Database Users

[HOW TO][UPDATED GUIDE] Unlocking & Rooting your XOOM!

UPDATED XOOM FLASHING GUIDE 02/02/12​
I recently bought a US Xoom MZ604 and had trouble flashing it initially. I came to a realization that the newer models of Xoom reinstalls the Stock Recovery after you flash a custom Recovery (eg. CWM, Rogue Recovery etc). This is uber frustrating for newer Xoom owners, especially those who are new to the flashing community, simply because you don not know exactly what's going on.
Also, I could not find any proper, full and updated guide to flashing your Xoom. So i decided to take the initiative to do so.
WARNING: I DO NOT TAKE ANY RESPONSIBILITY IF YOUR XOOM TURNS INTO A USELESS BRICK. BY FOLLOWING THIS GUIDE, YOU WILL VOID YOUR XOOM WARRANTY WITH MOTOROLA. YOU HAVE BEEN WARNED TO EXERCISE CAUTION WHILE FOLLOWING THIS GUIDE. STRICTLY FOLLOW THIS GUIDE AND I ASSURE YOU, NOTHING WOULD GO WRONG.
In order to follow this guide, you need fundamental knowledge of ADB and Fastboot for Android. Search around the forum for this knowledge.
STEP 1: Obtaining Required Materials
a.) Download the latest version of Android SDK from HERE and install it into your the root of your C: drive.
b.) Download the latest version of Java SE from HERE and install.
c.) Download and Install the latest version of Motorola USB Drivers from HERE.
STEP 2: Unlocking your Bootloader
What is a Bootloader?
In literal terms, bootloader is code that is executed before any Operating System starts to run. The concept of bootloaders is universal to virtually all Operating systems that inculcates operating systems on your PC, laptop, smartphones, and other such devices. Bootloaders basically package the instructions to boot operating system kernel and most of them also have their own debugging or modification environment. As the bootloader kicks off before any piece of software on your device, it makes it extremely processor specific and every motherboard has it’s own bootloader. Source: http://www.addictivetips.com/mobile/what-is-bootloader-and-how-to-unlock-bootloader-on-android-phones-complete-guide/
Click to expand...
Click to collapse
1.) Make sure your Xoom is turned on. Connect it to your PC via USB.
2.) On your PC, open up File Explorer and Browse to:
C:\Android\android-sdk\platform-tools
Click to expand...
Click to collapse
3.) In that directory, make sure nothing is selected, SHIFT+Right Click into empty space and select "Open command window here".
4.) Command Prompt will open up. Type the following command:
adb reboot bootloader
Click to expand...
Click to collapse
Your XOOM will reboot into the bootloader showing "Starting Fastboot Support Protocol".
6.) Type the following command into the Command Prompt to unlock your bootloader:
fastboot oem unlock
Click to expand...
Click to collapse
7.) Read the warning and follow the instructions on the Xoom Tablet itself from this point onwards. Use the Volume Down key to navigate to 'Accept' the agreement and press Volume Up to select.
8.) Once selected, your Xoom will now unlock and format itself, meaning, all data will be cleared and you will back to a factory rest.
9.) Reboot your Xoom with the following command:
fastboot reboot
Click to expand...
Click to collapse
10.) Exit Command Prompt.
STEP 3: Rooting your Xoom
1.) Download the latest version of "Universal Xoom Root" from this thread. Place the .ZIP file into the root of your SD card.
2. Download this version of "ClockworkMod Recovery - Modified for Motorola Xoom" and place it into this directory:
C:\Android\android-sdk\platform-tools
Click to expand...
Click to collapse
This will your new Recovery. MAKE SURE THAT IT IS IN .IMG FORMAT.
2.) With your Xoom still connected to your PC, type the following commands into Command Prompt (open up using the same method as STEP 1) to install your new Recovery.
adb reboot bootloader
fastboot flash recovery recovery-Tiamat-R4c-100611-1150-cwm.img
Click to expand...
Click to collapse
3.) Once you have verification on your device that this has been flashed, reboot your device by holding volume up + power.
Then 3 seconds after you see the Motorola logo, hit volume down. You should now see "Android Recovery" in the top left corner. Hit volume up to boot into recovery. If you miss this window and somehow end up booting your Xoom normally, repeat from STEP 3, section 2 onwards again. DO NOT CLOSE THE COMMAND PROMPT WINDOW.
4.)To root your Xoom, please perform the following:
"install zip from sdcard" -> "Choose zip from sdcard", then select the Xoom-Universal-Root.zip file you downloaded.
Note: use the volume buttons to navigate and the power button to select
Click to expand...
Click to collapse
After the root flashes itself, DO NOT REBOOT YOUR XOOM!
5.) Now you have to rename the 2 notorious files, that reinstall your Stock Recovery over CWM, into a format that is unreadable by the bootloader. In the already opened Command Prompt, type the following commands:
adb remount
adb shell mv /system/recovery-from-boot.p /system/recovery-from-boot.p.old
adb shell mv /system/etc/install-recovery.sh /system/etc/install-recovery.sh.old
Click to expand...
Click to collapse
6.) Reboot with CWM. Let your Xoom boot normally.
To test whether the root and flashing of CWM has been successful, type the following into your command prompt:
adb reboot recovery
Click to expand...
Click to collapse
If you are able to access the new Recovery, CONGRATULATIONS, you have successfully UNLOCKED & ROOTED your Xoom.
I would like to thank the Xoom Android community for your valuable commitment to into Xoom Android Development. Without you guys, the Xoom wouldn't feel much powerful in terms of usage. Also, I'd like to extend my gratitude to okantomi for his help when I first started out.
Those those experienced users of Xoom, please kindly help the newbies like me answer their questions in this thread. Could I also request the mods to sticky this thread for reference.
NOTE: For users who would like to revert to the original recovery, type the following into ADB: (tip provided by wontoniii)
adb shell mv /system/recovery-from-boot.p.old /system/recovery-from-boot.p
adb shell mv /system/etc/install-recovery.sh.old /system/etc/install-recovery.sh
adb reboot
Click to expand...
Click to collapse
Reference Threads:
1.) [Recovery] ClockworkMod 3.2.0.0 (R4c) Modded for Internal media [UPDATED 10/6]
2.) [ROM][Nightly][ICS] Team Eos WiFi Nightlies (Wingray/MZ604)
3.) [Root] Universal Xoom Root - ANY XOOM ANY UPDATE

Just my opinion, I would not recommend to everybody the step3/point6 as you do it...
I would just do something like:
adb remount
adb shell mv /system/etc/install-recovery.sh /system/etc/install-recovery.sh.old
Click to expand...
Click to collapse
This can be easily reverted with:
adb remount
adb shell mv /system/etc/install-recovery.sh.old /system/etc/install-recovery.sh
Click to expand...
Click to collapse
In case someone could want the old recovery back without flashing anything

wontoniii said:
Just my opinion, I would not recommend to everybody the step3/point6 as you do it...
I would just do something like:
This can be easily reverted with:
In case someone could want the old recovery back without flashing anything
Click to expand...
Click to collapse
I believe your method is better, at least there's still a recovery to revert to in case something goes wrong. I'll add it to the guide. Thanks for the suggestion!
Sent from my Xoom using Tapatalk

My tool can do it automatically, check on the signature LordAIOTool, and if you guys can please test and tell me the results
---------- Post added at 08:57 PM ---------- Previous post was at 08:39 PM ----------
wontoniii said:
Just my opinion, I would not recommend to everybody the step3/point6 as you do it...
I would just do something like:
This can be easily reverted with:
In case someone could want the old recovery back without flashing anything
Click to expand...
Click to collapse
I liked your idea too, will put on my tool (can I?)

XxLordxX said:
I liked your idea too, will put on my tool (can I?)
Click to expand...
Click to collapse
Sure, no prob

Thread moved to General.

This seams to be a good guide can anyone tell me if it works it is more detailed than the other guide ???? and why was it moved to general

This guide is great and easy and very updated i dont know why other people dont use it. One thing tho you should be more clear on how to reboot into recovery tell them to press volume up + power then let go then wait three seconds and after logo and press only the volume down

Having a problem with using your guide
Ok, I'm a noob. I am probably missing something simple. When I type "adb reboot bootloader" at the command prompt it says "Device not found." My Xoom is connected via USB (Same cable it came with). Xoom appears in my explorer window I can browse through the files; I even transferred files to the SD card. It is just not detected from the command prompt window when I start the unlocking procedure. Any assistance would be appreciated. Using Xoom 4G, Android 3.2.4; Windows 7

Make sure that adb debugging is checked. You can find this under Applications > Development settings.
Before you type, check if your device is listed
Code:
adb devices
This should list your device.
dstruble said:
Ok, I'm a noob. I am probably missing something simple. When I type "adb reboot bootloader" at the command prompt it says "Device not found." My Xoom is connected via USB (Same cable it came with). Xoom appears in my explorer window I can browse through the files; I even transferred files to the SD card. It is just not detected from the command prompt window when I start the unlocking procedure. Any assistance would be appreciated. Using Xoom 4G, Android 3.2.4; Windows 7
Click to expand...
Click to collapse

kewlguru said:
Make sure that adb debugging is checked. You can find this under Applications > Development settings.
Before you type, check if your device is listed
Code:
adb devices
This should list your device.
Click to expand...
Click to collapse
That did the trick I figured it was something simple like that. Thanks for the help.

Superb Guide!
Many thanks, I spent the best part of a day trying various methods but found this to be the most n00b friendly
1 point it may be worth adding is to use adb you must have java installed on your pc, without you get error "adb.exe is not a valid win32 application"

first time root/flash rom question
Hi all..to start with sorry if im asking in the wrong place. I have a stock Xoom with an unmodded ICS I also own the Bionic. Also I have never rooted or flashed anything so I am a super noob (soon to change though).
I wated to be able to have USB host functionality and be able to have SD card read/write assess so last week I started searching Google which led me to this wonderful sight of great help. There might be too much help because after tons of reading there is more than one way to do what I want. Can someone please point me in the best way to root and which rom I should use that will give me the least about of trouble.
Thanks in advance

Don_Don said:
Hi all..to start with sorry if im asking in the wrong place. I have a stock Xoom with an unmodded ICS I also own the Bionic. Also I have never rooted or flashed anything so I am a super noob (soon to change though).
I wated to be able to have USB host functionality and be able to have SD card read/write assess so last week I started searching Google which led me to this wonderful sight of great help. There might be too much help because after tons of reading there is more than one way to do what I want. Can someone please point me in the best way to root and which rom I should use that will give me the least about of trouble.
Thanks in advance
Click to expand...
Click to collapse
Ihave similar story m8. I spent the majority of yesterday reading and learning how to root. This is by far the easiest guide to follow to ulock and root your xoom.

I just want to correct a small error here.
In Step 6 of Step 3, you say you want to check and make sure that the new bootloader is on there correctly.
I think you mean to say check and make sure the new "Recovery" is on there and the adb command would be "adb reboot recovery".
Am I wrong? If so, please disregard.

At which point do I back up data already on Xoom? Will there be any data loss?

Don_Don said:
At which point do I back up data already on Xoom? Will there be any data loss?
Click to expand...
Click to collapse
You have to backup your data before unlocking the bootloader, which is the VERY FIRST step.

gbenj said:
I just want to correct a small error here.
In Step 6 of Step 3, you say you want to check and make sure that the new bootloader is on there correctly.
I think you mean to say check and make sure the new "Recovery" is on there and the adb command would be "adb reboot recovery".
Am I wrong? If so, please disregard.
Click to expand...
Click to collapse
Yes you are right. Thanks for pointing that it, it could have confused some. I'll rectify that right away.

Ok so I have a question about this rooting process and I haven't seen the answer yet. My question is will this process work weather your xoom is running ICS or HC?

TADitto said:
Ok so I have a question about this rooting process and I haven't seen the answer yet. My question is will this process work weather your xoom is running ICS or HC?
Click to expand...
Click to collapse
Yes, this process will work regardless of your OS.

Newbie One-Click (actually terminal command) root!

<rant> I am annoyed at how many Windows users there are lurking here -- I mean, you can't even develop Android with Windows!!! Why is everything I find Windows oriented with no Linux option? </rant>
Here is the one click root zip with a (less verbose) Linux sh script. To quote the other thread,
Credit goes to the creator of the Zenfone 2 installer: @29y6145 Thread
You need ADB and fastboot installed first. Your distro has it, Google it.
Just unzip, and run:
Code:
chmod +x root.sh
./root.sh
And that's literally it. Thanks to the other people who found the files and wrote the commands
Download here: https://steelcowboy.me/zenfone_root.zip

hello..may explain further on how to do this method? is it terminal on the phone or on linux or on the windows (cmd)? and where's the zip file?

Not a newbie tutorial at all. You might want to appropriately title this or add instructions to make it newbie friendly.

cangcan said:
hello..may explain further on how to do this method? is it terminal on the phone or on linux or on the windows (cmd)? and where's the zip file?
Click to expand...
Click to collapse
It's a Linux sh script, so you run it in the Linux terminal. It's the same directions as the other tools, just for Linux

Jhdoubleoseven said:
<rant> I am annoyed at how many Windows users there are lurking here -- I mean, you can't even develop Android with Windows!!! Why is everything I find Windows oriented with no Linux option? </rant>
Here is the one click root zip with a (less verbose) Linux sh script. To quote the other thread,
Credit goes to the creator of the Zenfone 2 installer: @29y6145 Thread
You need ADB and fastboot installed first. Your distro has it, Google it.
Just unzip, and run:
Code:
chmod +x root.sh
./root.sh
And that's literally it. Thanks to the other people who found the files and wrote the commands
Download here: https://steelcowboy.me/zenfone_root.zip
Click to expand...
Click to collapse
I'm stuck in "waiting for devices" but at the start when i check my adb devices, my phone is there.
what's wrong ?

AceHa92 said:
I'm stuck in "waiting for devices" but at the start when i check my adb devices, my phone is there.
what's wrong ?
Click to expand...
Click to collapse
The phone takes a moment to reboot into fastboot mode, so the script has it wait for 30 seconds. Can you confirm that still nothing happens after 30 seconds? And the phone does boot into bootloader mode? If so, type
Code:
adb reboot bootloader
fastboot devices
into your terminal and see if it shows up. If it's not showing up you may have a problem with fastboot itself.

This seems to work (though the fastboot in Debian is too old, I needed to download a newer version) - but I end up with no Superuser app. What's wrong?

Worked perfectly for my memo pad 7 (176cx) Thank you so much!!

drbobb said:
This seems to work (though the fastboot in Debian is too old, I needed to download a newer version) - but I end up with no Superuser app. What's wrong?
Click to expand...
Click to collapse
Sorry for the late reply -- XDA didn't seem to notify me of a new post :/
Did you see all of the fastboot messages go by in both the terminal and the phone's screen? Did everything say "OKAY"? Did you try installing SuperSU from the Play Store to see if it rooted?

Jhdoubleoseven said:
Sorry for the late reply -- XDA didn't seem to notify me of a new post :/
Did you see all of the fastboot messages go by in both the terminal and the phone's screen? Did everything say "OKAY"? Did you try installing SuperSU from the Play Store to see if it rooted?
Click to expand...
Click to collapse
Yep, I think it was OKAY on all commands. I pulled in SuperSU from the store and all root functionality seems okay as well.
I don't understand much of what the script does, especially how
Code:
fastboot flash /system/bin/partlink supersu.tgz
is supposed to work - but then, I haven't looked too closely.

Awesome, really glad it worked out for you! And yeah, I'm not entirely sure -- usually gaining root is based on an exploit so I'd guess that it replaces system binaries with modified ones to allow root access, but haven't rooted many phones so not sure how it generally works. Especially
Code:
fastboot oem start_partitioning

Thanks for this. I tried other one clicks on my fedora 22 box and kept getting fastboot errors. This one worked flawlessly.

Interesting...
The approach is quite a bit different to the usual tethered TWRP suspects as the exploit tries to overwrite quite a few binaries. Naturally I had to try it on my ME572C and unfortunately it couldn't write a single one of those binaries.

therealprof said:
The approach is quite a bit different to the usual tethered TWRP suspects as the exploit tries to overwrite quite a few binaries. Naturally I had to try it on my ME572C and unfortunately it couldn't write a single one of those binaries.
Click to expand...
Click to collapse
That's not a Zenfone though my friend... this is only for Zenfone 2

Jhdoubleoseven said:
That's not a Zenfone though my friend... this is only for Zenfone 2
Click to expand...
Click to collapse
I know, but at some point I would hope that Asus gets an f'ing clue to develop things once and use that across multiple devices running similar hardware. It's already funny how my ME176C and ME572C run completely different Android implementations (one rootable, the other not) despite being somewhat similar.

It's probably a too obvious question, but as the tutorial is for newbies I feel allowed to do:
Do I need to have an unlocked bootloader to succeed in the rooting ? The reason for asking is that the script successfully restart the phone but then the fastboot commands don't work, I get stuck at "waiting for device".
Thanks.

Outdated security
Hey, your HTTPS certs are out of date. I added a temporary exception, then found the redirect failed. I think you server needs some updating...
Any chance of a mediafire or dropbox link?

Rooting ideas and discussion

I just had an idea. What if someone roots a system.img by extracting it from a kdz and then mounting it in linux copying the root files setting the permissions and then flashing that with download mode? A simple
Code:
dd if=/data/local/tmp/system.img of=/dev/block/platform/??????/by-name/system
should do the trick to flash the system.img file replacing the ?????? with the correct directory.
Just a thought.

Wouldn't you have to have read/write access in order to push the system.img?

Impossible,without root.
Sent from my LG-D802 using Tapatalk

l33tlinuxh4x0r said:
I just had an idea. What if someone roots a system.img by extracting it from a kdz and then mounting it in linux copying the root files setting the permissions and then flashing that with download mode? A simple
Code:
dd if=/data/tmp/system.img of=/dev/block/platform/??????/by-name/system
should do the trick to flash the system.img file replacing the ?????? with the correct directory.
-
Click to expand...
Click to collapse

Dennisg34 said:
There's already a thread to discuss root. Please search before posting, thanks.
Sent from my G4 using your mom
Click to expand...
Click to collapse
I think both of the previous threads discussing root have been closed. I haven't seen another - did I miss it?

Already tried something similar. Requires root unless you're one of the lucky few who have such advanced knowledge of hacking bootloaders/exploits....which I unfortunately am not. LOL

rfarrah said:
I think both of the previous threads discussing root have been closed. I haven't seen another - did I miss it?
Click to expand...
Click to collapse
Apologies, I forgot they were.

Hello,
It is possible to rooter lg g4 with : V10B LGH815
thank you :fingers-crossed:

dydyfr said:
Hello,
It is possible to rooter lg g4 with : V10B LGH815
thank you :fingers-crossed:
Click to expand...
Click to collapse
Yes, look in the developer section.

It is possible to dd to partitions using download mode. The only real problem is that the root method would be huge having to include a system.img.

l33tlinuxh4x0r said:
It is possible to dd to partitions using download mode. The only real problem is that the root method would be huge having to include a system.img.
Click to expand...
Click to collapse
Additionally, you'd need a separate one for every carrier/variant.
I guess if it worked though, who cares how many we need or how big they are. Except with dd, one typo and you've got yourself a brick.

tabp0le said:
Additionally, you'd need a separate one for every carrier/variant.
I guess if it worked though, who cares how many we need or how big they are. Except with dd, one typo and you've got yourself a brick.
Click to expand...
Click to collapse
very true.

tabp0le said:
Additionally, you'd need a separate one for every carrier/variant.
I guess if it worked though, who cares how many we need or how big they are. Except with dd, one typo and you've got yourself a brick.
Click to expand...
Click to collapse
l33tlinuxh4x0r said:
very true.
Click to expand...
Click to collapse
Though...wouldn't it still be able to get into download mode? I could be wrong, but that's not on the system partition from my understanding.
I'm on linux and am familiar with dd (I'm a distro-hopper and have no optical drive, so everything gets dd'ed onto usb drive).
Wouldn't we have to specify a block size on that? I know at least on linux distro, if block size isn't specified, I end up in non-boot.

geoff5093 said:
Yes, look in the developer section.
Click to expand...
Click to collapse
Good
Thank's
Sent from my Iconia A3-A20 FHD using XDA Free mobile app

Th3Bill said:
Though...wouldn't it still be able to get into download mode? I could be wrong, but that's not on the system partition from my understanding.
I'm on linux and am familiar with dd (I'm a distro-hopper and have no optical drive, so everything gets dd'ed onto usb drive).
Wouldn't we have to specify a block size on that? I know at least on linux distro, if block size isn't specified, I end up in non-boot.
Click to expand...
Click to collapse
Actually you are correct. The laf partition is the download mode. Flashing recovery is where we have to worry about losing download mode. (I never understood why, but at least with the G2 download mode broke when flashing custom recovery without a certain patch)

The previous root threads were locked because peopel wouldn't stay on topic after multiple warnings...

Eagle1337 said:
The previous root threads were locked because peopel wouldn't stay on topic after multiple warnings...
Click to expand...
Click to collapse
Correction, they were closed per OP request
This one is now clean, lets try to stay on topic,
If anyone feels the urge to regurgitate further horse crap... we'll see what happens

l33tlinuxh4x0r said:
It is possible to dd to partitions using download mode. The only real problem is that the root method would be huge having to include a system.img.
Click to expand...
Click to collapse
How can you confirm being able to dd to partitions using download mode? In download mode isn't the dd running from /system/bin that is mounted as ro. How could you replace /system while it is mounted and running dd from it?

gbgadgets said:
How can you confirm being able to dd to partitions using download mode? In download mode isn't the dd running from /system/bin that is mounted as ro. How could you replace /system while it is mounted and running dd from it?
Click to expand...
Click to collapse
linux loads commands that you are in the process of running into ram. You can even delete a file that you are running and still be able to use it until you close it. Once you close it is when the problem would occur but by that time you would already have the new file in place. Also do NOT run a
Code:
dd if=/dev/zero of=/dev/block/platform/??????/by-name/system
just skip that step otherwise you would lose the ability to dd.
Go directly for a
Code:
dd if=/data/local/tmp/system.img of=/dev/block/platform/??????/by-name/system
also to get a system.img instead of extracting from a kdz you could run
Code:
dd if=/dev/block/platform/??????/by-name/system of=/data/local/tmp/system.img

docfreed said:
Wouldn't you have to have read/write access in order to push the system.img?
Click to expand...
Click to collapse
you can push to /data/local/tmp using adb without root.

Root ANY LG G4 Variant 100% Success Directives | Root Injection | Less Bricks

Hi everyone. As I found out there's root for the G4 but doing this isn't easy especially if your variant is hard to find or has less users. This may result in you waiting for longer than you should. This thread is for those who can take things into their own hands and do it themselves. The tools are available everywhere but I'll give you the best order and steps. I'm using the China LG G4 H818 Dual SIM variant but this method is UNIVERSAL FOR ALL LG G4s.
The process will involve extracting a system image, injecting root and reflashing this image. Most of the steps are effortless and need just copy and paste with keen eyes. Do it slowly. You need an Ubuntu installation for step 2 of this 3-step tutorial. I used universal USB installer and put in on my 8GB USB. Anywhere will do so far as it boots&works. Beware this thread is not dumb-proof but this will not wipe your data or void your warranty if done successfully.
Step 1 -> Getting the proper system image.
Check here and skip to step 3 if you have your rootedsystem.img
>Don't worry because this doesn't require searching. It is from your device. Every device has a system partition and this method will pull it out as an image without root required.
1--Make sure all drivers are installed properly. I'll not be talking about this. We're on XDA not kindergarten.
2--Download the LG_root file or send command file from here and extract it. US Carrier specific check here
3--Put your device in download mode and connect it to your PC.
4--Open(double-click duh) port.bat and make sure to write down the number after com. There maybe different com numbers but choose the com on the DIAG1 line and write down that number. This is important.
5--Hold shift and right-click in any empty space in the extracted folder. Choose open command windows here.
6-- In that copy and paste this
Code:
[FONT=Lucida Console][COLOR=#ff8c00]Send_Command.exe \\.\COM[/COLOR][COLOR=#00ff00][*insert your number here][/COLOR][/FONT]
7--Now you're in send command mode. Nothing looks different on your phone but that's ok. It should just remain in download mode.
8-- On the computer screen in the window you now see #.
9--Now in this post copy the Backup system to internal storage command specific to your device model number. Check in you settings >general >about if in doubt. This is the most important step. Copy the whole line of code. Highlight with your mouse, select everything on the line and copy.
10--You didn't come all this way to fail so do it. Remember it is device model specific.
11-- Paste it in the command window and hit enter. It should take a while so wait until you see#reappear.
12--Now typeLEAVEall in capital letters. Your device will reboot. Check using the file manager if you have a file called system.img in your internal storage. If yes step 2 is next and you did well. If no repeat it and follow the steps properly. Make sure drivers are installed especially windows 10/8/8.1 users. Check device manager
Step 2 -> Root injection.
1--Prepare your Ubuntu USB or virtual machine or computer.
2--Download inject_root zip from here and extract.
3--Copy the system.img from your phone to the extracted inject_root folder on your PC.
4-Reboot into Ubuntu.
5--Here open a terminal.
6--Gain root access on Ubuntu by typing or copy and paste sudo -i
7--You should either be asked for your password which you have to enter or if you used a USB drive like me you'll see the name change to[email protected]
8--Navigate to the inject_root folder by using cd commands. This can also be done by typing cd then [space] then dragging and dropping the folder into the terminal and hitting enter.
9--You'll now see the name in the terminal become longer with the name of the folder in it.
10--Now type chmod +x autoroot.sh
11--Hit enter then sudo ./autoroot.sh
12--If you get any thing like command not recognized or something of the sort use sudo sh autoroot.sh
-That worked for me.
13--If you're successful the name of the file should change from system.img torootedsystem.img
-Please note don't rename the files. Leave them as they are.
14--Now go back to Windows let's finish this.
Step 3 ->Root
1--Transfer the rootedsytem.img to your phones internal storage.
2--Put your phone in download mode and connect it to your PC.
3--Get into send command mode as in step one.
-Put your device in download mode and connect it to your PC.
-Open port.bat and make sure to write down the number after com. There maybe different com numbers but choose the one that has DIAG1 on the same line as it. Note it down this is important.
-Hold shift and right click in any empty space in the extracted folder. Choose open command windows here.
- In that copy and paste this
Send_Command.exe \\.\COM[*insert your number here]
-Now you're in send command mode. Nothing looks different on your phone but it's find. It should just remain in download mode.
4-Now grab your command to flash system.img line of code from this post. It isn't the same as step one. Copy that an paste in the command window. Make sure it is for your device. They are model specific.
5--This should take a while so wait until you see the # again.
6--After thatLEAVEand upon reboot you should have root.
To Un-root just flash a KDZ file compatible with your device here.
Testimonies
Spudnubs said:
Rooted H812 10g for my fellow Canadians. Enjoy!
https://www.androidfilehost.com/?fid=24052804347821979
Click to expand...
Click to collapse
Wildsheep said:
This root method works for my G4 purchased in Singapore (H815 SEA)
Click to expand...
Click to collapse
luongquang said:
Thanks to @hackarchive, H818p10f done with tut.
Click to expand...
Click to collapse
player911 said:
Fantastic. This method will also ease devs for future rooted firmwares. I really cannot see LG being able to patch this, since this is basically a 3rd party LG Flashing tool. If they block this method, then their own tool will ultimately die with it.
Click to expand...
Click to collapse
GavTheStoner said:
Fantastic! I had almost given up hope of root on my EE LG G4. Have just used this method and now rooted perfectly!
hackarchive You rock! Have a thanks!
Click to expand...
Click to collapse
articular said:
everything worked fine and i successfully got my g4 rooted
my variant is H815TR
all steps easy only the ubuntu part was a bit hard especially for a windows user ( finding an ubuntu version and usb install etc. not root injection part)
ty ty ty again )
Click to expand...
Click to collapse
rirozizo said:
if it were for me to decide if we should delete the low effort root method, i'd totally delete it.
"The more 'manual', the better"
Click to expand...
Click to collapse
Moe5508 said:
Only method that roots my device successfully...I updated to 10e of the H815P and using this method (and only this!0 I was able to root my phone...ah felt so good...
The other 1-click rooting methods I came across in other parts of this forum just fail on the G4...
Click to expand...
Click to collapse
Marshmallow and root situation read here
Hit thanks if you appreciate. Hope I helped.
Credits to them whom without this won't be possible :good:
Thecubed
Team Codefire
ManhIT

This is a good method, thanks for writing this up.
I would like to add a few points....
I recommend you do keep your original system.img on your phones regular internal storage. If you encounter any boot issues you can then re-enter download mode and write the original system.img over the top of the failed root attempt. Use the same command from "step 3: root" but replace rootedsystem.img with system.img. This should still be on your phone from step 1 and will recover your phone from a failed root injection attempt. Note that it will not recover your phone if you messed up the dd command and overwrote other partitons. Be sure to use the right dd command and cut n paste to prevent seek/offset typeos.
I also recommend that you keep a backup of your system.img on your pc. When you run autoroot.sh in step 2 the copy on your pc will be renamed and patched. I suggest copying system.img somewhere else first, or re-copy it off your phone.
Additional credits to blog.lvu.kr. This is the blog of the hobbyist who reverse engineered the download mode protocol, created send_command.exe and gave it to the world. Kudos to you.

How is this any easier than the original method....if anything this requires even more work

kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
It's for those who have rare variants.

psycho_asylum said:
It's for those who have rare variants.
Click to expand...
Click to collapse
Then you should probably take out the claim that this method is easier from the OP

Can this be used to inject Xposed as well for those of us with locked BLs.

djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
No, we need to wait for a custom recovery.

psycho_asylum said:
No, we need to wait for a custom recovery.
Click to expand...
Click to collapse
Just used flash fire it worked rocking xposed now on 810!

djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
Oh nice! I wasn't adventurous enough to try it. I'll make a system backup and give it a whirl!

Very nice thread, thank you. The steps were short, few, and fairly concise.
I was waiting for something like this where I could modify my own image and I wouldn't have to wipe everything or replace it with a new image.
One thing you might want to mention is that if your phone is encrypted, you'll need to unencrypt it first.
Can anyone link me to some instructions on how to disable OTA updates for an unlocked/international H815T?

kyle1867 said:
How is this any easier than the original method....if anything this requires even more work
Click to expand...
Click to collapse
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:

the_scotsman said:
This is what XDA is all about. It tells you how to inject root into your OWN system image. it's the opposite of spoon feeding. it's about teaching members how to do things for themselves. Too many people come here expecting to be spoon fed and have thigns done for them. This thread teaches people how to do their own work, while learning something at the same time.
Good work OP! :good:
Click to expand...
Click to collapse
Thanks. I guess people don't know what XDA is about. Seeing noobs and others trying to spit on hard work when I used my time and device as Guinea pig. Also people don't know this is almost brick-proof because the system image if from their devices. Unless they use wrong commands but all here is just copy and paste. They see lot's of text and get cold feet. Anyways will be updating the OP with system images. If yours is available please share. If you see your image available and you have drivers and LG_root downloaded proceed to step 3.

The only downside is that I have to drag out my windows laptop instead of doing everything on the ubuntu machine I use at work.
But if that's the biggest of my problems then I don't really have a problem

hi, thx for this tutorial, looks good
when flashing back the rooted img,does it wipe everything ? apps, data ... etc
thx
EDIT: just correct me if im wrong
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
must make sure before i go ahead
thx

How to calculator extractly bs/seek/count ?

Is there a possibility of any personal data being written to /system on a phone during normal use? I can provide 10c Optus AU (carrier 505-02) if I can be sure its not identifying, but ive been using the phone a couple of weeks.
Download link:
https://www.androidfilehost.com/?fid=24052804347799013

optiplex2012 said:
using this method WILL NOT wipe everything on my device cause im rooting my system with everything on it
correct ???
Click to expand...
Click to collapse
correct.
---------- Post added at 06:01 PM ---------- Previous post was at 05:29 PM ----------
djkinetic said:
Can this be used to inject Xposed as well for those of us with locked BLs.
Click to expand...
Click to collapse
HTCuser90 said:
How to calculator extractly bs/seek/count ?
Click to expand...
Click to collapse
I would also like to know this. You can resolve system by running the following. Note that this is for the H815T and is not the same on all variants.
# ls -lZ /dev/block/bootdevice/by-name/system
You'll get something like:
lrwxrwxrwx root root ubject_r:block_device:s0 system -> /dev/block/mmcblk0p47
Which tells you the actual block device (partition its on).
And you can see the size of that with:
# cat /proc/partitions
where you see:
major minor #blocks name
<snip>
259 15 4239360 mmcblk0p47
<snip>
However I dont know how to identify how large a block is or how to calculate the start offset in the main partition.

ok, it worked great
wasnt easy, since im not so familiar with using ubuntu, but all is ok
the explanation of the how to... was great and nothing lost
my H815L is now rooted
thx guys

djkinetic said:
Just used flash fire it worked rocking xposed now on 810!
Click to expand...
Click to collapse
I know it's kind of going off topic, but I figured I'd mention that Flash Fire doesn't work on VS986. It just goes to a black screen and sits there forever. I left it sit for almost an hour. I saw elsewhere it has something to do with automount, I'll have to mess with it further.

hackarchive said:
Hit thanks if you appreciate. I spent hours trying to root so hope I helped.
Click to expand...
Click to collapse
Appreciated but you should include a way to unroot (undo) as well, ie how do we get back to stock (if required) ?

[Thor][Apollo] Unlocking bootloader with any firmware

Hello. At first, I did not invent anything new, just checked some my guess on a other motherboard. All thanks and credits to our great developers. As always, all at your own risk.
It does not work on the Fire HDX 8.9 (Saturn)!
All steps in this manual are not necessary but they are present for maximum safety. So I highly recommend do anything exactly in this way. Sorry my English as always =)
Update2 - actual method is https://forum.xda-developers.com/showpost.php?p=75284993&postcount=1006
Update: now you can use updated draxie's utility - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014
Prerequisites for Installation
- Root
- Installed adb and fastboot drivers - official - https://drive.google.com/open?id=0B2twXJIOgv-UWWdwRl9TQS11b0k (if your system language not English, after fail navigate to "Program Files (x86)\Lab126\drivers" and run dpinst.exe /EL or switch to English =) for x64 need to disable driver signature verification before install ) also you can use pdanet drivers - http://forum.xda-developers.com/showpost.php?p=59268023&postcount=8
Manual:
1. Create unlock file following this instruction - https://forum.xda-developers.com/ki...r-firmware-t3463982/post70881555#post70881555
2. Flash old vulnarable aboot and cubed twrp (just in case). Check that all these commands executed without errors. If you'll get one - read second post below. If your firmware <=13(14)3.2.3.2 skip this step.
Download aboot and twrp for Thor (Kindle Fire HDX 7) https://drive.google.com/open?id=0B2twXJIOgv-UMGxXMUZPZTlZTUk or for Apollo (Kindle Fire HDX 8.9) - https://drive.google.com/open?id=0B2twXJIOgv-URzJDQkczNzRLaHM - and put this two files (twrp_cubed.img and aboot_vuln.mbn) into root of your kindle internal storage.
Run:
Code:
adb shell
su
dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
Now you have working twrp recovery. It already works even without unlocked bootloader. You could boot into it by holding volUP during grey kindle logo. But no need to flash anything until unlock. At this point this is just emergency tool if something goes wrong =)
3. Flash unlock file.
Now, if you reboot, you will go straight into fastboot because of old aboot - newest boot.img can't load with it. If your firmware <13(14).4.1.1 you need run "adb reboot bootloader" to boot into fastboot.
Time to flash your unlock file.
Code:
fastboot -i 0x1949 flash unlock 0xmmssssssss.unlock
You must obtain "unlock code is correct".
Grats. You are perfect =)
You can flash:
CM13 - http://forum.xda-developers.com/kin...ment/rom-cm-13-kindle-hdx-2015-11-29-t3259732
CM 12.1 - http://forum.xda-developers.com/kin...ent/rom-cm-12-unofficial-apollo-thor-t3050199
Or stock repacked latest 4.5.5.2 rom - https://drive.google.com/open?id=0B2twXJIOgv-UVFFtN2RYNXNUZ0k (13.x - thor, 14.x - apollo)
Do not flash original stock firmwares.
Regards and thank to all - @dpeddi, @vortox, @draxie, @ggow, @Ralekdev, @jcase, @Hashcode
And greatest thanks for motherboard for my experiments to @MahmudS !

FAQ:​1. if your get "not such file or directory" after su in step 2 (this is SAFESTRAP related possibly)- try to use next commands:
Code:
adb shell
su
dd if=/storage/emulated/0/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/storage/emulated/0/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
http://forum.xda-developers.com/showpost.php?p=68751981&postcount=35

I think you can use greatest @draxie tool - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014 with doing step2 only. But it need to test. Anyway I highly recommend get your hw id's before any actions.

Daredevil
ONYXis said:
Code:
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
Click to expand...
Click to collapse
Great job! So, simply flashing the vulnerable bootloader "just works"...
Are you absolutely positive?
Although I've been expecting this all along
[but wouldn't dare trying, since the HDX is *still* my only tablet],
I'm wondering what the supposed "rollback protection" after 3.2.8 really covers.
Fixed issue (now hidden)
BTW: I get the exact same MD5 hash for both versions of 'aboot_vuln.mbn' (the two 'cubed_twrp.img' are different).
Code:
66b7df0db97c7c2905d1d61199c816a5 13-aboot_vuln.mbn
66b7df0db97c7c2905d1d61199c816a5 14-aboot_vuln.mbn
087e7125c48fcbebcc2f51a9c46379f2 13-twrp_cubed.img
c06799a4a8d48d9dd55aea002def1caf 14-twrp_cubed.img
H[66b7df0db97c7c2905d1d61199c816a5]=aboot-13.3.2.3.2_user_323001720.mbn
Please double-check to make sure Apollo users won't get fried.
You do say that not all steps are necessary. Can you advise if my thinking below sounds correct?
I'm considering adding this to 1-Click; that's why I'm asking.. (If I could also include a surefire way
to root the device beforehand, we'd be all set for a truly 1-Click experience from scratch, modulo
strange Windows behaviour. [if anybody still cares ;-P])
I suppose getting rid of the potentially dangerous anti-rollback-related files is good measure,
but if they had been making any difference, this method shouldn't really work, right?
So, this may not be needed at all.
I'm also thinking that flashing TWRP in the same step -although nice- is not strictly needed.
Would you agree?

Are you absolutely positive?
Click to expand...
Click to collapse
I tried this with two devices with two firmwares at each after rollback-upgrade proccess to be sure.
Although I've been expecting this
Click to expand...
Click to collapse
Same as I. Just need to be checked.
: I get the exact same MD5 hash for both versions of 'aboot_vuln.mbn
Click to expand...
Click to collapse
Strange, I use same aboots in this tool - http://forum.xda-developers.com/kin...-to-unbrick-kindle-fire-hdx-firmware-t3277197 =) need to fix=)
Re-uploaded aboot from 14.3.2.3.2 - 4A2BE8E374C8D1FCE8E6743AC2D09BB0
Thank you.
'm also thinking that flashing TWRP in the same step -although nice- is not strictly needed.
Click to expand...
Click to collapse
Of course. But... why not? and sometimes fastboot flash recovery at very first time don't work.
but if they had been making any difference, this method shouldn't really work, right?
So, this may not be needed at all.
Click to expand...
Click to collapse
This is need to check. I really do not like that factory_provision_tool.
But I agree that all magic is just dd'ing of old aboot.

ONYXis said:
I tried this with two devices with two firmwares at each after rollback-upgrade proccess to be sure.
Click to expand...
Click to collapse
Sounds good.
ONYXis said:
Same as I. Just need to be checked.
Click to expand...
Click to collapse
Indeed! And, that's quite a daring achievement. Big thanks for that!
ONYXis said:
Strange, I use same aboots in this tool - http://forum.xda-developers.com/kin...-to-unbrick-kindle-fire-hdx-firmware-t3277197 =) need to fix=)
Re-uploaded aboot from 14.3.2.3.2 - 4A2BE8E374C8D1FCE8E6743AC2D09BB0
Thank you.
Click to expand...
Click to collapse
I also verified this, just to be sure; and, chose to hide the issue in my post above.
H[4a2be8e374c8d1fce8e6743ac2d09bb0]=aboot-14.3.2.3.2_user_323001720.mbn
ONYXis said:
Of course. But... why not? and sometimes fastboot flash recovery at very first time don't work.
Click to expand...
Click to collapse
I'll see if including the TWRP images in 1-Click pushes the size of the ZIP over the XDA limit.
I suppose I could opt to fetch from the net if it doesn't, but then I need to enable networking for the VM.
ONYXis said:
This is need to check. I really do not like that factory_provision_tool.
But I agree that all magic is just dd'ing of old aboot.
Click to expand...
Click to collapse
Yes. Please check!

draxie said:
Yes. Please check!
Click to expand...
Click to collapse
Ok. So... Another motherboard with stock 3.2.3.2
Updated it through OTA to 3.2.5 > 4.1.1 > 4.5.2 > 4.5.4 > 4.5.5 > 4.5.5.1 > 4.5.5.2
Rollbacked to 3.2.8, updated to 4.5.5.1, Kingroot.
Code:
adb shell
su
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
reboot
Boot into fastboot. At this point need to have id's already!!!
Flash unlock, flash recovery, flash upHDXed 4.5.5.2 rom. Succesfully booted up. :fingers-crossed:
OP edited.

ONYXis said:
Rollbacked to 3.2.8, updated to 4.5.5.1, Kingroot.
Click to expand...
Click to collapse
I don't suppose this rollback is essential, is it?
It should work just as well to stop the update before the currently unrootable 4.5.5.2, right?
ONYXis said:
Flash unlock, flash recovery, flash upHDXed 4.5.5.2 rom. Succesfully booted up. :fingers-crossed:
Click to expand...
Click to collapse
Nice. I'll PM you soon with an updated 1-Click, for testing, if you don't mind.
(I cannot [and don't even want to] test this on my only tablet.)

draxie said:
I don't suppose this rollback is essential, is it?
Click to expand...
Click to collapse
just checked all variations.
I'll PM you soon with an updated 1-Click, for testing, if you don't mind.
Click to expand...
Click to collapse
Of course.

Can it work on hdx 8.9?

Although I have registered my 'thanks' on various posts it seems hollow to not explicitly recognize @ONYXis and @draxie for their tremendous contributions supporting this device both past and present. The ability to unlock virtually any rooted 3rd gen HDX is a true game changer that will revive interest in this discontinued gem that still competes nicely with contemporary offerings. Well done, gents!

wizard_mini said:
Can it work on hdx 8.9?
Click to expand...
Click to collapse
You mean Saturn? No, sorry.

Hi, i cant get the adb driver to work with my german Win 10 64bit
dpinst.exe /EL starts fine but throws an error while installing.
So i wanted to try the pdanet drivers but im not sure how to get my fire into fastboot mode ("- connect your kindle already waiting in fastboot mode with usb cable to pc").
Any help? :>

Maybe you need to disable driver signature verification before install. Google it.
fastboot -
Code:
adb reboot bootloader

ONYXis said:
Maybe you need to disable driver signature verification before install. Google it.
fastboot -
Code:
adb reboot bootloader
Click to expand...
Click to collapse
Thanks, that worked. Now i have the following problem when trying "python.exe cuberHDX.py 0xmmssssssss": (tried with 64 and 32bit Python + gmpy2, because that seems to be the problem sometimes)
File "cuberHDX.py", line 7, in <module>
from gmpy2 import iroot, mpz
ImportError: DLL load failed: %1 ist keine zulõssige Win32-Anwendung. [last part means not a valid win 32 application]
Thanks for your help!

It is python installation related problem, I really not familar with that. You could post your id's and I'll create and attach your unlock-file.

ONYXis said:
It is python installation related problem, I really not familar with that. You could post your id's and I'll create and attach your unlock-file.
Click to expand...
Click to collapse
0x000015
0x1022b00d
Thank you!

RambaaZambaa said:
0x000015
0x1022b00d
Thank you!
Click to expand...
Click to collapse
Welcome.
Need to unarchive.

ONYXis said:
Welcome.
Need to unarchive.
Click to expand...
Click to collapse
Next problem :silly:
As long as im not su i can cd to sdcard folder (or storage/sdcard0). But then i cant use the "dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery" command.
So when im SU the command fails and i also cant enter the sdcard folder (no such file or directory). Strange...

RambaaZambaa said:
Next problem :silly:
As long as im not su i can cd to sdcard folder (or storage/sdcard0). But then i cant use the "dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery" command.
So when im SU the command fails and i also cant enter the sdcard folder (no such file or directory). Strange...
Click to expand...
Click to collapse
Sorry, really don't understand )
Pls, provide screenshot of cmd with your error.
And try to follow instructions directly.There is no any cd command.