Database Users

[RECOVERY][YotaPhone2][Lollipop][ROOT]Modified YotaPhone 2 Stock Recovery for ROOT

YotaPhone 2 ROOT with modified stock recovery​
NOTE:
Check out the more functional TWRP recovery for YotaPhone 2.
Since not much dev work is happening on the YotaPhone 2, I though I'd kick off by publishing a recovery image that will hopefully allow you to root your YotaPhone 2 device with lollipop, and e.g. make partition backups.
First off: Disclaimer!
I am not responsible for damaged or bricked devices. If you follow instructions in this post, then YOU are making the choice to tinker with your device, and you are likely to void your warranty by doing so. You might even damage or brick your device, so ask yourself if the benefits outweigh the risks, because after proceeding you are pretty much on your own.
What is it?
It's a slightly modified stock recovery that allows to install packages signed with testkeys, plus adb root access and busybox for e.g. shell. That's it.
What can you do with it?
- adb root & shell access (e.g. to manually backup partitions or modify system files)
- install update zips signed with testkeys (e.g. SuperSU) in addition to original Yota Devices software
- root your device
What can it NOT do?
- probably can NOT install unsigned zips (must be signed by YD (like fota update zips), OR signed with standard testkeys)
- no fancy features, just boring AOSP stock recovery as included in stock firmware
- installing of apks/zips only through adb sideload, not from (emulated) SD card
What do you need?
- YotaPhone 2 (YD201) with Lollipop 5.0, I used firmware 1.39 YMMV with other versions
- Some technical confidence
- USB cable with a PC or laptop on one end
Steps overview:
1) First read the whole post to understand what's going to happen
2) backup (sync stuff, copy photos off, use a backup app etc, use search if unsure how to)
3) Unlock the bootloader
4) Install adb and fastboot if not yet installed. (For Windows look e.g. here, for linux the fastest is probably to install Android SDK with platform tools, see here If this is not enough info to get you started, please use xda search!)
5) Download recovery image: yd201_reco_139_testkeys_v01.img
6) boot the recovery image
7) root the device by sideloading SuperSU,
Unlocking bootloader:
Warning 1: It is currently not known how to re-lock the bootloader. (fastboot oem lock just hangs). This means you cannot completely undo the next step as of yet. This might have consequences for sending the device in for repairs, if they check for this, and deem it a (warranty) problem.
Warning 2: on some devices unlocking the bootloader wipes the device clean to factory defaults. I didn't see this happening on my YD201, but be warned, backup first!
On Linux:
Code:
sdk/platform-tools$ sudo ./fastboot oem unlock
...
OKAY [ 0.002s]
finished. total time: 0.002s
On Windows:
Code:
C:\android-sdk-windows\platform-tools>fastboot oem unlock
...
OKAY [ 0.002s]
finished. total time: 0.002s
Maybe Windows will install some extra drivers in the process.
BOOT the recovery image:
a) First: put the device in fastboot/download mode:
method 1: Power off with USB cable disconnected, then hold volume down key while inserting USB cable (which should already be in your PC on the other end).
method 2: do a
Code:
adb reboot bootloader
You should see a black screen with a tiny white: downloading...
b) boot the recovery image:
On linux:
Code:
sdk/platform-tools$ sudo ./fastboot devices
Should show a connected device in fastboot mode, then proceed:
Code:
sdk/platform-tools$ sudo ./fastboot boot <path>/<to>/yd201_reco_139_testkeys_v01.img
Where <path>/<to>/yd201_reco_139_testkeys_v01.img is the path you downloaded the image file to (e.g. ~/Download/yd201_reco_139_testkeys_v01.img)
On Windows:
copy the yd201_reco_139_testkeys_v01.img file to the folder with fastboot.exe (here assuming C:\android-sdk-windows\platform-tools, and D:\downloads as download location for the img)
* snippet below is fabricated, but you get the idea
Code:
D:\>C:
C:\>cd C:\android-sdk-windows\platform-tools
C:\android-sdk-windows\platform-tools>fastboot.exe devices
Should show a connected device in fastboot mode, then proceed:
Code:
C:\android-sdk-windows\platform-tools>copy D:\downloads\yd201_reco_139_testkeys_v01.img . [i]note the dot at the end[/i
C:\android-sdk-windows\platform-tools>fastboot.exe boot yd201_reco_139_testkeys_v01.img
Hopefully you see the screen go completely black after a few seconds, and recovery menu will appear. Like stock recovery, it will show an error (E:Cannot load volume /misc) but you can ignore that, along with the 'error' triangle icon that goes with it.
If booting fails with a signature error, the bootloader is probably not properly unlocked, try again.
Note that this recovery image could be flashed too (I haven't actually tried to flash yet), but if you're cautious (as we are in this post) you can just boot it every time you need it.
SuperSU flashing:
1) download Chainfire's SuperSU flashable zip from this page, filename is:UPDATE-SuperSU-v2.46.zip
2) Assuming you're still in custom recovery, otherwise boot into custom recovery again as outlined above
3) choose "apply update from ADB" from the menu (choose with volume up/down keys, confirm with power key). Recovery now waits for a file.
4) on the connected PC:
on Linux:
Code:
sdk/platform-tools$ adb sideload <path>/<to>/UPDATE-SuperSU-v2.46.zip
on Windows:
Code:
D:\>C:
C:\>cd C:\android-sdk-windows\platform-tools
C:\android-sdk-windows\platform-tools>copy D:\downloads\UPDATE-SuperSU-v2.46.zip .
C:\android-sdk-windows\platform-tools>adb.exe sideload UPDATE-SuperSU-v2.46.zip
5) on the phone you should see SuperSU installing.
6) reboot when done
7) if SuperSU app is not visible in launcher, download & install SuperSU from playstore.
To verify if rooting worked, start SuperSU. If that looks OK, start an app that requires root (like e.g. betterbatterystats) or use a simple checkroot app from the store. Reboot and check again if it persisted.
NOTE: you could also FLASH this image, replacing the stock recovery on the recovery partition permanently (until you flash again). Above we're just BOOTing it once, next time entering recovery in the standard way will just load the stock recovery from the recovery partition). You would use fastboot flash instead of fastboot boot above. Flashing is UNTESTED.
Problems & FAQ
Q: It doesn't work!!1!
A: Please provide plenty of detail about error messages, which step, what versions etc. Without providing any detail you'll look silly.
Q: I don't know how to <backup/adb/download/reboot/flash>
A: Please use the search button, xda forums have lots of info
Q: How can I tell if I'm in stock recovery or modded stock recovery? They look the same!
A: The Droid error icon with the triangle in the centre of the modded recovery screen has some white text (yd201_cr0.1), the stock one doesn't.
Future development
I hope that there are some devs out there willing to work on the YotaPhone 2 in the near future. I'll try to tinker a bit every now and then, but I cannot promise anything as I'm no expert. To enable proper development of custom ROMs and better recoveries (e.g. TWRP) it would be great if Yota Devices released their Kernel sourcecode for the kernel they use in their YotaPhone 2 ROMs. I know they have been asked to release sources before (and they should in order to comply with the GPL license), but so far without response.
Good news is that You Can Help! Please stimulate Yota to publish Kernel sourcecode for YotaPhone 2 through their support page (hint: choose 'sales' as category, otherwise you'll have to enter lots of details. Be polite!).
Info::
Mod by: SteadyQuad
Version: 0.1 based on YD stock recovery 5.0 1.39 EU
Thanks to: Yota Devices for a great device, Jeopardy for testing and suggestions, Chainfire for SuperSU
Created: 2015-06-10
Last Updated: 2015-06-20 (added warning about current inability to re-lock bootloader)

As SteadyQuad already mentioned, I can confirm that this method works.
Bye bye Google Newsstand! Goodbye Google Books!
(When uninstalling system apps Lollipop handles a bit differently from Kitkat, and I had to always restart the device after deleting.)
Thank you very much for your effort SteadyQuad.

Allelujah!
Thanks SteadyQuad for this great job! It works like a charm!
:good:
Anybody tried to install xposed module on rooted Yotaphone2? (alpha 4 modules)?
I think it little bit risky that's why I'm asking...
Or maybe somebody know how to make a full backup Yotaphone (like in CWM)?
Thanks in advance again for a really great job!

zencooler said:
Allelujah!
Thanks SteadyQuad for this great job! It works like a charm!
:good:
Anybody tried to install xposed module on rooted Yotaphone2? (alpha 4 modules)?
I think it little bit risky that's why I'm asking...
Or maybe somebody know how to make a full backup Yotaphone (like in CWM)?
Thanks in advance again for a really great job!
Click to expand...
Click to collapse
I haven't tried testing xposed yet, but am planning to sooner or later.
Running that custom recovery we do have root level access to everything, so it should be possible to create a backup from there with the help of a computer. Have to look into this.

the recovery download doesn't work.
EDIT : it worked on laptop
How about somebody can compile a TWRP recovery because Yotaphone has posted there SDK ?
So we can make Nandroid backup.

a question : if you can modify stock recovery,
can't you compile from TWRP source and yotaphone SDK a TWRP recovery for the yotaphone 2 users ?
just my 2 cents, i evenly willing to pay for it

Gojira-r32 said:
a question : if you can modify stock recovery,
can't you compile from TWRP source and yotaphone SDK a TWRP recovery for the yotaphone 2 users ?
just my 2 cents, i evenly willing to pay for it
Click to expand...
Click to collapse
I think if we all contribute to twrp and request them they might make us one
Sent from my YD201 using Tapatalk

Can the bootloader be re locked And can the root be removed for warranty purposes
Sent from my YD201 using Tapatalk

Yes
Fastboot oem lock

Gojira-r32 said:
Yes
Fastboot oem lock
Click to expand...
Click to collapse
If the recovery image is modified don't we flash back to stock before oem lock
Sent from my YD201 using Tapatalk

Good work. A pity Xposed framework isn't compatible yet.
Sent from my YD201 using XDA Free mobile app

dai75 said:
Good work. A pity Xposed framework isn't compatible yet.
Sent from my YD201 using XDA Free mobile app
Click to expand...
Click to collapse
Xposed framework isn't FULLY compatible, but many features already work. See SteadyQuad's thread here

adamo86 said:
Can the bootloader be re locked And can the root be removed for warranty purposes
Sent from my YD201 using Tapatalk
Click to expand...
Click to collapse
I haven't been able to re-lock it when I last tried (fastboot oem lock just hung). If anyone did succeed to lock, let us know! (Gojira-r32: did you actually execute the fastboot oem lock?)

I also failed to lock it back . I wanted to install the new update 1.44 that arrive in France but it failed at the recovery stage. E:Error in cache/update/yota....zip (status 7)
I did a wipe cache partition but not a wipe data as I don't want to lose all my settings. Anyone achieved to install the new Yota update version? And then root?

I just updated to latest update in UK. But I tried Kingo no success still.
Sent from my YD201 using Tapatalk

and the first post with flashing S%U tru modified recovery ?
is this firmware somewhere to download?
still not yet on yota FTP

Has anyone the stock recovery image? Maybe I'll achieve to get the OTA update after unrooting my YD201 with the original stock recovery firmware.

i am doing that right now, unroot, flash stock recovery, i have the OTA 1.1.44 pulled out of phone after download and will try to flash it

stock recovery, boot, sustem img, unrooted, everything tried
also got other build, fixed that.
now yotaphone is completly stock and get :
error in update zip "status 7"
so i think this update is no good, some faults in it, that's why we can't flash it yet, also chaged some things in OTA and resigned it etc... no good

Gojira-r32 said:
stock recovery, boot, sustem img, unrooted, everything tried
also got other build, fixed that.
now yotaphone is completly stock and get :
error in update zip "status 7"
so i think this update is no good, some faults in it, that's why we can't flash it yet, also chaged some things in OTA and resigned it etc... no good
Click to expand...
Click to collapse
Did you try to flash the OTA update via adb sideload in the modified recovery? I'm having the same problem.
Edit: I just tried to flash the update via adb sideload - no joy. I got the following error:
Package expects build fingerprint of YotaPhone/yotaphone2/yotaphone2:5.0/LRX21M/5.0.0-EU1.1.39:user/release-keys or Yotaphone/yotaphone2/yotaphone2:5.0/LRX21M/5.0.0-EU1.1.44:user/release-keys; this device has Yotaphone/yotaphone2/yotaphone:5.0/LRX21M/5.0
E:Error in /sideload/package.zip
(Status 7)
I also tried resigning the package with testkeys, but that didn't work either. Same error. So something has changed in the rooting process, because some people in the forum have managed to update normally, presumably on their nonrooted devices.

[GUIDE] All-In-One noob friendly guide for xperia X (Root/Bootloader/Rom)

[UPDATE]: USE THIS ONLY FOR NOUGAT 7 OR 7.1! THERE IS A DIFFERENT GUIDE FOR ANDROID OREO!
https://forum.xda-developers.com/xperia-x/how-to/root-xperia-x-f5122-android-n-34-2-2-47-t3594502 (Written by YasuHamed, not me!)
If you are not interested in android Oreo, or you want to go back to Nougat, this guide is still valid! [End of Update]
This is a guide for newbies or for people that are simply confused. If you have any questions, you can always ask me, and I will reply. but please make sure you haven't made mistakes and do not ask about things that are already stated here. Let's go!
BEFORE DOING ANYTHING, NOTES
-make sure you have installed ADB : https://forum.xda-developers.com/showthread.php?t=2588979
-make sure ADB can read your phone with the correct drivers installed. If you have trouble with that, read "DRIVERS" section
!It is absolutely necessary to install the drivers correctly!
-Backup your stuff if you have any, you will need to delete everything from the phone
-Enable USB debugging
-Note: some of these instructions apply to Windows OS only!
-Note: links to downloads have been shortcutted as much possible to make it easier for you!
-Find some stock roms here! https://forum.xda-developers.com/xperia-x/how-to/sonyx-f5121-downgrade-8-0-0-to-7-1-1-to-t3754986
(Credit: HEKER510)
-Warning: you will lose your warranty!
-I am not responsible for any damage done to your device.
BACKUP DRM KEYS (OR WORKAROUND)
You may want to unlock your bootloader. If you unlock it without backing up the DRM keys, you will lose them. I did that mistake and I regret it. If you already did, there is an alternative solution, skip to step 8.
1) If you are running android 7 nougat, you will need to downgrade to MM. If you are running MM, skip to step 7.
2) You will need to wipe everything before rolling back, so if you have any data back it up
3) Download any stock MM 6.0.1 firmware for the xperia X. You can find one here : https://mega.nz/#!1xRj2CYS Decryption key: !qBVi7yky8AL84eUF3bpTTGQ2YmN0ePCjc-eSDZGIZCI
Watch out: if you have the dual SIM model, F5122, you need to download accordingly!
For more firmwares, check "BEFORE DOING ANYTHING"
4) Download the latest flashtool: http://www.flashtool.net/downloads.php
Upon installation, tick on fastboot, flashmode drivers! If it didn't ask you, go to the installation folder and run Flashtool-drivers.exe. Please read "DRIVERS" section!
5) Flash the .tft file
How to flash?
0. Go to "C:\Users\[Your PC Name]\.flashTool\firmwares" , and put your firmware .ftf file in there!
1. Open Flashtool and click on the lightning bolt icon (first one from the left)
2. In the prompt, choose flashmode.
3. Under firmware, click on the version you put (It should probably only be one option)
4. Under wipe , tick everything. Under the others, do not make any changes.
5. Click "Flash"
6. When the popup appears, connect your device. It needs to be powered off, and connected while you are holding the
"volume down" button.
7. Wait for it to finish.
8. Done. Boot up the device, it might take some time to open so don't worry.
Click to expand...
Click to collapse
6)If your phone bootloops, try flashing again or a different firmware and make sure you followed the steps correctly.
7) Once your phone successfully boots android MM, use Dirtycow to get your DRM keys out: https://forum.xda-developers.com/crossdevice-dev/sony/universal-dirtycow-based-ta-backup-t3514236
8) If you unlocked the bootloader before backing up your keys, you can use DRM kernel fix. You can get it here: https://forum.xda-developers.com/xperia-x/development/kernel-drm-fix-nougat-t3530849 Before using it check out the custom rom that includes this fix and other things.
UNLOCK BOOTLOADER
This is relatively easy and you can follow official sony instructions to do it.
1) Go to your phone settings, developer options, and enable OEM unlock
"But there is no developer options!" -Go to the bottom of your settings, system, about phone, and tap multile times on "Build Number", also at the bottom.
Click to expand...
Click to collapse
2) If you haven't already , install ADB fastboot and configure drivers (Link on top )
3) Follow the steps on the Sony website to get your unlock code: https://developer.sonymobile.com/unlockbootloader/email-verification/
4) After unlocking, a warning message on boot is normal!
INSTALL RECOVERY
Installing TWRP on your xperia X is very important, since you can flash zips and img files so easily, plus wipe, backup and other features.
1) Download the TWRP .img file: https://androidfilehost.com/?w=files&flid=197369 (Credit: eagleeyetom )
2) Make sure you have USB debugging enabled
3) Open your downloaded twrp folder
4) Run CMD in that folder (shift + right click inside the folder, Open CMD here )
5) Connect your Xperia X to your PC
6) Type these lines:
adb reboot bootloader
fastboot flash recovery recovery.img [where recovery.img is your twrp file name]
fastboot reboot
7) If no errors, twrp is now installed. Once your phone boots , turn it off,. To access TWRP recovery hold power button and volume down button until the TWRP menu appears.
STOCK ROM, ROOT
If you just want to root and not interested in additional features and tweaks, you can simply flash SU through TWRP to get your phone rooted.
Note: Current best stock ROM available: 7.1.1 (252) - better features than older ver, and good battery life.
0) Install your desired stock firmware using the exact same previous instructions, (under DRM section) with flashtool.
1) Download SuperSu
Or magisk, using YasuHamed guide mentioned on top, but I have not tested with anything other than Oreo 8.0
Use magisk if you want more stability / root features (like hide root from apps, modules )
2) copy it anywhere on your phone
3) Run TWRP
4) Tap on install
4) Flash the file
5) Reboot, you are now rooted
6) Insert your DRM keys if you have them
Custom ROMS
After unlocking the bootloader and installing TWRP this is the best way to go in order to get full root, tweaks.
https://forum.xda-developers.com/xperia-x/development/rom-xperia-x-pexorom-v1-0-0-f5122-f5121-t3590552
^ This is a very good custom ROM made by prmk74. You can see its features in his thread.
1) Download the rom and copy it to your phone
2) Run TWRP
note: It is recommended to wipe dalvik, cache, data ( your storage partition doesn't need to be wiped)
3) Tap install, find your downloaded file and execute
note: It is recommended to wipe dalvik, cache, data ( your storage partition doesn't need to be wiped)
4) Follow on-screen instructions, do not stop the booting after finishing the installation, it will take some time
5) Insert your DRM keys if you have them
6) For those who lost their keys: Now the functions like vivid image mode are working properly.
DRIVERS
For Windows 8/8.1/10 users, how to solve driver problems:
1) Press the Windows key + R together and in the ‘Run’ box type: shutdown.exe /r /o /f /t 00
– Now make the following selections to boot into the Start Up Setting Screen: Troubleshoot > Advanced options > Start Up Settings > Restart
– Then, when the machine restarts, select number 7 i.e. “Disable driver signature enforcement”. Your machine will start with Driver signing enforcement disabled until the next reboot.
B) Now you can install the Flashtool drivers. Go to the flashtool install location and run the drivers.exe again, check fastboot and flashmode
– Windows will warn that the driver is not signed and will require you to confirm the installation.
– Once the installation is complete, reboot the machine
TO CONCLUDE:
This is what you may want to do to get the most out of your new xperia x:
1) Backup DRM
2) Unlock BL
3) Install TWRP
4) Flash Persian (or a different rom) through TWRP (And subscribe to the thread so you receive updates)
5) Restore DRM
Notes:
None of the links, tools are of my work, I'm just writing a guide for my fellow XX owners

^^ this guide is so really good :3. I post flash script for someone dont know how to find it ^^
unzip it in this position.
C:\Users\[user-name]\.flashTool\mydevices

max26292 said:
^^ this guide is so really good :3. I post flash script for someone dont know how to find it ^^
unzip it in this position.
C:\Users[user-name]\.flashTool\mydevices
Click to expand...
Click to collapse
Thanks!

Thanks for this, I need some help!
All was fine until I tried flashing the recovery, comes back "partition unknown" error. I was unable to bring the device up under an adb device only as a fastboot device.
34.0.A.1.264_R3A firmware.
Different official sony driver (Sony bootloader guide driver didn't work)
Device now hangs on the Sony logo after boot messgae warning "OEM bootloader unlocked, device not trusted," any help would be appreciated.

brianx87 said:
Thanks for this, I need some help!
All was fine until I tried flashing the recovery, comes back "partition unknown" error. I was unable to bring the device up under an adb device only as a fastboot device.
34.0.A.1.264_R3A firmware.
Different official sony driver (Sony bootloader guide driver didn't work)
Device now hangs on the Sony logo after boot messgae warning "OEM bootloader unlocked, device not trusted," any help would be appreciated.
Click to expand...
Click to collapse
These USB drivers are very annoying to work with. I got mine to finally work using a program called ADB driver installer. http://adbdriver.com/downloads/ Choose automated installation and try what I said. I believe it should fix your problem, after installing the drivers reboot and flash again.
Other than that, I have to ask are you 1000% sure you used the exact commands?
I saw another thread someone mistook
"flash recovery recovery.img" for "flash recovery.img"
"recovery" should be included before the recovery file name

brianx87 said:
Thanks for this, I need some help!
All was fine until I tried flashing the recovery, comes back "partition unknown" error. I was unable to bring the device up under an adb device only as a fastboot device.
34.0.A.1.264_R3A firmware.
Different official sony driver (Sony bootloader guide driver didn't work)
Device now hangs on the Sony logo after boot messgae warning "OEM bootloader unlocked, device not trusted," any help would be appreciated.
Click to expand...
Click to collapse
Why didn't the sony guide work? It worked for me. Just so you know, the "device cant be trusted" message is appearing on everyones' phones after unlocking the bootloader, it's not a problem or something

the part of restoring DRM is skipped,
please xplain

YasuHamed said:
the part of restoring DRM is skipped,
please xplain
Click to expand...
Click to collapse
I know, as I said there is room for improvement. The reason I did not include it is because I never did it myself, so I don't want to write something wrong or something that could lead to problems. I write something only if I am 100% sure. If anyone of you is kind to offer that piece so the guide is complete I will be glad

FoxTheLegend said:
Why didn't the sony guide work? It worked for me. Just so you know, the "device cant be trusted" message is appearing on everyones' phones after unlocking the bootloader, it's not a problem or something
Click to expand...
Click to collapse
Ok I figured out what I did wrong and was able to amend another issue I edited out of this post.

brianx87 said:
Ok I figured outwhat I did wrong (able to boot into the os and warning message no longer an issue ) and the issue I am now facing is that twrp is hanging on the boot screen. Is this version of twrp built to a specific version of android?
Click to expand...
Click to collapse
What do you mean hanging? the twrp logo frozen?

FoxTheLegend said:
What do you mean hanging? the twrp logo frozen?
Click to expand...
Click to collapse
Working now, used a previous version of twrp by mistake. Using latest build works fine now, have to wait to get home from work to proceed with the rest, annoying procedures this stuff but your guide is great.

brianx87 said:
Working now, used a previous version of twrp by mistake. Using latest build works fine now, have to wait to get home from work to proceed with the rest, annoying procedures this stuff but your guide is great.
Click to expand...
Click to collapse
Thanks, Im glad to it works now

FoxTheLegend said:
I know, as I said there is room for improvement. The reason I did not include it is because I never did it myself, so I don't want to write something wrong or something that could lead to problems. I write something only if I am 100% sure. If anyone of you is kind to offer that piece so the guide is complete I will be glad
Click to expand...
Click to collapse
thank you for the answer sir
i am unable to find any twrp that work for my F5122, it always bricks and i have to reset.
is there any twrp recovery image that works correctly with f5122?

YasuHamed said:
thank you for the answer sir
i am unable to find any twrp that work for my F5122, it always bricks and i have to reset.
is there any twrp recovery image that works correctly with f5122?
Click to expand...
Click to collapse
Hmm.. Did you try the one from the poison thread? I myself have still the old version installed (not 3 or 3.1) if I find it on my pc I will share it with you

FoxTheLegend said:
Hmm.. Did you try the one from the poison thread? I myself have still the old version installed (not 3 or 3.1) if I find it on my pc I will share it with you
Click to expand...
Click to collapse
I have to modified kernel
all i want is to boot it via fastboot command
for example i have the rooted kernel SU installed (but battery drain is high) so i what wana do is flashing kernel with all securities OFF and then with twrp image i will do
Code:
fastboot boot twrp.img
i will boot the X in to twrp and i will flash SUPERSU via twrp.
thanks all

YasuHamed said:
I have to modified kernel
all i want is to boot it via fastboot command
for example i have the rooted kernel SU installed (but battery drain is high) so i what wana do is flashing kernel with all securities OFF and then with twrp image i will do
i will boot the X in to twrp and i will flash SUPERSU via twrp.
thanks all
Click to expand...
Click to collapse
I see, but don't you want to figure out why it's not working normally? Noone has reported a similar problem

FoxTheLegend said:
I see, but don't you want to figure out why it's not working normally? Noone has reported a similar problem
Click to expand...
Click to collapse
since there is no offcial twrp for X out yes and only DORA (XA) is available) even XA don't work for X
so either twrp 2.8, 3.0 or 3.1 any should just boot in order to let us flash superSU.

YasuHamed said:
since there is no offcial twrp for X out yes and only DORA (XA) is available) even XA don't work for X
so either twrp 2.8, 3.0 or 3.1 any should just boot in order to let us flash superSU.
Click to expand...
Click to collapse
=-= try to use this command fastboot flash recovery [your_recovery_name].img
I use f5122 and flash successfull twrp 3.0.2 and 3.1. with this, i flash some kernel and rom without any problem.

Everything is working good for me now, the only issue now is restoring the DRM keys, has anyone found a credible source for doing this on this device?
How can I be sure I have a full root? I can't seem to be able to uninstall some of the bloatware only disable it!

brianx87 said:
Everything is working good for me now, the only issue now is restoring the DRM keys, has anyone found a credible source for doing this on this device?
How can I be sure I have a full root? I can't seem to be able to uninstall some of the bloatware only disable it!
Click to expand...
Click to collapse
Well titanium backup can assure you but I don't see why you wouldn't have full root... You need an app uninstaller to uninstall bloatware, it can't be done through the settings you know that right

OEM Variant (Non-Amazon) - Unlock Bootloader, Flash TWRP, Root - Right steps?

I've spent a few hours searching these forums to learn as much as I can about rooting the OEM variant of the BLU R1 HD smart phone and have come across a handful of guides:
Blu R1 HD Unlock bootloader, install TWRP, and root (Non prime) by lil chickenz
For NONE prime R1HD by mrmazak
[TWRP] How to root ("newbie friendly"!) : by bibikalka
Amazon Blu R1 HD TWRP Recovery and Root Tutorial (https://www.youtube.com/watch?v=KMobKWfZbJg)
I found those guides very helpful but there were spots where the guides glossed over a few things that a new member, like myself, found vague and mysterious. Therefore, for my own personal use, I opted to compile a more thorough list of directions that I can follow when I root my device.
With all that said, as more experienced members, would any of you double check the steps and provide clarification when needed?
Thanks in advance!
(See my next post for my list of directions.)

Disclaimer: This list of instructions is my attempt to comprehend information from a variety of sources on how to root the R1 HD OEM Variant. I'm nearly positive that I'm doing something wrong or another. If I am, and you know the right way, please explain it to me! Thank you!
[SIZE="+2"]Required Software, Drivers, & Files[/SIZE]
MediaTek SP Drivers (https://androidfilehost.com/?w=files&flid=68715) | Install these drivers onto your Windows PC so that you can utilize the SP Flash Tool.
SP Flash Tool (https://androidmtk.com/smart-phone-flash-tool) | Install this application via Windows so that I can backup the ROM, including the partitions, of the unmodified smart phone.
ADB (https://forum.xda-developers.com/showthread.php?t=2588979) | Install this application and drivers using Windows in order to unlock the bootloader and flash the TWRP so that I might root the device.
SuperSu (https://download.chainfire.eu/1113/SuperSU/UPDATE-SuperSU-v2.82-20170528234214.zip) | This file needs to be uploaded / downloaded to the smart phone's internal storage aka /sdcard (internal storage). Eventually it will be installed to root the phone.
TWRP Scatter R1 Prime (https://www.mediafire.com/folder/usifl1vdnma1t/BLU_R1_HD) | This file is needed to flash the TWRP onto the smart phone.
[SIZE="+2"]Preliminary[/SIZE]
Ensure that the required software, drivers, and files are installed and placed appropriately.
Power on your smart phone, navigate to Settings -> About then scroll down to and tap Build Number multiple times until you are granted Developer Access.
Enter Developer Settings then enable USB Debugging as well as OEM Unlock.
Power off your smartphone (The battery must be removed to backup the ROM later. Should I remove it now?) then connect it to your computer with the mini-USB to USB cable.
[SIZE="+2"]Enter Bootloader[/SIZE]
On Windows, navigate to the ADB installation directory (Usually C:\adb) then double click on Runme.bat.
When in the shell and prompted type the following case sensitive code to put your smartphone into its bootloader:
Code:
adb reboot bootloader
[SIZE="+2"]Unlock Bootloader & Factory Reset[/SIZE]
Wait until your phone is in the bootloader (The smartphone will display text along the lines of "fastboot...") then, on Windows, type the following case sensitive code to unlock the bootloader and factory reset your smartphone:
Code:
fastboot oem unlock
[SIZE="+2"]Backup ROM[/SIZE]
Now that the bootloader is unlocked, on Windows, open your web browser then naviate to the following guide:
ROM Backup using SP Flash Tool 'Readback' feature by codelover
Follow the directions listed to Backup your ROM replacing 'Honor3C' with 'R1 HD,' and 'MT6582_Android_scatter.txt' with 'MT6735_Android_scatter.txt (Is this accurate?).'
Follow the directions to Process the dumped ROM files to create the SPFT Flashable files.
[SIZE="+2"]Flash TWRP Custom Recovery[/SIZE]
On Windows, extract the TWRP Scatter Prime zipped file into the ADB installation folder (Usually C:\adb).
Flash the custom TWRP by typing the following case sensitive code:
Code:
fastboot flash recovery recovery.img
[SIZE="+2"]Root[/SIZE]
Now that the TWRP is flashed onto your smart phone you may enter into its Recovery mode by pressing the 'Power' and 'Volume Increase' buttons for more than a few seconds. You may have to disconnect the smart phone from the PC first.
Navigate to the Recovery by using the volume button to highlight an option and the power button to select it.
Mount the system partition as read only then backup the partitions (select everything) to the specified storage location (including a SD card).
4. Install the SuperSu from the zipped file that you uploaded to your smart phone's internal storage in the Software, Drivers & Files section (After I wrote this I realized that the file may have been deleted when the phone was factory reset. Reconnect the phone back to the PC and you're able to access the internal and external storage from the PC. Drag the file into internal storage now.)
[SIZE="+2"]Optional[/SIZE]
In order to use apps like ES File Explorer, apps that aren't yet updated to handle system-less root, enter the following case sensitive code (Where am I entering this code? On the smart phone? On the PC using the ADB?):
Code:
adb shell
su
mount -o remount,rw /system
mount -o remount,rw /
touch /sbin/su /system/bin/su /system/xbin/su
mount -o remount,ro /system
mount -o remount,ro /

Thanks again for taking the time to review this process and make any clarifications!

Wait! The MOST important thing is checking what version of the ROM you are currently running. If you have updated your phone with an official ROM to version 8.0 or greater (I think that's the version), then you will NOT be able to run SPFT and replace the bootloader as Blu disabled SPFT in the updated ROM. So the most important first step is to find out what ROM you have installed and whether SPFT will even work. If not, you will not be able to replace the bootloader or root.
I am not sure what the equivalent version of the non-Amazon ROM is where they disabled SPFT. Maybe V17?

yaconsult said:
Wait! The MOST important thing is checking what version of the ROM you are currently running. If you have updated your phone with an official ROM to version 8.0 or greater (I think that's the version), then you will NOT be able to run SPFT and replace the bootloader as Blu disabled SPFT in the updated ROM. So the most important first step is to find out what ROM you have installed and whether SPFT will even work. If not, you will not be able to replace the bootloader or root.
I am not sure what the equivalent version of the non-Amazon ROM is where they disabled SPFT. Maybe V17?
Click to expand...
Click to collapse
Thanks for the response, yaconsult. Here's the specs:
Android Version | 6.0
Baseband Version | MOLY.LR9.W1444.MD.LWTG.MP.V79.971
Kernal Version | 3.18.19+
Build Number | MRA58K
Custom Build Version | BLU_R0011UU_V21_GENERIC

BLUper said:
Thanks for the response, yaconsult. Here's the specs:
Android Version | 6.0
Baseband Version | MOLY.LR9.W1444.MD.LWTG.MP.V79.971
Kernal Version | 3.18.19+
Build Number | MRA58K
Custom Build Version | BLU_R0011UU_V21_GENERIC
Click to expand...
Click to collapse
Having your build number as V21, I am affraid you are stuck, without possiblity to unlock bootloader, so no flashing custom recovery with fastboot mode. Or modified root enabled boot.img
Also with build #V21, no possible method to connect with spft to flash custom recovery. Or modified root enabled boot.img.
With these restrictions, all the past information you have gathered will do you no good. Sorry. BLU has locked you down

mrmazak said:
Having your build number as V21, I am affraid you are stuck, without possiblity to unlock bootloader, so no flashing custom recovery with fastboot mode. Or modified root enabled boot.img
Also with build #V21, no possible method to connect with spft to flash custom recovery. Or modified root enabled boot.img.
With these restrictions, all the past information you have gathered will do you no good. Sorry. BLU has locked you down
Click to expand...
Click to collapse
Thanks for your hasty response, MrMazak. The information that I gathered isn't too complete a loss - I was able to learn more about and have a greater understanding of the root process.
Is there a part of the XDA forums where I might ask around, or dig through, to find smart phones in the $100 USD range that are still root-able?

BLUper said:
Thanks for your hasty response, MrMazak. The information that I gathered isn't too complete a loss - I was able to learn more about and have a greater understanding of the root process.
Is there a part of the XDA forums where I might ask around, or dig through, to find smart phones in the $100 USD range that are still root-able?
Click to expand...
Click to collapse
Not specific page or thread, but a general search of the full forum would be a good start

So I'm confused, these BLU phones or which phones or all phones cannot be rooted any more? I have the BLU R1 PLUS and it doesn't even have a Developer option for unlocking the firmware ( BLU_R0051UU_V13_GENERIC 14-03-2017 10:40). Of course I cant run an oem unlock either.
How does anyone reload an image onto them if they can't be rooted? Thanks!

Donphillipe said:
So I'm confused, these BLU phones or which phones or all phones cannot be rooted any more? I have the BLU R1 PLUS and it doesn't even have a Developer option for unlocking the firmware ( BLU_R0051UU_V13_GENERIC 14-03-2017 10:40). Of course I cant run an oem unlock either.
How does anyone reload an image onto them if they can't be rooted? Thanks!
Click to expand...
Click to collapse
your device is different than the R1-HD
the plus (afaik) is not able to be unlocked, means no twrp, and probably no root.
I had this same device in hand for 3 weeks, and could not get anywhere with root.
maybe someone else has had more luck.
this is another thread that i respnded to for the device too.
https://forum.xda-developers.com/r1-hd/help/rooting-r0051uu-t3795795

[RECOVERY] TWRP for Onn Android Tablets (unofficial) - 2019-11-30

TWRP Custom Recovery for the Onn Android Tablet series​
This is the first fully-featured custom recovery for Walmart's MediaTek-based Onn tablets: ONA19TB002, ONA19TB003 and ONA19TB007. TWRP needs no introduction. If you have come here, you probably have some idea of what it is and what it's used for. This TWRP build does not need the bootloader unlocked or VBMeta verification disabled, although it's recommended that you at least unlock the bootloader.
DISCLAIMER
Everything described in this thread is done at your own risk. No one else will be responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.
FEATURES
Decrypted data partition
All USB modes functional: MTP, ADB, Mass Storage, OTG, Charging
Fast boot time
Adoptable storage mounting
Firmware image backup and restore
Works under locked bootloader
Android 9 build fits within the 16MB recovery partition -- no compromises or partition resizing necessary
INSTALLATION METHOD 1
Download the recovery to your PC and unzip the image
Unlock the bootloader (skip if you have already done this)
Enable OEM Unlock in Developer Options in Android Settings
Boot into fastboot mode either by holding vol. up+power to power it on and selecting "Fastboot mode", or by running the 'adb reboot bootloader' command from within Android.
Install fastboot and appropriate drivers on your PC if you have not set those up
Unlock the bootloader with the command
Code:
fastboot flashing unlock
...and follow the instructions on the screen. This will wipe your data.
Flash the custom recovery with
Code:
fastboot flash recovery twrp-3.3.1-ONA19TB002.img
(use the right file name path for your device)
Reboot to recovery with
Code:
fastboot oem reboot-recovery
INSTALLATION METHOD 2
This assumes you are familiar with SP Flash Tool or can figure it out on your own
Download the recovery to your PC and unzip the image
Get the appropriate scatter file for your device. The scatter file may be found in the device's firmware under /system/data/misc.
Set up SPFT Download tab as Download Only. Load your scatter file.
Under the recovery line, double-click Location and open your TWRP image.
Click Download and connect your powered-off tablet to your PC. SPFT will automatically flash the recovery to the emmc and disconnect when finished.
INSTALLATION METHOD 3
Head over to Amazing Temp Root for MediaTek ARMv8, read the requirements and directions, and grab the latest mtk-su.
Open a root shell with mtk-su
Flash the (unzipped) recovery with the command:
Code:
dd bs=1048576 if=twrp-3.3.1-0-ONA19TB002.img of=/dev/block/by-name/recovery
(replace the if= file name with your appropriate recovery image path)
Exit root shell
START RECOVERY
Three methods:
On a powered off tablet, hold Vol. up+power for about 3 seconds. In the menu that appears, select "Recovery mode"
With Android ADB, use the command 'adb reboot recovery'
From Android root shell, use the command 'reboot recovery' or just use any root app with OS reboot features
NOTES
Kind of important: Make a backup of your Crypto Footer as soon as you can. This is the encryption key to your data partition. When accessed from TWRP, this key can get "upgraded" so that you will get locked out of Android. TWRP uses a hacky workaround that saves and restores the original footer on every /data decrypt. But that method is not what I would call 100% reliable.
Make sure you have a backup of the untouched stock system and vendor images. There are no official firmware packages available to download.
Only mount system/vendor partitions in read/write mode if you have unlocked the bootloader. It is recommended to choose to leave system read-only at the startup prompt unless you have a specific reason to modify it. If the bootloader is locked, then dm-verity is enforced.* So merely mounting it once in r/w will cause a boot loop.
It's currently not possible to install incremental OTA updates using this TWRP. Use the stock recovery to update the FW. That will only work if you have never mounted system/vendor in write mode.
DOWNLOAD (Nov. 30, 2019)
Current version: 3.3.1-1
ONA19TB002 - Onn 8" model
ONA19TB003 - Onn 10.1" model
ONA19TB007 - Onn 10.1" w/keyboard model
Source code
ONA19TB002 | ONA19TB003 | ONA19TB007
ACKNOWLEDGEMENTS
The team behind TWRP & OmniROM
@tek3195 for testing and feedback on the 8" model

Please post feedback since these are still pretty new and not exhaustively tested. Let me know if I should port it to other models in the series.

Reserved also

grabbing this one too cuz why not

Very nice! I'll download and test the 003 one soon.
I also have a 007 model to experiment with.
I tried about a dozen times to build TWRP and failed miserably LOL. Closest I got was one that would boot but the rotation was all messed up, USB wouldn't work, didn't mount some partitions... Yeah, it was a hot mess.
Do you happen to have sources available?

Hi @NFSP G35,
I'll have the source code soon. Most of the tricks involved patching bootable/recovery. So I need to commit those changes and include the proper patch set from my tree....

Amazing!! Gonna install and test 8" right now.

Has anyone tried a GSI on these tablets yet?

MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I do know @tek3195 , the Onn 8 thread starter, has tried many of them as well as others here, somewhere on that thread he listed his tests and opinion of several of them.
I'm pretty sure others on that thread have also tried GSI's.

MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I did try both Phhuson vanilla and also Liquid Remix (I'm keeping this one for now). I didn't flash them through twrp, but using fastboot via bootloader.

WoW! AwEsOmE! I cannot wait to try this! THANK YOU!!!!!!

Hey,
This is a neat thing to see for the Onn tablets. I have a question though. I own a device based on the mt8163, and am trying to help people with another device I don't own (the powkiddy x18 which also uses the mt8163). One of the things I wanted to do was to make a custom rom for the x18, since it's stock firmware is horrible. And of course, one of the first steps to custom roms is twrp. So I have a question for you that I hope you can answer for me. How did you make this build of twrp? I have seen no device trees for this device so I was kinda curious. If you can help me in any way, I'd be so grateful, and I'm sure the other people with the x18 would be grateful for help.

@diplomatic
Is there a different procedure for installing TWRP on a locked bootloader?
I can confirm that using SP Flash to load your TWRP.img will produce a bootloop when installing to a device with the BL locked. Reflashing the original recovery.img makes the problem go away. You mentioned in the OP that this TWRP will work on a locked BL so I thought I would share my case study with you in following the procedure you defined.
MY SINCERE GRATITUDE FOR YOUR EFFORTS IN PORTING THIS TO THE ONN!

You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...

diplomatic said:
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
Click to expand...
Click to collapse
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
At one time I did run with the bootloader unlocked (with --disable-verification on stock vbmeta) and I ran Phusson's AOSP, Liquid Remix and Bliss. I found there was no benefit to me in running the other mods so I reverted back to stock courtesy of @CaffeinePizza and the bootloader re-locked to get rid of that annoying 5 second orange state.
In each instance, I always used SP Flash tools to load all .img files. I only used fastboot to install magisk_patched.img onto the stock installation. Unlocking the bootloader erases all data and I did not feel like reinstalling everything again, so I figured I would try to install TWRP per your instruction to see if it would work while the BL was still locked... Restoring the original recovery got rid of the bootloop. I do want to try your TWRP so I will try it with BL unlocked when I get some free time to do so.

Spatry said:
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
Click to expand...
Click to collapse
This sounds like you might have flashed a wrong/corrupt image to recovery. It may have to do with AVB checks rather than bootloader lock. But those conditions might be interdependent somehow so I can't tell you for sure. The fact that you are able to boot a patched image on a locked BL says it doesn't care too much about verification. I can tell you for sure that any recovery image must have avb metadata, not necessarily the required hash, for both Android and recovery to boot. Can you try to unzip the image file and flash it over again?

Hmm, the situation with the bootloader lock sounds eerily similar to the Nabi SE. The latter also had a similar implementation where there's not much in the way of locking things down, other than an (easily circumvented) SP Flash Tool signature check and different preloader keys. And here's the real kicker: the nearly-identical Fisher Price Nabi also ran on the MT8163, so it makes me wonder if it's possible to boot Pie on it, or perhaps a GSI assuming that Treble can be tacked onto it.
Also, do you have the source repo to this TWRP port of yours?

If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.

diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Where do I find crypto footer to backup

diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Kinda cool without the ads isn't it. I know I sent one about a week ago or so. I think everybody ought to send you one, you deserve it. THANKS and AWESOME work.

Red Magic 5G Bootloader Unlock Guide: OR get ROOT & TWRP without unlocking the BL!!!

Red Magic 5G Bootloader Unlock Guide: OR get ROOT & TWRP without unlocking the BL!!!
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
WARNING: ANY BOOTLOADER UNLOCK METHOD INVOLVES THE RISK OF BRICKING YOUR DEVICE PERMANENTLY. WHILE THERE IS USUALLY A WAY TO RECOVER, DO NOT ATTEMPT THIS PROCEDURE IF YOU DO NOT KNOW WHAT YOU ARE DOING. BAD THINGS CAN HAPPEN. YOU HAVE BEEN WARNED!!! YOU MAY BE LEFT WITH A USELESS BRICK!!! READ ALL FURTHER WARNINGS EXPERIMENTAL METHOD IN ORIGINAL DOWNLOAD FILE WORKS, I'M USING IT
If you want a NOOB guide look at this post: https://forum.xda-developers.com/nu...beginner-tutorial-unlock-bootloader-t4131585/
Also note a user has managed to fix the FP sensor post BL unlock, see this post here: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
Still, I suggest root bypass it's better.
MegaNZ Link for Root without unlocking the Bootloader, and without breaking the FP, also includes instructions for installing BlackMagic5G (explanation below), adding HD VOLTE, how to restore from a brick, and some other cool tricks: https://mega.nz/file/igphSCTD#OybJo9t1zwvJ0bdbAcN2BCqxWXAfHdhk3JFB4_5xkVc
I suggest you flash my BlackMagic5G and don't unlock your bootloader at all - just root. It's CN 2.52 ROM based. You'll get VOLTE, , GApps installed, Rooted with Magisk, TWRP, debloated, YouTube Vanced, AdAway, SmartPack Kernel Manager, etc. - looks like the Global / NA variant of the ROM. Almost perfect except still uses Messages and Phone from Nubia. Plus you will enable Face Unlock not available in the Global or NA versions of the ROM, and FP will still work! Click on the Google Search bar widget and the mic icon takes you to the Google Assistant, the left icon is Google Feed, type in the middle bar for a Google Search. Has 1Weather Free weather widget that looks great, and Google Calendar widget for your whole month of activities. Translate, Lens, Chrome, all the Google Apps are there. And the Chinese Nubia apps are nearly all GONE!
MegaNZ Link for BlackMagic5G Beta - IT'S ONLY THE DATA PARTITION + ROOTED KERNEL + NA SPLASH SCREEN, you NEED to 1) install the Red Magic 2.52 ROM below FIRST 2) Root using the first link posted above 3) Flash restore this from TWRP: https://mega.nz/file/r9hF2BwS#RrAXiFWSBNX8dLqfrH8nNHo_uigPC8uYXonwhALhGbo
MegaNZ Link for the Red Magic 5G CN 2.52 ROM: https://mega.nz/file/aoxBFAqY#EDt2OZBGTME4ZGKnERKpK_t-aJT_rWgD0aqBFkilRcY
*** NOW THE BOOTLOADER UNLOCK INSTRUCTIONS ***
Go to Settings / About phone / Build Number (NX659_J_ENCommon_V3.08 on North American Variant), click 7 times, Now you are a developer message appears, go back a menu to Settings / Other system settings / Developer options.
Enable:
OEM unlocking "Allow the bootloader to be unlocked"
USB debugging "Debug mode when USB is connected"
Install Minimal ADB and Fastboot (Windows 10 in this example): https://www.androidfilehost.com/?fid=746010030569952951
Default install path is:
C:\Program Files (x86)\Minimal ADB and Fastboot\
Go to the Search button on the bottom on Windows 10, type cmd, Command Prompt will appear in the menu. Right click it and Run as Administrator. All commands to be typed will be run in this Command Prompt window (referred to as terminal) unless otherwise stated to run on the phone.
Now Terminal window appears (it says Administrator: Command Prompt in the heading):
Text displayed is:
Microsoft Windows
(c) 2020 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
Typed in terminal:
cd "c:\Program Files (x86)\Minimal ADB and Fastboot"
I now connected the phone to a USB port on the PC.
On the phone, a Window appeared:
"Allow USB debugging?"
The computer's RSA key fingerprint is:
[36 digit code] Example:
C8:A17:E2:01:F6:A1
:368:10:E8:33:20:FB:
93:7D
Always allow from this computer (it's my computer so I clicked it since I trust the computer)
CANCEL / ALLOW (I clicked ALLOW)
Typed in terminal:
adb reboot bootloader
The phone reboots. Once the phone screen boots, in the center it says: Now you are in fastboot mode.
From the terminal I typed:
fastboot oem nubia_unlock NUBIA_NX659J
The terminal now displayed:
...
(bootloader) START update nubia fastboot unlock flag!!!
(bootloader) START set state to 1 ok!!!
In the terminal I typed:
fastboot flashing unlock *** DO NOT TYPE THIS IF YOU WANT TO KEEP A WORKING FP!!! READ TOP OF POST!!! AVOID THIS WITH THE EXPERIMENTAL METHOD OF ROOT WITH NO BL UNLOCK ***
Now a screen appeared on the phone with a big <!> red icon in the left corner. The rest in white text is a warning message. "By unlocking the bootloader, you will be able to install custom operating system on this phone. A custom OS is not subject to the same level of testing as the original OS, and can cause your phone and installed applications to stop working properly-
Software integrity cannot be guaranteed with a custom OS, so any data stored on the phone while the bootloader is unlocked may be at risk.
To prevent unauthorized access to your personal data, unlocking the bootloader will also delete all personal data on your phone.
Press the Volume keys to select whether to unlock the bootloader, then the Power Button to continue."
I selected UNLOCK BOOTLOADER and my device was completely erased. The factory OS loaded then. This process takes some time to complete.
Now the device rebooted with a warning message, and a big <!> yellow icon in the left corner.
"The boot loader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device.
Visit this link on another device:
g.co/ABH"
Now the device reloads the firmware apparently and wipes all user data. Upon setting up the phone, the fingerprint display registration comes up and asked to place my finger on the back of the phone. There is no fingerprint sensor on the back of the Redmagic 5G! It is under the screen! So this step must be skipped. The ROM setup is corrupt or incomplete, a beta possibly. I setup the phone then went into Settings / Security to try to add a fingerprint. The button to add fingerprint then appears. Once I click the button, I get this error:
Loss of fingerprint calibration data
Loss of fingerprint calibration data was detected.
Currently unable to complete fingerprint entry,
please contact Nuia after-sales service via
4007006600
See the XDA post for recalibrating the FP: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
ROOT FOR ALL DEVICES:
(These files are included in the tools download zip, Magisk 20.4 and MagiskManager-v7.5.1.apk, but this is the official source as updates post): Go to XDA and Download Magisk Manager and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power, release the power button once the screen shows it loading, hold the volume up down until you see TWRP pop up). Flash Magisk from TWRP Install / Zip / sdcard / Magisk.zip reboot and you'll have root.
BL unlock first method was tested on North American variant and it works. But it breaks your FP sensor and gives you an annoying boot prompt.
If at any time you want to remove the OEM Bootloader unlock, you plug into the PC, go to the terminal for Minimal ADB and Fastboot, type:
adb reboot fastboot
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing lock (screen will prompt to relock BL, choose to Relock)
The phone should reboot and install the original software. BUT...
If it says you are corrupted well, you have more issues.
You'll have to reflash the stock recovery.img, reboot to stock recovery, wipe data, wipe cache, and flash the CN update.zip rom to a flash drive FORMATTED TO FAT32 (annoying as hell) But you NEED a USB-C to OTG Adapter to attach a Flash Drive / SDCARD this way). If you don't have one, you better reflash TWRP using the prior instructions and flash the update.zip from there. Install, select the update.zip, flash. Wipe Data, Cache, ART/Dalvik. Reboot.
Now it should WIPE the entire phone and be back to normal Android 10 setup non rooted, no unlocked bootloader. Always beware of data loss doing root functions!!! Always be prepared to setup your phone entirely over again. Google Backup is very good to turn on before you do any of this stuff if you have already installed apps.
*** WARNING - THIS BYPASS METHOD COULD GO AWAY AT ANYTIME. IT SHOULD EVENTUALLY BE FIXED BY NUBIA ***

mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse
You were able to actually install TWRP? Not just boot it? I thought A10 devices cant have twrp permanently installed?

That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.

mslezak said:
That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.
Click to expand...
Click to collapse
So its not permanent? Thats what I thought.

Well it could be permanent...
VZTech said:
So its not permanent? Thats what I thought.
Click to expand...
Click to collapse
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.

mslezak said:
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.
Click to expand...
Click to collapse
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe

Can anyone send me backup of the super partition?
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)

Future updates...
VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
Yes what I've been told by prior Redmagic Users 3 and 3S is the ROM is released, as long as your boot.img is not patched with Magisk, it can be installed through the menus in Settings / About Phone / Update or someplace like that. You just download the ROM to the appropriate folder on the phone.
So far I have 1 link to a China ROM update here: https://ui.nubia.cn/rom/detail/65
Now on how to install the ROM, I use the Chrome browser set to autotranslate webpages. Most of the Chinese will be translated from here: https://bbs.nubia.com//thread-1136030-1-1.html
Basically it's going to wipe your device clean, and you can use a Nubia backup tool which will save all your items to a folder. Which then you should copy to your PC before installing the new ROM. Then it gives you instructions to get that data back onto your updated device.

apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.

VZTech said:
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.
Click to expand...
Click to collapse
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---

apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
You should be able to flash the latest ROM via EDL mode if you've ever used EDL mode before, it usually requires shorting pins together in the device, although some recoveries will let you just boot into EDL mode if the phone still boots. It will be detected. Although on this device with the dynamic partition, I don't know how you would flash these in EDL mode... dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm that do not look like fastboot flashable parts. Possibly the unbrick tool for Redmagic 3/3S could be modified to do this for you.

mslezak said:
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---
Click to expand...
Click to collapse
Yes those .img files can easily be fastboot flashed. Unfortunately it wont solve his problem. He needs the nubia unbrick tool, which is tough to get. I dont understand why Nubia makes things difficult. They should provide proper Fastboot files.

I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.

apersomany said:
I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.
Click to expand...
Click to collapse
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.

mslezak said:
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.
Click to expand...
Click to collapse
Thank you so much!

Okay I can't add anything special but daaamn this community is amazing. So much help I love you all

To relock BL repeat the instructions with 1 different command
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse

Just in case if somebody need a Chinese version of official ROM v2.46 for RedMagic 5G.
Code:
https://mega.nz/file/vc0DiabR#npahTop-JXZ9Mwv-lA7G6DxTG2qqOOAf6AwW8NdEEKw

mslezak said:
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
Click to expand...
Click to collapse
we found out that using the cn rom it all works without even unlocking the bootloader, even while oem unlock was disabled in dev options but there is some kind of vbmeta img required. a full guide is incoming.

VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
You can flash their NX659J-update.zip files directly from TWRP that's how we restored our bricked devices already. So OTA updates no, but you can download them anyway and flash from TWRP directly. Yes we have to figure out a concrete restore method which isn't 100% working yet. I.e. all your data is lost this way apparently AT THIS MOMENT... MORE TO COME.