.1 fresh and might loose vital things that need to install again.
Reboot into the stock recovery, if you use TWRP flashed on the Shield already then please flash the recovery from the 7.1 firmware first.
Hook up the controller and pressing A or B should get you into the normal recover screen past the dead droid.
ADB sideload XXX - where the xxx stands for the filename you have for the developer ZIP.
After the rebbot you should be back on your 7.1 homescreen and can dismiss the 7.2 update.
Also change the update settings while at it
Fixing a fully stuffed Shield and then downgrading to the 7.1 firmware:
If all went down south then you tried a few things and realised there is no way to get your data back and even less to prevent the 7.2 update.
Installing the 7.1 from scratch forces the setup wizard and before you can get anywhere you need to update to 7.2
So much easier to use the linked 7.2 update from above until Nvidia provides it on their download servers.
A vital thing to do is to keep the bootloader locked!!
Same for NOT having TWRP installed on the Shield!
If in doubt flash the 7.1 boot and recovery partitions first then go back into the stock recovery and wipe the cache.
Coming from a stock developer firmware with just an unlocked bootloader you are good to go.
Sideload the 7.2 update.
Unplug when the reboot starts and go into fastboot to lock the bootloader: Fastboot oem lock.
This is a vital step as the new kernel otherwise could ruin the completion of the install.
Ignore the double hassles and go through the wizard so you can enter the settings again to enable the developer mode and USB debugging.
Unlock the bootloader so you can do it all again Last time I promise!
Once you have both the bootloader unlocked AND the Shield in a usable condition past the setup wizard:
Reboot into the recovery to sideload the 7.1 firmware.
After the next reboot you are back on the 7.1 homescreen drirectly and can dismiss the update.
Possible tricks that can help you to prevent the installation of the 7.2 update if you come from a fresh 7.1 install instead:
Don't allow the reboot and instead use ADB to reboot into the recovery.
Wipe the cache - this will remove the scripts required to start the update after the reboot.
The next reboot should bring you back to the homescreen where you can stop the new download of the update and change the update settings.
TWRP, full root and new security measures in 7.2:
The 4.9 kernel used also makes use of a Fstab configuration that no longer includes the system partition.
This and other restrictions currently make the normal use of Magisk impossible.
With no system partition available to Magisk the changes in the boot process come to a stop and the Shield gets stuck during boot.
The added restrictions also make it very, very hard to manually add SU and busybox.
At least without getting the currupt system popup on every boot and finding out that a lot of things still don't work properly.
A final 7.2 firmware is said to be available on the download servers today.
If this final is no different from the current OTA then it will not be of any use for users requiring a fully rooted devices.
With the stock recovery still using the old kernel all attempts to use recovery functions to alter the system for rooting fail as well.
Can't blame the company as all this is part of Google revamp og security and closing backdoors and loopholes for possible attackers.
Personally I think it is Googles way of keeping control over devices they don't actually own.
Anyways I did make some little progress:
Plans for the near future:
Security is good but I like to know what my Android devices are doing and especially what Google likes to collect if I can not find ways to stop it.
So I will not try to use any backdoors or secrurity vulnerablilites in the new kernel to allow a full root on my Shield.
I will go the route I know best: Manual labour
The bootloader is already fixed to allow what we are used to from previous developer firmwares.
As SU and busybox can not be manually entered at this stage I will try to include them directly in the stock 7.1 firmware while renaming the OTA updater to have it a bit easier.
Assuming that works as expected I will do the same on the 7.2 firmware and compare the corresponding scripts and so on.
If the standard SU still works on an "unlocked" 7.2 I should be able to adjust the Magisk ZIP accordingly to implement it into the bootloader.
Only need to figure out if Magisk then has enough rights to work and the system is still happy to accept the changes.
I noly have the 16Gb 2017 model to work with but since the bootloader seems to be same for all Shield models I think if it works then it should do so for all models.
In the meantime I hope the infos here will help some pople to get their shield back without the need to sent it in.
Update 25/12/18: I got TWRP working on 7.2
This is only true for the 2017 model though as I have only this for testing.
Currently creating a backup to the internal storage.
If the restore works then I will upload the new TWRP - for the said model only!
Give me a day or two to fix it for the other models too.
There is progress on the rooting front as well.
Created new scripts for my kitchen to be able to handle the new file_context thing.
A fully pre-rooted and totally unsecure (in terms of ABD, DM-verity and such) is already cooked, just did not dare yet to try it out as I have a real life job too.
As for the pre-rooted firmware:
Things have changed quite a bit with the new kernel in terms of "just adding SU or Magisk".
Magisk might see an update for this problem soon, SU however seems to tally fail on two levels.
So far I was unable to do a full install of the modded firmware.
Flashed all at once and the boot just hangs.
Bootloader, reboot, then the rest seems to work.
At least for the basic install of the system.
If I add SU and busybox the system still ends up with a corrup notice during boot and then it fails.
Tune in over the next few days for progress updates at the end of the thread.
Major developments will be added right here.
Just a matter of finding the last restrictions.
Once that is done Magisk should be possible as well.
Ok, TWRP boot fine, does a backup but fails to restore the system to a bootable state.
Will now check if at least installing a zip works.
Well, it did not, so TWRP has to wait a few more days
I edited post 3 with instructions on how to "unbrick" and go back to 7.1.
Update 27/12/18: A friend of mine found some intersting stuff.
A 7.2 firmware offering a pure Android without any TV stuff but also a full root possible.
I hope he will share his finding here soon or allow me post it all in his name.
For now lets just say: It really works if done the rght way!
Full write rights, installing Magisk modules and all.
All thanks to an undocumented flaw in the device security structures, so even without any hidden backdoors or such LOL
Update: Whiteak was so kind to provide a working root solution in post 36, please check it.
I can confirm it is working as promised.
So the credits for this one go to Whiteak and the credits for the idea and use of the DTB file to Zulu99 - great idea!
To prevent any problems I advise to perform a factory wipe after the install and before the first boot.
Switch to the stock recovery to do this then boot as normal an enjoy.
A complete firmware with the required mods is sitting on my PC just waiting for idiot behing the keyboard to figure out how to pack it properly for flashing.
Once that problem is sorted and also TWRP working again things will get a lot easier.
Annoying update:
I was not able to confirm my web findings on the 7.2 firmwares bootloader but it seems other devices running the same type of kernel and bootloader and a bit lost now.
AVB is fully implemented on the latest level.
(Again I am working on confirming or denying these findings!)
This means any alteration to vital parts of the system will fail with a corruption warning or worse.
Custom recovery access is limited if not fully restricted.
But even if it works you still need a firmware to flash that either is able to disable all this crap, hoping the bootloader alone will allow it, or
to hope Nvidia will provide a future bootloader update with these restrictions removed.
We can not downgrade the bootloader and even if there is some old one out there that would actually be flashable the risk is high to end with a brick anyway.
The DTB, at least in my tests gives us the required system wide write access but I have no information about the AVM verfified boot other than that Zulu99's firmware works.
But if it was compiled with the NVidia developer suite then it will be signed accordingly so the bootloader accepts it.
Could not find any info on how his firmware was actually created.
It gives me the hope though that once I have a fully working TWRP again that my modded 7.2 will work as expected and with no restrictions anymore.
Thanks for the info.
Edit: Will use this post to list options to recover the Shield is all seems lost.
As a result of far too much rom cooking and mods I needed a 100% working way to recover the Shield in case things turn very ugly.
So lets sum up what I define as very ugly when playing with firmwares:
1. Firmware installed but the Shield just hangs on the logo.
2. Firmware installed and now the system is corrupt and even it is boots it takes forever to get around the nag screens.
3. Firmware downgrade attempted but now the Shield won't even boot anymore.
4. Anything that would qualify for a soft brick.
My worst case when I only got a flashing white screen after trying to restore a TWRP backup under 7.2.
There any many way that work for a variety of boot problems but it takes too long to list all cases I encountered with a list of fixes that work or a comment that only the below way works.
So just to be clear here: This is not for any recovery purpose other than fixing what can't be fixed through a factory reset or fresh flashing of the firmware!
1. Get the Shield into Fastboot mode: Connect wired controller and male to male USB cable.
2. Power the Shield up while holding A and B on the controller.
Keep holding until you see the fastboot menu on the screen.
3. Install the 7.1 recovery firmware for your Shield type after unpacking it.
With Fastboot connection working type: flash-all.bat and hit enter.
4. Keep an eye on the progess!
5. Once the Shield is finnished and reboots, hold the A and B buttons on the controller again to enter fastboot mode!
Do not let the Shield boot up other than into the fastboot mode!
6. Lock the bootloader! Fastboot oem lock
Confirm with the controller, then go down and select the recovery kernel.
7. Once the dead droid is on the screen press B on the controller to enter the real recovery.
If B does not work try A
8. Select the factory reset option to wipe all!
9. Once the wipe is done you can boot into 7.1 as normal again.
10. With a bit of chance you might even get directly to the homescreen if the previous setup was completed.
If you need the full seup wizard again and are forced to update to 7.2 then at least the update will work fine this time around.
In case you desire to go back to the 7.1:
If you just finnished the above only to end with the 7.2 then set it up and flash the 7.1 - you won't get the setup wizard again and can skip the update.
If you are on a working 7.2 that was update the OTA way but want to go back:
1. Install the 7.1 firmware.
2. Lock the bootloader.
3. Boot and then skip the update to 7.2.
Any idea what to do if the Shield sticks at the NVidia logo when you select Recovery from Fastboot? I reflashed boot and got the same result.
psycho_asylum said:
Any idea what to do if the Shield sticks at the NVidia logo when you select Recovery from Fastboot? I reflashed boot and got the same result.
Click to expand...
Click to collapse
It won't work from fastboot.
Fastboot operates on a different level and calling the recovery from there lets it end up in nowhere with no access to the system.
You need to boot into recovery through ADB as (for the new model) without a power button and usable hardware buttons we can't get into it otherwise.
Having said that, the fastboot way should still work with an unmodified bootloader.
When the dead droid is on the screen the recovery should be available after pressing the A button on the wired up controller.
But during my tests on 7.2 it did not always work, so you might have to try a few times and also try the B button.
Downunder35m said:
It won't work from fastboot.
Fastboot operates on a different level and calling the recovery from there lets it end up in nowhere with no access to the system.
You need to boot into recovery through ADB as (for the new model) without a power button and usable hardware buttons we can't get into it otherwise.
Having said that, the fastboot way should still work with an unmodified bootloader.
When the dead droid is on the screen the recovery should be available after pressing the A button on the wired up controller.
But during my tests on 7.2 it did not always work, so you might have to try a few times and also try the B button.
Click to expand...
Click to collapse
I have not been able to get to the dead droid screen.
Downunder35m said:
For starters, I uploaded a copy of the 7.2 developer firmware here:
7.2 developer ZIP on Dropbox
It is the full 1.1Gb update and not the 422mb block based one.
(snip)
Click to expand...
Click to collapse
Thanks for posting this, but please note that this firmware is only for the 2017 16GB model and cannot be used with a 2015 or Pro model.
I just got a 7.2.1 update that forced me to update. Wouldn't give me an option to skip it... As soon as I turned on my Shield, it said something about the 7.2.1 update and then rebooted and installed.
I was holding off on updating too so I didn't lose root. Now I'm unrooted and am unable to get Magisk working again until I can get my hands on a 7.2.1 bootloader... Bleh.
Weird, I am not getting the 7.2.1 at all here.
And since yesterday the OTA only tries the block based but not the full image.
AthieN said:
I just got a 7.2.1 update that forced me to update. Wouldn't give me an option to skip it... As soon as I turned on my Shield, it said something about the 7.2.1 update and then rebooted and installed.
I was holding off on updating too so I didn't lose root. Now I'm unrooted and am unable to get Magisk working again until I can get my hands on a 7.2.1 bootloader... Bleh.
Click to expand...
Click to collapse
I was able to downgrade using the 7.2 image after setting up the device on 7.2.1 OTA just make sure you disable automatic updates
Thanks downunder this kind of in-depth info is always appriciated man........i like to learn these kind of things, having bits here and bits there gives a better picture of the whole, while also giving us upto date current info.
Thanks for taking the time to write this :good:
---------- Post added at 07:35 AM ---------- Previous post was at 07:27 AM ----------
Edit
Hi downunder, could you confirm i have this correctly
With no access to fastboot thus no twrp or root, are you implying, assuming your able to inject root into stock firmware, that, i'd be able to flash this stock+root rom in STOCK recovery, which i do have access to?
Edit: im under the impression that stock firmware zips are checked by stock recoveries, so modifying a stock firmware zip tends to fail this check and thus wont install/flash.......which makes me think im misunderstanding here......or just hoping im not
If so, im interested
Edit
i just read your second post which near enought answers my curiousity, so that'll teach me to read beyond the first post before asking answered questions ........even if the post excites me............ahhh, who am i kidding, ill probabably do it again........the equivelancy of a mental post boner........not controllable
Sorry for the disgusting analogy
SyberHexen said:
I was able to downgrade using the 7.2 image after setting up the device on 7.2.1 OTA just make sure you disable automatic updates
Click to expand...
Click to collapse
Did I understand it correctly? You successfully downgraded from 7.2.1 to 7.2?
ErAzOr2k said:
Did I understand it correctly? You successfully downgraded from 7.2.1 to 7.2?
Click to expand...
Click to collapse
Yes,
Just ran flash all from the bootloader. For the newly released 7.2 developer_rooted factory image.
As long as we don't jump to Android 9 we should always be able to downgrade through a full factory firmware.
Once Android 9 comes this might not work anymore due to the massive changes involved for the boot and system checks.
@banderos101: Unless you really did something bad you should always be able to enter the fastboot mode to flash a full firmware.
If I have some time after xmas I will have another look on the options of signing the zip properly or simply to fake it.
Biggest problem will be to generate the corret SHA checksums ince all is installed so I can use the same checksums in the check files.
The bootloader needs them to identify the system and vendor as genuine.
The system needs them to confirm all is actually unmodified as otherwise all fails to boot at some stage.
Modding a proper userdebug firmware is not really that hard, but converting a release version that also is a true and secure user release...
Lets just say that it won't be an easy task.
As it looks like the kernel is a keeper I might have to figure something out unless TopJohnWu won't enjoy a break after his exams and works on a way to get Magisk working with out kernel.
At least I figured out why the recovery trick isn't working for me.
The system partition is not mounted for the sideload mode.
To apply an update the stuff is written directly onto the partition, so no file level access left to play with and break things
In comparison you could say the shield is now like a modern car with keyless operation only.
You know you can start it with ease, if you only could the remote that you left in the drivers seat when you locked the door
SyberHexen said:
Yes,
Just ran flash all from the bootloader. For the newly released 7.2 developer_rooted factory image.
Click to expand...
Click to collapse
Just wondering what is achieved by going back to 7.2?
What do you mean "going back"?
Right now the 7.2 is the official and latest firmware.
I was unable to get my hands in the 7.2.1 but guess it might have been a testversion for certain models only.
I wasted a few hours trying to fix the system image.
First stage was only to get the basic "features" back, like full ADB support, enabling the support to use SU and busybox....
Just what is required to actually allow these nice apps we like to gain root to work.
This backfired badly as right after the start the bootloader complained about the system being corrup and no override to get past this worked.
So of course I then removed the known restrictions from the bootloader...
As you guessed it the damn thing then did not even boot at all, just jumped right into the (locked) recovery mode.
A half decent comparision with my last manual root on a tv box that was a success showed I still did the right things...
If anyone wondered why we needed a new bootloader for the support of smart helpers an some codes stuff:
We didn't as all this could have been done with the 7.1 bootloader as well.
Since my root attempts so far all ended either in disaster or in a root access that failed shortly after/corrupted the system, I took a look of the general kernel changes that were published for other devices.
Before I could find anything meaningful I realised the 4.9 kernel is actually a requirement for Android Pie!
With that info sorted I started digging inti the new "security" features Pie can offer.
I will try to keep it simple and to the stuff that actually concerns us for rooting purposes:
The new boot process with Pie is aimed at being secure from the hardware level up and all the way into the system partion once the boot is completed.
So the hardware checks if the bootloader is actually usable - we had that for a long time, nothing new.
Once the bootloader starts and reaches the point of actually getting somewhere, all partitions required will be checks by either a hash check or a trusted certificate gererated at boot time that is compared to the previous certificate.
Only if that is fine the bootloader will call upon the system and vendor partitions.
The handover of control from bootloader to the system is made far more secure as well.
SELinux is called early on to ensure that only trusted apps and tasks can work but also to all a new control level.
System related apps no longer run as root or with special permissions.
Instead every single app and service runs as its own user!
And under SELinux conditions this means nothing can access anything that it is not entitled to unless included as a user for the other app.
And with that sorted the vendor stuff is called to ensure all hardware and vendor related stuff is still genuine - this include the required certs but also the recovery and bootloader hash codes and certs.
So if something is fishy either SELinux will stop us or the vendor stuff will just overwrite it all.
Once we finally reach the system stage the recovery is checked if called from within the system, if fully implemented it could mean that using an official update on a modded firmware will delete all data as the encryption from the old system is declared invalid.
Sadly it does not stop there because even with full rigths (faked or otherwise) to access the system partition with write access we still can not just change things.
If something belongs to a user (a secure app) than a change will corrupt the system.
To overcome all this without using vulnerabilities that so far no one has found, a compatible userdebug release has to be created from the official user firmware.
DM-Verity needs to be disabled as well as all partition encryption stuff.
The bootloader needs to be adjusted to reflect these changes and the required turst certificates generated and included in both system and boot images.
The only problem here is that the kernel won't allow these changes unless it itself is a userdebug kernel.
After that it is only the little efford to go through about 60 different scripts to remove or redirect the calls for all boot and system security related things.
If then by some chance all this actually boots up and goes all the way into a usable homescreen the entire stuff needs to be secured again.
This time so that the final system has a correct cert and checksum that matches those we need to include in the bootloader.
Anyone knows how to gain full access to the trusted keystore on the 4.9 kernel? LOL
For the moment I don't really care about all the stuff above.
I would be happy to figue out what to make out of these new fstab configurations without the vital partitions listed.
The real aprtitions used have not changed but it is impossible include them in the fastab, doing so causes the bootloader to fail.
Presumably because the kernel realised we try to get around the verification process.
This and some other minor things are also the reason TWRP fails so badly, same for the stock recovery by the way.
Since TWRP is toy a lot us like:
TWRP and 7.2....
Without a system partion in the bootloader fastab TWRP can not mount it.
Same for all other things TWRP needs to mount as it simply does not have the right to access these areas.
To make things worse, we need system access to even start TWRP through fastboot.
So, now matter if we flash or start it through fastboot: The bootloader and system will realise our recovery does not match the checksum.
What does al this now mean in terms a lot more people are able to understand?
Let me try...
Imagine the 7.2 in a running version would be just some encrypted file with a lot of folders in it.
And like PGP or other encryptions software we know there is a private and a public key.
With the public key you can see a lot and use most the encrypted file - but only to a level that is required, nothing above your low level clearance.
For every attempt to write into this file or to make changes we need the private key.
If you follow so far then lets just say the recovery (stock) and Fastboot can be, to some extent, used for this access.
But since every folder in the encrypted file also uses private and public keys it is like tracing a tree.
Although it is getting too long, let me give you the example of just adding SU to the sytem partition:
Adding SU into the system image is no big deal.
Singing this image to get a usable key and including this key into the keystore is.
Assume we would just be able to do it....
SU needs to be called quite early in the boot process.
It then elevates the access level for certain things and also intercepts all root related requests from apps and services.
Except of course those that already had these rights by default.
Problem here is that adding the scripts we need plus changing some others means violating the tree of trust on the device and we get locked out.
Finding a spot to add the required rights for SU might be still possible.
On the other hand it will be impossible to give SU any rights or access to "trusted user" owned parts, files, folders, partitions....
The entire concept of SU just fails.
I will have to check how much of the new features are active in the 7.2 kernel that hinder us.
If I find enough it might be possible it enough to call for a Magisk update.
But I guess it is of little use for just one set of devices, so maybe once more devices on the 4.9 kernel fail to work with Magisk it will be easier to spot a usable pattern.
In case someone else if already working ona mdified system: Please let me know how you made it boot after the changes
Shield Tv 16 2017 - OTA update 7.2.1 Ready for updating
Im on 7.1. I have been waiting for 7.2 developer image, which is now out and just noticed 7.2.1 is available OTA. I'm really confused what to do. I want to keep root without bricking my Shield. Should I Stay with what I have as it is running well.
I am not even sure if it is safe trying to update to dev 7.2 image (or if I would want to) by hooking to computer and using ADB Fastboot tools.
Is there any good reason to update to 7.2 or 7.21? and if so how would I go about doing it? Which program is good for flashing developer images or OTA updates. I used to use flash-fire, which seems to be obsolete now and have heard TWRP is incompatible rooting with SU with OREO updates????
Should I play it safe and stay with what I have rather than experiment and end up with a brick? (wouldn't be the first time)
Anyone know if 7.21 is some-kind of bug fix?
Alot of questions but hope someone has some answers.
Thanks for any info.
"You know you can start it with ease, if you only could the remote that you left in the drivers seat when you locked the door "
My fastboot issue
Yeah, i think i busted the microusb somehow with a faulty usb hub, whenever i plug the usb to my raspberrypi/windows box(for adb/fastboot) now, it turns off all usb ports on the pi aswell as the windows box, even when the shield is unplugged, some sort of earth problem maybe
......all i have is adb over network, adb reboot bootloader simply reboots back to system, adb reboot recovery works though.
ive read that fastboot over tcp(ethernet) had been introduced a couple of android versions ago, but i dont think its been implemented in our shields
infact heres a link
https://www.androidpolice.com/2016/...-capabilities-wireless-flashing-isnt-far-off/
Looks like it needs to be specifically added onto a build
As far as you making a stock root build, if you can, that would awesome, more then awesome, but if it becomes more work then you thought dont worry about it, its not like their making it easy
Also, sounds like 4.9/future android is gonna be a nightmare for root......... having the ability to root so that the option is there to see whats going on in the background of these devices, these devices posessing cameras/microphones/old+latest sensors/personal files/personal info, which reside on our personal beings or in our homes........is just one reason why i dont want to see root go away
So what is the purpose of the developer image of 7.2?
Rather, I know the stated purpose of the developer image, but if it is locked in the way described it sounds like the benefit is negated for typical developers.
(e.g. sometimes I debug an application without permissions in order to benchmark or debug a problem).
For casual users of the shield, using ad blockers and whatnot, is there any benefit to derive from installing the developer rom over stock? Does "adb root" still work?
What is left as the difference. It doesn't sound like they produced a userdebug build of the OS.
Thanks
The 2 new updates are horrible. I have gone back to 7.1. They have crippled my shield. I'll wait for a new update.
Hey everyone,
So! I bought a Sony Xperia 1 (J8110-2019) phone from someone on Facebook Marketplace at a very solid price of £250 (RRP is still £850 in the UK) due to the seller describing it as 'in retail demo mode' so they lowered the price. I jumped the gun thinking I was getting a solid deal and just stupidly assumed it to be a feature I could just disable with *#*#73556673*#*#- me believing I was some insane developer with mad coding skills where in realityI had once flashed and rooted my Xperia XZ back in 2016. [Insert 'Hackerman' meme]
Yes... I am fully aware I'm a complete idiot for not doing a full assessment on the phone and am now having to learn a very important lesson from this situation!!
It seems to have a Store Front firmware installed and unsure what firmware to download and flash? I've tried some of the official stock ROMs from XperiFirm and it just continues to boot into constant 10-second cycles of demo videos making general functionality like phone calls pretty much impossible. without interruption. I've tried Customized and UK Service Provider Firmware such as EE and O2 but it always goes back into Store mode.
I was hoping if anyone would have or could elaborate on how to make an executable system flash zip for a 2019 Xperia 1? When I extract files from XperiaFirm ROMS (FTF,ZIP,SIN etc), I don't seem to get any META-INF files and thus cant make the proper .zip that TWRP needs to successfully flash a new repacked stock ROM? It always ends in a boot loop."
Here are some key points to hopefully give you some background:
I've installed TWRP successfully and have attempted to use 3 official firmware to flash whilst in recovery but have been unsuccessful each time with 'Invalid .ZIP format'. I've only a few times got booted whilst bundling together FTF files via Flashtool and doing it that way round but only ever seems to solve half the problem
I can't use the SinExtract feature in Flashtools as the SIN file errors as not being supported yet to use different file versions.
I can't use PRFCreator as it errors as the FTF file being unsupported (Due to it being new I assume)
I attempted to create my own META-INF>Updater-script but am unable to identify what partition my phone would use for mounting on "/dev/block". I only ever seem to get MANIFEST.MF from the files and nothing else. On my XZ I think I used something like:
(package_extract_file("boot.img", "/dev/block/mmcblk0");
package_extract_file("system.sin","/dev/block/platform/msm_sdcc.1/by-name/system");
Click to expand...
Click to collapse
I have been able to install Magisk for rooting and verified.
I have used Minimal ADB and Fastboot to install programs like TWRP, SuperSu, Magisk but have never attempted, nor would I even know how to wipe my phone completely and install a clean stock ROM - is this possible?
All drivers, software, and systems are correct and up to date (as far as I am aware)
Would installing the' Service Exchange Firmware' be recommended (if I ever make it that far!) due to it being StoreFront?
I checked the IMEI number to see if it was blacklisted/blocked and it's all good. Not lost or stolen.
Thank you for your time to read and wallow in my woes with me my lovelies! Any help would be GREATLY appreciated you magnificent beasts! x
Bump x
...
the last chance... :good:
in this thread i am going to outline the method i used to restore my device to may security patch after completely botching my current install after trying to root, on august security patch.
a major hand to PsYk0n4uT for the suggestions he's posted in response to my problems, giving me the ability to figure out what's really going on here amongst other things.
(this is compatible with metropcs branded devices, therefore is compatible with t-mobile branded devices and so on)
anyways.
download this may OTA i discovered somewhere online. (hint: if download quota is exceeded. make a copy to your gdrive, then put it in a folder. download the folder and you will bypass the quota)
the OTA will contain msmdownloadtool, but it is unusable in it's current form because it's an internal tool. you're gonna want to download this tool off github to help assist in decrypting the .ofp file and flashing it's complete contents over automatically.
extract the OTA zip, and place the tool from github in the same folder. if using linux, install the python requirements and if you're on windows, i would suggest replacing the adb/fastboot executables with current versions. probably shouldn't matter, but i did in this case.
put your phone into fastboot and run the tool. further instructions depending on OS, are on the repository's page.
after flashing i had to switch my active slot over to the prior inactive slot before i could boot.
now that you've got your device downgraded, get through the initial setup, set it up offline, and put your phone into power saving mode so it can't automatically update (just in case)
instead of using DSU sideloader to extract the files we need, we can use the same .ofp file that our images came from and extract its contents with this tool
install magisk, copy your boot image over, patch the boot image, return it back to your computer, and enter fastboot mode.
proceed to flash the boot image, and all 3 vbmeta images. (important: be sure to disable verification and disable verity when flashing your vbmetas)
???
profit
i hope this can help anyone that's got a paperweight for a device at the moment, and help anyone who wants to root their device without a bunch of possible nonsense. in turn, hoping this can accelerate any possible development with this device.
protip: after getting everything installed and set up, install the systemless debloater module in magisk and download de-bloater from f-droid. "remove" the update service application (com.oplus.romupdate) and the software update tab in settings will now think you're on the latest security patch and will prevent your device from accidentally being updated. unless you want that to happen.
mirrors:
[vngsm.vn] GN2200export_11_A.05_2022050718170202.zip | VietNam GSM Services
vngsmservices.com
OnePlus Nord N20 5G Flash File (Official Firmware) GSMMAFIA
OnePlus Nord N20 5G Qualcomm Snapdragon 695 5G Flash File available here with MSM download tool to download via Direct link.
www.gsmmafia.com
And no problem man. Im glad others are sharing their knowledge and experience here. I've been focused on other things trying to make some progress on the device but still having to learn a lot along the way.
Hopefully we will have custom recovery soon. Looking promising so far and the real devs have given more time than I could possibly ever expect towards a device they don't even own.
For anyone wanting to know more about the people that are doing the leg work check out the team at https://t.me/Android_General_Chat The devs work hard to make these things happen so if you wanna help the cause consider making a contribution to them.
dmtec said:
in this thread i am going to outline the method i used to restore my device to may security patch after completely botching my current install after trying to root, on august security patch.
a major hand to PsYk0n4uT for the suggestions he's posted in response to my problems, giving me the ability to figure out what's really going on here amongst other things.
oneplus seems to be weakly supporting this device because i tried to ask them again for the OTA (i mean, it's pulling from somewhere, right) and they told me that i'd need to send it into a service center for repair. what's the point of unlockable bootloaders if user error can't be corrected in some way.
(this is compatible with metropcs branded devices, therefore is compatible with t-mobile branded devices and so on)
anyways.
download this may OTA i discovered somewhere online. (hint: if download quota is exceeded. make a copy to your gdrive, then put it in a folder. download the folder and you will bypass the quota)
the OTA will contain msmdownloadtool, but it is unusable in it's current form because it's an internal tool. you're gonna want to download this tool off github to help assist in decrypting the .ofp file and flashing it's complete contents over automatically.
extract the OTA zip, and place the tool from github in the same folder. if using linux, install the python requirements and if you're on windows, i would suggest replacing the adb/fastboot executables with current versions. probably shouldn't matter, but i did in this case.
put your phone into fastboot and run the tool. further instructions depending on OS, are on the repository's page.
after flashing i had to switch my active slot over to the prior inactive slot before i could boot.
now that you've got your device downgraded, get through the initial setup, set it up offline, and put your phone into power saving mode so it can't automatically update (just in case)
instead of using DSU sideloader to extract the files we need, we can use the same .ofp file that our images came from and extract its contents with this tool
install magisk, copy your boot image over, patch the boot image, return it back to your computer, and enter fastboot mode.
proceed to flash the boot image, and all 3 vbmeta images. (important: be sure to disable verification and disable verity when flashing your vbmetas)
???
profit
i hope this can help anyone that's got a paperweight for a device at the moment, and help anyone who wants to root their device without a bunch of possible nonsense. in turn, hoping this can accelerate any possible development with this device.
protip: after getting everything installed and set up, install the systemless debloater module in magisk and download de-bloater from f-droid. "remove" the update service application (com.oplus.romupdate) and the software update tab in settings will now think you're on the latest security patch and will prevent your device from accidentally being updated. unless you want that to happen.
Click to expand...
Click to collapse
BROOOO you are EFFING AWESOME! MUCH LOVE!
bumping my own thread because people are being real extra after "bricking" their phones trying to get them working again
Really glad people are still working on this device. I've been away for a while and no longer have access to mine right now so just wanted to say thanks to those of you continuing the efforts
Careful with this. Windows Defender flagged a virus when I tried to download it.
(Moderators, please make this post a sticky, and i will keep it updated of any changes or issues that might come up in future builds, thanks)
To clarify things.... I am the dude who figured out how to side-step from model to model... I have went from 2419 (android 12 .11), to 2413 (android 13), Down to 2415 (android 12 .08), then 2417 (android 12.10), back up to 2415 (android 13), down to 2415 (android 12 .05), 2417 (android 12 .08) and finally a FULL sidestep 2417 (12 .08) to 2415 (12.08) which the latter is supposed to be impossible, with downgrade package, yet i am sitting here and i have done it!
Spoiler: Credits for discovery ===>
!!! Credit for discovering the Downgrade Packages, and Information about OPPO/Oneplus Bootloader restrictions goes to, Maamdroid , and EtherealRemnant !... Without their most important input, i would not have had the courage, and knowledge of exactly what i was going up against, in attempting a region change on a BL/Carrier locked device. They were the geniuses who helped me derive this method, i was just the guinea pig willing to go Dr. Frankenstein on my T-Mobile locked, handicapped device. !!!!
Spoiler: ***DISCLAIMER***
**" I TAKE NO RESPONSIBILITY FOR BRICKS, BOOTLOOPS, SYSTEM CRASHES, INSTABILITY.... WORLD FAMINE, 6G MUTANT INVASION, NANO BOTS ENTERING YOUR FANNY, TRUMP RE-ELECTION, CIVIL WAR, YOU FORGETTING TO DO THAT THING YOU WERE SUPPOSED TO DO EARLIER.... 72 HOUR KARDASHIAN MARATHONS, GLOBAL WARMING, YO MAMA SLAPPING YOU, OR ANY OTHER SIDE EFFECT FROM ATTEMPTING THESE IMAGINARY WORDS THAT YOU THINK YOU ARE READING, YET YOU ARENT BECAUSE READING HASNT BEEN INVENTED YET IN YOUR TIMELINE B.C.5182 , AND THE FACT THAT YOU ARE A MEAT POPSICLE... PROCEED ONLY IF YOU FEEL FULLY CONFIDENT IN THE ANALYSIS YOU ARE ABOUT TO IMAGINE READING , AND THEN REPEAT AFTER ME: ***
" I AM FULLY AWARE OF THE RISKS INVOLVED WITH MAKING MODIFICATIONS OR EXPLOITING FUNCTIONS THAT WERE NOT INTENDED TO BE USED IN THE METHOD I AM ABOUT TO USE THEM FOR. AND IF A ZOMBIE APOCALYPSE ERUPTS DUE TO ANY MISTAKE I MADE FLASHING THE FILES LISTED HERE, I WILL NOT EVER ... EVER... EVEN CONSIDER ANY WORDS READ FROM HERE, AS HAVING ANY THING BUT A TRULY POSITIVE EFFECT UPON MY LIFE! " .... PROCEED!
Spoiler: Only open if you acknowledge the risk!
The ONLY requirements of the downgrade packages on the 10T, is that you CANNOT downgrade to a build version that is lower than your current one IF you are attempting to region hop while staying on the same version of android.... (ie. you cannot go from A12 .10, to A12 .08... but you can go from 2415 A12 .05 to 2413 A12 .08) Got that?
One other important thing is that in the zip file that contains the payload.bin, there is an additional file named payload_properties.txt. You need to open that file in a text editor, and look for the line about the "Update_Engine_Check_Disable".... by default it is set to 0 which makes Local Updater check to see if the models match in some files. A mismatch will just cancel your update. Local updater is KEY to doing any Region Swaps, especially with a locked bootloader. This is because Local Updater does NOT perform any of the flashing itself... that whole progress bar is your phone verifying the contents of the payload.bin to make sure that all files in the manifests are present, and compatible with your device... it actually KEEPS YOU FROM BRICKING your phone because of a mismatched file/ or bad flash. If Local Updater detects ANYTHING that is not interchangeable, it will crash during the verification, your phone will reboot, and start normally as if you never attempted an update.
Local updater is also not capable (afaik) of applying ANY changes to the Bootloader, or boot partition. As well it seems limited in its ability to even fully access some userdata files. All of my developer options were in exactly the same state that they were prior to each flash. The only deviation of that , was in DOWNGRADING from A13 to A12... but every upgrade, no matter which model fw used seemed to have done the 'Data, system, bin, etc, var, lib, and kernel, plus a few others' , but the truly secure partitions such as 'aboot, xbl, and system-priv' + deep memory blocks werent touched i believe.
The END result of each region swap will be your device FULLY IDENTIFYING as the model for that region.. (ex. 2419 will now show as 2415 if Global, 2413 if India, or 2417 if North America)
This will change EVERY TIME you flash a different region, and Local Updater will block you from flashing if it detects a lower build, EXCEPT for the 2415 Downgrade Package. So ALWAYS use that as a base if you want to go to another region. <ie. to go from 2413 to 2417, i recommend first flashing the 2415 downgrade, which will put you on A.08 build, then you can update to any region you want, even the Android 13 builds.... but if you want to go to a different region and back to 12, you must use that 2415 Downgrade or Local updater will stop you. The 2415 is a signed official rollback package direct from oneplus, so it allows you to downgrade from pretty much any version.
***** KEY FACT ***** This ONLY applies to OTA upgrade and downgrade packages that come in a single zip file that contains 3 items. Payload.bin Payload_properties.txt and Meta_Inf folder ... If you unzip the fw that you dl, and it contains anything other than those 3 that i just named, you either have a Fastboot package, a Full system package, or a MODIFIED package which you should NOT interact with unless you completely trust the source it was dl from. I have seen some NAAAAASTY scripts, coded in Russian, Vietnamese, Chinese, and Wingdings (yes that weird windows font!) ... and they are becoming VERY GOOD at moving to an app directory, changing a files name and replacing that file with WHATEVER IT IS, but renamed to a something common to the location! So by doing that, those files evade most onboard detection, if they have modified code, because that file name was whitelisted . Stick with the signed rollback package, and OTA either direct from the Oneplus community websire, or from the "gsmmafia" site, as both are packages sourced direct from the manufacturer and contain no modified code!
***How to get the OTA files for the region you want to switch to... follow instructions EXACTLY and you wont have an error.***
You have to use the "OXYGEN UPDATER" app from the google play store... When you first open it , it will tell you that your device is on the current version... ignore that, and you have to open the settings menu for it, and go enable ADVANCED MODE.... This will allow you to go back and CHOOSE what device you are supposedly using. (kinda a cheap override command)... doing this will let you choose the 2417 (NA) model. **Now once again HIGHLY IMPORTANT that you are doing this ONLY after flashing the Downgrade/Rollback so that you will be on 2415 A.08 build... cuz then when you select the 2417 model, it will show an update available for 2417 A.12 build. and also the Android 13 Beta. Pick whichever you want, and click download... NOW once downloaded DO NOT HIT THE REBOOT BUTTON.... this will attempt to flash it via normal methods... instead jump into ADB , go to Shell, and head to /sdcard/ and start looking for the folder where it just downloaded the update. It places it sometimes in the main /Sdcard/ folder, and other times in the /Sdcard/Android/Data/<app name>/ folder.... you will know it when u see it. Find it and copy it to your computer and then you have the official OTA saved. After that, make sure it is moved to the /Sdcard/ folder and use "local updater". Will ask you to confirm, click Ok, and it should start the verification and flash process.
Be advised it will APPEAR like its frozen or no progress for like 4 minutes, then it will slowly start moving. Once it gets to 99, it will appear stuck again... just be patient and about 5 min later it will complete. Total flash time is arouund 20-25 min.
DO NOT FORGET TO UNPACK THE ZIP FILE
EDIT THE PAYLOAD_PROPERTIES.TXT
CHANGE THE "0" TO A "1" ON THE ENGINE_UPDATE_CHECK_DISABLE =
SAVE THE CHANGES, AND RE - ZIP THE CONTENTS
THEN COPY THIS ZIP FILE TO YOUR /SDCARD/ FOLDER!
if you dont it will fail!
Links to Downgrader Packages used can be found HERE
EDIT: I went ahead and linked the main files necessary for this whole process here for ease, and my peace of mind. Now I know that you have all re required tools. Enjoy!
2015 Rollback Package, courtesy of EtherealRemnant
Oxygen Updater (for current OTA of region)
Local Update apk (official)
... And to clarify again.. This does NOT unlock the bootloader, nor does it change our T-Mobile Devices ability to unlock via conventional methods. (still working on that)
Quick expl. In our T-Mobile models, Oppo worked directly with the carrier and enabled a feature new to Android 12 and future builds, which allows the FACTORY bootloader to be wrapped up and hidden from the FastBoot binary... And move a "copy" of the bootloader into "userspace" partitions. These partitions are called AFTER the initial secure boot has passed, and therefore disabled normal FastBoot operations. Instead in userspace, "FastbootD" is enabled, and for all who know of it, that is not much more than a glorified recovery. All OEM, and Flashing commands are rendered inoperable, because bootloader operations cannot be modified once the system is up, or in "default mode". This proves my theory of Local updater not modifying partitions. It uses the currently identified locations of the files that need to be updated to the new region on just changes them where they are already located. For "FastBoot mode" to work properly, it would need to UNWRAP the original bootloader, and disable the "Userspace Init" instructions, which cannot be done on a already running OS.
If somehow you are LUCKY and after your region change, you are able to run 'adb reboot bootloader' ... And your device starts in 'Fastboot Mode' and does not kick you out, then you should be fully able to run the Unlock commands to unlock your bootloader, without need to flash anything else. The chances of that are very minute... But I have seen stranger things with this device. Tho most likely, that command will reboot you right back into normal android immediately .
I have this problem with bootloader and I don't know how to solve it on ghasedak24 website.
mrwilliamm said:
I have this problem with bootloader and I don't know how to solve it on ghasedak24 website.
Click to expand...
Click to collapse
what you mean??? i dont have any info pertaining to the real bootloader for this, the Tmobile model. Ours ships with this Oppo/Oneplus Hybrid crap what makes Fastboot Mode inaccessible. It doesnt respond to the keypress method of getting to it... and adb reboot bootloader attempts to boot into it, but the phone reboots exactly .5 seconds aftter it shows the screen. The only thing you can access is FASTBOOTD which give you literally ZERO functions that we need for the bootloader. OEM, BOOT, Flashing, Flash all fail in FASTBOOTD. Other than that man i honestly would suggest you speak with MAAMDROID because they seem to know more about the OPPO loader. MY knowledge of what is taking place came from me interrogating a Oneplus employee for about 4 straight hours when he broke and told me everything.
NOW I WILL STATE ONE DEVELOPMENT.... The GSMMAFIA user who is responsible for all the MSM firmwares that are now available for the 10T, is 100% legit. You can download the entire UPDATED Full Flash FW including the MSM TOOL... for free.... but without a login/pass authenticated, they are not much help to us. BUT... i have confirmed that the guy is a REAL Oneplus Employee, and he uses official software to remote connect and flash the MSM Unbrick firmware to your device. His charge is $45 ... but he is HIGHLY sensitive to ppl with Fiddler, or any capture programs running on your computer, so much to the point that he checks your app tray and task manager when he remote connects, and if he even sees one of these kinda programs, you lose your $45 and he disconnects. Just head to the GSM Mafia page for the 10T firmware and you can get his WhatsAPP number to contact him and setup.
Me personally, I have WAY MORE than just Fiddler, Wireshark, Proxifier, WinpCap, and many more programs that i know will spook him, and i am not gonna wipe my pc for something that is not guaranteed to do what i want. BUT if you have a bootloader error, you have nothing to lose, and flashing a full, Unbrick fw thru MSM, like he does just MIGHT format all partitions first and therefore erase the instruction init filee that locks up fastboot. Literally EVERY model except the 2419 has normal Fastboot, and an unlockable BL....
Just a thought!
I did not find any over the air or upgrade packages for the 2417 model from the above link. How did you get back to the 2417 model? And what APK did you use because some of them did not work on my device. It would just say verification failed. I thought I tried to go from a global.08 to the over the air .10 2417 model but it didn't work for me it just said verification failed. I did try to go sideways from the global .10 to the North American .10 but it also did a verification failed. maybe I'll try again. I got the over-the-air 2417 model update from the OnePlus updater app.
tdamocles said:
I did not find any over the air or upgrade packages for the 2417 model. How did you get back to the 2417 model? And what APK did you use because some of them did not work on my device. It would just say verification failed. I thought I tried to go from a global.08 to the over the air .10 2417 model but it didn't work for me it just said verification failed. I did try to go sideways from the global .10 to the North American .10 but it also did a verification failed. maybe I'll try again
Click to expand...
Click to collapse
You have to use the "OXYGEN UPDATER" app from the google play store... When you first open it , it will tell you that your device is on the current version... ignore that, and you have to open the settings menu for it, and go enable ADVANCED MODE.... This will allow you to go back and CHOOSE what device you are supposedly using. (kinda a cheap override command)... doing this will let you choose the 2417 (NA) model. **Now once again HIGHLY IMPORTANT that you are doing this ONLY after flashing the Downgrade/Rollback so that you will be on 2415 A.08 build... cuz then when you select the 2417 model, it will show an update available for 2417 A.12 build. and also the Android 13 Beta. Pick whichever you want, and click download... NOW once downloaded DO NOT HIT THE REBOOT BUTTON.... this will attempt to flash it via normal methods... instead jump into ADB , go to Shell, and head to /sdcard/ and start looking for the folder where it just downloaded the update. It places it sometimes in the main /Sdcard/ folder, and other times in the /Sdcard/Android/Data/<app name>/ folder.... you will know it when u see it. Find it and copy it to your computer and then you have the official OTA saved. After that, make sure it is moved to the /Sdcard/ folder and use "local updater". Will ask you to confirm, click Ok, and it should start the verification and flash process.
Be advised it will APPEAR like its frozen or no progress for like 4 minutes, then it will slowly start moving. Once it gets to 99, it will appear stuck again... just be patient and about 5 min later it will complete. Total flash time is arouund 20-25 min.
DO NOT FORGET TO UNPACK THE ZIP FILE
EDIT THE PAYLOAD_PROPERTIES.TXT
CHANGE THE "0" TO A "1" ON THE ENGINE_UPDATE_CHECK_DISABLE =
SAVE THE CHANGES, AND RE - ZIP THE CONTENTS
THEN COPY THIS ZIP FILE TO YOUR /SDCARD/ FOLDER!
if you dont it will fail!
thx for reminding me.. adding to OP
beatbreakee said:
You have to use the "OXYGEN UPDATER" app from the google play store... When you first open it , it will tell you that your device is on the current version... ignore that, and you have to open the settings menu for it, and go enable ADVANCED MODE.... This will allow you to go back and CHOOSE what device you are supposedly using. (kinda a cheap override command)... doing this will let you choose the 2417 (NA) model. **Now once again HIGHLY IMPORTANT that you are doing this ONLY after flashing the Downgrade/Rollback so that you will be on 2415 A.08 build... cuz then when you select the 2417 model, it will show an update available for 2417 A.12 build. and also the Android 13 Beta. Pick whichever you want, and click download... NOW once downloaded DO NOT HIT THE REBOOT BUTTON.... this will attempt to flash it via normal methods... instead jump into ADB , go to Shell, and head to /sdcard/ and start looking for the folder where it just downloaded the update. It places it sometimes in the main /Sdcard/ folder, and other times in the /Sdcard/Android/Data/<app name>/ folder.... you will know it when u see it. Find it and copy it to your computer and then you have the official OTA saved. After that, make sure it is moved to the /Sdcard/ folder and use "local updater". Will ask you to confirm, click Ok, and it should start the verification and flash process.
Be advised it will APPEAR like its frozen or no progress for like 4 minutes, then it will slowly start moving. Once it gets to 99, it will appear stuck again... just be patient and about 5 min later it will complete. Total flash time is arouund 20-25 min.
DO NOT FORGET TO UNPACK THE ZIP FILE
EDIT THE PAYLOAD_PROPERTIES.TXT
CHANGE THE "0" TO A "1" ON THE ENGINE_UPDATE_CHECK_DISABLE =
SAVE THE CHANGES, AND RE - ZIP THE CONTENTS
THEN COPY THIS ZIP FILE TO YOUR /SDCARD/ FOLDER!
if you dont it will fail!
thx for reminding me.. adding to OP
Click to expand...
Click to collapse
the OP updater app only shows the 500mb OTA 2417 and not the 4gb full install. Will it still work? On the global version .08 I could not get the in built local install to install anything without verification failure. Also 2417 variant does not have beta 13.
tdamocles said:
the OP updater app only shows the 500mb OTA 2417 and not the 4gb full install. Will it still work? On the global version .08 I could not get the in built local install to install anything without verification failure. Also 2417 variant does not have beta 13.
Click to expand...
Click to collapse
Links straight from 1+ community... android 13 OTA update packages for 2413, 2415, and 2417 ....
AND
Rollback packages for the same respective models... All in zip format. Must unpack and change payload_properties... Yadda yadda....
Android 13 all regions and Android 12 rollback all regions!
Now you can rollback to any region you want and start from there! I must remind EVERYONE... If you have not Sim unlocked your device prior to changing regions, you will lose that ability for the near future, because there will not be a T-Mobile official upgrade/rollback packages released afaik until maybe after the new year. (Don't know why.. just relaying what T-Mobile told me!). But the Unlock apk is strictly for the 2419 model and there is not currently a way back to it.
And be aware, that if you have ANY belief that you might be considering either doing this or maybe unlocking bootloader if we find an exploit, I highly advise you flip your OEM UNLOCKING switch to ON, now! Because T-Mobile may find a way to turn that toggle grey again if your sim is still locked. Just an fyi
tdamocles said:
the OP updater app only shows the 500mb OTA 2417 and not the 4gb full install. Will it still work? On the global version .08 I could not get the in built local install to install anything without verification failure. Also 2417 variant does not have beta 13
Click to expand...
Click to collapse
GLO version is not NA. GLO is 2415 EU. I know this because this is the reason I'm stuck on 2415.
yes you are correct... and i can honestly say i have NO idea where i got a 2417 beta 1 android 13 firmware from, but I DO have it downloaded to my computer ... I am looking at it. I know for a fact that i got it from some chinese site, or vietnamese ... something like that... but because of that i wont upload or link it, as i stated in my OP, i had 2 of my Laptops, one macbook pro running parallels 18 from bootcamp, AND my Dell laptop, BOTH infected with a VERY FIERCE malware/virus that took me almost 12hrs to find everything altered, and i STILL dont feel 100% about that! I get some random cpu spikes while doing nothing, but cannot find the process doing it. So it was definitely a modified package of android 13 ... C.11 .... (which gives me ideas because if they modded a payload and it still flashed, then maybe i can do the same to crash that dumbass init script somehow.... anyways... different thread)
if i find the link i will post it with caution.... but YES that 573 mb file will work to move you to 2417. Personally i would consider looking more towards using a GSMMAFIA Full Flash FW, for 2417 , but thats just me, and i trust them. but again, Yes this file will work.
(its very funny how the official oneplus site shows 3 different files for 3 Android 13 updates, as well as 3 files for 3 rollback packages
NONE OF WHICH are the 2419.... why create 3 files for 2 versions?
I can't move to 2417 from 2415 with built in updater. Even changed 0 to 1. Downloaded update apk and it doesn't see ota zip in root directory. I think I need full install zip for 2417. Any ideas how to go from the 2415.08 to the 2417.10? What's even better is the global package doesn't want to install either through the inbuilt updater. I have to use the updater APK to install the global package.
There's something in that zip that keeps it from verifying it and it's not the zero and the one. The updater APK doesn't even see that zip file it only sees the GLO zip file.
The incremental GLO a.12 did not want to flash. Failed every time I tried. The full GLO a.12 package was giving me problems flashing also. It would get to 40% complete and then fail. Third time flashing after rebooting finally took.
beatbreakee said:
yes you are correct... and i can honestly say i have NO idea where i got a 2417 beta 1 android 13 firmware from, but I DO have it downloaded to my computer ... I am looking at it. I know for a fact that i got it from some chinese site, or vietnamese ... something like that... but because of that i wont upload or link it, as i stated in my OP, i had 2 of my Laptops, one macbook pro running parallels 18 from bootcamp, AND my Dell laptop, BOTH infected with a VERY FIERCE malware/virus that took me almost 12hrs to find everything altered, and i STILL dont feel 100% about that! I get some random cpu spikes while doing nothing, but cannot find the process doing it. So it was definitely a modified package of android 13 ... C.11 .... (which gives me ideas because if they modded a payload and it still flashed, then maybe i can do the same to crash that dumbass init script somehow.... anyways... different thread)
if i find the link i will post it with caution.... but YES that 573 mb file will work to move you to 2417. Personally i would consider looking more towards using a GSMMAFIA Full Flash FW, for 2417 , but thats just me, and i trust them. but again, Yes this file will work.
(its very funny how the official oneplus site shows 3 different files for 3 Android 13 updates, as well as 3 files for 3 rollback packages
NONE OF WHICH are the 2419.... why create 3 files for 2 versions?
Click to expand...
Click to collapse
Hey you seem like a very competent programmer you should shoot me a private message and add me and discord I have the OnePlus 10t and I've been trying to figure out how to restore it if we run into a problem again I did restore them at once but it doesn't seem like I can do it the same way again I would like to get more details but I want to keep it to a private chat cuz I don't want to get people's hopes up a way to fix a phone that isn't real
This is great! I have been looking to change region from India onto a Global Version.
I have the Oneplus Ace Pro which is a chinese release of the 10T, the seller I bought this from flash it to Oneplus 10T India region.
Will give it more time though, wanted to get feedback first from those that has the Ace Pro Version.
so after doing some research i have found 2 things... 1. Oppo has ppl watching this thread and has made some alterations to the files that come from their server... these are the only 3 i had original copies of but of those 3 ALL of them had a minor difference and all were modified right after I revealed that i had success in converting my 2419 to a 2415. Once i stated that i was able to move to ANY region using my method, SOMETHING very small was changed in the files, and that is the reason the 2417 OTA fails to load in Local Updater... look at the attached pic.
So this is obvious that they are onto us and this is a concern to them. You should still be able to Downgrade with any region that has an Android 13 Beta. The technique works perfectly as long as you have a full version of Android in between.... AKA 12 to 13, and 13 back down to 12. And because of the new links in the OP, you can use local update to roll back to 2413 or 2415 ... I do believe that a 2417 beta is imminent and as such there will have to be a 2417 rollback released with it. There is still no danger with using this method, as you see because if the file is incompatible. local updater will fail to populate it!
Now for the second thing. OPPO used to have a special function in the Engineering Mode, which when activated would re-enable Fastboot Mode on the devices temporarily. This function is still alive in these devices today, only it has been hidden away deeper. This was confirmed to me after another grueling 3 hr chat with OnePlus technicians. I was told, "Sir we do not have access to the program you are asking about. The MSM Tool is completely maintained and controlled by OPPO division, and while yes we are under their ownership, there remains 2 different divisions in our company" ... 1st tech ..... "Sir you would need to enable fastboot mode so that you can flash the original firmware to your device, if it is failing to boot. You need to enter "Factory Mode" and input the locking code which is calculated from your device Imei. Once you have entered the code, you will be instantly rebooted into fastboot mode, and there you will be able to flash the signed firmware to it. Do not attempt to flash unsigned firmware as it will fail if your device comes with a locked bootloader." ..... 2nd tech......
This is not FastbootD he is talking about, because in FastbootD you do not need "Factory Mode" to enter it, and a little bit further research found this post which almost exactly matches what the tech told me!
Factory Mode Unlock
Of course the same way that Oppo decided to interfere with me, they also interfered with this method. They went and simply unlocked engineering mode completely in our devices, which made the screen where you enter the code, vanish. But i guarantee you, that based on some digging into the system files that our devices have running, i found several processes mentioning privileged processes that have simple flags that are called when "pre-boot" functions are initiated. Now in YEARS of time that OPPO has had to deal with the programming these devices they have never managed to actually eliminate "Fastboot Mode". They just become sneakier in hiding it behind user accessible operations. I am fully confident that the same thing applies here. While i dont have all the answers, i implore you all to apply the knowledge i have given and help find just where it is hidden in ours.
To call Engineering Mode on our phones, the code was changed to:
*#899*
Maybe the unlock screen has been hidden in here under a different label... maybe they created a new dialer code, but make no mistake, OPPO must have a need for this mode for repairing our phones otherwise they would eliminate it completely. Oppo is a 2-bit chinese company who is too cheap to design a new OS, and therefore somewhere, there is going to be a method to gain what were looking for. That is all i have for now.... but i am still digging. ( i have managed to get an additional 2 weeks to hold onto the 10t before i have to drop it into the return box and hand it over. So any ideas that you come up with, you DO NOT have to risk your personal devices! I can try ANYTHING on mine with absolutely ZERO ****s to give, as to it getting bricked! BRAINSTORM PPL! let me know what you come up with and i will try it!)
AkayamiShurui said:
Hey you seem like a very competent programmer you should shoot me a private message and add me and discord I have the OnePlus 10t and I've been trying to figure out how to restore it if we run into a problem again I did restore them at once but it doesn't seem like I can do it the same way again I would like to get more details but I want to keep it to a private chat cuz I don't want to get people's hopes up a way to fix a phone that isn't real
Click to expand...
Click to collapse
as soon as i get some free time, possibly this evening or tomorrow morning, i will shoot you a dm and we will link up.
tdamocles said:
There's something in that zip that keeps it from verifying it and it's not the zero and the one. The updater APK doesn't even see that zip file it only sees the GLO zip file.
The incremental GLO a.12 did not want to flash. Failed every time I tried. The full GLO a.12 package was giving me problems flashing also. It would get to 40% complete and then fail. Third time flashing after rebooting finally took.
Click to expand...
Click to collapse
Well i do know that the Zero - One does trigger a fail, thru simple trial and error. But you are correct in that it is much more than that. I have managed to open 2 different Payload.bin files, SWAP highly important files in each such as Boot.img ... and then pack them back, AND THEY STILL FLASHED... so it definitely doesnt have anything to do with the file signatures, because the sigs would change considering the boot.img is of different sizes. There is something possibly hidden in one of the Android Manifest files, or one of the many Build.prop files in the Payload that is what triggers a fail. If we can figure out exactly what file it is, we can find out whether we can alter them, or eliminate them completely. My focus has shifted though, now that we have a working region swap. Now i am focused on this special function of the engineering/factory mode, because if it can be found, it will mean a FULL BL unlock... THAT will negate the need for these, because we will be able to flash whatever we want !
AND YES OPPO.... I KNOW YOU ARE WATCHING MY THREAD NOW! JUST KNOW THAT IDGAF! I AM AND I WILL CONTINUE TO CHIP AT YOUR B.S. ATTEMPT TO KEEP OWNERS FROM DOING WHATEVER THEY WANT WITH THEIR DEVICES! YOU DONT OWN THE PHONES... YOU MANUFACTURE THEM! ONCE THEY LEAVE YOUR WAREHOUSES, AND WE PAY THE STORE FOR THEM, THEY BELONG TO US. IF YOU DONT WANT TO SUPPORT THEM AFTER WE CHANGE THE FW, SO BE IT.... BUT THAT DOES NOT GIVE YOU THE RIGHT TO DENY US THAT OPTION... THIS AINT CHINA! THE VAST MAJORITY OF THE WORLD WHICH PURCHASE YOUR PHONES ARE FREE REPUBLICS, SO YOU DONT DICTATE OR GOVERN THE USAGE OF OUR DEVICES! REALIZE THIS OR BECOME LIKE MOTOROLA, AND SO MANY OTHER COMPANIES WHO WENT OBSOLETE FOR A VERY LONG TIME! WHEN YOUR SALES DECLINE 50% OR MORE BECAUSE YOU ALIENATED A BIG GROUP OF YOUR CUSTOMER BASE, THEY WILL ELIMINATE THE EXECUTIVES WHO WERE RESPONSIBLE FOR THIS LOSS!
beatbreakee said:
as soon as i get some free time, possibly this evening or tomorrow morning, i will shoot you a dm and we will link up.
Click to expand...
Click to collapse
So I actually have a complete list pulled off of my OnePlus 10t the 2417 edition of the ussd codes otherwise the dialer codes that can and should work on the phone I can post them if you want or I can send a link to them.
kramnod said:
This is great! I have been looking to change region from India onto a Global Version.
I have the Oneplus Ace Pro which is a chinese release of the 10T, the seller I bought this from flash it to Oneplus 10T India region.
Will give it more time though, wanted to get feedback first from those that has the Ace Pro Version.
Click to expand...
Click to collapse
Hey man, that happened to me as well... Amazon right?.
So the only issue is the 12GB Ram... And the antennas in my case (I cant get 5G).
So why do you want to change?.....
I want to know so i can change it as well, lol