Database Users

[GUIDE] Root & recovery WITHOUT oem unlock & wipe (2.3.2 & older, plus now 2.3)

[GUIDE] Root & recovery WITHOUT oem unlock & wipe (2.3.2 & older, plus now 2.3)
UPDATE #2 - Fitchman has reported successful root and rom flash without unlocking the bootloader by using Ginger Break. Full details in this post: http://forum.xda-developers.com/showpost.php?p=13236136&postcount=135
UPDATE - IMPORTANT: This method does not work with Android 2.3.3. Search the forum or this post in this thread for a way to update to 2.3.3 and root without unlocking if you haven't updated yet.
Alternatively, use this method on 2.3.2 and lower, then use titanium to back up everything, store it on your laptop (along with all your sdcard's data), then do the oem unlock step first and then continue from there with the rest of the guide.
Not my original idea, but a consolidation of a discussion between inakipaz and shrivelfig and myself in another thread and being posted here for easier finding by future root-seekers.
Shrivelfig's tested the method to re-root a previously rooted pone with a re-locked bootloader, and inakipaz has done it on a phone that's never had the bootloader unlocked.
The advantage here is that those who chose not to root when they first got the phone won't lose any app data or sdcard data like the methods that have you unlock the bootloader do. The disadvantage is your bootloader remains locked, which may prevent you flashing certain things in the future.
edit: see ravidavi's posts below; he's shown you can even flash custom roms that are clockwork compatible while having a locked bootloader with this method.
Download these two files:
clockwork recovery v3.0.0.5 or clockwork recovery v3.0.0.5 mirror if above not working
su-2.3.6.1-ef-signed.zip
Koush's blog for the latest clockwork updates (find Nexus S in the list).
Also, if you don't already have the necessary android sdk and drivers on your computer, get them from here: http://developer.android.com/sdk/index.html and install them. Some Windows users report better luck just installing pdanet. There's a decent guide for Windows users on installing the sdk here.
Place the recovery file on your laptop where you can access it while using the sdk fastboot commands.
Place the su zip one in the top level folder of your sdcard.
Put your phone in fastboot mode (power off, then hold volume up and power key at the same time until the phone boots to a white screen).
Use fastboot to boot the phone into the clockwork recovery:
Code:
fastboot boot recovery-clockwork-3.0.0.5-crespo.img
If you're not sure how to get fastboot working on your computer, follow the excellent instructions that Allgamer gives in this GUIDE, but don't do the oem unlock command!
Once in clockwork, flash the su file to the phone by following these steps below.
To navigate in the clockwork recovery, you use the volume keys to scroll up/down through the menus, and the on/off button to select what's highlighted.
(note: some report success without these first 3 steps, others don't get a succesful root without, I recommend doing them)
select mounts and storage.
select mount /system
select go back
select install ZIP from sdcard
select choose zip from sdcard
select su-version#-signed.zip file you downloaded earlier
select yes - install su-version#-signed.zip
confirm it says "Install from sdcard complete"
select go back
select reboot
After the phone reboots, you should be rooted, with a locked bootloader, and none of your data erased.
That said, never hurts to have a backup of your precious data on the sdcard that you can copy over to the computer.
This method doesn't install busybox, so go to the Market and download/install busybox directly, or get Titanium Backup and check it's "problems?" button and let it install busybox for you. There's also an app called root checker that supposedly verifies you have a working root on your phone.
Once you have a successful root installed, I'd suggest getting back into clockwork recovery and running a nandroid back up from clockwork's backs and restore menu. Then copy that file from your sdcard (in the /clockwork/backups folder) to your laptop for safe-keeping and an easy full system restore to a known working config.
Usual disclaimers about I'm not responsible for damage to your phone or loss of data apply. Use any rooting method at your own risk.
Thanks and all the real credit go to inakipaz, shrivelfig and allgamer, and of course to koush, and ChainsDD for the superuser apk.

Worked perfectly. I used fastboot from my Mac (outlined in the stickied Mac Root thread). Root checker verifies that I have root.
And by the way, my phone and I are both root/ROM cherry. First android phone, first time rooter. Will work up the guts to flash a ROM soon, but of course there's no chance of doing THAT without unlocking the bootloader.
Thanks to all involved in this!

yeah! good work!

Srsly. Awsom.
Someone sticky this....

Question: When you do the fastboot boot command, does that overwrite the stock recovery with Clockwork? Or is it just booting into the recovery img without actually flashing it?
I would think this method also gives you a way to back up before unlocking the bootloader.
1) fastboot boot into Clockwork as described here
2) Full nandroid backup from Clockwork
3) Mount "SD" from Clockwork over USB, copy everything to computer (since it wipes everything)
4) Go back and unlock the bootloader as usual, resulting in a full wipe
5) Flash Clockwork Recovery again through whichever method
6) Mount "SD" from Clockwork over USB, copy the backup back to phone
7) Restore nandroid
And now you've unlocked the bootloader without amnesia =)
ravidavi said:
And by the way, my phone and I are both root/ROM cherry. First android phone, first time rooter. Will work up the guts to flash a ROM soon, but of course there's no chance of doing THAT without unlocking the bootloader.
Thanks to all involved in this!
Click to expand...
Click to collapse
Are you sure you need to unlock the bootloader to flash a ROM? Now that you have root, try installing ROM Manager from the Market, and see if it lets you flash custom recovery with bootloader still locked. If so, then yes you can install a ROM!
Also, the fact that you're able to boot into Clockwork using "fastboot boot" - that also means you can install a ROM .zip file right from there.

cmstlist said:
Question: When you do the fastboot boot command, does that overwrite the stock recovery with Clockwork? Or is it just booting into the recovery img without actually flashing it?
Click to expand...
Click to collapse
"fastboot boot" only launches the recovery no unlock needed. "fastboot flash" flash the recovery

cmstlist said:
Are you sure you need to unlock the bootloader to flash a ROM? Now that you have root, try installing ROM Manager from the Market, and see if it lets you flash custom recovery with bootloader still locked. If so, then yes you can install a ROM!.
Click to expand...
Click to collapse
It worked! Here's the process I used, starting from a completely unmodded Nexus S.
1: Use the method detailed here to gain root access without unlocking the bootloader.
2: Using a root-enabled file explorer (I used Super Manager), rename install-recovery.sh (in /etc) to install-recovery.sh.old . You'll need to remount as r/w to do this. NOTE: You don't *have* to do this step, but if you don't, then you can only use clockwork once after which it will be erased on reboot.
3: Using ROM Manager, install Clockwork Recovery.
4: Pleasure yourself, because your bootloader is still locked and nothing was erased.
I have yet to try actually flashing a custom ROM. Does this mean that it can also be done without unlocking bootloader?

Well damn, whaddaya know. I just flashed MoDaCo r10 without unlocking the bootloader, and without losing any personal data on /sdcard.
I figure someone at XDA should like this.
Pretty much followed distortedloop's advice. Starting from a fully stock Nexus S with Android 2.3.2 (GRH78C):
* Root using the method on this thread.
* Rename install-recovery.su to install-recovery-old.su. (in /bin)
* Install Clockwork Recovery from ROM Manager.
* Download whatever ROM you want (compatible with Clockwork), rename to update.zip, and copy to sdcard.
* Reboot into Clockwork.
* Wipe cache, reset to factory (IF REQUIRED BY NEW ROM). This was my first install of MoDaCo, and that requires it. This step does NOT erase your personal files on sdcard, just all android-related files.
* Install update.zip from Clockwork.
* Continue self-pleasuring ... you now have a custom rom without touching your bootloader or wiping your personal sdcard data.
Maybe it's just because I'm a noob here, but it seems to me that this is a BIG deal. All root/ROM installation methods that I've seen so far have required an unlocked bootloader. This seems to be the first time a Nexus S has been unlocked and custom-ROM'd without unlocking the bootloader and wiping the entire /sdcard.
Ravi

Yeah, it's pretty clear that the unlock the bootloader step isn't necessary for most of what we want to do. Just a habit from earlier devices, perhaps?
What's really odd is now we have to wonder what's the purpose of the oem unlock erasing your sdcard? Speculation was that it was a security feature to keep people from accessing your data if they stole your phone; they couldn't flash something on the phone to get access, but clearly they can. Fastboot into a custom recovery and you own the phone.
Perhaps this is a security hole Google will try to fix some day?
At any rate, I wish we'd discovered this sooner, it would have saved several people some grief in having to lose saved games (Angry Birds!) when they finally decided to root.

distortedloop said:
Yeah, it's pretty clear that the unlock the bootloader step isn't necessary for most of what we want to do. Just a habit from earlier devices, perhaps?
...
At any rate, I wish we'd discovered this sooner, it would have saved several people some grief in having to lose saved games (Angry Birds!) when they finally decided to root.
Click to expand...
Click to collapse
You say "for most of what we want to do." Could you think of a case where you would need to unlock it now? It's now shown to be unnecessary for rooting and installing custom recovery/ROM.
Is there any way to get the word out? This thread isn't stickied, and all the stickied threads on rooting & custom ROMs currently assert that you have to unlock the bootloader.
Ravi

ravidavi said:
You say "for most of what we want to do." Could you think of a case where you would need to unlock it now? It's now shown to be unnecessary for rooting and installing custom recovery/ROM.
Click to expand...
Click to collapse
I'm thinking that something like Superboot might need to have the bootloader unlocked, since it replaces the boot image, right? But I'm not sure.
ravidavi said:
Is there any way to get the word out? This thread isn't stickied, and all the stickied threads on rooting & custom ROMs currently assert that you have to unlock the bootloader.
Ravi
Click to expand...
Click to collapse
There's only a page and a half of posts in the development section right now, so it's not likely to disappear any time soon, but you could ask a mod (theimpaler747 is ours) via PM to sticky it. I thought about asking myself, but seemed a bit tacky to ask for my own thread.
Meanwhile, I'd been linking people to various posts I'd made in other threads suggesting this might work, but once inakipaz and shrivelfig confirmed it, I'm just now pointing people here. I just hope people see this before wiping their phones unnecessarily.
Really, the other guides should just be updated to skip the oem unlock step. That's really the only different thing we're doing here.

i'm just waiting for more people "newbies" to confirm this actually works for them, before making it a sticky

In theory if you really really screw up your phone, you might need fastboot flash in order to recover it. But if fastboot also lets you boot into an img recovery... then you still have a recovery route that doesn't require unlocking.
Sent from my Nexus One using XDA App

I know it's a noob question and all since all you're doing is flashing a custom recovery but will you still be able to get OTA updates after doing this as well?
Sent from my Nexus S using XDA App

qreffie said:
I know it's a noob question and all since all you're doing is flashing a custom recovery but will you still be able to get OTA updates after doing this as well?
Sent from my Nexus S using XDA App
Click to expand...
Click to collapse
yes because you still have the original recovery installed

distortedloop said:
Perhaps this is a security hole Google will try to fix some day?
Click to expand...
Click to collapse
This would be my guess.
But how? Is it possible to plug this with just a software update? Time will show, I guess.
This (security hole) should also make it possible to do perfect out-of-the-box OS backups. And restores. The problem is that nobody's going to do a backup without playing with their shiny new toy first.

shrivelfig said:
This would be my guess.
But how? Is it possible to plug this with just a software update? Time will show, I guess.
This (security hole) should also make it possible to do perfect out-of-the-box OS backups. And restores. The problem is that nobody's going to do a backup without playing with their shiny new toy first.
Click to expand...
Click to collapse
I can confirm that the Nexus One does not allow this "fastboot boot" on a locked bootloader. Maybe this was just an oversight?
It is entirely possible to plug this with a software update: Samsung/Google could issue a signed update that includes a bootloader upgrade. This has been done many times by HTC for example.

I can confirm that this method works, without unlocking the BL or erasing the SD part.

This is pretty cool. I wish I new about this before I unlocked the bootloader days after I received my phone. I too wonder if this was intentional or an oversite. Google did want this phone to be for developers, but like other's said, this is also a bit of a security hole. The wiping of the sd card on unlock would protect the person if the phone was stolen, like if there was confidential corporate stuff on there. Even if you password protect your phone, someone could fastboot clockwork, mount the sd card and retrieve all the information that was on there.

cmstlist said:
It is entirely possible to plug this with a software update: Samsung/Google could issue a signed update that includes a bootloader upgrade. This has been done many times by HTC for example.
Click to expand...
Click to collapse
It's also been done by Samsung with some versions of the Galaxy S line (some of the "leaked" roms, and even one official kies push (IIRC) changed the bootloader, causing people the ability to use 3 button mode for Odin access, and causing others to lose it.

Why Do All These Xoom Rooting Methods Require a Modified Boot/Kernel Image?

I'll start by saying here that I fully understand that what I'm saying may not apply to the international (non-GED) Xoom devices.
Maybe someone can shed some light on this. Why is it that every rooting method I see here seems to involve flashing some ZIP file that has a modified kernel or boot image? Seems pointless considering that, as with any other Google Experience Device, you can simply unlock your bootloader, flash Clockwork, and then flash the official Superuser.zip from androidsu.com and you're done. There's no unsecuring of the boot image, or anything. It just installs Superuser.apk, the su binary and changes the permissions on the binary.
Am I missing something here? Is there some advantage I'm not thinking of to using a custom boot image to obtain root on a Xoom?

No. Before when I first bought my xoom I just rooted it, no custom kernel or rom. Now I've used both and benefits alot. As for example some games people complain laggs, with custom kernel ya can over clock and fix some of this. Then custom roms allow ya to use features not enabled by Google on default. For example the wifi xoom can not connect ad-hoc networks like mobile hotspots. Roms include this unless you wanna do it the hard way. Another nifty feature is the USB OTG to attach hard drives which Google allows ya to do like mice and keyboards but not external drives.

oldblue910 said:
Seems pointless considering that, as with any other Google Experience Device, you can simply unlock your bootloader, flash Clockwork, and then flash the official Superuser.zip from androidsu.com and you're done. There's no unsecuring of the boot image, or anything. It just installs Superuser.apk, the su binary and changes the permissions on the binary.
Am I missing something here? Is there some advantage I'm not thinking of to using a custom boot image to obtain root on a Xoom?
Click to expand...
Click to collapse
I think you ARE missing something. The process you outlined with other GED devices is identical to the Motorola XOOM root process as well.
1. You use "fastboot oem unlock" to unlock the bootloader. (This only unlocks the bootloader so you can flash custom ones, recoveries, etc. but does NOT modify the current bootloader in any way.)
2. Flash clockwork with fastboot as well.
3. Install the Universal XOOM rooting ZIP through clockwork.
4. Done.
How is this any different?
The Universal XOOM root ZIP can be found @ http://forum.xda-developers.com/showthread.php?t=1242241 and does NOT contain any sort of modified Kernel or Boot image.
I don't know where you got your information from.

Sure it does. Take a look at the zip file (all those files in the kernel folder). Plus once it's done, stock recovery no longer auto flashes because something was changed in the boot image and the checksums don't match anymore.
Sent from my Xoom using Tapatalk

Well, I stand corrected! Yeah, I don't know why it modifies the boot image either then. I'd have just thought flashing clockwork and installing the binary should be fine.
I guess you need to talk to solarnz or one of the other more experienced XOOM devs...

sodaboy581 said:
Well, I stand corrected! Yeah, I don't know why it modifies the boot image either then. I'd have just thought flashing clockwork and installing the binary should be fine.
I guess you need to talk to solarnz or one of the other more experienced XOOM devs...
Click to expand...
Click to collapse
And that's the thing...flashing just the binaries DOES work fine, at least on my Xoom. I wonder if it has something to do with the international non-GED Xooms...
Sent from my Xoom using Tapatalk

You do need a modified initramfs to root properly.
an insecure boot.img is the most useful part of being rooted.
And with one of those you don't even need clockworkmod.
flash it with fastboot / reboot / adb remount and then just push su and superuser set suid on su (10 seconds total - far less hassle than messing with clockworkmod).

I am a little surprised no one figured out how to root before unlocking. Would sure be handy to do a titanium backup before unlocking ( which wipes everything !! ) That said, it is just a minor inconvenience. Copy some stuff to the PC and I am good to go.

oldblue910 said:
I'll start by saying here that I fully understand that what I'm saying may not apply to the international (non-GED) Xoom devices.
Maybe someone can shed some light on this. Why is it that every rooting method I see here seems to involve flashing some ZIP file that has a modified kernel or boot image? Seems pointless considering that, as with any other Google Experience Device, you can simply unlock your bootloader, flash Clockwork, and then flash the official Superuser.zip from androidsu.com and you're done. There's no unsecuring of the boot image, or anything. It just installs Superuser.apk, the su binary and changes the permissions on the binary.
Am I missing something here? Is there some advantage I'm not thinking of to using a custom boot image to obtain root on a Xoom?
Click to expand...
Click to collapse
You don't _need_ to flash an insecure kernel image; there's multiple paths to root. If you don't have a version of CWM for the device, then running the system insecure may be the only way to do it. Running the system in insecure mode does give you the ability to run adb as root amongst other things, however (so you can do things like adb remount).

Yeah I can see needing the insecure image in the case of not having ClockworkMod or if you need those extra commands in ADB. I was more just curious if running an insecure image was somehow a better practice than just flashing the androidsu.com zip. I guess it's 6 of one or a half dozen of the other in the end.
Thanks for the explanation!
Sent from my Xoom using Tapatalk

unrandomsam said:
an insecure boot.img is the most useful part of being rooted.
Click to expand...
Click to collapse
I suppose that depends on what you use root for, really. For instance, the ability to run adb as root means nothing to me really. I can count the number of times I've used adb on one hand. I more use root so I can take screenshots without hooking up to USB, and I also like having root access to the filesystem.
Plus, it seems that the insecure image is the reason why everyone says not to accept OTAs if you're running a rooted stock ROM. I've read horror stories of people accepting OTAs on a rooted stock ROM and ending up with bootloops and all kinds of other craptastic stuff. If you root with the boot image secure, you can accept OTAs and just re-root when it's done flashing.
Different strokes for different folks, right?
Sent from my Xoom using Tapatalk

mobileweasel said:
I am a little surprised no one figured out how to root before unlocking. Would sure be handy to do a titanium backup before unlocking ( which wipes everything !! ) That said, it is just a minor inconvenience. Copy some stuff to the PC and I am good to go.
Click to expand...
Click to collapse
This.
Most devices have temp root so you're able to run rooted app to fully backup before unlocking it. I've been holding off rooting on my wife's xoom because I don't want to wipe her saved data, but im really itching to mess with it, hehe. I heard with ICS you can do a full backup with adb, I believe you use the " adb backup" method.

The insecure boot image is need for two reasons.
1) without it you would not be able to adb mount the partitions while inside the Android os.
2) every time you boot into Android, a script it's ran to check for stock recovery and overwrite it, insecure boot images disable this (you can also disable by deleting the script files)
Sent from my Nexus S 4G

Rooting without flashing custom recovery

Is it possible at all to root my Nexus 7 (on Android 4.2 JOP40C) without having to flash a custom recovery or something else that would cause me to lose all of my data, and would allow me to continue to receive normal OTA updates? I understand that an OTA update would likely remove my root, that's a non-issue if I can re-root in a similar way.

Skyline969 said:
Is it possible at all to root my Nexus 7 (on Android 4.2 JOP40C) without having to flash a custom recovery or something else that would cause me to lose all of my data, and would allow me to continue to receive normal OTA updates? I understand that an OTA update would likely remove my root, that's a non-issue if I can re-root in a similar way.
Click to expand...
Click to collapse
It's not the rooting part which erases the data., it's unlocking the boot loader which does that. But an unlocked boot loader is necessary to root.
My advice is that you create a backup using one of the toolkits or using TitaniumBackup and then go ahead and begin the rooting process. After that's complete you can just restore the backup.
Sent from my Nexus 7

veeman said:
It's not the rooting part which erases the data., it's unlocking the boot loader which does that. But an unlocked boot loader is necessary to root.
My advice is that you create a backup using one of the toolkits or using TitaniumBackup and then go ahead and begin the rooting process. After that's complete you can just restore the backup.
Sent from my Nexus 7
Click to expand...
Click to collapse
Titanium backup requires root in the first place.
Unlocking boot loader does a factory reset so save any personal pictures etc you have, copy them to your PC using one of the many methods available.
The apps you can just red-download but you will loose the data from them, whether that's a concern depends what data you have in your apps that you can't manage to save or recreate.
Once the bootloader is unlocked then flash a custom recovery, I use twrp. Then you can do a nandroid backup before you flash the files needed for root just in case it screws up.
If an OTA removes root then you can just reflash the root files.

My Backup Pro is a backup program that works without being rooted. It's also dead easy to use and its free.
Sent from my Nexus 7 using xda premium

I was curious about this too.
I don't care about losing data when unlocking the bootloader.
BUT I would like to know if it is possible to root the nexus 7 but not have a custom recovery?
I just want to be able to use apps that require root access but I remember from my old phone that with custom recovery there were a whole lot of things (like doing a factory reset using the settings) that couldn't be relied upon. I would like to avoid this if possible. For the moment I have no interest in custom roms.
But every time I search for this no one can give a clear answer.
So Yes or No? Can I have a rooted nexus 7 but stock recovery?
And if possible do you know how? I'm on a mac so a non-toolkit method would be amazing

Will rooting remove any data from an unlocked bootloader?
I reflashed my device and accidently left it unlocked... well seems like it was lucky maybe, since I want to root now

Unlocking bootloader wipes ALL data.
Flashing custom recovery does not wipe any data.
Rooting, ie flashing root files, does not wipe any data.
You must have an unlocked bootloader to install custom recovery.
You must have an unlocked bootloader to root.
You can have have a custom recovery and root.
You can have a custom recovery and no root.
You can have root and no custom recovery.
NOTE NOTE NOTE
The easiest way to obtain root is by flashing root files via custom recovery.
If you have an unlocked bootloader then you may as well flash a custom recovery and take a full backup of the device via the custom recovery before you root in case you mess something up. There is no reason to not have a custom recovery. It allows you to also perform a 'factory reset' by wiping certain parttitions and makes rooting MUCH easier as you flash the root files via the custom recovery.

If you want to root, you have to unlock the bootloader first (as said before):
> fastboot oem unlock
After that, you can boot a custom recovery (not flash, the normal recovery will be back again after a restart)
> fastboot boot [recovery.img]
And when the recovery has started, you can mount /system and push the necessary files:
> adb push su /system/xbin
> adb push Superuser.apk /system/app
After that, you should set the correct permissions:
> adb shell
(now you are in your device's shell)
> chmod 06755 /system/xbin/su
> chmod 0644 /system/app/Superuser.apk
> exit
And now just reboot:
> adb reboot
Enjoy
Edit:
The custom recovery can be found here: http://clockworkmod.com/rommanager
The su and Superuser.apk files can be found here: http://forum.xda-developers.com/showthread.php?t=1538053 (just extract the two files from the .zip, I dont like those installer scripts )

Interesting thread. I also posted something similar but was ignored, so never got a answer.
So, to anyone with the answer, PLEASE,
Is there ANY way to backup the WHOLE device, apps included, BEFORE any bootloader unlocking + rooting is done ?
I have googled this question for the past week and cannot get a definitive answer, some saying yes with xx-app, some saying it's not possible because the hidden folders are not accessible to a non-rooted device.
I have purchased many apps on google play store, I don't mind downloading most of them again but I am worried if I wipe the device whether I will be allowed to download from the play store, or whether I will get asked to pay for them again - don't want this.
Plus, most of my games are HUGE, GTAIII, NFS Most Wanted, Asphalt 5,6,7, etc.. and these take a very long time to download again via wifi.
So please, a simple yes or no would suffice. If I have to bite the bullet then so beit, but I have quite a lot to lose if I do, so you can see why I need to get a definitive answer and then do some thinking. Would have rooted 2 weeks ago when I bought the Nexus 7 32Gb, but hindsight is a good thing when you know how.

JohnRM said:
Is there ANY way to backup the WHOLE device, apps included, BEFORE any bootloader unlocking + rooting is done ?
Click to expand...
Click to collapse
Yes, there is the adb backup command:
> adb backup –apk –shared –all –f C:\path\to\backup.bak
However, this will not backup your SMS&MMS. But there is the tool SMS Backup & Restore, which can do this job
Edit:
Here is another Thread with a more detailed description:
http://forum.xda-developers.com/showthread.php?t=1420351

kroegerama said:
Yes, there is the adb backup command:
> adb backup –apk –shared –all –f C:\path\to\backup.bak
However, this will not backup your SMS&MMS. But there is the tool SMS Backup & Restore, which can do this job
Edit:
Here is another Thread with a more detailed description:
http://forum.xda-developers.com/showthread.php?t=1420351
Click to expand...
Click to collapse
Many thanks. :good:

JohnRM said:
Many thanks. :good:
Click to expand...
Click to collapse
You can re-download from the playstore again without repaying. Just as you would re-download if you were using a new device and/or additional device.
You can download one app to multiple devices, is have an app installed on multiple devices at the same time, but you only pay once.

kroegerama said:
And when the recovery has started, you can mount /system and push the necessary files:
> adb push su /system/xbin
After that, you should set the correct permissions:
> adb shell
(now you are in your device's shell)
> chmod 06755 /system/xbin/su
Click to expand...
Click to collapse
Thank you so much for the info! this helped me a lot. Except one thing didn't work for me. Did you mean "adb push su /system/bin" and "chmod 6755/system/bin/su"??? I tried what you said and discovered that /xbin is not a directory.
BTW if you can't be bothered doing it manually, CMW recovery has a nice "install from sideload" feature.

DPI Changes with Locked Bootloader?

Hello fellow XDAers,
Here's my dilemma: when I get my 6P I want to keep my bootloader locked for security reasons. However, I also want to change the DPI, preferably in build.prop. The only way to do this is to unlock, edit, and relock. Which is fine until I have to flash a new stock system image. Is it possible to do that with a locked bootloader and modified system? I was thinking I may be able to keep it rooted, flash TWRP from terminal emulator when I need it, then flash the image from recovery.
Sent from my Nexus 6 using Tapatalk

I'm not at all sure about this, but does adb or fastboot allow copy-pasting to the system partition over non-rooted devices? I don't really think so, but just going to guess..
Code:
adb pull /system/build.prop
Modify the file via Notepad++ and save.
Code:
adb push build.prop /system
adb shell
cd system
chmod 644 build.prop
Again, I'm not a hundred percent sure of this method, and I don't have any non-rooted devices laying around to check.. :silly:
If I recall correctly, I saw someone do something like this here on XDA itself.. I forget who posted it and where the post is but lemme know if it worked for you?

GuitarGuy96 said:
I'm not at all sure about this, but does adb or fastboot allow copy-pasting to the system partition over non-rooted devices? I don't really think so, but just going to guess..
Code:
adb pull /system/build.prop
Modify the file via Notepad++ and save.
Code:
adb push build.prop /system
adb shell
cd system
chmod 644 build.prop
Again, I'm not a hundred percent sure of this method, and I don't have any non-rooted devices laying around to check.. :silly:
If I recall correctly, I saw someone do something like this here on XDA itself.. I forget who posted it and where the post is but lemme know if it worked for you?
Click to expand...
Click to collapse
I don't think that'll worked with a locked bootloader. Can anybody confirm?
The real issue is that I wouldn't be able to apply OTAs without unlocking, because system would be modified. I need a way to return to stock (flash with TWRP?), apply the OTA (do I need stock recovery?), and keep TWRP so I can edit build.prop again with adb. That seems like it would work, but the OTA might replace TWRP with stock so I'd be screwed.
Sent from my Nexus 6 using Tapatalk

GuitarGuy96 said:
I'm not at all sure about this, but does adb or fastboot allow copy-pasting to the system partition over non-rooted devices? I don't really think so, but just going to guess..
Code:
adb pull /system/build.prop
Modify the file via Notepad++ and save.
Code:
adb push build.prop /system
adb shell
cd system
chmod 644 build.prop
Again, I'm not a hundred percent sure of this method, and I don't have any non-rooted devices laying around to check.. :silly:
If I recall correctly, I saw someone do something like this here on XDA itself.. I forget who posted it and where the post is but lemme know if it worked for you?
Click to expand...
Click to collapse
how can you push files to a read-only partition? you need to gain RW privileges to the folder, which in this case is ROOT (or ADMIN). the only way to root is to flash the recovery. the only way to flash the recovery is to unlock the bootloader.
you can re-lock the bootloader post root. you can even remove root and the custom recovery after modifying your system files. just remember, any OTA you receive will bomb because key files don't match and you'll have to redo everything you did to secure your phone.
i'm curious as to what exploits are out there that depend on an unlocked bootloader. if you're not flashing ROM data, what's the concern? avoid malicious sites, lock/encrypt your device and find a good tracker. that's about all you can do.
---------- Post added at 11:17 AM ---------- Previous post was at 11:14 AM ----------
one more thing. in general, OTAs don't typically replace your recovery.img (that i recall). it's called recovery so that you can RECOVER. flashing that ROM store seems like it would cause problems should the OTA fail. plus, don't most OTAs need the recovery partition to install anyway?

Cheater912 said:
Hello fellow XDAers,
Here's my dilemma: when I get my 6P I want to keep my bootloader locked for security reasons. However, I also want to change the DPI, preferably in build.prop. The only way to do this is to unlock, edit, and relock. Which is fine until I have to flash a new stock system image. Is it possible to do that with a locked bootloader and modified system? I was thinking I may be able to keep it rooted, flash TWRP from terminal emulator when I need it, then flash the image from recovery.
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
Everything you want to do starts with unlocking the bootloader, you can't write to something without write access, Sorry. I see what you want to do, but it's not possible.

Big Cam said:
Everything you want to do starts with unlocking the bootloader, you can't write to something without write access, Sorry. I see what you want to do, but it's not possible.
Click to expand...
Click to collapse
I'd unlock the bootloader to root the phone, then lock it again. Everything is writable with a locked bootloader as long as it's done on the phone, not through adb/fastboot.
Sent from my Nexus 6 using Tapatalk

Cheater912 said:
I'd unlock the bootloader to root the phone, then lock it again. Everything is writable with a locked bootloader as long as it's done on the phone, not through adb/fastboot.
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
this is the correct answer. the countless #s of exploits found to gain root, without unlocking the bootloader supports this. the reason unlocking the bootloader to gain root is the "only method" to do so is because in other cases you're relying on an exploit that gives you a back door to getting elevated privileges within the system. most of these are or do get closed, so exploits are NOT the correct method for gaining root.
so i reiterate - can someone please provide a case study where having an unlocked bootloader provides system privilege to malicious apps, etc., that would cause a security concern from within a device?
as far as i understand, the "only" reason to lock the bootloader is to preserve the system ROM image (for recovery, troubleshooting, experience, etc.). as a user, you become the responsible party for flashing non-OEM-approved images, exposing yourself to the risk. translation - if you download something that requires you to flash a partition from within the phone, you are the one putting yourself at risk.

640k said:
this is the correct answer. the countless #s of exploits found to gain root, without unlocking the bootloader supports this. the reason unlocking the bootloader to gain root is the "only method" to do so is because in other cases you're relying on an exploit that gives you a back door to getting elevated privileges within the system. most of these are or do get closed, so exploits are NOT the correct method for gaining root.
so i reiterate - can someone please provide a case study where having an unlocked bootloader provides system privilege to malicious apps, etc., that would cause a security concern from within a device?
as far as i understand, the "only" reason to lock the bootloader is to preserve the system ROM image (for recovery, troubleshooting, experience, etc.). as a user, you become the responsible party for flashing non-OEM-approved images, exposing yourself to the risk. translation - if you download something that requires you to flash a partition from within the phone, you are the one putting yourself at risk.
Click to expand...
Click to collapse
You can't boot the phone without decrypting the data partition. That stops an exploit in the OS.
Sent from my Nexus 6 using Tapatalk

You can easily do it following these steps:
Enable ABD Debugging,
Using the CMD window in platform tools (same areas you use for flahsing)
adb devices
adb shell
wm density xxx && reboot
The xxx will be your new density and its as easy as that. I use it all of them time this way because its easier when you don't want to root

Pilz said:
You can easily do it following these steps:
Enable ABD Debugging,
Using the CMD window in platform tools (same areas you use for flahsing)
adb devices
adb shell
wm density xxx && reboot
The xxx will be your new density and its as easy as that. I use it all of them time this way because its easier when you don't want to root
Click to expand...
Click to collapse
That always screws with Hangouts pictures, SwiftKey, and random stuff in the Play Store. Does it not for you? What do you set it to?
Sent from my Nexus 6 using Tapatalk

Cheater912 said:
That always screws with Hangouts pictures, SwiftKey, and random stuff in the Play Store. Does it not for you? What do you set it to?
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
Nope it works fine for me. I set it to 485 usually and don't have any issues
Edit: I forgot to mention that Android Pay won't work with custom dpi settings for some reason. I contacted Google about that issue and they are looking into fixing it.

btw is there a risk now to re-lock your device if you are not 100% stock because you could be stuck in a bootloop ?
I don't have a N6 or N9 but I read a few threads about the "enable OEM unlock" in Developer options that could lead to a lot of troubles if you re-lock your device....

Matrix_19 said:
btw is there a risk now to re-lock your device if you are not 100% stock because you could be stuck in a bootloop ?
I don't have a N6 or N9 but I read a few threads about the "enable OEM unlock" in Developer options that could lead to a lot of troubles if you re-lock your device....
Click to expand...
Click to collapse
That's true. I'd lock it with TWRP installed, then flash stock recovery with flashify once safely booted.
Sent from my Nexus 6 using Tapatalk

Cheater912 said:
That's true. I'd lock it with TWRP installed, then flash stock recovery with flashify once safely booted.
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
Cna you flash a recovery from a locked BL in TWRP? Call me old fashioned but i didn't think that's was possible

All this playing around with locking and unlocking the bootloader is going to cause someone to wipe some data.
You wipe the phone when you unlock the BL. This is why it is suggested to just go ahead and do it.
There is no real security risk unless you flash something malicious. Don't flash stuff from unknown sources.. DUH!
Unless you have root, you cannot write to anything but data partitions and even then security keeps you boxed in.
There will be no exploit to gain root with a locked BL Who is going to spend the time when root access is a couple of adb command and two file flashes away?
Anyway that's just MHO.

Pilz said:
Cna you flash a recovery from a locked BL in TWRP? Call me old fashioned but i didn't think that's was possible
Click to expand...
Click to collapse
Yes, you can do whatever you want with a locked bootloader as long as it's done on the phone (not through adb/fastboot).
Sent from my Nexus 6 using Tapatalk

Quickest way to 5.0?

I'm currently on 4.2.2 and I'm trying to figure out the quickest way to 5.0, or whatever is the most recent, to be able to get back up to speed. I'm also wanting to finally unlock my phone and get TWRP too after I get my phone updated to the most recent version. Thanks for any help!

4.4.2 not 4.2.2
Sent from my SM-N900V using XDA-Developers mobile app

Go back to factory 4.4.2 no root. Take new update to 5.0 OF1 from Verizon then root phone install Super SU make shure you have root. Then unlock bootloader install TWRP and you're ready to flash. Everything you'll need is in the General Forum
Sent from my SM-N900V using XDA Free mobile app

buckeyestilidie said:
4.4.2 not 4.2.2
Click to expand...
Click to collapse
Yeah I was sort of wondering about that - i think that would predate even MI9.
Is your phone already rooted, or not? The 'samsung_unlock_n3' thing can provide you with immediate access to a custom recovery (twrp-3.0.2-0-hltevzw-4.{x}.img with {x} = 3 or 4). Perform the retail-to-DevEd conversion with 'samsung_unlock_n3', and after you verified that it worked, just 'dd' the recovery image into the recovery partition with a root shell. No Odin, no incrementing your bootloaders, no re-rooting a stock device.
Then boot into the TWRP recovery with a 3-finger salute (Vol-Up+Home+Pwr), blow the Knox Warranty fuse by booting TWRP, take a TWRP backup, get it off onto some safe media, and you are ready to start doing what you want. Try the -4.3 image if the -4.4 wont boot.
Note: hltevzw, *not* hlte

bftb0 said:
Yeah I was sort of wondering about that - i think that would predate even MI9.
Is your phone already rooted, or not? The 'samsung_unlock_n3' thing can provide you with immediate access to a custom recovery (twrp-3.0.2-0-hltevzw-4.{x}.img with {x} = 3 or 4). Perform the retail-to-DevEd conversion with 'samsung_unlock_n3', and after you verified that it worked, just 'dd' the recovery image into the recovery partition with a root shell. No Odin, no incrementing your bootloaders, no re-rooting a stock device.
Then boot into the TWRP recovery with a 3-finger salute (Vol-Up+Home+Pwr), blow the Knox Warranty fuse by booting TWRP, take a TWRP backup, get it off onto some safe media, and you are ready to start doing what you want. Try the -4.3 image if the -4.4 wont boot.
Note: hltevzw, *not* hlte
Click to expand...
Click to collapse
Okay that was a lot of information I'm not too sure about lol yes I am rooted and I'm pretty sure I'm using safestrap as my recovery.
Sent from my SM-N900V using XDA-Developers mobile app

bftb0 said:
Yeah I was sort of wondering about that - i think that would predate even MI9.
Is your phone already rooted, or not? The 'samsung_unlock_n3' thing can provide you with immediate access to a custom recovery (twrp-3.0.2-0-hltevzw-4.{x}.img with {x} = 3 or 4). Perform the retail-to-DevEd conversion with 'samsung_unlock_n3', and after you verified that it worked, just 'dd' the recovery image into the recovery partition with a root shell. No Odin, no incrementing your bootloaders, no re-rooting a stock device.
Then boot into the TWRP recovery with a 3-finger salute (Vol-Up+Home+Pwr), blow the Knox Warranty fuse by booting TWRP, take a TWRP backup, get it off onto some safe media, and you are ready to start doing what you want. Try the -4.3 image if the -4.4 wont boot.
Note: hltevzw, *not* hlte
Click to expand...
Click to collapse
This seems like an easier way then mentioned above, but I'm vague on the terminology used. Could you elaborate on the ideas you explained?
Sent from my SM-N900V using XDA-Developers mobile app

buckeyestilidie said:
This seems like an easier way then mentioned above, but I'm vague on the terminology used. Could you elaborate on the ideas you explained?
Click to expand...
Click to collapse
I started writing a SBS (step by step), but as I took the time to make sure that nobody would shoot themselves in the foot with my instructions, I realized that it would take a huge amount of effort once all the caveats and "be careful here"s are included.
The only reason that I took the path I did is that I don't care much for dodgy/opaque rooting methods, so I just preferred to try a route that avoided losing root, even temporarily.
It basically boils down to writing the recovery image (e..g twrp-3.0.2-0-hltevzw-4.3.img or twrp-3.0.2-0-hltevzw-4.4.img) directly to the recovery partition (/dev/block/mmcblk0p15) from the rooted ROM using the "dd" program after you have unlocked the bootloader. You can find those recovery images here, and raw-writing looks like this (note root prompt '#' symbol) :
Code:
# dd if=twrp-3.0.2-0-hltevzw-4.4.img bs=2048 of=/dev/block/mmcblk0p15
***
(You need root for both this operation and to unlock the bootloader, so it makes most sense to unlock the bootloader first).
Note that the above says nothing at all about how to prepare for disasters before you travel down this path. All of that is your responsibility; if reading this makes you uncomfortable, then you shouldn't be doing it.
Among the things that I prepared beforehand: TiBu backups; full tar image of the "internal" /sdcard; full backup of external SDcard; Safestrap TWRP backups of all slots; raw dumps of all of the partitions p1-p22; debrick images (first 256 MB of /dev/block/mmcblk0) both before and after the CID-changing unlock method, another p6 (= aboot) partition raw copy *after* the unlock CID change, etc.
After I had a real recovery running on the phone, the first thing I did was to take TWRP backups of everything and got those backups off the phone as well.
Even after that, I think I forgot something: I think safestrap backs up the "loopback mount blobs" for the non-stock slots somewhere in /data/media - so they are not captured by backups of "real" TWRP (in the real recovery partition), nor in backups of the "internal" SDcard. They are captured by the psuedo-recovery that Safestrap uses, but the ability to use them may depend on having the stock slot be the active slot before you take the (real) TWRP backup. You will see similar instructions elsewhere: e.g. "get your rooted ROM running in the stock slot before you begin, and make sure the stock slot is the active slot"
*** The partitioning numbering scheme is not guaranteed to be identical on devices other than the SM-N900V Verizon Samsung Galaxy Note 3. If you have in mind using a command like this on another device, a better means for naming the destination (output file of=) target is "by-name", e.g.
dd ... of=/dev/block/platform/msm_sdcc.1/by-name/recovery ...
I didn't use that notation here because Safestrap plays games trying to protect the real boot partition by altering these symlinks, so you need to verify they really point where you think they do before you use them. (e.g. iirc, safestrap symlinks boot -> /dev/null and userdata -> mmcblk0p25 -> mount point of data blob for active slot)