[GUIDE] [ROOT] Extracting boot.img and rooting Xperia XA1 - Sony Xperia XA1 Guides, News, & Discussion

Unlocking the bootloader
There are couple of options available when it comes to unlocking the bootloader:
• Using Sony's method, as outlined here - https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/.
• Using the Flashtool, by connecting the device in Fastboot mode, and pressing Unlock bootloader button within Flashtool.
Flashing new firmware using Flashtool
Xperia blog has a very detailed guide on how to use Flashtool to flash a new firmware, so I would recommend following it - http://www.xperiablog.net/2016/03/12/install-xperia-marshmallow-using-flashtool-and-xperifirm-guide/.
Creating kernel.elf file
Once the you are done flashing the firmware using the guide above, it is time to extract the kernel.sin and covert it to kernel.elf file. .
1. Navigate to the folder where you had originally downloaded Xperia firmware for flashing. The path should be something similar to C:\Users\USER\.flashTool\firmwares
2. Within the same folder open the .ftf file in file archiving program, such as WinRar or 7Zip
3. Find a file called kernel.sin and extract it somewhere in your computer
4. Launch Flashtool and navigate to Tools > Sin Editor
5. Locate your kernel.sin file and select Extract data option
6. Flashtool should output a kernel.elf file in the same location as kernel.sin file
Creating boot.img file
Now it is time to extract boot.img file from the kernel.elf file. This can be achieved using Android Image Kitchen tools - https://forum.xda-developers.com/showthread.php?t=2073775.
1. Open the folder where Android Image Kitchen is located
2. Drag and drop your kernel.elf file into the unpackimg.bat file
3. A new window should open showing the progress of the unpacking
4. Once that is done, go back to the Android Image Kitchen folder and launch repackimg.bat file
5. A new window will open again, and once the process is done, you will a image-new.img file in the same folder
6. Rename image-new.img file to boot.img and you are done
Flashing boot.img
1. Reboot your device into fastboot mode
2. Open command line tools (Command Prompt, or similar) on your machine
3. Navigate to the folder where your boot.img file is saved by entering cd [Path to the boot.img file]
4. Type in fastboot devices command to verify that your phone is recognized
5. Type in fastboot reload to reload the bootloader
6. Type in fastboot boot boot.img to test the boot image. If your phone boots up fine, then the boot.img is safe to flash
7. Type in fastboot flash boot boot.img to flash the boot image
8. Type in fastboot reboot to restart your phone
If fastboot commands do not seem to work, then try typing ./fastboot followed by your command.
Click to expand...
Click to collapse
Flashing Magisk
Now that you have a boot.img file which is fully compatible with the firmware on your phone, you can easily install Magisk on your phone to get root privileges. Simply follow this installation guide in the original Magisk thread - https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445. Keep in mind that you will need to use Magisk Manager install method.

creating a boot img file the way you explain gives a brick on xa1 latest firmware, not working
trying to boot the image before flashing already gives bootloop on the device

Radishface said:
Unlocking the bootloader
There are couple of options available when it comes to unlocking the bootloader:
• Using Sony's method, as outlined here - https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/.
• Using the Flashtool, by connecting the device in Fastboot mode, and pressing Unlock bootloader button within Flashtool.
Flashing new firmware using Flashtool
Xperia blog has a very detailed guide on how to use Flashtool to flash a new firmware, so I would recommend following it - http://www.xperiablog.net/2016/03/12/install-xperia-marshmallow-using-flashtool-and-xperifirm-guide/.
Flashtool doesnt recognize XA1, only XA2? Help?
Click to expand...
Click to collapse

Awesome guide!
So easy, so quick.
Just rooted my xda1 dual (G3112 7.0) in less than 1h (downloading all the needed stuff)
Thx!!

Related

Tried rooting and bricked it, any help?

I tried rooting it, and after flashing the latest build and installing TWRP I get a "Decryption Unsuccessful" message. Factory reset doesn't work.
In TWRP log I get:
E: Unable to mount storage
Version 2.8.7.2 on TWRP and Build mdb08k.
xDucker said:
I tried rooting it, and after flashing the latest build and installing TWRP I get a "Decryption Unsuccessful" message. Factory reset doesn't work.
In TWRP log I get:
E: Unable to mount storage
Version 2.8.7.2 on TWRP and Build mdb08k.
Click to expand...
Click to collapse
Try this below. Follow step 8 in the tutorial linked below and try to get back to stock, leave phone unlocked, then try to follow the guide again from step 2. Also you you might have to change some commands around in step 8 if you are using a different build when sending commands in the bootloader. bootloader-angler-angler-01.31.img radio-angler-angler-01.29.img are the two files that will differ from build to build. Just change the command to use the proper filename.
http://forum.xda-developers.com/nexus-6p/general/guides-how-to-guides-beginners-t3206928
This will fix your problem. See link above ^^ Your bootloop sounds like you didn't do step 5 and get the modified boot.bin for root. http://forum.xda-developers.com/apps/supersu/wip-android-6-0-marshmellow-t3219344. Make sure you follow step 5 in the guide in the link below. Also another thing that can cause bootloops is you let TWRP install SU/Root, if it asks upon exit, make sure you decline. I was messing with my phone for hours friday night because of bootloops but you just need to folow the link below, start at step 8, don't relock your device, then test to see if you can boot into Android again. Upon confirming you can boot android again, start the guide at step 2 once you get things working again. Install TWRP, then step 3, then step 5 you want to make sure you follow 100% so you don't get bootloops. Make sure you flash Chainfires boot.bin as linked, then make sure you have put the SUPerSU zip on your internal storage and you flash that in TWRP install. Then you should be golden. Make a nandroid backup of your system once you get root installed properly.
Go to step 8. Get the factory image https://developers.google.com/android/nexus/images?hl=en Don't relock your device though like it says to do at the end of step 8.
Download the appropriate factory images for your model here.
Unzip the angler-xxxxxx-factory-xxxxxxxx (x's replace variables) into a directory on your PC (for this guide we'll use C:\angler\).
Once unzipped you should have a folder named angler-xxxxxx (x's replace variables). Open it and move the following files to a new directory named C:\angler\images\:
bootloader-angler-angler-01.31.img
radio-angler-angler-01.29.img
(Please note that radio and bootloader naming changes from build to build so the filenames and below commands will change with them)
Within C:\angler\angler-xxxxxx\ you'll see another zip archive named image-angler-xxxxxx, unzip the contents of that zip into the C:\angler\images\ folder we created before. Now within C:\angler\images\ you should have the following files:
android-info.txt
boot.img
bootloader-angler-angler-01.31.img
cache.img
radio-angler-angler-01.29.img
recovery.img
system.img
userdata.img
vendor.img
Boot into the bootloader and connect your phone to your PC via usb cable.
Open a command prompt from within your fastboot folder (navigate to where you have fastboot.exe located on your PC, shift + right click anywhere within that folder, select open command prompt here), enter these commands to flash:
Code:
fastboot flash bootloader C:\angler\images\bootloader-angler-angler-01.31.img
fastboot reboot-bootloader
fastboot flash radio C:\angler\images\radio-angler-m8994f-2.6.28.0.65.img
fastboot reboot-bootloader
fastboot flash boot C:\angler\images\boot.img
fastboot erase cache
fastboot flash cache C:\angler\images\cache.img
fastboot flash recovery C:\angler\images\recovery.img
fastboot flash system C:\angler\images\system.img
fastboot flash vendor C:\angler\images\vendor.img
The following command is optional as it isn't usually necessary:
Code:
fastboot format userdata
Please note that formatting userdata will (obviously) wipe all user data from the device, this includes everything on your internal storage (images, music, files, etc), apps, and system settings.
TNS201 said:
Try this below. Follow step 8 in the tutorial linked below and try to get back to stock, leave phone unlocked, then try to follow the guide again from step 2. Also you you might have to change some commands around in step 8 if you are using a different build when sending commands in the bootloader. bootloader-angler-angler-01.31.img radio-angler-angler-01.29.img are the two files that will differ from build to build. Just change the command to use the proper filename.
http://forum.xda-developers.com/nexus-6p/general/guides-how-to-guides-beginners-t3206928
This will fix your problem. See link above ^^ Your bootloop sounds like you didn't do step 5 and get the modified boot.bin for root. http://forum.xda-developers.com/apps/supersu/wip-android-6-0-marshmellow-t3219344. Make sure you follow step 5 in the guide in the link below. Also another thing that can cause bootloops is you let TWRP install SU/Root, if it asks upon exit, make sure you decline. I was messing with my phone for hours friday night because of bootloops but you just need to folow the link below, start at step 8, don't relock your device, then test to see if you can boot into Android again. Upon confirming you can boot android again, start the guide at step 2 once you get things working again. Install TWRP, then step 3, then step 5 you want to make sure you follow 100% so you don't get bootloops. Make sure you flash Chainfires boot.bin as linked, then make sure you have put the SUPerSU zip on your internal storage and you flash that in TWRP install. Then you should be golden. Make a nandroid backup of your system once you get root installed properly.
Go to step 8. Get the factory image https://developers.google.com/android/nexus/images?hl=en Don't relock your device though like it says to do at the end of step 8.
Download the appropriate factory images for your model here.
Unzip the angler-xxxxxx-factory-xxxxxxxx (x's replace variables) into a directory on your PC (for this guide we'll use C:\angler\).
Once unzipped you should have a folder named angler-xxxxxx (x's replace variables). Open it and move the following files to a new directory named C:\angler\images\:
bootloader-angler-angler-01.31.img
radio-angler-angler-01.29.img
(Please note that radio and bootloader naming changes from build to build so the filenames and below commands will change with them)
Within C:\angler\angler-xxxxxx\ you'll see another zip archive named image-angler-xxxxxx, unzip the contents of that zip into the C:\angler\images\ folder we created before. Now within C:\angler\images\ you should have the following files:
android-info.txt
boot.img
bootloader-angler-angler-01.31.img
cache.img
radio-angler-angler-01.29.img
recovery.img
system.img
userdata.img
vendor.img
Boot into the bootloader and connect your phone to your PC via usb cable.
Open a command prompt from within your fastboot folder (navigate to where you have fastboot.exe located on your PC, shift + right click anywhere within that folder, select open command prompt here), enter these commands to flash:
Code:
fastboot flash bootloader C:\angler\images\bootloader-angler-angler-01.31.img
fastboot reboot-bootloader
fastboot flash radio C:\angler\images\radio-angler-m8994f-2.6.28.0.65.img
fastboot reboot-bootloader
fastboot flash boot C:\angler\images\boot.img
fastboot erase cache
fastboot flash cache C:\angler\images\cache.img
fastboot flash recovery C:\angler\images\recovery.img
fastboot flash system C:\angler\images\system.img
fastboot flash vendor C:\angler\images\vendor.img
The following command is optional as it isn't usually necessary:
Code:
fastboot format userdata
Please note that formatting userdata will (obviously) wipe all user data from the device, this includes everything on your internal storage (images, music, files, etc), apps, and system settings.
Click to expand...
Click to collapse
Thank you! That's what I get for watching a ****ty youtube guide.

[THE ULTIMATE GUIDE]Unlock bootloader,TWRP,Root,Patch boot.img,Edit OTA zip etc.

By this you will be able to Unlock bootloader, Flash TWRP, and Root while maintaining possibility of applying future OTA's
I've researched many topics and forums for this and compiled all those things in this single step by step topic.
WARNING
Follow if you understand every word written in the topic name only and at your own risk.
I am not responsible for your doing. Follow every step as mentioned, you can skip parts if you understand what you are doing. Read it again to understand clearly, don't do it if you have any doubt and ask before rather asking later.
Credits to xda miui forums and all their ops for this kind info. Thank You.
Divided in 5 parts:
Main Topic-Introduction, Download links
Post two-Short Instructions-Rooting and Flashing OTA's
Post three-Unlocking bootloader, Flashing TWRP, Flashing 7.2.3 OTA, Rooting
Post four-How to flash Future OTA and Root after that
Post five-Troubleshooting- Drivers installation, Patching boot.img, Re-locking Bootloader, Fixing error 0x80070002 in MI Tool, VOLTE fix for marshmallow roms, Debloat MIUI 8, Under Test Methods
Things needed:
1. Redmi Note 3
2. PC with windows x64 (I did it on Windows 10 x64)
3. MiFlash_2016.03.30.exe
4. Fastboot 7.1.8 rom
Note: Fastboot 7.2.5 Rom is now available, you can use that and skip ota modifying and flashing part:Fastboot 7.2.5 rom
5. i) Miui 7.2.3 OTA
ii) Miui 7.2.5 OTA
6. twrp-3.0.2-2-kenzo.img
Twrp-3.0.2-2 Complete backup version
7. unlocked_emmc_appsboot.mbn Recovery flashable
8. Boot.img patcher (extracted from alka recovery, credits to the dev)
Patching method on pc is also given in the guide
9. Volte Fix for Marshmallow Roms: Here
10. MIUI 8 Debloating:Here
Some patched boot.img:
i) 7.2.3 patched boot.img
ii) 7.2.5 patched boot.img
iii) 7.3.2 patched boot.img
9. Android Image Kitchen OP-Android Image Kitchen - Unpack/Repack Kernel Ramdisk
10. Minimal adb and fastboot OP-[TOOL]Minimal ADB and Fastboot
11. SuperSU zip OP-SuperSU v2.65
12. i) Edited updater-script for OTA 7.2.3
ii) Edited updater-script for OTA 7.2.5
Now follow post 3 if you are not clear about this 'thing' or try looking at post 2 for simple and short instructions.
Short Instructions-Rooting and Flashing OTA's
Divided in two parts:
PART 1
How to root?
1. Falsh complete 7.1.8 with unlocked emmc_appsboot.mbn instead of the one in the rom .tgz and unlock using fastboot- After this our bootloader is unlocked.
2. We will now flash the twrp recovery using fastboot (with help of minimal adb and fastboot)- we have a custom recovery to apply modified ota zip (all future ota zips need to be modify before flashing) and also to flash supersu and patched boot.img
3. We will make a backup of 7.1.8 system+boot in TWRP.
4. We will now modify the ota zip (replace emmc_appsboot.mbn and updater-script) and flash in the recovery (system mounted as read only on first TWRP boot) but will NOT flash supersu.- updated to 7.2.5 now
5. We will now make a backup of 7.2.5 system+boot with NO compression in TWRP.- we got 7.2.5 boot.img (boot.emmc.win is the name )to patch it (#8 in things needed)
6. We will take this backed up boot.emmc.win in Android Image Kitchen in pc and patch it.- we now have patched 7.2.5 boot.img and a way to patch all future boot.img's
7. We will now mount system as read/write and flash supersu and this patched boot.img in twrp.- we have successfully rooted the phone.
PART 2
Future OTA's will fail as they will verify system and boot too before flashing. We have altered both here. But we have a recovery and a backup to restore before flashing ota.
So, how to apply future updates?
1. Download the ota but DO NOT flash it.
2. Modify the OTA zip as we did for 7.2.3 and 7.2.5
3. Restore unrooted system and not patched boot.img (the 7.2.5 TWRP backup)
4. Mount system and read only
5. Patch the OTA zip by replacing emmc_appsboot.mbn and updater-script. Flash the OTA
6. Make a new boot+system backup.
7. Patch the new boot.img.
8. Mount system as read/write
9. Flash patched boot.img along with supersu.
Follow up post three for detailed Rooting guide if things are not clear for you.
Unlocking bootloader, Flashing TWRP, Flashing 7.2.5 OTA, Rooting
It is particularly focused on rooting latest (at writing this) version of Miui i.e. 7.2.3
How to Root?
For rooting we have to flash SuperSu from custom recovery i.e. TWRP. So, obviously we need to flash TWRP first in Redmi Note 3.
But, to flash TWRP we need to unlock bootloader first
Unlocking Bootloader:
Downloads from post one:
1. Download and Install Mi Flash Tool
2. Download and Extract 7.1.8 Fastboot Rom (You can also use latest fastboot rom, just skip OTA part from this guide)
3. Download, Extract and Replace unlocked_emmc_appsboot.mbn in the extracted rom folder
4. Download and Install Minimal ADB and Fasboot Tools
Instructions:
1. Turn Your Phone On and Connect USB Cable to the phone and the Computer
2. Go to settings-about phone and tap Miui versoin five times.
3. Go back and go to Additional settings-Developer Options and enable USB debugging (if disabled) and Enable OEM Unlock (if disabled)
4. Open Device Manager in PC and check to find your phone Installed as ADB Device
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
5. See if there is any pop up in phone asking to Authorization (Allow USB debugging). Check Always allow from this Computer and tap ok.
6. Run the Minimal ADB and Fastboot From the Start Menu
7. Check if your Device is Detected in ADB by typing this command
Code:
adb devices
You should see the output like this
If not, then you have to install drivers. Go to topic #5. Then try again.
8. Type the following command to Reboot the Phone to EDL mode
Code:
adb reboot edl
9. Check the Device Manager you should see the Phone as shown in the Screenshot below
NOTE: The Driver can be Either the one Shown in the Image (which is a default driver loaded by windows)
or
can be from Qualcomm which will read as
Qualccomm HS-USB QLoader 9008
Click to expand...
Click to collapse
Note that there is a possibility that You might End up in
Qualcomm HS-USB Diagnostics 900E
Click to expand...
Click to collapse
But Don't Panic and Follow the Steps from Step No. 1 again
10. Now Start the MI Flash Tool and Browse to the Location Where you have Extracted the Fastboot ROM
11. Go to Advanced (arrow in front of browse) and Select:
Flash Programmer, Raw XML File and Patch XML File
from the Fastboot ROM\Images folder and press enter on keyboard
12. Press Refresh in MI tool and You should see you phone in the MI Flash tool With the same COM# as in the Device Manager
13. Press Flash and wait. It would take some time to flash about 170-250 seconds or more ( if Miflash shows a error on clicking Flash , please restart Miflash and try again)
14. After the Miflash fastboot is completed successfully, hard boot phone to Fastboot mode by pressing and holding Volume Down+Power On. You will see mi bunny on screen.
15. Again run Minimal ADB and Fastboot from start menu (as Administrator)
16. Type:
Code:
fastboot oem device-info
It will show you the current Bootloader Status .
17. Now again Type:
Code:
fastboot oem unlock-go
Optional: Type in the previous command again to check if the status of Bootloader had changed or not.
18. Type:
Code:
fastboot reboot
to reboot the phone.
Bootloader is unlocked now but do not disconnect the phone from pc yet.
Credits:
http://en.miui.com/thread-253680-1-1.html
http://en.miui.com/thread-261019-1-1.html
Flashing TWRP:
Downloads from post one:
1. TWRP recovery
Instructions:
1. Once done with bootloader unlock guide, without disconnecting the phone, restart phone in fastboot mode (use steps 1-8 from unlocking guide and replace edl command with fastboot, i.e. write fastboot instead of edl in cmd) or Press and hold volume down+power to hard boot it to fastboot.
2. Go to Minimal ADB and Fastboot directory
C:\Program Files (x86)\Minimal ADB and Fastboot
Click to expand...
Click to collapse
and copy/move downloaded twrp-3.0.2-2-kenzo.img here.
3. Type following in cmd once the phone is in fastboot mode.
fastboot flash recovery twrp-3.0.2-2-kenzo.img
4. Once done, hard boot phone to recovery by Pressing and holding Volume Up+Power On. TWRP should boot.
Note: When asked to mount system as read only or as read/write select read only in TWRP. This step is important otherwise you will face bootloop after flashing ota.
Flashing 7.2.3 OTA and then 7.2.5 OTA:
Downloads from post one:
1. Miui 7.2.3 OTA and Miui 7.2.5 OTA
2. unlocked_emmc_appsboot.mbn
Downloads from internet
1. 7zip Or WinRAR
Instructions:
1. Download the OTA in your PC or move it in your pc from phone after downloading.
2. Open the OTA file in Windows with Winrar/7zip
3. Locate the emmc_appsboot.mbn in firmware-update folder and delete from the zip (it will take a while for the deletion please be patient)
4. Drag and drop the (unlocked)emmc_appsboot.mbn to the firmware-update folder of the OTA
5. Navigate to "META_INF/com/google/android/" and extract the updater-script file and then delete it from the zip.(make sure to keep a backup of the zip)
6. Open the file in a text editor, (I prefer Notepad++) and delete the following lines and save the file
ui_print("Verifying current system...");
getprop("ro.build.fingerprint") == "Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.1.8.0.LHOMICL:user/release-keys" ||
getprop("ro.build.fingerprint") == "Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.2.3.0.LHOMIDA:user/release-keys" ||
abort("Package expects build fingerprint of Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.1.8.0.LHOMICL:user/release-keys or Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.2.3.0.LHOMIDA:user/release-keys; this device has " + getprop("ro.build.fingerprint") + ".");
apply_patch_check("EMMC:/dev/block/bootdevice/by-name/boot:33721674:bf5d61ecd25d0026e768f6258f320640385976fd:34037066:22a19fe883c5fe4b25852702a1bd25bcaeedd9a0") || abort(""EMMC:/dev/block/bootdevice/by-name/boot:33721674:bf5d61ecd25d0026e768f6258f320640385976fd:34037066:22a19fe883c5fe4b25852702a1bd25bcaeedd9a0" has unexpected contents.");
if block_image_verify("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") then
ui_print("Verified system image...");
else
(range_sha1("/dev/block/bootdevice/by-name/system", "2,0,1") == "e04e9788c17630b4088243d8b3ee29509568b793") || (range_sha1("/dev/block/bootdevice/by-name/system", "2,0,1") == "3b8aeee76a291f2b1647c9bbcbece5be948a83fc") || abort("/dev/block/bootdevice/by-name/system has been remounted R/W; reflash device to reenable OTA updates");
(range_sha1("/dev/block/bootdevice/by-name/system", "80,0,32770,32929,32931,33439,65535,65536,65538,66046,98303,98304,98306,98465,98467,98975,131071,131072,131074,131582,163839,163840,163842,164001,164003,164511,196607,196608,196610,197118,229375,229376,229378,229537,229539,230047,262143,262144,262146,262654,294911,294912,294914,295073,295075,295583,327679,327680,327682,328190,360447,360448,360450,360958,393215,393216,393218,393726,425983,425984,425986,426494,458751,458752,458754,459262,476353,491520,491522,524288,524290,557056,557058,589824,589826,622592,622594,623102,650190,650191,655320") == "a75d23fa6067c58c166603cfac0b3d0df9b81919") ||
abort("system partition has unexpected contents");
endif;
Click to expand...
Click to collapse
(Edit the 7.2.5 OTA the same way or use updater-scripts provided for both OTA's from post 1)
7. Now again navigate to "META_INF/com/google/android/" and drag and drop the modified updater-script file inside the folder
8. Move this modified OTA zip to your (internal/external sd) and flash using TWRP.
9. Once done, make a system+boot bakcup in twrp, name it "7.1.8 stock"
10. Apply future updates like this and make backup with naming. Delete old backups.
Example: Make a backup named "7.2.5 stock" just after flashing 7.2.3 and 7.2.5 updates. Then root it and flash patched boot.img. If the phone starts up normal, reboot to recovery and delete 7.1.8 stock backup and keep 7.2.5 stock backup to use it for flashing future OTA.
Rooting:
Downloads from post one:
1. SuperSU zip
2. 7.2.5 boot patched.img
Instructions:
Note: Now change the mode to read/write for system partition from mount option in TWRP. Otherwise these zips will not flash.
1. Copy/Move/Download SuperSU zip and patched boot.img in your phone.
2. Extract the .rar containing the patched boot.img.
3. Reboot to recovery and Tap on Install in the TWRP main screen.
4. Select SuperSu.zip
5. To flash boot.img, the default mode is to flash zip files, you will need to toggle the mode to images.
6. To do so, tap on the Images… button on the bottom-right of the screen
7. The recovery will now only see the image files, select the patched boot.img
8. Once you select, you will be prompted to select the type of image it is, select Boot or Recovery. Select Boot.
9. Finally, swipe the button on the bottom of the screen to start the flashing process.
10. Once complete, you can go to Reboot > System.
How to flash Future OTA and Root after that
You got a Unlocked, Rooted phone with custom TWRP recovery. The OTA will check the system and will fail to flash as you have flashed SuperSu and Boot.img.
What you may do when a new OTA arrives??
Flashing any OTA and rooting it
Downloads from post one:
1. SuperSU zip
2. Unlocked boot img (will be updated when ota will arrive)
3. Unlocked_emmc_appsboot.mbn
Downloads from internet:
1. WinRAR/7zip
Preparing OTA:
1. Download the OTA in your PC or move it in your pc from phone after downloading.
2. Open the OTA file in Windows with Winrar/7zip
3. Locate the emmc_appsboot.mbn in firmware-update folder and delete from the zip (it will take a while for the deletion please be patient)
4. Drag and drop the (unlocked)emmc_appsboot.mbn to the firmware-update folder of the OTA
5. Navigate to "META_INF/com/google/android/" and extract the updater-script file and then delete it from the zip.(make sure to keep a backup of the zip)
6. Open the file in a text editor, (I prefer Notepad++) and delete the following lines and save the file
ui_print("Verifying current system...");
getprop("ro.build.fingerprint") == "Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.1.8.0.LHOMICL:user/release-keys" ||
getprop("ro.build.fingerprint") == "Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.2.3.0.LHOMIDA:user/release-keys" ||
abort("Package expects build fingerprint of Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.1.8.0.LHOMICL:user/release-keys or Xiaomi/kenzo/kenzo:5.1.1/LMY47V/V7.2.3.0.LHOMIDA:user/release-keys; this device has " + getprop("ro.build.fingerprint") + ".");
apply_patch_check("EMMC:/dev/block/bootdevice/by-name/boot:33721674:bf5d61ecd25d0026e768f6258f3206403859 76fd:34037066:22a19fe883c5fe4b25852702a1bd25bcaeed d9a0") || abort(""EMMC:/dev/block/bootdevice/by-name/boot:33721674:bf5d61ecd25d0026e768f6258f3206403859 76fd:34037066:22a19fe883c5fe4b25852702a1bd25bcaeed d9a0" has unexpected contents.");
if block_image_verify("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") then
ui_print("Verified system image...");
else
(range_sha1("/dev/block/bootdevice/by-name/system", "2,0,1") == "e04e9788c17630b4088243d8b3ee29509568b793") || (range_sha1("/dev/block/bootdevice/by-name/system", "2,0,1") == "3b8aeee76a291f2b1647c9bbcbece5be948a83fc") || abort("/dev/block/bootdevice/by-name/system has been remounted R/W; reflash device to reenable OTA updates");
(range_sha1("/dev/block/bootdevice/by-name/system", "80,0,32770,32929,32931,33439,65535,65536,65538,66 046,98303,98304,98306,98465,98467,98975,131071,131 072,131074,131582,163839,163840,163842,164001,1640 03,164511,196607,196608,196610,197118,229375,22937 6,229378,229537,229539,230047,262143,262144,262146 ,262654,294911,294912,294914,295073,295075,295583, 327679,327680,327682,328190,360447,360448,360450,3 60958,393215,393216,393218,393726,425983,425984,42 5986,426494,458751,458752,458754,459262,476353,491 520,491522,524288,524290,557056,557058,589824,5898 26,622592,622594,623102,650190,650191,655320") == "a75d23fa6067c58c166603cfac0b3d0df9b81919") ||
abort("system partition has unexpected contents");
endif;
Click to expand...
Click to collapse
NOTES:
a. If this is not working for you, getting error while flashing, then use the updater script added in post one, i have edited that my self for my use and worked perfectly.
b. Allow TWRP to read/write system (asked on first time when recovery boots) as flashing ota to system is a write process.
7. Now again navigate to "META_INF/com/google/android/" and drag and drop the modified updater-script file inside the folder
8. Move this modified OTA zip to your (internal/external sd) and flash using TWRP.
9. Once done, make a system+boot bakcup in twrp, name it "7.2.3 stock"
Flashing and making new Backup:
1. Reboot to TWRP (Volume Up+Power on)
2. Restore 7.2.3 stock backup from backup and restore options
3. Flash the modified OTA.
4. Make a new backup of system+boot and name it "version" stock. Like "7.2.3 stock"
Rooting:
1. Copy/Move/Download SuperSU zip and patched boot.img in your phone.
2. Extract the .rar containing the patched boot.img.
3. Reboot to recovery and Tap on Install in the TWRP main screen.
4. Select SuperSu.zip
5. To flash boot.img, the default mode is to flash zip files, you will need to toggle the mode to images.
6. To do so, tap on the Images… button on the bottom-right of the screen
7. The recovery will now only see the image files, select the patched boot.img
8. Once you select, you will be prompted to select the type of image it is, select Boot or Recovery. Select Boot.
9. Finally, swipe the button on the bottom of the screen to start the flashing process.
10. Once complete, you can go to Reboot > System.
Troubleshooting
Installing Drivers
1. Disable Windows Drivers Signature on your computer: you can do that by pressing Windows button + i on keyboard to reveal the Settings page. From there you can choose Update & Security >> Recovery >> Advanced startup >> Restart now. Wait a moment for your computer to restart. Next, go to Troubleshoot >> Advanced options >> Startup settings >> Restart. Once your computer restarts, now choose Disable driver signature enforcement which is option number 7. See the video below:
Disable Windows Drivers Signature
:credits to the owner i have not made it.
2. Hold Vol - and Vol + and plug Usb , you will enter adb Mode.
3. Now Phone is Connected as ADB. Check Device Manager for Below:-
4. Run Minimal adb (search adb in start)
5. Type these Commands:
Code:
adb devices
adb reboot edl
Phone will enter in download Mode with Red Led.
6. Open Device Manager and Phone will be detected as QHUSB_BULK.
Right Click and choose Update Drivers.
7. Choose Browse My Computer for Driver Software
8. Choose the Path of Xiaomi Folder. Most of users will find it like this.
Note:- If Folder does not exist , Install MI Flash (post #1) first.
Win 64 bit C: \ Program Files (x86) \ Xiaomi \ MiPhone \ Qualcomm \ Driver
Win 32 bit C: \ Program Files \ Xiaomi \ MiPhone \ Qualcomm \ Driver
9. Choose Install this Driver Software anyway.
10. The driver will be installed Sucessfully and you can see added in Ports as Qualcomm HS-USB.
Credits:http://en.miui.com/thread-235865-1-1.html
Patching Boot.img
1. Download the Android Image Kitchen Tool from post #1 and extract it.
2. Download the fastboot room and extract to locate the boot.img (or any other source you would like) and move it to the Android Image Kitchen folder, as shown below:-
3. Right click & hold, on the "Boot.img" file and move & place it onto unpackimg.bat file and proceed with the on-screen message to "Run", as shown below:-
4. Next go to ramdisk directory and locate fstab.qcom file, as shown below:-
5. Use any text editor (notepad++ preferred) to open fstab.qcom file, then use the Find function to find any value containing "Verify" and delete with care, and save it accordingly, as shown below:-
Code:
,verify
:delete verify also the , in from of it.
6. Now we need to repack the modded boot.img file, double-click to execute "repackimg.bat" hence it will generate a new boot file as "image-new.img" as shown below:-
7. Done..
Credits:http://en.miui.com/thread-249666-1-1.html
Relocking Bootloader: (DO AT YOUR OWN RISK AND ONLY IF YOU KNOW WHAT YOU ARE DOING)
1. Get the fastboot rom image from topic #1 or the locked emmc_appsboot.mbn from post #1 (version 7.1.8)
2. Download (from post #1) and Install Minimal adb and fastboot
3. Go to C:\Program Files (x86)\Minimal ADB and Fastboot and copy/move the downloaded emmc_appsboot.mbn here.
4. Run MAF32.exe (it is in this folder too)
5. Type following commands
Code:
fastboot Flash aboot emmc_appsboot.mbn
fastboot Flash abootbak emmc_appsboot.mbn
fastboot Reboot
6. Done.
Fixing The system cannot find the file specified.(0x80070002):
* Make sure you have downloaded correct rom.
* Make sure there is no space in you path of images.
Eg:
NOT E:\MI TOOLS\rn3\kenzo_global_images_V7.1.8.0.LHOMICL_20160129.0000.14_5.1_global_9706e12561UNLOCK\kenzo_global_images_V7.1.8.0.LHOMICL_20160129.0000.14_5.1_global\images
BUT E:\MI_TOOLS\rn3\kenzo_global_images_V7.1.8.0.LHOMICL_20160129.0000.14_5.1_global_9706e12561UNLOCK\kenzo_global_images_V7.1.8.0.LHOMICL_20160129.0000.14_5.1_global\images
IF STILL THE ERROR IS THERE (ONLY TRY IF ALL ABOVE METHODS FAIL)
1. Download this Rar and replace both files in your fastboot rom. (flash_all.bat in rom folder and rawpragram0.xml in images folder)
2. Try to flash now.
What about the fingerprint error while flashing OTA?
OP, you need to really give detailed steps... Else this thread is gonna be filled with more questions than answers....
For example the ota zip does not contain the boot.img file but contains a patch file boot.img.p , so do we need to replace modded full boot.img in ota- will it get flashed or will the flashing fail as the instructions in ota will be for patch boot file...
Dropbox link for patched bot image of 7.2.3 is not working... gives error
7.2.3.0 boot.img
use this link to downloadwww.dropbox.com/s/k5w16gotzz7zge0/7.2.3 boot patched.rar?dl=0
Sudeep Duhoon said:
reserved 4
Click to expand...
Click to collapse
I am on miui 7.2.3.0(locked boot loader), can I flash modified 7.2.3.0 boot.IMG and twrp through adb?
pvp16 said:
I am on miui 7.2.3.0(locked boot loader), can I flash modified 7.2.3.0 boot.IMG and twrp through adb?
Click to expand...
Click to collapse
to flash modified boot.img you have to do all the steps till that part first.
Error from dropbox
Downloaded file of boot .rar has been corrupted
root 7.2.3.0
if i am on 7.2.3.0 (bootloader locked) is it neccessary to flash 7.1.8 ie downgrade to unlock bootloader... or i can skip some of ur steps plzzz help
---------- Post added at 09:29 AM ---------- Previous post was at 09:15 AM ----------
what we are doing (deleting) in script..... it is for to get rid from finger print error
Deevit said:
Downloaded file of boot .rar has been corrupted
Click to expand...
Click to collapse
Downloading in phone? Try uc browser.
vivekjha said:
if i am on 7.2.3.0 (bootloader locked) is it neccessary to flash 7.1.8 ie downgrade to unlock bootloader... or i can skip some of ur steps plzzz help
---------- Post added at 09:29 AM ---------- Previous post was at 09:15 AM ----------
what we are doing (deleting) in script..... it is for to get rid from finger print error
Click to expand...
Click to collapse
Yes necessary.
I was following the process to install the OTA after making changes to the zip file with the emmcxx and update-script.
TWRP threw me this error
Failed to apply patch " patch/boot.img.p"
Updater process ended with ERROR:7
Pls help. Thanks
Tried
Sudeep Duhoon said:
Downloading in phone? Try uc browser.
Click to expand...
Click to collapse
In UC I had tried but it has been corrupted
Unlocking Bootloader Error
When I try to flash fastboot oem unlock-go it returns: FAILED (remote: Token verification failed, reboot the device)
.HOW TO FIX
pvp16 said:
I am on miui 7.2.3.0(locked boot loader), can I flash modified 7.2.3.0 boot.IMG and twrp through adb?
Click to expand...
Click to collapse
Not without unlocking the bootloader, you cant
---------- Post added at 06:07 AM ---------- Previous post was at 06:04 AM ----------
fylim said:
I was following the process to install the OTA after making changes to the zip file with the emmcxx and update-script.
TWRP threw me this error
Failed to apply patch " patch/boot.img.p"
Updater process ended with ERROR:7
Pls help. Thanks
Click to expand...
Click to collapse
I guess you need to remove the patch boot file and replace it with modified boot image file.
Deevit said:
Downloaded file of boot .rar has been corrupted
Click to expand...
Click to collapse
link has been updated but file working fine. it is 10.64mb

[Guide] Safe bootloader unlock, restore DRM, custom recovery, root, bootloader relock

** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​
The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​
I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the Customized NL ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, follow this guide through to section 5 place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133 (The rootkernel tool has a bug in its built-in SuperSU integration. See: http://forum.xda-developers.com/showpost.php?p=67485478&postcount=838)
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to root
5.1- Place SuperSU 2.71 zip (or higher) on the phone's sdcard. The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
5.2- Reboot to recovery and flash the zip file.
6- How to relock bootloader and return it to original factory state
6.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
6.1- Repeat step 1.1
6.2- Repeat steps 1.3, 1.4, and 1.5
6.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
6.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.
Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
najoor said:
** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **​The following is tested on model E6553. This may work for the dual sim model too but I have not verified it. Do not flash the ftf and kernel files intended for one model onto another.​I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your phone when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this phone such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each device and cannot be copied over from another) unlocking the bootloader results in an irreversible loss of some of your phone's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable.
Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your phone.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the phone which is now in USB debugging mode to your PC and answer yes when the phone asks to authorize the PC to access it in USB debugging mode. You can check that the PC indeed sees the phone by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-05052016.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the phone initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 E6553_Customized HK_1294-9654_32.1.A.1.185_R7C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root and/or add recovery after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Extract the boot image from the 32.1.A.1.185 marshmallow ftf that you installed in step 1.15. Here are the steps to take:
Open the ftf file with 7-zip or any zip program that you have at your disposal
Look for a file called kernel.sin and extract it.
Start flashtool and from Tools menu choose Sin Editor.
Select the kernel.sin that you extracted in the previous step and hit Extract data.
Flashtool will create a file called kernel.elf which you will use in the next step.​2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel.elf that you got in step 2.1 to this folder. If you want root, place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd kernel.elf boot-patched.img
When prompted, answer as follows:
- Sony RIC is enabled. Disable? [Y/n] Y (if you want root plus write access)
- Install TWRP recovery? [Y/n] Y (if you want to have recovery)
- Install busybox? [Y/n] Y (if you want busybox. It is very useful)
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)​This will create a new kernel image called boot-patched.img which you will now flash on your phone.
2.5- Boot the phone in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the phone and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is successful you will see this.
3- How to flash a custom or stock kernel
3.0- If you have already flashed the patched kernel in part 2 you will skip this part.
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash a boot image (i.e. kernel) on your phone you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to add and use recovery
4.1- Recovery is added to your kernel in step 2.4.
4.2- To enter recovery reboot the phone and touch the volume up key when the LED turns yellow during the boot splash screen.
5- How to relock bootloader and return it to original factory state
5.0- To relock the bootloader along with restoring the DRM keys the phone must have unmodified stock firmware.
5.1- Repeat step 1.1
5.2- Repeat steps 1.3, 1.4, and 1.5
5.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the phone. The command will look similar to this:
Code:
tarestore TA-05052016.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the phone. Your bootloader is now locked and your DRM keys restored.
5.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.
Click to expand...
Click to collapse
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.
arokososoo said:
Whoa Great
---------- Post added at 01:32 AM ---------- Previous post was at 12:50 AM ----------
Very usefull step by step guide.. But is there is any method to root phone without unlocking Bl? Quite curious to know from you.
Click to expand...
Click to collapse
Not yet, atleast for my Dual SIM Version.
njaya95 said:
Not yet, atleast for my Dual SIM Version.
Click to expand...
Click to collapse
So you mean there is a way to root single sim version without unlocking BL?
Thanks ú so much! this is well writen, i will try this when i get the time to do a fresh install. Cheers mate
@arokososoo
Please, in the future never quote long OP and any other long posts. This is very annoying for mobile and desktop users to scroll to the next post. Thanks.
Sent from my Sony E6553 using XDA Labs
I wonder if E6533 can use this guide
Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer
Stoneybridge said:
Got as far as going to the sony website, there's no mention of phones that can be unlocked there and for some reason Ive got bootloader unlock allowed no, even with a sim free phone and my xperia turned off.....bummer
Click to expand...
Click to collapse
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.
How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler
Trilliard said:
How long did that take on your devices? 1.1- Start by clean flashing any 28.0.A.8.266 firmware, For this tutorial I used the UK Generic ftf that you can get from here.
I am waiting for half an hour now...
Spoiler
Click to expand...
Click to collapse
I can't see your picture, but I assume you have that stucking at modem/system ?
If so, downgrade Flashtool to 0.9.19
Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.
Trilliard said:
Well i got a soft brick, but was able to restore it trough Sony Companion. Here is the picture on another hoster http://fs5.directupload.net/images/160529/gr5fpf8t.png dont know on what point it stuck.
Funfact that two germans writting in english
Edit, big thanks version 0.9.19 worked perfect. Cant understand why the newest one doesnt work
Edit 2: System boots up, but when the setup start the process com.android.phone stops instant and if i hit ok the message comes instantly again after about ten times the phone reboot, i cant do anything else... next repair through sony companion and back to stock german 6.0. I´ll stop try it for today.
Click to expand...
Click to collapse
Did you forget to wipe?
In a thread i opened in Q&A a user said that even though service info reported bl unlock allowed NO, he managed to unlock it anyways using standard procedure, what do you think?
it seems like Sony RIC is not fully disabled with this patch.
Finally ! Works like a charm in my E6533 (Dual sim) !!! Thanks a lot !!!
Hi thiefxhunter,
How you do this? could you explain us step by step. I like to root my dual sim model.
Thanks.
Hi.. I am stuck in 2.5
My device is unlocked, It is connected in fastboot mode (blue led).
error msg
'Fastboot is not recognised as an internal or external command, operable program or batch file'
Please help me in this.
Solved..
Thanks for this post..
Thanks for this guide, it worked like a charm on my E6553 with 32.2.A.0.224
CorzCorry said:
I also unlocked my Z3+, although it wasn't supported. I just picked Z4 Tablet since it is the "nearest" one. Worked Got MM rooted now.
Click to expand...
Click to collapse
Can you please explain how did you do that? Thanks

Go back to the original firmware for all Huawei-Series via UPDATE.APP extract.

If you want to go back to the original firmware. Here is a little guide.
First, download your firmware at https://easy-firmware.com/home/browse/category/id/337/.
Then you extract the UPDATE.APP from this archive.
Next, load the splitupdater from here: https://github.com/marcominetti/split_updata.pl.
Moves the folder split under Downloads and copies the UPDATE.APP into it.
Then open the terminal and enter the following.
1. cd downloads
2. ls
3. cd split
4. # copy splitupdate, crc and UPDATE.APP files
5. chmod + x splitupdate
6. chmod + x crc
7. ./splitupdate UPDATE.APP
Now you boot your Huawei in the fast boot mode first connect the USB cable and at the same time hold down the volume down button until the Fastboot mode appears.
Then you just need to install the files BOOT.img, RECOVERY.img and SYSTEM.img via the terminal with the following command. The 3 files can be found in the split output folder.
1. fastboot devices
2. fastboot flash boot BOOT.IMG
3. fastboot flash recovery RECOVERY.img
4. fastboot flash system SYSTEM.img
5. fastboot reboot
Now you have a fresh clean install again.
I hope that the guide will help you with missteps of Custom Roms that are listed here.
Greetings Jack241287

Message of dm-verity on TWRP Recovery website

I'm using android Pie(stock rom) on mi a1. I want to flash Lineageos for microG. On TWRP Recovery website, it says this device(mi a1-tissot) uses dm-verity and in order to bypass dm-verity's boot prevention, you will have to install a kernel that has dm-verity disabled in fastboot.
I'm completely new in the realm of flashing custom roms. And no website and youtube video talks about dm-verity in a clear manner:crying:. So what steps exactly should I follow to install Lineageos for microG?
Also, my phone(data) is encrypted. And I can't find a way to decrypt it. Will it affect flashing TWRP Recovery or Lineageos?
wHY did not anybody answer guys?
Here are the steps to install TWRP and maybe a custom ROM:
1.Make sure to have USB Debugging activated
2.Put the Mi A1 in Fastboot Mode(Volume Down+Power)
3.Connect your phone to your PC
4.Make sure to have downloaded platform-tools
5.Download the .img TWRP file and copy it in the platform-tools folder
6.Hold Shift and right Click in the platform-tools folder,and click onpen a PowerShell window here
7.Type fastboot devices or .\fastboot devices(for me the second worked)
8.Now write fastboot boot twrp.xx.xx.xx.img(here Goes the name of your .img TWRP file)
9.After 15 seconds,you will probably see a warning that asks You to swipe to allow modifications.Don't swipe.Press on:Keep read only.
10.From this point,You can install every custom ROM,You can install Magisk.
Hope this helped You out!
TheAlmigthyOne said:
Here are the steps to install TWRP and maybe a custom ROM:
1.Make sure to have USB Debugging activated
2.Put the Mi A1 in Fastboot Mode(Volume Down+Power)
3.Connect your phone to your PC
4.Make sure to have downloaded platform-tools
5.Download the .img TWRP file and copy it in the platform-tools folder
6.Hold Shift and right Click in the platform-tools folder,and click onpen a PowerShell window here
7.Type fastboot devices or .\fastboot devices(for me the second worked)
8.Now write fastboot boot twrp.xx.xx.xx.img(here Goes the name of your .img TWRP file)
9.After 15 seconds,you will probably see a warning that asks You to swipe to allow modifications.Don't swipe.Press on:Keep read only.
10.From this point,You can install every custom ROM,You can install Magisk.
Hope this helped You out!
Click to expand...
Click to collapse
I found this thread by doing something wrong that you mentioned. I didn't swipe to allow modifications and now the TWRP can't flash anything. Tried every remedy I can find but nothing. It can wipe system though, but not restore it so now I'm stuck in bootloops. Damn, idk what to do.
Dear Zentom,for me,that method worked.But,I can help you get out of that situation
1.Make sure to have your bootloader unlocked
2.Download the stock ROM for Mi A1
3.Boot into Fastboot Mode
4.Extract the stock ROM archive
5.Copy all the extracted files into the platform-tools folder
6.Find a .bat file names "flash-all"
7.Open it
8.After 15 minutes or so,your phone will boot.
Hope I helped you!
TheAlmigthyOne said:
Dear Zentom,for me,that method worked.But,I can help you get out of that situation
1.Make sure to have your bootloader unlocked
2.Download the stock ROM for Mi A1
3.Boot into Fastboot Mode
4.Extract the stock ROM archive
5.Copy all the extracted files into the platform-tools folder
6.Find a .bat file names "flash-all"
7.Open it
8.After 15 minutes or so,your phone will boot.
Hope I helped you!
Click to expand...
Click to collapse
Thanks, but I flashed the stock rom from twrp anyway. Though I had to flash the October 2019 ROM. Do you know anywhere where one can get an updated one?
If You want the latest stock ROM,this is:https://drive.google.com/file/d/1yVWv4hiTSk-3zai-4u2c2OcLpRdFL_J6/view

Categories

Resources