Insecure boot.img for 4.4 - Nexus 4 Q&A, Help & Troubleshooting

I've been looking for an insecure stock boot.img for about two hours now and I can't find one. I also tried modifying the one included in the factory image by unpacking and setting the ro.secure value in default.prop to 0 but it doesn't seem to work.
So my question is really split in two:
1) Am I just bad at searching? If so, could you link me to a working insecure stock boot.img?
2) What am I missing? I found something about adbd binaries or so, saying that this method doesn't work since 4.2.2, but I didn't quite understand it to be honest... What more modifications do I need to make in order for it to work?
Basically, all I want to be able to do is use adb remount and adb push.
Huge thanks in advance! :good:

fritzhy said:
I've been looking for an insecure stock boot.img for about two hours now and I can't find one. I also tried modifying the one included in the factory image by unpacking and setting the ro.secure value in default.prop to 0 but it doesn't seem to work.
So my question is really split in two:
1) Am I just bad at searching? If so, could you link me to a working insecure stock boot.img?
2) What am I missing? I found something about adbd binaries or so, saying that this method doesn't work since 4.2.2, but I didn't quite understand it to be honest... What more modifications do I need to make in order for it to work?
Basically, all I want to be able to do is use adb remount and adb push.
Huge thanks in advance! :good:
Click to expand...
Click to collapse
as far i know to do adb remount / push u just need to unlock bootloader doing fastboot oem unlock(with phone in fastboot mode)those 2 command work here using that.

opssemnik said:
as far i know to do adb remount / push u just need to unlock bootloader doing fastboot oem unlock(with phone in fastboot mode)those 2 command work here using that.
Click to expand...
Click to collapse
My bootloader is unlocked alright, also I'm pretty sure that the only thing the bootloader has to do with it, is that it has to be unlocked if you want to be able to flash a new kernel (independent on if it's insecure or not).

fritzhy said:
My bootloader is unlocked alright, also I'm pretty sure that the only thing the bootloader has to do with it, is that it has to be unlocked if you want to be able to flash a new kernel (independent on if it's insecure or not).
Click to expand...
Click to collapse
weird, i have never seen security boot off even with custom, now im on stock 4.3 with google kernel and i can do those 2 commands, i just flashed ak now and still security boot on, franco is the same thing, so i guess there is not security boot off for n4.

Related

[Q] How to install kernel with ADB

Hi Everyone!
My question is can you install kernel (that is boot.img) with ADB?
I don't want responses like use SGY Toolkit (I know it can flash kernel but it does not use ADB), or use chamatht kernel restore, Kernel Backup/Restore.
I want this to be done by ADB,
because I don't want to wear and tear hardware buttons in recovery.
I have a idea, but I don't know if this works. Can someone test this and tell me?
NOOBS DON'T TRY THIS. THIS IS NOT CHILDS PLAY.
Code:
adb push boot.img /sdcard/hnk
adb shell
$ su
# stop
# dd if=/sdcard/hnk/boot.img of=/dev/block/bml7
# reboot
Can someone tell me is this proper way? Or suggest any other new working way.
Thanks in advance.
hnkotnis said:
Hi Everyone!
My question is can you install kernel (that is boot.img) with ADB?
I don't want responses like use SGY Toolkit (I know it can flash kernel but it does not use ADB), or use chamatht kernel restore, Kernel Backup/Restore.
I want this to be done by ADB,
because I don't want to wear and tear hardware buttons in recovery.
I have a idea, but I don't know if this works. Can someone test this and tell me?
NOOBS DON'T TRY THIS. THIS IS NOT CHILDS PLAY.
Code:
adb push boot.img /sdcard/hnk
adb shell
$ su
# stop
# dd if=/sdcard/hnk/boot.img of=/dev/block/bml7
# reboot
Can someone tell me is this proper way? Or suggest any other new working way.
Thanks in advance.
Click to expand...
Click to collapse
why would someone recommed you using SGY TOOLKIT
WHEN IT HAS BEEN CREATED BY YOU
HAHAHA....
abhishekr700 said:
why would someone recommed you using SGY TOOLKIT
WHEN IT HAS BEEN CREATED BY YOU
HAHAHA....
Click to expand...
Click to collapse
Do you know why I typed it?
There are n00bs who suggest such things. They don't bother what they type.
(This has been previously happenedd to a Recognized Developer, who used to live near my place).
So I added it so I will not get stupid notifications suggesting my own toolkit to me.
Anyway please do not post unless you have answer.
hnkotnis said:
Do you know why I typed it?
There are n00bs who suggest such things. They don't bother what they type.
(This has been previously happenedd to a Recognized Developer, who used to live near my place).
So I added it so I will not get stupid notifications suggesting my own toolkit to me.
Anyway please do not post unless you have answer.
Click to expand...
Click to collapse
sorry for posting
well found this maybe it helpshttp://www.xoomforums.com/forum/motorola-xoom-development/3209-flashing-kernel-through-adb-lots-pics.html
and
http://sanamsxperia.blogspot.in/p/installing-stock-custom-kernels.html
abhishekr700 said:
sorry for posting
well found this maybe it helpshttp://www.xoomforums.com/forum/mot...09-flashing-kernel-through-adb-lots-pics.html
and
http://sanamsxperia.blogspot.in/p/installing-stock-custom-kernels.html
Click to expand...
Click to collapse
I appreciate your help.
But you have found wrong answer.
This has Fastboot.
Samsung phones are not compatible with fastboot.
In that method you need to go to bootloader menu (NOT AVAILABLE IN SAMSUNG)
In that method command is
Code:
fastboot flash [COLOR=red][U]boot[/U][/COLOR] boot.img
This flashes boot.img to boot partition (red coloured in above command)
But it is not for SGY.
Have you tried the code I have mentioned above? (OF COURSE AT YOUR OWN RISK)
hnkotnis said:
I appreciate your help.
But you have found wrong answer.
This has Fastboot.
Samsung phones are not compatible with fastboot.
In that method you need to go to bootloader menu (NOT AVAILABLE IN SAMSUNG)
In that method command is
Code:
fastboot flash [COLOR=red][U]boot[/U][/COLOR] boot.img
This flashes boot.img to boot partition (red coloured in above command)
But it is not for SGY.
Have you tried the code I have mentioned above? (OF COURSE AT YOUR OWN RISK)
Click to expand...
Click to collapse
maybe this is suitable
So your question was how to flash a kernel NOT how to flash a rom image, correct? The suggestions above are how to install a rom (update.zip or nandroid backup)
Here's how to flash just the kernel:
Assumptions:
- you have root
- you can use ADB
- flash_image binary is installed
- you have the kernel image you want to install on the phone already
Steps:
1). Boot phone into recovery
2). run "adb shell" to get a root shell
3). type "flash_image boot kernel.img" where kernel.img is the filename of the kernel image you want to flash
Note: you can ONLY do this via adb in recovery. Any other way will result in an error (permissions).
Click to expand...
Click to collapse
abhishekr700 said:
maybe this is suitable
Click to expand...
Click to collapse
I told you.
I have already searched shell and Android Debugging Bridge commands before asking a question in XDA Forum.
This does not work.
I think I will have to wait till someone tries my ADB commands set.

[ROOT][Surnia]Moto E 2015 root all the things!

disclaimer:
Code:
I take no responsibility for any devices that may be bricked,
or any bad things that will happen to you.
flash/boot twrp from here
either flash SuperSU by chainfire, or reboot system and accept installing supersu via TWRP.
we've experienced a bug on the first boot after flashing supersu, where there is no boot animation. instead the warning sign will stay up saying "you're unlocked".
Do not worry. It will still load, and supersu will prompt you to finish installing SU. do so, and everything will be back to normal.
A known issue happens, where root breaks the camera.
If this happens to you, then change SeLinux to permissive. I may look in to fixing it properly at a later point.
thank you to @fix-this for testing
previous post:
Please note this is a development thread. If something is said that is NOT constructive, I will have it deleted.
OK so this thread doesn't tell you how to root your device... yet.
in the process of rooting my device, I have essentially soft bricked it until I can get hold of either a boot/recovery image, or I find out the kernel base, ramdisk offset and tags offset.
long story short, I shouldn't have been messing about with the system while I was tired, so I forgot about dm-verity, and now it won't boot since the boot image contains a dm-verity key. hurrah for perma root prevention systems finally working.. sort of..
Motorola has implemented a nifty method in to their bootloaders. It essentially allows you to dump a partition. This is when I stumbled on yet another security measure. to allow you to do anything with the bootloader, you must flick a switch in the android dev settings to give full access... oh wait, I can't load the system I don't know if this switch is done by writing a value to memory, or is passed on with the reboot reason. I don't know Java that well, and I sure as hell don't know smali.
So far I have attempted:
Dump a modified system image (Failed because dm-verity).
Pull the boot image (Failed because SELinux)
Dump the boot image via moto fastboot (failed because either outdated mfastboot, or security from [read above])
Boot directly in to DLOAD mode. (Failed. seems with the msm8916, they've changed the method of accessing it, and having dload mode is now optional [which they disabled.. probably..]. I'm not going to risk wiping the bootloader to see if DLOAD mode will load as a fail safe).
so how can you help?
method failed. trying something else..
I need someone who doesn't mind unlocking their bootloader (or already has done), and doesn't need their hand holding. (request for hand holding isn't development, it will be deleted).
unlock bootloader.
get mfastboot
go to settings, dev settings, and allow oem unlock
boot to fastboot/bootloader
run this command
Code:
mfastboot oem partition dump recovery
If this fails, then try this (with this fastboot) (Thank you @m1cha for this version of fastboot, sources here)
Code:
fastboot_dump dump recovery.img oem partition moto-dump recovery
send the results back to me
Hopefully, this will all go well. If not, I'll spend a few hours figuring out the values they've used for the kernel base and offsets.
If anyone else has any ideas (even if it's to get a temp root), then feel free to share them
Big thankyou to @PotatoJ who has donated a very generous $20
And it finally begins
Gave em both the commands, nothing. Both are restricted. Ugh...
C:\windows\system32>fastboot dump recovery.img oem partition moto-dump recovery
...
(bootloader) Command Restricted
FAILED (remote failure)
finished. total time: 0.002s
more updates. just been told that those commands are for internal use only.
had an idea though.. will get back to you
cybojenix said:
more updates. just been told that those commands are for internal use only.
had an idea though.. will get back to you
Click to expand...
Click to collapse
Whatever you need, let me know. I've got the phone waiting for commands.
if im correct i think the system images are now available. ill help with what i can to obtain root. id hope rooting this wont be too hard considering we can unlock the bootloader via moto.
i also messaged jcase to see if he might be able to help us.
fix-this! said:
if im correct i think the system images are now available. ill help with what i can to obtain root. id hope rooting this wont be too hard considering we can unlock the bootloader via moto.
i also messaged jcase to see if he might be able to help us.
Click to expand...
Click to collapse
No need for jcase now. the boot image is out. I can patch it, and talk with chainfire about how to best handle dm-verity
cybojenix said:
No need for jcase now. the boot image is out. I can patch it, and talk with chainfire about how to best handle dm-verity
Click to expand...
Click to collapse
Yeah jcase responded and said since we can unlock the bootloader all we needed was a custom recovery to flash superuser. Was just trying to help.
fix-this! said:
Yeah jcase responded and said since we can unlock the bootloader all we needed was a custom recovery to flash superuser. Was just trying to help.
Click to expand...
Click to collapse
it's kind of a pain to make a custom recovery without having a recovery/boot image
Do you plan on making the recovery work with the boost mobile Variant
903tex said:
Do you plan on making the recovery work with the boost mobile Variant
Click to expand...
Click to collapse
no. I don't have the device.
btw, got twrp on it, however the return of the "No touch till screen goes off" bug is back.
Xda seems to be glitching, and won't show there's a thread in original dev from the main forum, so here's a direct link.
http://forum.xda-developers.com/moto-e-2015/orig-development/twrp-moto-e-2015-recovery-t3049726
if you need me to test, pm me. otherwise ill wait until you say its ok to root.
Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #
cybojenix said:
Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #
Click to expand...
Click to collapse
congratulation to you to gaining root access. :good::good::good:
we want rooting all together:laugh::laugh:
cybojenix said:
Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #
Click to expand...
Click to collapse
you hard work is much appreciated.
so some bad news. the GB and EU variants have different camera blobs it seems.
unless I get decent testers, I will not be supporting the different variants.
cybojenix said:
so some bad news. the GB and EU variants have different camera blobs it seems.
unless I get decent testers, I will not be supporting the different variants.
Click to expand...
Click to collapse
how would i know if i have a gb or eu variant? and yes that's sad indeed for users. ill test whatever you need. i have an unlocked lte gsm model from moto.
root is done, thanks @fix-this for doing the final testing
cybojenix said:
root is done, thanks @fix-this for doing the final testing
Click to expand...
Click to collapse
Whatever you need for the CDMA variant I'll be happy to provide!

Very simple way to enable cam2api using patched_image

Not even going to keep this for the learning experience, it's not worth it.
Hi! Tks for you suport.
I have 2 questions if you can help me. I´m a noob for this phone, but i used to update mu Xperia with Remix and i unsdestand a little bit of installing costum firmware.
1- Do we need after this to install again stock boot.img? Because i read in were and MIUI forum that patch boot.img will not give OTA updates.
But installing stock will not remove Camera2api also?
2- I Have V9.6.13.0.ODIMIFE ( second september update) i try to seach for patch boot.img for A2 in were, but i only find the full stock image
in https://forum.xda-developers.com/mi-a2/how-to/fastboot-xiaomi-mi-a2-fastboot-images-t3824849
I read what you said about teaching to fishing rather give a fish, but if for this thime you could put the link, in future updates we all will be more confortable do do other updates.
Kind regards
ki69 said:
1- Do we need after this to install again stock boot.img? Because i read in were and MIUI forum that patch boot.img will not give OTA updates.
But installing stock will not remove Camera2api also?
Click to expand...
Click to collapse
Ki, this is a great example of where one needs to look carefully at the command, and do some research. If you look closely the code says "boot" patched_boot. The point there is that it doesn't say "flash". Booting it won't flash it. That command will read it from your hard drive into rom memory of the device, and NOT write it to the flash memory of the device. I.E. The boot.img on the device will not change, so no reason to flash it again.
ki69 said:
2- I Have V9.6.13.0.ODIMIFE ( second september update) i try to seach for patch boot.img for A2 in were, but i only find the full stock image
in https://forum.xda-developers.com/mi-a2/how-to/fastboot-xiaomi-mi-a2-fastboot-images-t3824849
Click to expand...
Click to collapse
Bring up all the topics in the MiA2 Guide(s) forum. At the top right is "Search This Forum". So... obviously... type in; patched_boot.
The first thread, OTA Jasmine (etc) has many posts with links to specific versions of (magisk) patched_boot images. (hint; search that thread also if you don't want to page through the posts!) - and don't forget to thank (use thank button!) cpkv5 for his efforts of extracting the boot.img and patching it for everyone, and making it available for easy download!
AsItLies said:
So to enable Cam2API w/out root, and continue to get OTA updates;
1) You need to be familiar with using ADB and FASTBOOT. Pls look at easily searchable documentation for them. Have them installed and usable on your pc / laptop. Try some of the commands out before using this guide, to get use to them / verify working.
2) You have to unlock the bootloader, which will wipe the device. It will also have to stay unlocked, which means your phone will be considered 'uncertified' in Play Store. Because we don't have NFC, and I don't do any banking apps on my phone... no worries for me.
3) You need the patched_boot.img for your current software version. The patched image (and the original boot image) are readily available. Just search the MiA2 forums and you'll find numerous links to new and previous images for the various software versions that have existed for our MiA2's.
So, you should already know how to enable adb and to OEM unlock in developer options (pls SEARCH if not!). So make an adb connection to do:
Code:
adb devices
The above will verify your pc sees the phone, obviously.
Code:
adb reboot bootloader
The above is an easy way to get to fastboot mode.
Code:
fastboot devices
The above will verify fastboot sees our device
Code:
fastboot oem unlock
The above unlocks the bootloader and wipes / reboots device. Again recheck to be sure in Dev options adb is on.
Code:
adb reboot bootloader
Above to get back to fastboot mode.
Code:
fastboot boot patched_boot.img
The above will now boot the device. Be sure the patched boot image is in the directory you are issuing the command from, and again, it needs to be the patched image that corresponds to the current software version you are using.
At this point, I'd recommend to not do anything with the device. It should be booted and appear normal. Back at our command prompt;
Code:
adb devices
Assuming we still see our device:
Code:
adb shell
The above will now put our command prompt into a linux shell, and then type the following:
Code:
setprop persist.camera.HAL3.enabled 1
and then
Code:
setprop persist.camera.eis.enable 1
At this point, it's about done. The above settings will get propagated to the appropriate tables after rebooting the device. They won't change system settings. So OTA updates should work.
Next, we just type 'exit' in the command prompt to exit the adb shell. Lastly we again issue 'adb reboot bootloader' and once we're back into fastboot, just issue 'fastboot reboot'.
That's it. We never flashed anything, only booted the patched image. So nothing really gets touched, that could inhibit OTA updates. When we do the reboot, it will read the original (untouched) boot image and boot as normal. This also keeps us from touching the other 'Slot' (not really needed). This is much simpler than using TWRP imho.
Click to expand...
Click to collapse
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Abbey Bhatt said:
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Click to expand...
Click to collapse
Yes I saw that Abbey, just updated the original post. At this point pls use the TWRP method I mentioned in similar thread. That works for sure.
I thought the Magisk patched boot image would have the same abilities (in this sense) as twrp, but it seems it does not. Will update if I find a solution.
Abbey Bhatt said:
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Click to expand...
Click to collapse
hey mate after rebooting, magisk appeared in app drawer, did i flashed patched boot image. by using this code? please advise
AsItLies said:
Ki, this is a great example of where one needs to look carefully at the command, and do some research. If you look closely the code says "boot" patched_boot. The point there is that it doesn't say "flash". Booting it won't flash it. That command will read it from your hard drive into rom memory of the device, and NOT write it to the flash memory of the device. I.E. The boot.img on the device will not change, so no reason to flash it again.
Click to expand...
Click to collapse
Yes, i didn´t read carefully, but my question has because i read that we need magisk after put patche boot.img, then enable, then remove magisk then flash stock boot.img
I read that you update the firt post informing of the need of that.
AsItLies said:
Bring up all the topics in the MiA2 Guide(s) forum. At the top right is "Search This Forum". So... obviously... type in; patched_boot.
The first thread, OTA Jasmine (etc) has many posts with links to specific versions of (magisk) patched_boot images. (hint; search that thread also if you don't want to page through the posts!) - and don't forget to thank (use thank button!) cpkv5 for his efforts of extracting the boot.img and patching it for everyone, and making it available for easy download!
Click to expand...
Click to collapse
Sorry, i only find this one:
https://forum.xda-developers.com/showpost.php?p=77295065&postcount=22
that have magisk, but with that like i said before i will mess with system/root, the thing i did´t want. so for me is not the path i want to take. I prefer the patch you give in:
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
And because is a diferente path i think that that thread should be reopen by mods.
Abbey Bhatt said:
hey mate after rebooting, magisk appeared in app drawer, did i flashed patched boot image. by using this code? please advise
Click to expand...
Click to collapse
It shouldn't have flashed it, should have just booted it. I just uninstalled the magisk in app drawer myself. It looks as though a part of the magisk patched boot image installs that 'stub' part of magisk, to then allow a full install I'm sure. So that seems to happen whether you flash it or boot it.
ki69 said:
Yes, i didn´t read carefully,
Sorry, i only find this one:
Click to expand...
Click to collapse
You're looking in the ROM forums, not the indicated GUIDES forum.
AsItLies said:
It shouldn't have flashed it, should have just booted it. I just uninstalled the magisk in app drawer myself. It looks as though a part of the magisk patched boot image installs that 'stub' part of magisk, to then allow a full install I'm sure. So that seems to happen whether you flash it or boot it.
Click to expand...
Click to collapse
hey i am now wish to follow method presented in this thread
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
but at stage of fastboot getvar currdent-slot
it showing failed. no any partition showed
Abbey Bhatt said:
hey i am now wish to follow method presented in this thread
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
but at stage of fastboot getvar currdent-slot
it showing failed. no any partition showed
Click to expand...
Click to collapse
Not sure what's going on. When I do the same the result is:
fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.000s
Did you flash it by mistake instead of boot it? Have you tried to do a 'fastboot set_active' ?
AsItLies said:
Not sure what's going on. When I do the same the result is:
fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.000s
Did you flash it by mistake instead of boot it? Have you tried to do a 'fastboot set_active' ?
Click to expand...
Click to collapse
Humble request,
If you don't know about device or appropriate procedure don't post irrelevant things. As I know this device is tricky and more chances for hard brick if something goes wrong.
Abbey Bhatt said:
Humble request,
If you don't know about device or appropriate procedure don't post irrelevant things. As I know this device is tricky and more chances for hard brick if something goes wrong.
Click to expand...
Click to collapse
out and out flagrant request, if you can't follow directions, don't even try what is suggested.
There's no way anything I indicated would brick a phone. I've done it. Mine is not bricked. As indicated the setprop commands won't work with patched boot image. Then all you have to do is exactly what the procedure says and it's back to normal.
You're the reason people don't bother to post guides.
I do know about device and relevant procedure, it's not irrelevant. Your inability is what's irrelevant.
AsItLies said:
out and out flagrant request, if you can't follow directions, don't even try what is suggested.
There's no way anything I indicated would brick a phone. I've done it. Mine is not bricked. As indicated the setprop commands won't work with patched boot image. Then all you have to do is exactly what the procedure says and it's back to normal.
You're the reason people don't bother to post guides.
I do know about device and relevant procedure, it's not irrelevant. Your inability is what's irrelevant.
Click to expand...
Click to collapse
Hero how's your age how long been in this you are the people who doesn't know things and phones and wage all around being as op. Now cut this crappy out and first learn and then come for advice.
Abbey Bhatt said:
Hero how's your age how long been in this you are the people who doesn't know things and phones and wage all around being as op. Now cut this crappy out and first learn and then come for advice.
Click to expand...
Click to collapse
I'm sorry you screwed up your device. But it's not my fault. Nothing I indicated, if followed, would have caused that.
I'd suggest quitting the childish attempts at personal attacks. Your problems are not my fault.
@oka1 Hi again, sorry, this is the 2nd time! Please close this thread, and delete if possible. It' no longer provides any benefit.
Thanks! Won't happen again.

HOW-TO Unlock, Root and get Xposed for Onn 8" Walmart tablet

Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.
edit: I had this tucked away and easy to miss so here it is.
magisk_patched.img, mt8163_scatter and a few more things
IMG Files pulled from device using dd
I have added a full backup taken with TFM Tool that can be flashed with TFM or individually with fastboot
(Folder emptied by google)
There is an SP Flash Tool backup and tools on @CaffeinePizza 's server here: https://www.nathanbar.net/files/android/
There is also a flashing guide that works very well in post #192 by @CaffeinePizza
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Wow... I totally entered the wrong commands in fastboot /facepalm
This is really good to know though. @diplomatic was able to help me unlock the bootloader on my 10" Onn tablet via 'other' means... but it's awesome that's not required and thus available to a large audience!
I'll give this a shot on both variants of the 10" (the one with the keyboard actually has slightly different hardware/software)
Also, thanks for drawing my attention here with the mention @diplomatic
I have been trying to build TWRP for this thing, but haven't been successful just yet.
If anyone cares to lend some guidance, I wouldn't turn it down
tek3195 said:
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates....
...Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader.
Click to expand...
Click to collapse
Confirmed working (not there was any doubt). Thanks for you excellent post.
---------- Post added at 11:41 PM ---------- Previous post was at 11:36 PM ----------
diplomatic said:
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Click to expand...
Click to collapse
Not necessarily. Your tool has two distinct advantages:
- ability to easily lock and unlock
- preserves contents of data partition
In the absence of TWRP I would be loath to unlock via the stock method unless working with a virgin device. Yes, there are ways to backup/restore contents ofthe data partition outside of a dedicated recovery but I don't have the time or ambition to mess with such clumsy approaches. Your non-destructive unlockbl.sh script makes it easy.
DB126 said:
In the absence of TWRP...
Click to expand...
Click to collapse
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
NFSP G35 said:
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
Click to expand...
Click to collapse
Can I get a copy of your TWRP ?
Nevermind, just realized you said both 10" and not 8".
tek3195 said:
Can I get a copy of your TWRP ?
Nevermind, just realized you said both 10" and not 8".
Click to expand...
Click to collapse
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.
diplomatic said:
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Click to expand...
Click to collapse
What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
NFSP G35 said:
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!).
Click to expand...
Click to collapse
Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ? I have Magisk fully operational already. Or do I need to un-root before pulling recovery.img ? Shouldn't matter should it?
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell
NFSP G35 said:
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
Click to expand...
Click to collapse
I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.
tek3195 said:
What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
Click to expand...
Click to collapse
Well, you need to get root first to unlock it from Android. And I'm not sure it'll work on the mt8127....
tek3195 said:
Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ?
Click to expand...
Click to collapse
Although not directly related I opt for mtk-su for simplicity and portability. No prep required other than changing permissions on the executable.
diplomatic said:
I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.
Click to expand...
Click to collapse
Yeah, I saw that in several guides. I fought with compiling from source several times and just can't seem to get it even close to working. It took several tries just to get the build to finish and even then it just boot looped.
Doing a repack was the only thing I could get to boot.
I'd prefer to build from source, but it's kinda overwhelming.
NFSP G35 said:
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell
Click to expand...
Click to collapse
Ok cool, just making sure. Not trying to avoid or discount mtk-su, I think it's freakin awesome. But, you can also use adb shell from pc with Magisk. When you get shell and enter su you just have to grant permission for shell when prompted on device.
This is great!
Has anyone searched for a way to hide the walmart nav bar button?
blueberry.sky said:
This is great!
Has anyone searched for a way to hide the stupid walmart nav bar button?
Click to expand...
Click to collapse
Just use the Custom Navigation Bar app or adb commands to customize the Navbar.
You don't even need root.
^ can confirm. Actually, I saw the post in my email and was coming here to answer, but creeve4 beat me to it lol
Wait, if it has Treble support, is it possible to flash an Android Q GSI whenever it comes out?
Pix12 said:
Wait, if it has Treble support, is it possible to flash an Android Q GSI whenever it comes out?
Click to expand...
Click to collapse
Should be possible. Android Q Beta 4 GSI is out if anyone wants to try now.
xda-developers.com/install-android-q-beta-gsi-project-treble
NFSP G35 said:
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.
Click to expand...
Click to collapse
tek3195 said:
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.
Click to expand...
Click to collapse
How do you get to fastboot mode? When I tried it with the one in the store I managed to get it to the menu where you can choose recovery, bootloader/fastboot, or normal boot but it just froze after choosing fastboot. Which I thought meant that they removed fastboot entirely like some other tablets do.

Root without unlocking bootloader

Hi,
I'd like to root my zenfone 2 laser (ze550kl z00ld). I've been trying to unlock the bootloader with the Asus app (version 9.0.0.3) for a few days but it fails every time as for many other users (can't post urls but several threads on asus zentalk forums). I can't find version 9.1.0.0 of the tool unfortunately. However, it looks like I could root the phone without unlocking the bootloader because I can use adb to reboot to fastboot mode (adb reboot bootloader from pc command line) as I have enabled developer mode with usb debugging and the computer is allowed on the phone.
Am I right to do this?
- download latest twrp recovery image for phone model (twrp-3.3.1-0-Z00L.img from dl.twrp.me) on computer
- connect phone to computer (linux OS) & reboot to fastboot mode
- flash twrp image via
Code:
flashboot flash recovery twrp-3.3.1-0-Z00L.img
from computer
- simultaneously reboot the phone from computer via
Code:
fastboot reboot
while simultaneously holding down the volume down key on the phone
- this should allow me to reboot into twrp recovery from which I can flash the supersu app zip dowloaded from supersu.com and copied from the computer onto the phone's sd card root
Does this seem correct to you? Is this likely to succeed or should I continue trying to unlock the bootloader?
Thank you very much!
DrWaste said:
Hi,
Does this seem correct to you? Is this likely to succeed or should I continue trying to unlock the bootloader?
Thank you very much!
Click to expand...
Click to collapse
Hello
You won't be able to install TWRP without unlocking the bootloader.
The official unlocking tool is very buggy, and pretty much useless since it never works.
I recommend you follow this unofficial method.
https://forum.xda-developers.com/ze...de-unlock-bootloader-asus-unlock-app-t3405850
You should be able to unlock the bootloader in less than 5minutes. Just enable adb, boot into fastboot and run the code available in that thread, and it should do the trick.
After unlocking, then you can install TWRP and then Magisk, if all you want is to have root.
Hello,
FHC1998 said:
I recommend you follow this unofficial method.
https://forum.xda-developers.com/ze...de-unlock-bootloader-asus-unlock-app-t3405850
Click to expand...
Click to collapse
There's something I don't understand. On the first message of that thread it says:
You MUST be rooted to use this method.
Click to expand...
Click to collapse
That can't work for me as my phone isn't rooted.
It says to follow other methods given in another thread to try to root the phone beforehand. I'd read all these threads before. There are three which give a guide to root the zenfone 2 laser ze550kl. One requires to first unlock the bootloader (feels like I'm going round in circles here...) and the other two link to a firmware patch which used to be hosted on mega.nz but aren't available anymore.
I'd love to go the easy way and unlock the bootloader first before flashing twrp recovery and then rooting, but it seems like that's just not possible because all the guides are obsolete, or am I missing something more subtle?
Thanks!
DrWaste said:
Hello,
There's something I don't understand. On the first message of that thread it says:
That can't work for me as my phone isn't rooted.
It says to follow other methods given in another thread to try to root the phone beforehand. I'd read all these threads before. There are three which give a guide to root the zenfone 2 laser ze550kl. One requires to first unlock the bootloader (feels like I'm going round in circles here...) and the other two link to a firmware patch which used to be hosted on mega.nz but aren't available anymore.
I'd love to go the easy way and unlock the bootloader first before flashing twrp recovery and then rooting, but it seems like that's just not possible because all the guides are obsolete, or am I missing something more subtle?
Thanks!
Click to expand...
Click to collapse
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Hello,
FHC1998 said:
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Click to expand...
Click to collapse
OK, I'll give a shot that way. If you do find the system image that would be cool.
Thanks.
Hello,
FHC1998 said:
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Click to expand...
Click to collapse
Nope, seems to require root to modify the hex value of byte 16 on the boot device (I presume that's what the command does, there's no man accessible via adb shell but that's what that dd command does on unix machines). I can't even, as normal user, list /dev/block or even /dev:
Code:
1|[email protected]_Z00L_63:/ $
count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo <
dd: /dev/block/bootdevice/by-name/devinfo: Permission denied
1|[email protected]_Z00L_63:/ $ ls /dev
/dev: Permission denied
Bummer, really hoped it would work. Back to unlocking the bootloader via the buggy Asus app it seems, or chucking the phone out of the window maybe...
Thanks for your help anyway :good:

Categories

Resources