Database Users

TF300TG Voice Calls enabled on 4.1.1 now 4.2.2 also

Hi Guys, I'm super stoked to post that I have just modded my stock ASUS TF300TG 4.1.1 to enable voice calls from the on board sim. Not VOIP, not Groove IP or SIP from the mobile number from the sim!!!
I was one of the unfortunate few who purchased this device in hast when it was on special. I was searching for an all-in-one unit. 7” was too small, single core wasn’t enough, no expandable memory, no thank you. I read that this device had at one stage using Hydro 4.4 firmware which enabled voice. So I knew it was possible. Even though people who reported it working stated that it only truly works via a Bluetooth headset, but that’s what I wanted anyways. Besides, who wants to have a 10” tablet to the side of their face while on the phone, people might think you’re mad.
What I didn’t know in my hast, was the sleepless nights that would follow by simply pressing OK to an ASUS update from 4.0.3 to 4.1.1 would cause.
Here are some facts I have learnt along the way.
NVFLASH is unit specific.
NVFLASH can be install on JB, but because of the above, can’t go back to ICS anyway unless to installed it while you were on ICS and made the files then.
Why go back, once you update to JB, ASUS enables signing which prevents you from installing HYDRO 4.4 or stock ICS anyway.
No one makes ROMS for TF300TG, sad news get over it. I had to. If they do, none enable the phone function, or disabled 3G all together or have reported nothing but issues when it was enabled.
My only option was then clear, make my only rom or mod to do it myself with stock 4.1.1.
This is what I have installed currently, any other variation has not been tested and I will not be held responsible for bricking your device if you wish to test this on your device!!!
I have stock ASUS WW_epad-10.4.3.9 firmware
I have rooted my device via the motochopper method
I have unlocked my bootloader via the official unlocker from ASUS v7
I have installed openrecovery-twrp-2.6.3.0-tf300tg-JB and BACKED UP EVERYTHING BEFORE PROCEEDED!!
I will not bore you will all the different ways I tried, how many soft bricks or hours I spent learning from knowing nothing about Android or cooking as this is my first android device. So here is what worked.
I can’t attach the TWRP update.zip of the end result until I reach 10 posts, but if I give you a fish, you’ll eat for a day, but if I teach you how to fish, you’ll eat for a lifetime.
Hunt down the following tools on your PC (WILL POST SOURCE LOCATIONS ONCE AGAIN WHEN I REACH 10 POSTS) (ALSO I KNOW THIS SHOULD BE IN THE DEV SECTION, CAN’T POST THERE UNTIL 10 POSTS EITHER) Please don’t ask:
FrameworkFlasher-MOD 1.1.4 to generate installable zips to push changes
Apktool to decompile and recompile apk packages
JAVA JDK 1.7
WinRAR
Notepad++ (regular notepad / wordpad might add artifacts to your file and “F” with things)
Install the following on your tablet, FX with the root explorer add-on both free
Using FX on your device copy the following file located under /system/framework/framework-res.apk to a USB device.
Copy into the folder of Apktool on your PC and run the following commands from the command line:
apktool.bat if framework-res.apk
apktool.bat d framework-res.apk
(keep command prompt open)
This will create a folder called "framework-res", navigate to that folder and open "framework-res\res\values\bools.xml”
In here you’ll find a line "config_voice_capable">false
Change false to true
Save file.
Rebuild the apk by running from the command line
apktool.bat b framework-res framework-res-new.apk
Here is a trick I learnt to overcome the countless soft-bricks which followed and disappointment of being stuck on the boot screen.
Open "framework-res-new.apk" with a program such as WinRAR and extract out the file called "resources.arsc".
Once that’s done open the original unmodified framework-res.apk with WinRAR and replace "resources.arsc" with the one you extracted from the last step. (make sure you keep a backup of the original framework-res.apk before modifying it a.k.a framework-res-orig.apk)
Now create the update.zip or push via abd
It is kind of just making the shell zip to copy your mod into as I created this from a previous attempt at enabling phone functionality.
Copy your original framework-res-orig.apk into the FrameworkFlasher-MOD\place-framework-res-here folder
Run the RunMe.bat file and select option 1, then 2, then 3 and then 4. Signing kills the file, but we have to, to create a shell update.zip
Go into the FrameworkFlasher-MOD\final-zip-file
There you’ll find your ~5MB update file. Open this via WinRAR and head to \system\framework.
Override the framework-res.apk file with the file we created with apktools.
Side note: rename the framework-res-orig.apk to framework-res.apk and create another update.zip with your original framework-res.apk file a.k.a framework-res-orig.apk and call it updatefix.zip. This is just in case this doesn't work for you, you can just use this to reinstall your original file back. Saved me time and from having to restore my device repeatedly.
Copy to your Device and install via TWRP.
Note I did a wipe of cache and Dalvik, but for some reason google play had issues. Stating that google play had stopped, and whenever I tried to install would be stuck at installing for what appears to be infinity.
As this device is only a few days old had nothing on it, so I did a factory reset and everything including voice calls started working correctly.
You have been warned!!
Now shop for a bluetooth headset and happy voice calls.
Happy days 10 posts reached. Attached are the update files for 10.6.2.10 stock ASUS rom. I don't have them for 4.1.1. Please backup your framework-res.apk file first and place it in the updatefix.zip file under system/framework just in case. Update via recover install from zip method. Wipe cache and Dalvik.
Updateshell.zip is just an empty zip that you can't then use to install other changes.

Update
NVFLASH appears to require people to update as close to the JB Bootloader as possible before NVFLASH will work correctly. A handful of people have reported issues when not running 10.6 JB bootloader.
Will update to 10.6 JB and create a backup of my device. Will then trail my patch again if not, will run through the NVFLASH process to go back to 10.4 JB.
Moving forward, I will slowly as far as time permits, to add more features to the stock rom for TF300TG enabling the phone and other enhancements. Will keep you all posted.

Upgrading from 10.4.3.9 to 10.6.2.10
For those of you worried about having JB 4.1.1 with TWRP 2.6.3.0 JB installed and wanting to update to 4.2.X but fear that because you have a custom recovery installed not sure how to upgrade. The easiest way is to use fastboot and download the latest firmware from ASUS.
As part of the blob you download from ASUS contains the bootloader, system, recovery and boot partitions. So it doesn't matter what version you are running, all the before mentioned with be updated with stock 4.2.
All you have to now remember is to reflash your TWRP with the 4.2 version.
I will upgrade shortly and then reflash my patch and confirm whether it works with 4.2. If so I with move onto adding some other useful mods.

Flashed to 10.6.2.10 broke everything
Updated to 10.6.2.10 via fastboot to the staging partition. The blue bar filled and the command ended. Issue a fastboot reboot to reboot device.
Flashed TWRP 2.6.3.0 4.2 but this never made it into recovery. Reverted back to TWRP 2.5.0 4.2 and all is well.
Tried to update the framework-res.apk which broke everything. Bootloop
Had to recompile via the same method above, but also failed stating invalid resource directory. Still haven't found a solution to completely recompile back to an APK. Was told to simply remove the affected folder and later add to the APK via WinRAR. Removing the folder allowed me to recompile, however as this is a Value folder which gets complied into resources.arsc so you can't add it later.
Flashed with the newly created 4.2.2 and phone function is enabled, but still am working on completely compiling the APK.
Heard it could also be a aapt.exe issue. Downloading the SDK 17 to recompile again.

It's been a day now and I haven't seen any side effects from deleting the values-mcc454-mnc-1 folder so that I can't compile the apk. Still haven't found a solution to the problem. Framework-res.apk appears to be version specific so you will really have to compile it yourself following the steps in my first post, otherwise you'll get stuck with a bootloop device.
Has anyone come across a: invalid resource directory name when recompiling 10.6.2.10 framework-res.apk? If so could you please post a working aapt.exe and which compiler you used.
Thanks in advance.

Built the frame-res.akp in full
Just an update, was able to fully compile the framework-res.apk file.
Was looking at it all wrong. The build process only failed at one directory. Looked at all other value folders and noticed that it was only this folder that had a mnc-1 where others had a mnc1, mnc7, mnc10 none had a -1 or other number. Corrected the folder to values-mcc454-mnc1 compiled correctly. Must be a glitch when decompiling.

Cooking the TF300TG
Started cooking my first rom, some tips so far.
Followed http://forum.xda-developers.com/showthread.php?t=1801690
To set up the kitchen. Step 1 only
Downloaded 10.6.2.10 from ASUS Extracted both zips, as in the zip within the zip
Used http://forum.xda-developers.com/showthread.php?t=1890912 on the blob file
BlobUnpack.exe blob
This gives you a number of files
blob.HEADER – Header stuff (ignore it)
blob.APP – system.img
blob.LNX – boot.img
blob.SOS – recovery.img (e.g. regular boot.img)
blob.EBT – bootloader.bin (ignore)
Rename each the matching.
Past the renamed files into the kitchen original_update
Setup working directory... TBA

Boy who cried wolf
Hmmm....it appears that I have hit another road block. I finally got my Bluetooth earpiece, paired the two, made a call and no sound....
After another night of trolling the forums found that all I have really done is tell android that this device is voice enabled, which simply allows you to access the phone app and that there could be a lot more I have yet to discover which could be stopping this from working.
Now I love all the comments people have made in regards to the fact that similar devices have been out for a while now and that people much smarter then you have been trying to crack what appears to be the 'Da Vinci code' over this time and that if they can't do it, then essentially it isn't going to happen.
But I also love one comment I came across "Hope dies last"
I have read an interest forum http://forum.xda-developers.com/showthread.php?t=2025377 all 46 pages of what appeared to be a group of very clever people trying to get the Nexus 7 3G to do the same. From my understanding of the forum is that they started out with a device which has what appears to be no telephony beyond data via 3G. AKA no SMS or MMS or voice. They managed to get SMS and MMS but never VOICE.
Why not stop there then? Well from what would appear to be to the more experienced devs here as a simply party trick on my part to change one Boolean value in the framework-res.apk file to true I have learned the following a parts from the fact that SMS and MMS worked out of the box, but also that by putting in my mobile phone sim into my voice capable enable device the following works:
The phone apps loads
I can dial and the call reaches the other mobile and displays my number
I can call my mobile number and my tablet rings
I can answer and hang up
So most of the underlying functionality appears to be active. What doesn't work:
When I answer, there is no sound from the tablet or Bluetooth
The people on the other end can't hear me from the tablet or Bluetooth.
Why did I cry wolf, well with all the functionality appeared to working, with someone claiming to have had this working only via Bluetooth already and another device apparently having it working via a similar method got me over excited.
The road block currently is the follow:
Software
Or hardware AKA the connection between the 3G and sound hardware is not linked, which I thought that having a Bluetooth device would overcome as my thinking was the following. Bluetooth would create it's own software sound device which will send the audio to the 3G via software bypassing the hardware, but I could be wrong in this way of thinking. When I have the Bluetooth paired, when I dial I hear that the Bluetooth device activates and dis-activates when I hang up, so the tablet is communicating and I suspect transmitting sound.
Or the biggest problem, IMEI is black listed by the courier, which I didn't think was the case as why would I be able to dial and connect to another number if I was blacklisted?
So it kind of leaves me to wonder if it's only really software, a link of profile missing in the Bluetooth stack, the my device has my headset listed as "Use for phone audio"
Moving forward I will get NVFLASH and the blob files created as I fear flashing anything I have created myself without a fail-safe way of getting my device back. Play a little with the build.prop file and retrace the step then ended with the forum I read to see if I am about to get any further as as far as I can tell it's more software at this stage.
Anyone could shed some light on this?

It's nice job bro.
I admire you
you try hard to challenge with this issue
I learn many thing from you
tnx
sadly it doesn't work
continue your job I believe on you and I proud to you

freak4916 said:
Hi Guys, I'm super stoked to post that I have just modded my stock ASUS TF300TG 4.1.1 to enable voice calls from the on board sim. Not VOIP, not Groove IP or SIP from the mobile number from the sim!!!
I was one of the unfortunate few who purchased this device in hast when it was on special. I was searching for an all-in-one unit. 7” was too small, single core wasn’t enough, no expandable memory, no thank you. I read that this device had at one stage using Hydro 4.4 firmware which enabled voice. So I knew it was possible. Even though people who reported it working stated that it only truly works via a Bluetooth headset, but that’s what I wanted anyways. Besides, who wants to have a 10” tablet to the side of their face while on the phone, people might think you’re mad.
What I didn’t know in my hast, was the sleepless nights that would follow by simply pressing OK to an ASUS update from 4.0.3 to 4.1.1 would cause.
Here are some facts I have learnt along the way.
NVFLASH is unit specific.
NVFLASH can be install on JB, but because of the above, can’t go back to ICS anyway unless to installed it while you were on ICS and made the files then.
Why go back, once you update to JB, ASUS enables signing which prevents you from installing HYDRO 4.4 or stock ICS anyway.
No one makes ROMS for TF300TG, sad news get over it. I had to. If they do, none enable the phone function, or disabled 3G all together or have reported nothing but issues when it was enabled.
My only option was then clear, make my only rom or mod to do it myself with stock 4.1.1.
This is what I have installed currently, any other variation has not been tested and I will not be held responsible for bricking your device if you wish to test this on your device!!!
I have stock ASUS WW_epad-10.4.3.9 firmware
I have rooted my device via the motochopper method
I have unlocked my bootloader via the official unlocker from ASUS v7
I have installed openrecovery-twrp-2.6.3.0-tf300tg-JB and BACKED UP EVERYTHING BEFORE PROCEEDED!!
I will not bore you will all the different ways I tried, how many soft bricks or hours I spent learning from knowing nothing about Android or cooking as this is my first android device. So here is what worked.
I can’t attach the TWRP update.zip of the end result until I reach 10 posts, but if I give you a fish, you’ll eat for a day, but if I teach you how to fish, you’ll eat for a lifetime.
Hunt down the following tools on your PC (WILL POST SOURCE LOCATIONS ONCE AGAIN WHEN I REACH 10 POSTS) (ALSO I KNOW THIS SHOULD BE IN THE DEV SECTION, CAN’T POST THERE UNTIL 10 POSTS EITHER) Please don’t ask:
FrameworkFlasher-MOD 1.1.4 to generate installable zips to push changes
Apktool to decompile and recompile apk packages
JAVA JDK 1.7
WinRAR
Notepad++ (regular notepad / wordpad might add artifacts to your file and “F” with things)
Install the following on your tablet, FX with the root explorer add-on both free
Using FX on your device copy the following file located under /system/framework/framework-res.apk to a USB device.
Copy into the folder of Apktool on your PC and run the following commands from the command line:
apktool.bat if framework-res.apk
apktool.bat d framework-res.apk
(keep command prompt open)
This will create a folder called "framework-res", navigate to that folder and open "framework-res\res\values\bools.xml”
In here you’ll find a line "config_voice_capable">false
Change false to true
Save file.
Rebuild the apk by running from the command line
apktool.bat b framework-res framework-res-new.apk
Here is a trick I learnt to overcome the countless soft-bricks which followed and disappointment of being stuck on the boot screen.
Open "framework-res-new.apk" with a program such as WinRAR and extract out the file called "resources.arsc".
Once that’s done open the original unmodified framework-res.apk with WinRAR and replace "resources.arsc" with the one you extracted from the last step. (make sure you keep a backup of the original framework-res.apk before modifying it a.k.a framework-res-orig.apk)
Now create the update.zip or push via abd
It is kind of just making the shell zip to copy your mod into as I created this from a previous attempt at enabling phone functionality.
Copy your original framework-res-orig.apk into the FrameworkFlasher-MOD\place-framework-res-here folder
Run the RunMe.bat file and select option 1, then 2, then 3 and then 4. Signing kills the file, but we have to, to create a shell update.zip
Go into the FrameworkFlasher-MOD\final-zip-file
There you’ll find your ~5MB update file. Open this via WinRAR and head to \system\framework.
Override the framework-res.apk file with the file we created with apktools.
Side note: rename the framework-res-orig.apk to framework-res.apk and create another update.zip with your original framework-res.apk file a.k.a framework-res-orig.apk and call it updatefix.zip. This is just in case this doesn't work for you, you can just use this to reinstall your original file back. Saved me time and from having to restore my device repeatedly.
Copy to your Device and install via TWRP.
Note I did a wipe of cache and Dalvik, but for some reason google play had issues. Stating that google play had stopped, and whenever I tried to install would be stuck at installing for what appears to be infinity.
As this device is only a few days old had nothing on it, so I did a factory reset and everything including voice calls started working correctly.
You have been warned!!
Now shop for a bluetooth headset and happy voice calls.
Happy days 10 posts reached. Attached are the update files for 10.6.2.10 stock ASUS rom. I don't have them for 4.1.1. Please backup your framework-res.apk file first and place it in the updatefix.zip file under system/framework just in case. Update via recover install from zip method. Wipe cache and Dalvik.
Updateshell.zip is just an empty zip that you can't then use to install other changes.
Click to expand...
Click to collapse
I was wondering, the update files you uploaded, are they simply run and go?

I installed the update file you provided. I do, indeed, have a dialer. I recieve incomming calls and can make them too. but no audio. I have a bluetooth headset, is there anything else I can try?

how can that mod be for 4.2.2 if the last version asus released was 4.2.1 asus rom 10.2.6.11 ?
edit:
[changes the framework-res.apk and did changes ,got telephone app but i always get connection problem]
edit2:
[phonecalls are working at first i tried a mmi code *100# now i will retry with a bt headset]
edit3:
[get no sound if i get a call or place a call the call connectes fine but i cant hear me even with a bt headset, im going to backup via twrp now and then make a factory reset maybe that will help]
edit4:
[im drunk and i can report that its not working indded you can place a call the call connects but you cant hear one word or speak tried to call to my nexus 4 from tablet and other way around]

Hi, I have tf300tg and I was wondering too if I can make voice calls. I will try it and make you feedback I hope. My tablet is rooted and I have tested android 5.1 (cyanogenmod) but there is no 3G support. I have returned original 4.2 and try voice call. Sorry for bad english.

I need certain partition dumps. #unlockthedroids

Okay, I am attempting to #unlockthedroid, but first I will need dumps from "/dev/block". What I'm trying to do is pull off @CrashXXL methods of rooting with Write Protect=1 but allowing the potential of unlocking bootloader with Sunshine. And I don't want it to be done randomly, so this is what we'll need to do in order to get that dump:
Requirements:
Rooted
Bootloader Unlocked
Firmware to be at 4-21. It's easier for me. Or if you have anything below, it'll probably work too.
Willing to spend time; this'll take a VERY long time. So you'll need to leave your phone overnight or whatever it takes for it to finish copying.
Instructions:
Turn on ADB in settings. (If done already, next step)
Get ADB and Fastboot on your computer. (If done already, next step)
Go to ADB directory
adb shell
Click to expand...
Click to collapse
dd if=/dev/block/mmcblk0p38 of=/(any directory)/(name your file anything - just remember the location combination)
Click to expand...
Click to collapse
When done, exit ADB
adb pull /(directory)/(file name)
Click to expand...
Click to collapse
Submit the file from the ADB folder to your own Google Drive, Mega, or Dropbox. Wherever you wish.
Files we currently need:
Droid Mini mmcblk0p5, 0p13, 0p33
Droid Ultra mmcblk0p5, 0p13, 0p33
Droid Maxx mmcblk0p5, 0p13, 0p33
There is also a certain block I don't know the mmc block number to, so when someone knows where partitions.mbn is then we'll be one step closer to getting my phone flashed and tested.
Thanks in advanced!
P.S.: Staff, please move this somewhere correct if where it is right now it's not.

mr_verystock said:
Okay, I am attempting to #unlockthedroid, but first I will need dumps from "/dev/block". What I'm trying to do is pull off @CrashXXL methods of rooting with Write Protect=1 but allowing the potential of unlocking bootloader with Sunshine. And I don't want it to be done randomly, so this is what we'll need to do in order to get that dump:
Requirements:
Rooted
Bootloader Unlocked
Firmware to be at 4-21. It's easier for me. Or if you have anything below, it'll probably work too.
Willing to spend time; this'll take a VERY long time. So you'll need to leave your phone overnight or whatever it takes for it to finish copying.
Instructions:
Turn on ADB in settings. (If done already, next step)
Get ADB and Fastboot on your computer. (If done already, next step)
Go to ADB directory
When done, exit ADB
Submit the file from the ADB folder to your own Google Drive, Mega, or Dropbox. Wherever you wish.
Files we currently need:
Droid Mini mmcblk0p5, 0p13, 0p33
Droid Ultra mmcblk0p5, 0p13, 0p33
Droid Maxx mmcblk0p5, 0p13, 0p33
There is also a certain block I don't know the mmc block number to, so when someone knows where partitions.mbn is then we'll be one step closer to getting my phone flashed and tested.
Thanks in advanced!
P.S.: Staff, please move this somewhere correct if where it is right now it's not.
Click to expand...
Click to collapse
various dumps https://yadi.sk/d/UnLW2G54f5Gbx

Thanks for the SU6-7 and 5-24 dumps! But just a question: can you dump for earlier versions? I can probably get it to run Sunshine and onto the bootloader unlock. Thanks though!

mr_verystock said:
Thanks for the SU6-7 and 5-24 dumps! But just a question: can you dump for earlier versions? I can probably get it to run Sunshine and onto the bootloader unlock. Thanks though!
Click to expand...
Click to collapse
I do not think that this would work, yes You can flash the 4-21 (all bootloader partitions + kernel + system) in the QLOAD mode, as You have access to the whole flash memory.
But the trusted boot chain will not let you boot earlier bootloader and system when a newer one was already there. Phone needs to be bootloader unlocked, to boot into any version.

It's worth trying. And plus, you never know what you can find if you try...

question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out

mr_verystock said:
It's worth trying. And plus, you never know what you can find if you try...
Click to expand...
Click to collapse
I think You can get all you need from the original FXZ file.
You can get all the bootloader partitions from the motoboot.img, see my post here.
Additionally You can extract the system partition with the simg2img tool from here, but this would be the original, not the rootet image,so You would need to insert the su binary by yourself.

pizmak said:
I think You can get all you need from the original FXZ file.
You can get all the bootloader partitions from the motoboot.img, see my post here.
Additionally You can extract the system partition with the simg2img tool from here, but this would be the original, not the rootet image,so You would need to insert the su binary by yourself.
Click to expand...
Click to collapse
If this is the method it would've been done already... But no, motoboot.img cannot be extracted for all it's worth. It has aboot, gpt, and many other parts we need to create a complete set of unbricking and/or bootloader-necessary files.
happysteve11c said:
question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out
Click to expand...
Click to collapse
Sigh... I wish, my friend. I know what you want, but nobody's willing to provide it because of. @CrashXXL is nice enough to provide the unbricking files but nobody is willing to dump for SU1.

mr_verystock said:
If this is the method it would've been done already... But no, motoboot.img cannot be extracted for all it's worth. It has aboot, gpt, and many other parts we need to create a complete set of unbricking and/or bootloader-necessary files.
Click to expand...
Click to collapse
it actually is as easy as this, the motoboot.img file is just the bootloader partition images put into one file plus a 1024 bytes header. I have extracted these image and compared them with the dumps from my own phone and they are identical, so this motoboot is not compressed or encrypted.
If You still do not believe me just check for yourself, dump for example the aboot partition from your phone and compare it with the motoboot image from the FXZ file for your firmware version, I think you will find the aboot image inside the motoboot image at some 512bytes aligned offset (you can get the offset from the header, see the description in my post linked above)
Edit: I have added my code I wrote to extract the motoboot image to this thread

happysteve11c said:
question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out
Click to expand...
Click to collapse
Not sure if you or anyone can do anything with it but I have a twrp backup of the boot and system from su1-15. Let me know if anyone wants it.
Sent from my XT1080 using XDA Free mobile app

@mr_verystock are you still working on this?

Yes, I'm working on it. But I'm dealing with school, along with patching up a broken computer which I am planning to use for my daily driver. So currently I'm installing Linux, to do a mbn split.
Oh, and I kinda messed up my Droid Maxx while doing this... Don't worry, it's a backup, I have a Droid Mini as main.

WOHOO!!!!!!!!!
Is it rooted?
What version of Android are you on?

Ya still working on this?
Hey man. I have a (probably useless) Droid Mini "dev" edition (on su6-7). Today, I will be receiving a droid maxx on 4.4 (idk if its 19.5.3 or 19.6.3 yet) and i will be unlocking it with sunshine. if you still need files/help, i can help. (when you do start work on this again). my sincere hope, aside from a bootloader unlock for the folks on 4.4.4) is that somehow this will help the Turbo folks. (mofo root is good, but bl unlock is better). let me know if and when i can help man.

Hey, yeah, please let me know if you need anything once you get started again. I have a droid ultra that I just bought off groupon for $80.

YYUSSSSSSSSSS!!!!!!!!!!!!!!!!!!!!! Thank you VERY MUCH!!!!
Great thing I have a Droid Mini. Can you dump cid.mbn for 4.4? That's the file I want to mess with currently after you unlocked.

me or him, broheim?
edit: duh, me. ill have it pulled and uploaded tomorrow around noon

Is it uploaded to a hosting site or not?

i never saw any reply dude. i can upload what i have...but my mini is on 4.4.4. i have a maxx on 4.4, but no dice on that build. i thought for a moment i was crazy. if it helps you to have either or both, i will pull them right now and throw up a link to my drive.

Hm... I can't do anything with the 4.4.4 one, I'll take the Maxx on 4.4 cid.mbn. Sorry if there were any confusion!!!

[BUSYBOX]Busybox Installation

Don't Use.

That's awesome! Thanks for this. What about xposed? I guess since this flashes blocks 1, 5, 16 there isn't a way to add it before or after.
Sent from my locked but not stocked XT1080.

chuck864 said:
That's awesome! Thanks for this. What about xposed? I guess since this flashes blocks 1, 5, 16 there isn't a way to add it before or after.
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
If I remember correctly, this includes Xposed.
Sent from my Nexus 6 using Tapatalk

Yeah, you said it originally but it wasn't listed in your last post. Maybe add what all is included at the top of the OP for any new comers.
Sent from my locked but not stocked XT1080.

chuck864 said:
Yeah, you said it originally but it wasn't listed in your last post. Maybe add what all is included at the top of the OP for any new comers.
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
Gotcha, added to OP.
Sent from my Nexus 6 using Tapatalk

after flashed. I can install safestrap then flash custom rom??

Quick question. In the starting of the guide , it says
Warning : It wipes off all data.
Then in step 5, you talk about modified XML which helps you to keep data. So is it safe to assume that data is preserved during flash ?
Edit : NVM, Saw your note in the middle of the post. My Bad.
BTW, thanks OP for providing debloated ROM and Viper4android . Finally the perfect ROM *_*
Tuulaihuu said:
after flashed. I can install safestrap then flash custom rom??
Click to expand...
Click to collapse
I feel sorry for OP and the other users here who have said a countless number of times that this ain't possible as of now due to write protect = 1 :3

I think many people tried to download this, dropbox says:
Error (429)
This account's public links are generating too much traffic and have been temporarily disabled!
can someone upload a copy to for example google-drive?

pizmak said:
I think many people tried to download this, dropbox says:
Error (429)
This account's public links are generating too much traffic and have been temporarily disabled!
can someone upload a copy to for example google-drive?
Click to expand...
Click to collapse
I will, one second.
Edit: Updated.
Sent from my Nexus 6 using Tapatalk

Question
If my phone is already rooted, do I still have to start from scratch?
And, how much time should this take?
I read somewhere it was 16 hours?

hazam1992 said:
If my phone is already rooted, do I still have to start from scratch?
And, how much time should this take?
I read somewhere it was 16 hours?
Click to expand...
Click to collapse
Yes and yes.
Sent from my locked but not stocked XT1080.

thenameisnigel said:
If I remember correctly, this includes Xposed.
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
Just double checking, when i reflash this my phone will automatically have xposed, busybox, & viper4android after following the directions, and where it says get busybox RIGHT HERE there isn't a link, that is the reason i'm just getting my facts straight. my phone is almost at 100% and i wanna do this right. Thank you sooooooo much crash and @thenameisnigel for all of the work put into this.

jblock92 said:
Just double checking, when i reflash this my phone will automatically have xposed, busybox, & viper4android after following the directions, and where it says get busybox RIGHT HERE there isn't a link, that is the reason i'm just getting my facts straight. my phone is almost at 100% and i wanna do this right. Thank you sooooooo much @CrashXXL and @thenameisnigel for all of the work put into this.
Click to expand...
Click to collapse
Link fixed and yes, everything will work after it's reflashed.

thenameisnigel said:
Link fixed and yes, everything will work after it's reflashed.
Click to expand...
Click to collapse
ok and sorry but 2 more things, are the edited xml files included in the (the firmware here) link because i didnt see a link there for it ( i'm still downloading off wifi so i cant check), and other is the busy box comes up on my pc as "busybox-armv7l" and its file type is file, so before i move it i'm to rename it as plain "busybox" and do i have to alter the file extension or leave it as is? sorry I haven't done any of this stuff since rooting the droid bionic so i'm a little rusty
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
---------- Post added at 10:44 PM ---------- Previous post was at 10:15 PM ----------
jblock92 said:
ok and sorry but 2 more things, are the edited xml files included in the (the firmware here) link because i didnt see a link there for it ( i'm still downloading off wifi so i cant check), and other is the busy box comes up on my pc as "busybox-armv7l" and its file type is file, so before i move it i'm to rename it as plain "busybox" and do i have to alter the file extension or leave it as is? sorry I haven't done any of this stuff since rooting the droid bionic so i'm a little rusty
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
Click to expand...
Click to collapse
i guess what i mean is the stuff added through you such as the added batch files and the sys folder gonna automatically do its thing when i reflash?
---------- Post added at 11:35 PM ---------- Previous post was at 10:44 PM ----------
please help my loose cord accidently unplugged during flashing system.img 7/16 in rsd and keep getting fail now
nvm restarting rsd seemed to fix

jblock92 said:
and all of the extra batch files for example Runsys_1-5 will auto run in the process?
i guess what i mean is the stuff added through you such as the added batch files and the sys folder gonna automatically do its thing when i reflash?
Click to expand...
Click to collapse
Yeah, I have looked around and can't find what .bat file to run. The RUN_SYS1,2,3,4,5 look like they would be it but I'm not sure if you run just the first or all of them. I am downloading the files now and will look into it more once it completes. The guide is confusing because it's just a quickly patched version of somberfox's. I will see if I can clean it up once I have all the details.
EDIT: Looks like you have to run every RUN_SYS.bat file in order. They are broke up so you can charge your phone in between each one I believe. YOU DO NOT want your battery to die will doing this.

** UPDATED ** I take no credit or responsibility for this. Please do what ever you want with it.
** YOU NEED ROOT ACCESS FOR THIS. IF YOU DO NOT HAVE IT THEN FOLLOW THE GUIDE HERE
Instructions
This entire method is the work of user @CrashXXL and Busybox/V4A/Debloated/Xposed installation by @thenameisnigel. This is a literal copy and paste of @somberfox 's awesome guide with just busybox instructions (Thank you, you're the best for the guide as I'm terrible at rightups). I am ONLY writing it up like this to make the instructions as plain as possible for anyone to follow. All credit goes to @CrashXXL for this awesome hack. Normal warnings, it isn’t my fault, and it isn’t crashxxl’s fault if your phone gets ****ed up because you messed up the process or didn’t read things through carefully. This is an AT YOUR OWN RISK situation. If you can’t afford to lose your phone, don’t do this.
******* WARNING *******
MAKE SURE YOU HAVE A FACTORY CABLE THAT WILL CHARGE YOUR PHONE WHILE IN FASTBOOT. DO THIS BY BOOTING INTO FASTBOOT WITH YOUR PHONE PLUGGED INTO THE CHARGER AND SEE IF IT SAYS THE BATTERY IS CHARGING. IF YOU CAN NOT CHARGE YOUR PHONE IN FASTBOOT THEN YOU CAN NOT DO THIS METOD.
******* END WARNING *******
WHAT THIS ACHIEVES: This will give your phone Root/Busybox/V4A/Debloated/Xposed but WILL NOT turn off /system write protection.
WARNING: THIS WIPES ALL DATA ON YOUR PHONE. Backup any pictures or files you have stored there that you want to keep. UPDATE: YOU CAN KEEP ALL DATA WITH THE XML FILE LINKED IN THE FILES SECTION, but I would still recommend backing things up. Seriously, it's your data. Back it up.
This method works on the following phones:
-Droid Mini XT1030 SU6-7
-Droid MAXX XT1080m SU6-7
-Droid Ultra XT1080 SU6-7
NEEDED FILES
RSD Lite
Motorola Drivers – (if you don’t have these, or know if you have them, get them)
This firmware, CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip
The Soft_and_Drivers.rar file from here
Download Python27.zip from here.
Edited XML file to maintain data in reflash. Thank you user @chuck864 for providing this!
THE PROCESS (Do yourself a favor, start with a fully charged phone)
1.)Install RSD Lite
2.)Install Motorola Drivers
3.)Open the Soft_and_Drivers.zip and extract the files. Install Python 2.7.9 first, and then install pyserial 2.7. This should create a Python27 folder on your C: drive (or other base computer drive). This will be our working folder. Extract the windows_drivers_QHSUSB_DLOAD.zip to the Python27 folder for safe keeping. You might not need this.
4.)Extract everything in the Python27.zip you downloaded to your desktop and copy the contents of the python27 folder you just extracted to the Python27 folder on your C: drive. Overwrite everything.
5.)Create a folder in Python27 called “444” and extract the CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip to that folder. IF YOU WISH TO SAVE THE DATA ON YOUR PHONE, now extract the Edited XML file you downloaded above and copy it into your 444 folder and replace the old version of the file. This one has been edited to allow you to keep your data during the next step.
5.1) DO NOT FORGET THIS STEP.
On your phone, go to a shell and run
Code:
su
cp -R /system/xbin /data/xbin
THIS IS IMPORTANT.
6.) Power down your phone entirely and boot into FASTBOOT. You do this by holding down the POWER and the VOLUME DOWN button at the same time for ten seconds. When you release them you'll be in FASTBOOT. Now plug your phone into your computer (NOT INTO A USB 3.0 PORT, those are off limits for this whole install), and run RSD Lite. Click the “…” next to the blank space that says “filename” and navigate to the “444” folder you just extracted. Select the XML file and click “ok”. Now click “Start” and wait for the process to run and for your phone to reboot. IF THIS PROCESS FAILS and you get something that says “failed flashing process, unknown fastboot command,” then you need to go into the XML file in your “444” folder and delete the line . Then start STEP 6 over again and it should work this time.
7.)After the reboot, boot your phone into FASTBOOT. This is done by powering down your phone all the way (make sure you are not plugged into your USB cable) and then press and hold the POWER and VOLUME DOWN (at least on the Maxx) button on your phone at the same time. Hold this for about ten seconds and then let go. You’ll be in fastboot.
8.)Run BLBROKE.bat from your Python27 folder. This will run a script that is essentially bricking your phone. Your screen will go black. Leave it alone for a minute or two, and then open up your “Devices and Printers” control panel frame and see if you have something listed called qualcomm hs-usb qdloader 9008. If you do, go to STEP 9. If you do not, try unplugging your phone from your computer, and then plugging it back in. Wait for it to be recognized. If you STILL don’t have qualcomm hs-usb qdloader 9008 listed under Devices and Printers, go to device manager and look for it RIGHT HERE.
It will probably be listed as “Unknown Device”. If this is the case, open up the “Unknown Device” and click “Update Driver” and then “Browse Computer.” Remember the windows_drivers_QHSUSB_DLOAD.zip you extracted in STEP 3? Navigate to that folder and tell it to look for the drivers there. It will find them. Install, and you’re good to go! You may need to unplug your phone and plug it back in, but you might not.
IF YOU CANNOT GET THE DRIVER TO INSTALL, it is probably because you need to allow the running of unsigned drivers. Do a google search for "allow unsigned drivers" and your version of windows. This tutorial is long enough without adding that process to it.
******* FINAL WARNING ********
THIS IS NOT FOR THE FAINT OF HEART OR ANYONE WHO DOESN"T WANT TO THROW THEIR PHONE IN THE TRASH!
SCARED YET??? YOU WILL BE. YOU WILL BE.
YOU CAN SIMPLY RUN RUN_SBL.bat IN YOUR PYTHON27 FOLDER AND YOUR PHONE WILL REBOOT NORMALY.
I HAVE NOT DONE THIS AND AM ONLY REPOSTING THE DIRECTIONS I HAVE READ SO YOU ARE ON YOUR OWN.
THIS IS YOUR LAST CHANCE TO RUN TO SAFTEY AND ENJOY WHAT EVER IS LEFT OF YOUR DAY!
********* END OF FINAL WARNING ********
STILL HERE?
9.)This process will take 10+ hours.
Run RUN_SYS1.bat, This will flash (1-30) parts of system section
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS2.bat,This will flash 30 (31-60) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS3.bat,This will flash 30 (61-90) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS4.bat,This will flash 30 (90-120) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS5.bat,This will flash 30 (121-132) Parts of partition system.
When it’s done, your phone should reboot and start up normally.
After the phone boots, run the following steps to install busybox.
1. Download busybox-armv7l from RIGHT HERE.
2. Use a root file explorer to copy busybox-armv7l to your /data/xbin folder and rename it busybox
3. Open terminal and type busybox --install /data/xbin
4. Reboot your phone.
You should now have root, xposed, busybox, and debloat if all went well.
Go and get a beer for a job well done! :highfive:
FAQ
q. Will sunshine work?
a. No, sunshine will not work after this method.
q. Can I install and use (insert an app name here)?
a. Any root app can be installed and used, BUT if the app takes access to /system to work then you will have to bake-in the app and reflash your phone to get it working. It’s not a simple process.
q. How do I get into FASTBOOT?
a. Well, if you didn't read Step 7 where it tells you how to do this already, here is how this is done (again): Power the device off completely and make sure it's not plugged in. Now hold down the POWER and VOLUME DOWN button for about ten seconds and then let them go. This will get you into fastboot.
q. Hey, none of the changes I made to system/ stuck after I rebooted my phone. What gives?!
a. NO CHANGES TO SYSTEM/ WILL PERSIST AFTER A HARD REBOOT. NONE EXCEPT BUSYBOX UPGRADES.
Also, if you love this Root setup as much as I do, PLEASE consider donating to CrashXXL! He has done great work on this and donations help keep folks like him working on innovations for us.

chuck864 said:
Please do what ever you want with it.
Click to expand...
Click to collapse
Sorry, I'm real lazy and don't not speak windows hardly at all.
Say I have one of those cool chargey factory cords and I wanna use linux to do all this, is there any reason I couldn't just plug the phone in with that cord, use a bash script something like this:
Code:
#!/usr/bin/bash
python qdloadSYS1.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS2.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS3.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS4.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS5.py MPRG8960.bin -ptf _SYS/partitions.txt
and go wash dishes (I am real lazy and ain't not done them in awhile)?
I see some notes on flashing blbroke in betwixt each step is why I ask. Not that I really want to wash dishes er nuthin'. It doesn't fix the bootloader at each step does it? If so, is there some re-write on the qdload that could allow the whole shebang in one step? Given I have one of those factory cords (and a short attention span)?
Again, this hinges on having a factory cord that allows you to disregard the state of the battery.

chuck864 said:
** UPDATED ** I take no credit or responsibility for this. Please do what ever you want with it.
Instructions
This entire method is the work of user @CrashXXL and Busybox/V4A/Debloated/Xposed installation by @thenameisnigel. This is a literal copy and paste of @somberfox 's awesome guide with just busybox instructions (Thank you, you're the best for the guide as I'm terrible at rightups). I am ONLY writing it up like this to make the instructions as plain as possible for anyone to follow. All credit goes to @CrashXXL for this awesome hack. Normal warnings, it isn’t my fault, and it isn’t crashxxl’s fault if your phone gets ****ed up because you messed up the process or didn’t read things through carefully. This is an AT YOUR OWN RISK situation. If you can’t afford to lose your phone, don’t do this.
******* WARNING *******
MAKE SURE YOU HAVE A FACTORY CABLE THAT WILL CHARGE YOUR PHONE WHILE IN FASTBOOT. DO THIS BY BOOTING INTO FASTBOOT WITH YOUR PHONE PLUGGED INTO THE CHARGER AND SEE IF IT SAYS THE BATTERY IS CHARGING. IF YOU CAN NOT CHARGE YOUR PHONE IN FASTBOOT THEN YOU CAN NOT DO THIS METOD.
******* END WARNING *******
WHAT THIS ACHIEVES: This will give your phone Root/Busybox/V4A/Debloated/Xposed but WILL NOT turn off /system write protection.
WARNING: THIS WIPES ALL DATA ON YOUR PHONE. Backup any pictures or files you have stored there that you want to keep. UPDATE: YOU CAN KEEP ALL DATA WITH THE XML FILE LINKED IN THE FILES SECTION, but I would still recommend backing things up. Seriously, it's your data. Back it up.
This method works on the following phones:
- Droid Mini XT1030 SU6-7
- Droid MAXX XT1080m SU6-7
- Droid Ultra XT1080 SU6-7
If you are already rooted using crashxxl's method and are running 6-7 then read below. If not, then skip to "NEEDED FILES".
*********************************************************************************
* Section For people who have already rooted using Crashxxl's method running 6-7.
* Download this file. Here.
* Only do steps 4, 5.1, 9
*********************************************************************************
NEEDED FILES
RSD Lite
Motorola Drivers – (if you don’t have these, or know if you have them, get them)
This firmware, CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip
The Soft_and_Drivers.rar file from here
Download Python27.zip from here.
Edited XML file to maintain data in reflash. Thank you user @chuck864 for providing this!
THE PROCESS (Do yourself a favor, start with a fully charged phone)
1.)Install RSD Lite
2.)Install Motorola Drivers
3.)Open the Soft_and_Drivers.zip and extract the files. Install Python 2.7.9 first, and then install pyserial 2.7. This should create a Python27 folder on your C: drive (or other base computer drive). This will be our working folder. Extract the windows_drivers_QHSUSB_DLOAD.zip to the Python27 folder for safe keeping. You might not need this.
4.)Extract everything in the Python27.zip you downloaded to your desktop and copy the contents of the python27 folder you just extracted to the Python27 folder on your C: drive. Overwrite everything.
5.)Create a folder in Python27 called “444” and extract the CFC-obakem_verizon-user-4.4.4-SU6-7-release-keys.xml.zip to that folder. IF YOU WISH TO SAVE THE DATA ON YOUR PHONE, now extract the Edited XML file you downloaded above and copy it into your 444 folder and replace the old version of the file. This one has been edited to allow you to keep your data during the next step.
5.1) DO NOT FORGET THIS STEP.
On your phone, go to a shell and run
Code:
cp -R /system/xbin /data/xbin
THIS IS IMPORTANT.
6.) Power down your phone entirely and boot into FASTBOOT. You do this by holding down the POWER and the VOLUME DOWN button at the same time for ten seconds. When you release them you'll be in FASTBOOT. Now plug your phone into your computer (NOT INTO A USB 3.0 PORT, those are off limits for this whole install), and run RSD Lite. Click the “…” next to the blank space that says “filename” and navigate to the “444” folder you just extracted. Select the XML file and click “ok”. Now click “Start” and wait for the process to run and for your phone to reboot. IF THIS PROCESS FAILS and you get something that says “failed flashing process, unknown fastboot command,” then you need to go into the XML file in your “444” folder and delete the line . Then start STEP 6 over again and it should work this time.
7.)After the reboot, boot your phone into FASTBOOT. This is done by powering down your phone all the way (make sure you are not plugged into your USB cable) and then press and hold the POWER and VOLUME DOWN (at least on the Maxx) button on your phone at the same time. Hold this for about ten seconds and then let go. You’ll be in fastboot.
8.)Run BLBROKE.bat from your Python27 folder. This will run a script that is essentially bricking your phone. Your screen will go black. Leave it alone for a minute or two, and then open up your “Devices and Printers” control panel frame and see if you have something listed called qualcomm hs-usb qdloader 9008. If you do, go to STEP 9. If you do not, try unplugging your phone from your computer, and then plugging it back in. Wait for it to be recognized. If you STILL don’t have qualcomm hs-usb qdloader 9008 listed under Devices and Printers, go to device manager and look for it RIGHT HERE.
It will probably be listed as “Unknown Device”. If this is the case, open up the “Unknown Device” and click “Update Driver” and then “Browse Computer.” Remember the windows_drivers_QHSUSB_DLOAD.zip you extracted in STEP 3? Navigate to that folder and tell it to look for the drivers there. It will find them. Install, and you’re good to go! You may need to unplug your phone and plug it back in, but you might not.
IF YOU CANNOT GET THE DRIVER TO INSTALL, it is probably because you need to allow the running of unsigned drivers. Do a google search for "allow unsigned drivers" and your version of windows. This tutorial is long enough without adding that process to it.
******* FINAL WARNING ********
THIS IS NOT FOR THE FAINT OF HEART OR ANYONE WHO DOESN"T WANT TO THROW THEIR PHONE IN THE TRASH!
SCARED YET??? YOU WILL BE. YOU WILL BE.
YOU CAN SIMPLY RUN RUN_SBL.bat IN YOUR PYTHON27 FOLDER AND YOUR PHONE WILL REBOOT NORMALY.
I HAVE NOT DONE THIS AND AM ONLY REPOSTING THE DIRECTIONS I HAVE READ SO YOU ARE ON YOUR OWN.
THIS IS YOUR LAST CHANCE TO RUN TO SAFTEY AND ENJOY WHAT EVER IS LEFT OF YOUR DAY!
********* END OF FINAL WARNING ********
STILL HERE?
9.)This process will take 10+ hours.
Run RUN_SYS1.bat, This will flash (1-30) parts of system section
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS2.bat,This will flash 30 (31-60) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS3.bat,This will flash 30 (61-90) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS4.bat,This will flash 30 (90-120) Parts of partition system.
After it completes, the phone will try to start and will hang on the logo, boot into fastboot. Let the battery charge for 15-20 minutes and then run BLBROKE.bat from your Python27 folder again.
Run RUN_SYS5.bat,This will flash 30 (121-132) Parts of partition system.
When it’s done, your phone will reboot and you will have root, busybox, etc.
Go and get a beer for a job well done! :highfive:
FAQ
q. Will sunshine work?
a. No, sunshine will not work after this method.
q. Can I install and use (insert an app name here)?
a. Any root app can be installed and used, BUT if the app takes access to /system to work then you will have to bake-in the app and reflash your phone to get it working. It’s not a simple process.
q. How do I get into FASTBOOT?
a. Well, if you didn't read Step 7 where it tells you how to do this already, here is how this is done (again): Power the device off completely and make sure it's not plugged in. Now hold down the POWER and VOLUME DOWN button for about ten seconds and then let them go. This will get you into fastboot.
q. Hey, none of the changes I made to system/ stuck after I rebooted my phone. What gives?!
a. NO CHANGES TO SYSTEM/ WILL PERSIST AFTER A HARD REBOOT. NONE EXCEPT BUSYBOX UPGRADES.
Also, if you love this Root setup as much as I do, PLEASE consider donating to CrashXXL! He has done great work on this and donations help keep folks like him working on innovations for us.
Click to expand...
Click to collapse
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
---------- Post added at 05:11 AM ---------- Previous post was at 04:52 AM ----------
jblock92 said:
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
Click to expand...
Click to collapse
will i brick if i unplug reboot and give up?

gilbertiddi0 said:
Sorry, I'm real lazy and don't not speak windows hardly at all.
Say I have one of those cool chargey factory cords and I wanna use linux to do all this, is there any reason I couldn't just plug the phone in with that cord, use a bash script something like this:
Code:
#!/usr/bin/bash
python qdloadSYS1.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS2.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS3.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS4.py MPRG8960.bin -ptf _SYS/partitions.txt
python qdloadSYS5.py MPRG8960.bin -ptf _SYS/partitions.txt
and go wash dishes (I am real lazy and ain't not done them in awhile)?
I see some notes on flashing blbroke in betwixt each step is why I ask. Not that I really want to wash dishes er nuthin'. It doesn't fix the bootloader at each step does it? If so, is there some re-write on the qdload that could allow the whole shebang in one step? Given I have one of those factory cords (and a short attention span)?
Again, this hinges on having a factory cord that allows you to disregard the state of the battery.
Click to expand...
Click to collapse
I'm not sure about Linux, but the reason it is broken into 5 steps is because your battery will not last long enough to do it all at once. You have to run blbroke each time because the script fixes your boot loader so you can boot into fastboot to charge your battery. (It won't charge in qdload mode from my understanding.) All this is from crashxxl's original post on the Russian forums and he knows what he is talking about.
Sent from my locked but not stocked XT1080.
---------- Post added at 08:15 AM ---------- Previous post was at 08:13 AM ----------
jblock92 said:
I have been stuck on 7/16 flashing system.img in rsd for 6 hours now is that normal
---------- Post added at 05:11 AM ---------- Previous post was at 04:52 AM ----------
will i brick if i unplug reboot and give up?
Click to expand...
Click to collapse
6 hours definitely isn't normal. Can you screenshot the window for us?
Sent from my locked but not stocked XT1080.

chuck864 said:
I'm not sure about Linux, but the reason it is broken into 5 steps is because your battery will not last long enough to do it all at once. You have to run blbroke each time because the script fixes your boot loader so you can boot into fastboot to charge your battery. (It won't charge in qdload mode from my understanding.) All this is from crashxxl's original post on the Russian forums and he knows what he is talking about.
Sent from my locked but not stocked XT1080.
---------- Post added at 08:15 AM ---------- Previous post was at 08:13 AM ----------
6 hours definitely isn't normal. Can you screenshot the window for us?
Sent from my locked but not stocked XT1080.
Click to expand...
Click to collapse
it failed, now i cant even get past 2/16 flashing gpt.bin

Root ANY LG G4 Variant 100% Success Directives | Root Injection | Less Bricks

Hi everyone. As I found out there's root for the G4 but doing this isn't easy especially if your variant is hard to find or has less users. This may result in you waiting for longer than you should. This thread is for those who can take things into their own hands and do it themselves. The tools are available everywhere but I'll give you the best order and steps. I'm using the China LG G4 H818 Dual SIM variant but this method is UNIVERSAL FOR ALL LG G4s.
The process will involve extracting a system image, injecting root and reflashing this image. Most of the steps are effortless and need just copy and paste with keen eyes. Do it slowly. You need an Ubuntu installation for step 2 of this 3-step tutorial. I used universal USB installer and put in on my 8GB USB. Anywhere will do so far as it boots&works. Beware this thread is not dumb-proof but this will not wipe your data or void your warranty if done successfully.
Step 1 -> Getting the proper system image.
Check here and skip to step 3 if you have your rootedsystem.img
>Don't worry because this doesn't require searching. It is from your device. Every device has a system partition and this method will pull it out as an image without root required.
1--Make sure all drivers are installed properly. I'll not be talking about this. We're on XDA not kindergarten.
2--Download the LG_root file or send command file from here and extract it. US Carrier specific check here
3--Put your device in download mode and connect it to your PC.
4--Open(double-click duh) port.bat and make sure to write down the number after com. There maybe different com numbers but choose the com on the DIAG1 line and write down that number. This is important.
5--Hold shift and right-click in any empty space in the extracted folder. Choose open command windows here.
6-- In that copy and paste this
Code:
[FONT=Lucida Console][COLOR=#ff8c00]Send_Command.exe \\.\COM[/COLOR][COLOR=#00ff00][*insert your number here][/COLOR][/FONT]
7--Now you're in send command mode. Nothing looks different on your phone but that's ok. It should just remain in download mode.
8-- On the computer screen in the window you now see #.
9--Now in this post copy the Backup system to internal storage command specific to your device model number. Check in you settings >general >about if in doubt. This is the most important step. Copy the whole line of code. Highlight with your mouse, select everything on the line and copy.
10--You didn't come all this way to fail so do it. Remember it is device model specific.
11-- Paste it in the command window and hit enter. It should take a while so wait until you see#reappear.
12--Now typeLEAVEall in capital letters. Your device will reboot. Check using the file manager if you have a file called system.img in your internal storage. If yes step 2 is next and you did well. If no repeat it and follow the steps properly. Make sure drivers are installed especially windows 10/8/8.1 users. Check device manager
Step 2 -> Root injection.
1--Prepare your Ubuntu USB or virtual machine or computer.
2--Download inject_root zip from here and extract.
3--Copy the system.img from your phone to the extracted inject_root folder on your PC.
4-Reboot into Ubuntu.
5--Here open a terminal.
6--Gain root access on Ubuntu by typing or copy and paste sudo -i
7--You should either be asked for your password which you have to enter or if you used a USB drive like me you'll see the name change to[email protected]
8--Navigate to the inject_root folder by using cd commands. This can also be done by typing cd then [space] then dragging and dropping the folder into the terminal and hitting enter.
9--You'll now see the name in the terminal become longer with the name of the folder in it.
10--Now type chmod +x autoroot.sh
11--Hit enter then sudo ./autoroot.sh
12--If you get any thing like command not recognized or something of the sort use sudo sh autoroot.sh
-That worked for me.
13--If you're successful the name of the file should change from system.img torootedsystem.img
-Please note don't rename the files. Leave them as they are.
14--Now go back to Windows let's finish this.
Step 3 ->Root
1--Transfer the rootedsytem.img to your phones internal storage.
2--Put your phone in download mode and connect it to your PC.
3--Get into send command mode as in step one.
-Put your device in download mode and connect it to your PC.
-Open port.bat and make sure to write down the number after com. There maybe different com numbers but choose the one that has DIAG1 on the same line as it. Note it down this is important.
-Hold shift and right click in any empty space in the extracted folder. Choose open command windows here.
- In that copy and paste this
Send_Command.exe \\.\COM[*insert your number here]
-Now you're in send command mode. Nothing looks different on your phone but it's find. It should just remain in download mode.
4-Now grab your command to flash system.img line of code from this post. It isn't the same as step one. Copy that an paste in the command window. Make sure it is for your device. They are model specific.
5--This should take a while so wait until you see the # again.
6--After thatLEAVEand upon reboot you should have root.
To Un-root just flash a KDZ file compatible with your device here.
Testimonies
Spudnubs said:
Rooted H812 10g for my fellow Canadians. Enjoy!
https://www.androidfilehost.com/?fid=24052804347821979
Click to expand...
Click to collapse
Wildsheep said:
This root method works for my G4 purchased in Singapore (H815 SEA)
Click to expand...
Click to collapse
luongquang said:
Thanks to @hackarchive, H818p10f done with tut.
Click to expand...
Click to collapse
player911 said:
Fantastic. This method will also ease devs for future rooted firmwares. I really cannot see LG being able to patch this, since this is basically a 3rd party LG Flashing tool. If they block this method, then their own tool will ultimately die with it.
Click to expand...
Click to collapse
GavTheStoner said:
Fantastic! I had almost given up hope of root on my EE LG G4. Have just used this method and now rooted perfectly!
hackarchive You rock! Have a thanks!
Click to expand...
Click to collapse
articular said:
everything worked fine and i successfully got my g4 rooted
my variant is H815TR
all steps easy only the ubuntu part was a bit hard especially for a windows user ( finding an ubuntu version and usb install etc. not root injection part)
ty ty ty again )
Click to expand...
Click to collapse
rirozizo said:
if it were for me to decide if we should delete the low effort root method, i'd totally delete it.
"The more 'manual', the better"
Click to expand...
Click to collapse
Moe5508 said:
Only method that roots my device successfully...I updated to 10e of the H815P and using this method (and only this!0 I was able to root my phone...ah felt so good...
The other 1-click rooting methods I came across in other parts of this forum just fail on the G4...
Click to expand...
Click to collapse
Marshmallow and root situation read here
Hit thanks if you appreciate. Hope I helped.
Credits to them whom without this won't be possible :good:
Thecubed
Team Codefire
ManhIT

This is a good method, thanks for writing this up.
I would like to add a few points....
I recommend you do keep your original system.img on your phones regular internal storage. If you encounter any boot issues you can then re-enter download mode and write the original system.img over the top of the failed root attempt. Use the same command from "step 3: root" but replace rootedsystem.img with system.img. This should still be on your phone from step 1 and will recover your phone from a failed root injection attempt. Note that it will not recover your phone if you messed up the dd command and overwrote other partitons. Be sure to use the right dd command and cut n paste to prevent seek/offset typeos.
I also recommend that you keep a backup of your system.img on your pc. When you run autoroot.sh in step 2 the copy on your pc will be renamed and patched. I suggest copying system.img somewhere else first, or re-copy it off your phone.
Additional credits to blog.lvu.kr. This is the blog of the hobbyist who reverse engineered the download mode protocol, created send_command.exe and gave it to the world. Kudos to you.

How is this any easier than the original method....if anything this requires even more work

kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
It's for those who have rare variants.

psycho_asylum said:
It's for those who have rare variants.
Click to expand...
Click to collapse
Then you should probably take out the claim that this method is easier from the OP

Can this be used to inject Xposed as well for those of us with locked BLs.

djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
No, we need to wait for a custom recovery.

psycho_asylum said:
No, we need to wait for a custom recovery.
Click to expand...
Click to collapse
Just used flash fire it worked rocking xposed now on 810!

djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
Oh nice! I wasn't adventurous enough to try it. I'll make a system backup and give it a whirl!

Very nice thread, thank you. The steps were short, few, and fairly concise.
I was waiting for something like this where I could modify my own image and I wouldn't have to wipe everything or replace it with a new image.
One thing you might want to mention is that if your phone is encrypted, you'll need to unencrypt it first.
Can anyone link me to some instructions on how to disable OTA updates for an unlocked/international H815T?

kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:

the_scotsman said:
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:
Click to expand...
Click to collapse
Thanks. I guess people don't know what XDA is about. Seeing noobs and others trying to spit on hard work when I used my time and device as Guinea pig. Also people don't know this is almost brick-proof because the system image if from their devices. Unless they use wrong commands but all here is just copy and paste. They see lot's of text and get cold feet. Anyways will be updating the OP with system images. If yours is available please share. If you see your image available and you have drivers and LG_root downloaded proceed to step 3.

The only downside is that I have to drag out my windows laptop instead of doing everything on the ubuntu machine I use at work.
But if that's the biggest of my problems then I don't really have a problem

hi, thx for this tutorial, looks good
when flashing back the rooted img,does it wipe everything ? apps, data ... etc
thx
EDIT: just correct me if im wrong
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
must make sure before i go ahead
thx

How to calculator extractly bs/seek/count ?

Is there a possibility of any personal data being written to /system on a phone during normal use? I can provide 10c Optus AU (carrier 505-02) if I can be sure its not identifying, but ive been using the phone a couple of weeks.
Download link:
https://www.androidfilehost.com/?fid=24052804347799013

optiplex2012 said:
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
Click to expand...
Click to collapse
correct.
---------- Post added at 06:01 PM ---------- Previous post was at 05:29 PM ----------
djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
HTCuser90 said:
How to calculator extractly bs/seek/count ?
Click to expand...
Click to collapse
I would also like to know this. You can resolve system by running the following. Note that this is for the H815T and is not the same on all variants.
# ls -lZ /dev/block/bootdevice/by-name/system
You'll get something like:
lrwxrwxrwx root root ubject_r:block_device:s0 system -> /dev/block/mmcblk0p47
Which tells you the actual block device (partition its on).
And you can see the size of that with:
# cat /proc/partitions
where you see:
major minor #blocks name
<snip>
259 15 4239360 mmcblk0p47
<snip>
However I dont know how to identify how large a block is or how to calculate the start offset in the main partition.

ok, it worked great
wasnt easy, since im not so familiar with using ubuntu, but all is ok
the explanation of the how to... was great and nothing lost
my H815L is now rooted
thx guys

djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
I know it's kind of going off topic, but I figured I'd mention that Flash Fire doesn't work on VS986. It just goes to a black screen and sits there forever. I left it sit for almost an hour. I saw elsewhere it has something to do with automount, I'll have to mess with it further.

hackarchive said:
Hit thanks if you appreciate. I spent hours trying to root so hope I helped.
Click to expand...
Click to collapse
Appreciated but you should include a way to unroot (undo) as well, ie how do we get back to stock (if required) ?

[VK810] Archive of Files (Stock, Programs, Recovery, Root)

This thread is meant to help share programs and older files that have gone missing or have dead links and to collect everything in one place. I came here a long time ago to ask a few questions, but now I would like to return the favor by organizing everything so owners of the VK810 don't have to run around looking for everything.
One of the most common files I see asked for is TWRP 2.7.0.1. I still have my old copy and have uploaded it to Android File Hosts. The link is located below at the very bottom. In that link, I also include a stock rom in case anyone wants to start over along with the tools to do so. Other TWRP versions are also included. I also include some other programs as well, but they are mostly meant to act as a backup in case other links go down. Just to clarify, they are not my own. I just want to make sure everyone gets what they need. If there is anything I forgot to give credit for, I will add it as I remember or let me know so I can properly give the credit.
I don't want to take credit for anything here. I just want to help people have an easy time with setting up their device, but I will give out credit where needed.
For people starting out, roirraW "edor" ehT has made an extensive tutorial for the VK810. His roms work with LTE if you need it.
https://forum.xda-developers.com/lg-g-pad-83/general/vk810-4g-reliable-to-root-install-t3283027
Since his Android File Host page is still working and he is still very active, I won't archive any of his work. Get everything you need from his pages.
For anyone that wants to return to stock, ttn1185 has a very simple guide on return to root along with the stock rom, but the link to the guide doesn't seem to work.
https://forum.xda-developers.com/lg-g-pad-83/general/vk810-verizon-lg-g-pad-8-3-to-stock-t2800857
To save time, I have included the guide I used and the link to the guide for returning to stock below. Credit goes to hyelton for creating it.
https://forum.xda-developers.com/showthread.php?t=2432476
Magendanz has been making new TWRP builds for the VK810. I included one of his older builds in my archive since it helped me out a lot.
https://forum.xda-developers.com/lg-g-pad-83/general/vk810-twrp-3-1-1-0-unofficial-t3691551
One way I managed to install it was to flash my recovery to version 2.8.7.0, run the recovery, flash the image using TWRP, and then restart. There are easier methods, but I used this one since it doesn't rely on using ADB or setting it up if you don't have it already.
Drgravy originally had the important TWRP 2.7.0.1, but his link to it is dead. The instructions for it are still relevant.
https://forum.xda-developers.com/showthread.php?t=2726707
For those that don't want to use ADB, you can copy the contents of the files to a folder you have easy access to, download/run a terminal emulator of your choice on the device, change directory to where the lok and flash files are, and use the cp command in place of push to copy the contents to the specified folders. Other than that, the other commands in the instructions are the same and can be followed verbatim. I believe it is easier or required to have root first to do this, so run Stump to root the device before doing this. It is also included in the link.
For people that do not need LTE, invisiblek has created a rom of Lineage 14.1 to work with the device. It is what I am currently using right now. While invisiblek gets credit for creating the rom, I give credit to thunderbolt128 for introducing it to me. He has simple instructions on how to install it and has a link to download the rom included in the post.
https://forum.xda-developers.com/lg-g-pad-83/general/vk810-invisibleks-lineage-14-1-rom-t3806903
I flashed pico gapps (ARM) when I was flashing the rom in recovery, but use whichever gapps (or none) that you are comfortable with.
Finally, here is my page with all of the files I mentioned before.
https://www.androidfilehost.com/?w=files&flid=278786
Again, I do not take credit for anything in here other than organizing it. I do hope it helps you a lot like it did for me.