Related
YotaPhone 2 ROOT with modified stock recovery
NOTE:
Check out the more functional TWRP recovery for YotaPhone 2.
Since not much dev work is happening on the YotaPhone 2, I though I'd kick off by publishing a recovery image that will hopefully allow you to root your YotaPhone 2 device with lollipop, and e.g. make partition backups.
First off: Disclaimer!
I am not responsible for damaged or bricked devices. If you follow instructions in this post, then YOU are making the choice to tinker with your device, and you are likely to void your warranty by doing so. You might even damage or brick your device, so ask yourself if the benefits outweigh the risks, because after proceeding you are pretty much on your own.
What is it?
It's a slightly modified stock recovery that allows to install packages signed with testkeys, plus adb root access and busybox for e.g. shell. That's it.
What can you do with it?
- adb root & shell access (e.g. to manually backup partitions or modify system files)
- install update zips signed with testkeys (e.g. SuperSU) in addition to original Yota Devices software
- root your device
What can it NOT do?
- probably can NOT install unsigned zips (must be signed by YD (like fota update zips), OR signed with standard testkeys)
- no fancy features, just boring AOSP stock recovery as included in stock firmware
- installing of apks/zips only through adb sideload, not from (emulated) SD card
What do you need?
- YotaPhone 2 (YD201) with Lollipop 5.0, I used firmware 1.39 YMMV with other versions
- Some technical confidence
- USB cable with a PC or laptop on one end
Steps overview:
1) First read the whole post to understand what's going to happen
2) backup (sync stuff, copy photos off, use a backup app etc, use search if unsure how to)
3) Unlock the bootloader
4) Install adb and fastboot if not yet installed. (For Windows look e.g. here, for linux the fastest is probably to install Android SDK with platform tools, see here If this is not enough info to get you started, please use xda search!)
5) Download recovery image: yd201_reco_139_testkeys_v01.img
6) boot the recovery image
7) root the device by sideloading SuperSU,
Unlocking bootloader:
Warning 1: It is currently not known how to re-lock the bootloader. (fastboot oem lock just hangs). This means you cannot completely undo the next step as of yet. This might have consequences for sending the device in for repairs, if they check for this, and deem it a (warranty) problem.
Warning 2: on some devices unlocking the bootloader wipes the device clean to factory defaults. I didn't see this happening on my YD201, but be warned, backup first!
On Linux:
Code:
sdk/platform-tools$ sudo ./fastboot oem unlock
...
OKAY [ 0.002s]
finished. total time: 0.002s
On Windows:
Code:
C:\android-sdk-windows\platform-tools>fastboot oem unlock
...
OKAY [ 0.002s]
finished. total time: 0.002s
Maybe Windows will install some extra drivers in the process.
BOOT the recovery image:
a) First: put the device in fastboot/download mode:
method 1: Power off with USB cable disconnected, then hold volume down key while inserting USB cable (which should already be in your PC on the other end).
method 2: do a
Code:
adb reboot bootloader
You should see a black screen with a tiny white: downloading...
b) boot the recovery image:
On linux:
Code:
sdk/platform-tools$ sudo ./fastboot devices
Should show a connected device in fastboot mode, then proceed:
Code:
sdk/platform-tools$ sudo ./fastboot boot <path>/<to>/yd201_reco_139_testkeys_v01.img
Where <path>/<to>/yd201_reco_139_testkeys_v01.img is the path you downloaded the image file to (e.g. ~/Download/yd201_reco_139_testkeys_v01.img)
On Windows:
copy the yd201_reco_139_testkeys_v01.img file to the folder with fastboot.exe (here assuming C:\android-sdk-windows\platform-tools, and D:\downloads as download location for the img)
* snippet below is fabricated, but you get the idea
Code:
D:\>C:
C:\>cd C:\android-sdk-windows\platform-tools
C:\android-sdk-windows\platform-tools>fastboot.exe devices
Should show a connected device in fastboot mode, then proceed:
Code:
C:\android-sdk-windows\platform-tools>copy D:\downloads\yd201_reco_139_testkeys_v01.img . [i]note the dot at the end[/i
C:\android-sdk-windows\platform-tools>fastboot.exe boot yd201_reco_139_testkeys_v01.img
Hopefully you see the screen go completely black after a few seconds, and recovery menu will appear. Like stock recovery, it will show an error (E:Cannot load volume /misc) but you can ignore that, along with the 'error' triangle icon that goes with it.
If booting fails with a signature error, the bootloader is probably not properly unlocked, try again.
Note that this recovery image could be flashed too (I haven't actually tried to flash yet), but if you're cautious (as we are in this post) you can just boot it every time you need it.
SuperSU flashing:
1) download Chainfire's SuperSU flashable zip from this page, filename is:UPDATE-SuperSU-v2.46.zip
2) Assuming you're still in custom recovery, otherwise boot into custom recovery again as outlined above
3) choose "apply update from ADB" from the menu (choose with volume up/down keys, confirm with power key). Recovery now waits for a file.
4) on the connected PC:
on Linux:
Code:
sdk/platform-tools$ adb sideload <path>/<to>/UPDATE-SuperSU-v2.46.zip
on Windows:
Code:
D:\>C:
C:\>cd C:\android-sdk-windows\platform-tools
C:\android-sdk-windows\platform-tools>copy D:\downloads\UPDATE-SuperSU-v2.46.zip .
C:\android-sdk-windows\platform-tools>adb.exe sideload UPDATE-SuperSU-v2.46.zip
5) on the phone you should see SuperSU installing.
6) reboot when done
7) if SuperSU app is not visible in launcher, download & install SuperSU from playstore.
To verify if rooting worked, start SuperSU. If that looks OK, start an app that requires root (like e.g. betterbatterystats) or use a simple checkroot app from the store. Reboot and check again if it persisted.
NOTE: you could also FLASH this image, replacing the stock recovery on the recovery partition permanently (until you flash again). Above we're just BOOTing it once, next time entering recovery in the standard way will just load the stock recovery from the recovery partition). You would use fastboot flash instead of fastboot boot above. Flashing is UNTESTED.
Problems & FAQ
Q: It doesn't work!!1!
A: Please provide plenty of detail about error messages, which step, what versions etc. Without providing any detail you'll look silly.
Q: I don't know how to <backup/adb/download/reboot/flash>
A: Please use the search button, xda forums have lots of info
Q: How can I tell if I'm in stock recovery or modded stock recovery? They look the same!
A: The Droid error icon with the triangle in the centre of the modded recovery screen has some white text (yd201_cr0.1), the stock one doesn't.
Future development
I hope that there are some devs out there willing to work on the YotaPhone 2 in the near future. I'll try to tinker a bit every now and then, but I cannot promise anything as I'm no expert. To enable proper development of custom ROMs and better recoveries (e.g. TWRP) it would be great if Yota Devices released their Kernel sourcecode for the kernel they use in their YotaPhone 2 ROMs. I know they have been asked to release sources before (and they should in order to comply with the GPL license), but so far without response.
Good news is that You Can Help! Please stimulate Yota to publish Kernel sourcecode for YotaPhone 2 through their support page (hint: choose 'sales' as category, otherwise you'll have to enter lots of details. Be polite!).
Info::
Mod by: SteadyQuad
Version: 0.1 based on YD stock recovery 5.0 1.39 EU
Thanks to: Yota Devices for a great device, Jeopardy for testing and suggestions, Chainfire for SuperSU
Created: 2015-06-10
Last Updated: 2015-06-20 (added warning about current inability to re-lock bootloader)
As SteadyQuad already mentioned, I can confirm that this method works.
Bye bye Google Newsstand! Goodbye Google Books!
(When uninstalling system apps Lollipop handles a bit differently from Kitkat, and I had to always restart the device after deleting.)
Thank you very much for your effort SteadyQuad.
Allelujah!
Thanks SteadyQuad for this great job! It works like a charm!
:good:
Anybody tried to install xposed module on rooted Yotaphone2? (alpha 4 modules)?
I think it little bit risky that's why I'm asking...
Or maybe somebody know how to make a full backup Yotaphone (like in CWM)?
Thanks in advance again for a really great job!
zencooler said:
Allelujah!
Thanks SteadyQuad for this great job! It works like a charm!
:good:
Anybody tried to install xposed module on rooted Yotaphone2? (alpha 4 modules)?
I think it little bit risky that's why I'm asking...
Or maybe somebody know how to make a full backup Yotaphone (like in CWM)?
Thanks in advance again for a really great job!
Click to expand...
Click to collapse
I haven't tried testing xposed yet, but am planning to sooner or later.
Running that custom recovery we do have root level access to everything, so it should be possible to create a backup from there with the help of a computer. Have to look into this.
the recovery download doesn't work.
EDIT : it worked on laptop
How about somebody can compile a TWRP recovery because Yotaphone has posted there SDK ?
So we can make Nandroid backup.
a question : if you can modify stock recovery,
can't you compile from TWRP source and yotaphone SDK a TWRP recovery for the yotaphone 2 users ?
just my 2 cents, i evenly willing to pay for it
Gojira-r32 said:
a question : if you can modify stock recovery,
can't you compile from TWRP source and yotaphone SDK a TWRP recovery for the yotaphone 2 users ?
just my 2 cents, i evenly willing to pay for it
Click to expand...
Click to collapse
I think if we all contribute to twrp and request them they might make us one
Sent from my YD201 using Tapatalk
Can the bootloader be re locked And can the root be removed for warranty purposes
Sent from my YD201 using Tapatalk
Yes
Fastboot oem lock
Gojira-r32 said:
Yes
Fastboot oem lock
Click to expand...
Click to collapse
If the recovery image is modified don't we flash back to stock before oem lock
Sent from my YD201 using Tapatalk
Good work. A pity Xposed framework isn't compatible yet.
Sent from my YD201 using XDA Free mobile app
dai75 said:
Good work. A pity Xposed framework isn't compatible yet.
Sent from my YD201 using XDA Free mobile app
Click to expand...
Click to collapse
Xposed framework isn't FULLY compatible, but many features already work. See SteadyQuad's thread here
adamo86 said:
Can the bootloader be re locked And can the root be removed for warranty purposes
Sent from my YD201 using Tapatalk
Click to expand...
Click to collapse
I haven't been able to re-lock it when I last tried (fastboot oem lock just hung). If anyone did succeed to lock, let us know! (Gojira-r32: did you actually execute the fastboot oem lock?)
I also failed to lock it back . I wanted to install the new update 1.44 that arrive in France but it failed at the recovery stage. E:Error in cache/update/yota....zip (status 7)
I did a wipe cache partition but not a wipe data as I don't want to lose all my settings. Anyone achieved to install the new Yota update version? And then root?
I just updated to latest update in UK. But I tried Kingo no success still.
Sent from my YD201 using Tapatalk
and the first post with flashing S%U tru modified recovery ?
is this firmware somewhere to download?
still not yet on yota FTP
Has anyone the stock recovery image? Maybe I'll achieve to get the OTA update after unrooting my YD201 with the original stock recovery firmware.
i am doing that right now, unroot, flash stock recovery, i have the OTA 1.1.44 pulled out of phone after download and will try to flash it
stock recovery, boot, sustem img, unrooted, everything tried
also got other build, fixed that.
now yotaphone is completly stock and get :
error in update zip "status 7"
so i think this update is no good, some faults in it, that's why we can't flash it yet, also chaged some things in OTA and resigned it etc... no good
Gojira-r32 said:
stock recovery, boot, sustem img, unrooted, everything tried
also got other build, fixed that.
now yotaphone is completly stock and get :
error in update zip "status 7"
so i think this update is no good, some faults in it, that's why we can't flash it yet, also chaged some things in OTA and resigned it etc... no good
Click to expand...
Click to collapse
Did you try to flash the OTA update via adb sideload in the modified recovery? I'm having the same problem.
Edit: I just tried to flash the update via adb sideload - no joy. I got the following error:
Package expects build fingerprint of YotaPhone/yotaphone2/yotaphone2:5.0/LRX21M/5.0.0-EU1.1.39:user/release-keys or Yotaphone/yotaphone2/yotaphone2:5.0/LRX21M/5.0.0-EU1.1.44:user/release-keys; this device has Yotaphone/yotaphone2/yotaphone:5.0/LRX21M/5.0
E:Error in /sideload/package.zip
(Status 7)
I also tried resigning the package with testkeys, but that didn't work either. Same error. So something has changed in the rooting process, because some people in the forum have managed to update normally, presumably on their nonrooted devices.
:good:
I have cm13 ported over from different Phone (Blu Life_Max) and booting.
already working
1. wifi
2. camera but not video camera
3. bluetooth audio
4. loud speaker audio
5. FM Radio
6. cell in sim1 and sim2 slot, but sim2 only gets H+ speed(5-10Mbps)
SIm1 gets 4G(LTE) speeds on test 50Mbps Both tests with freedomPop
known issue (mostly camera related)
1. videocamera causes camera crash
2. selfie-camera not available **Fixed with V6**
3. panarama shot crashes camera
4. NFC not able to turn on (stock rom did not have NFC, so this may not be possible to work) : next update may remove this **fixed in V5**
V7 -- Hassome permission changes in boot.img that were found in logcat, for "SMI"
still not working videocamera
To install:
1. Must be bootloader unlocked
.
How to Unlock Bootloader via Fastboot
1. Setup ADB and Fastboot on your PC.
2. Enable USB debugging and OEM Unlock on your Android device.
3. Connect your device to the PC with a USB cable.
4. Open a command window on your PC.
5. Boot your device into bootloader mode using the following command:
Code:
adb reboot bootloader
└ You may get a request to authorize USB debugging on the device, accept it.
6. Once your device is in bootloader mode, issue the following command to unlock bootloader:
Code:
fastboot oem unlock
You get a confirmation screen on your device. Press Volume Up button to highlight Yes and press Power button to select it.
This will begin bootloader unlocking process, which shouldn’t last more than couple of minutes.
7. Once bootloader is unlocked, your device will reboot into bootloader mode. You need to boot it into system now using the command below:
Code:
fastboot reboot
During reboot, your device will go through a factory reset and then finally boot into system.
2. Install included twrp(New kernel for recovery allows touchscreen to work)
***PRIOR RELEASES NEED TO USE LOPESTOM RECOVERY TO INSTALL***
Due to different moint point descriptions Future versions(If they come) will use block number moints to be compatible with both
******V-7-Block is compatible with both recoveries
1. make sure developer options is enabled
2. Reboot to bootloader
Code:
adb reboot bootloader
3. Test recovery works for your device
(example commands assume you have the vampirefo version of recovery downloaded to the desktop)
Code:
Fastboot boot Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
4. If recovery boots good, then return to bootloader and flash (commands work from in booted twrp)
These steps are what I find to be best order to prevent the stock rom from replacing the stock recovery on boot.
Code:
fastboot flash recovery Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
fastboot boot Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
adb wait-for-device
adb reboot recovery
3. If first install. do wipe and wipe system too. If Updating no wipe needed
Sources:
Rom not built for this device Built for Blu Life-Max --no thread to link, sorry
Rom uses the stock kernel, pulled from oem device (studio_XL_2)
keeping a git of files swapped to make rom work
https://github.com/mrmazakblu/BLU_Studio-XL-2_port_from_Life-Max
kernel source for recovery:
https://github.com/mrmazakblu/Blu_studio-XL_2_kernel_source
Other projects for Studio_XL_2:
Reserrection Remix Port
XDA:DevDB Information
blu-studio-xl-2, ROM for all devices (see above for details)
Contributors
mrmazak, Thanks to vampirefo --building donor rom
ROM OS Version: 6.0.x Marshmallow
ROM Kernel: Linux 3.10.x
ROM Firmware Required: BLU-Studio-XL-2--BLU_S0270UU_V09_GENERIC
Based On: Lineage OS
Version Information
Status: Testing
Created 2017-10-30
Last Updated 2017-11-30
New TWPR kernel
Reserved
TWRP touchscreen
new kernel for TWRP allows touchscreen to work when recovery is flashed to device.
thanks to @vampirefo for finding a fix for Life-Max. Same fix worked here too.
New kernel is also put into @lopestom twrp.
Choose either one they both work.
Thanks for porting. I'm looking forward to testing it with my Studio XL2
killer13666 said:
I tried flashing it like you said and this is what happened....
Code:
Installing zip file '/external_sd/BLU_Studio-XL-2_port_from_Life-Max-V-7.zip'
Checking for MD5 file...
Skipping MD5 check: no MD5 file found
I:Update binary zip
I:Zip contains SELinux file_contexts file in its root. Extracting to /file_contexts
I:Legacy property environment initialized.
Target: Blu Studio XL 2
Target: Blu Studio XL 2Check if system is already mounted
Check if system is already mountedcould not detect filesystem for /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system, assuming ext4could not detect filesystem for /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system, assuming ext4
mount: failed to mount /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system at /system: No such file or directorymount: failed to mount /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system at /system: No such file or directoryRunning backup script for update installsabout to run program [/tmp/install/bin/backuptool.sh] with 2 args
Running backup script for update installs
run_program: child exited with status 127
unmount of /system failed; no such volumeChecking if Data is compatableunmount of /system failed; no such volume
Checking if Data is compatable
about to run program [/tmp/install/bin/otasigcheck.sh] with 1 args
You have an installed system that isn't signed with this build's key, aborting...
run_program: child exited with status 124
script aborted: Can't install this package on top of incompatible data. Please try another package or run a factory reset
Can't install this package on top of incompatible data. Please try another package or run a factory reset
Updater process ended with ERROR: 7
I:Legacy property environment disabled.
I:Install took 14 second(s).
Error installing zip file '/external_sd/BLU_Studio-XL-2_port_from_Life-Max-V-7.zip'
Updating partition details...
Click to expand...
Click to collapse
Do not know why you have failed to mount /system error could be because you have /system set to be read only.
In install directions it says need to wipe /data
and
also advanvance wipe /system
second error says imcompatable /data == this means you did not wipe data before installing.
Please continue here in the rom thread.
mrmazak said:
Do not know why you have failed to mount /system error could be because you have /system set to be read only.
In install directions it says need to wipe /data
and
also advanvance wipe /system
second error says imcompatable /data == this means you did not wipe data before installing.
Please continue here in the rom thread.
Click to expand...
Click to collapse
I figured out what the problem was. For some reason, the recovery image you supplied wasn't mounting the system partition properly. I used a different image and the ROM flashed perfectly
killer13666 said:
I figured out what the problem was. For some reason, the recovery image you supplied wasn't mounting the system partition properly. I used a different image and the ROM flashed perfectly
Click to expand...
Click to collapse
please let me know which one worked for you and which one did not.
I think I was using the one marked 3.1.1 (vampirefo) but now I am not sure.
I may do independet testing again on both, but would appreciate your input.
Just confirmed there is a problem with the combination of the update-binary used in these install zips and the vampirefo recovery. The fix can be either i use different update-binary file or you use lopestom recovery.
**EDIT**
Problem was with the my updateer-script. I put fixed install packages up.
Thanks for the port my version is v06.0.04.00_generic 16/06/2017
I have a unlocked phone from best buy
I keep seeing everyone say v09 mine has updated twice wondering if it will work on mine or if I need to update somehow
ahnuts72 said:
Thanks for the port my version is v06.0.04.00_generic 16/06/2017
I have a unlocked phone from best buy
I keep seeing everyone say v09 mine has updated twice wondering if it will work on mine or if I need to update somehow
Click to expand...
Click to collapse
I dont see any version of my stock OS that is similar to that number you have.
When I had stock installed, In the settings screen, about phone listed the build version as
Code:
BLU_S0270UU_V09_GENERIC
This port is for Blu_Studio_XL_2 make sure that is device you have.
If you look in the build.prop you will get more information about the device.
if you want to , you can pull the build.prop and post it , so I can see
Code:
adb pull /system/build.prop Desktop\build-prop.txt
then attach the file here.
According to the device in about phone mine is studio xl 2 and that was what the box said when I purchased the phone at best buy
And this one shows the version
And this one shows the version
Wrong pic
ahnuts72 said:
Wrong pic
Click to expand...
Click to collapse
The dates show it is a newer software than what I had, but this should still work, as long as you are still able to unlock the bootloader.
In the developer options I have a setting that says oem unlocking allow the bootloader to be unlocked will that work or will I have to still do it from adb
ahnuts72 said:
In the developer options I have a setting that says oem unlocking allow the bootloader to be unlocked will that work or will I have to still do it from adb
Click to expand...
Click to collapse
here is guide.
https://www.theandroidsoul.com/unlock-bootloader-via-fastboot-android/
the unlocking does do a complete wpe on the data part of the phone. so if you have pictures or music or any files you want to keep , make sure to copy first. Also to be safe , if you have external sdcard in , take it out before doing unlock
****
****
Must complete the unlock as the guide shows includeing the reboot, so stock recovery does its wipe, I t is important part of the unlock.
**
**
after unlocked,
to flash recovery, enable developer options again, enable usb debugging. authorize adb connection to your pc-
Code:
adb reboot bootloader
fastboot boot recovery.img
**recovery.img = "full path to the downloaded recovery"
**example if you downloaded the vampire based recovery and you downloaded to the desktop**
Code:
fastboot boot Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
after booted to recovery and it works return to bootloader and flash it to phone. I allways recomend this boot first method to verify it recovery works. You cant be certain every od will work on every device. Better safe than sorry.
select reboot menu from recovery and then select reboot bootloader.
Due to a securety measure android has (recovery-from-boot) when replacing recvoery to need to boot directly to new recovery to prevent the android system from replacing it with stock version. so I use the steps below
Code:
fastboot flash recovery Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
fastboot boot Desktop/recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img
adb wait-for-device
adb reboot recovery
.
Android 6 or 7, plus install questions
Hi, I have rooted several phones but the procedure keeps getting more difficult. I see the instructions for installing recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img but I am curious what is on this image .... will it be rooted and if so, what version of Android is bundled? Will the phone then support Xposed and Xprivacy?
From what I can determine, the video camera is not working with your most recent release, V8, is this correct?
Thank you for your assistance!
Donphillipe said:
Hi, I have rooted several phones but the procedure keeps getting more difficult. I see the instructions for installing recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img but I am curious what is on this image .... will it be rooted and if so, what version of Android is bundled? Will the phone then support Xposed and Xprivacy?
From what I can determine, the video camera is not working with your most recent release, V8, is this correct?
Thank you for your assistance!
Click to expand...
Click to collapse
LineageOS 13 is android 6
there is no V8 only upto V7
video recording does not work
Lineage has root built in. Enable it in developer options
I do not know about xposed I not use it
Donphillipe said:
" I see the instructions for installing recovery-TWRP-3.1.1-Vampirefo-studio-xl-2.img but I am curious what is on this image "
Click to expand...
Click to collapse
That image is TWRP recovery only
I have not been working on this anymore.
I have ported "better" Resurection rom based on android 7 , have been using it as a daily use phone for just over a month now
https://forum.xda-developers.com/android/development/-t3699638
I appreciate your patience with someone who only dabbles in this hobby. When you say that the install image is TWRP only, what exactly does this mean?
I know I have owned several BLU phones and each time I tried to install a high-end recovery tool in the past, the list of supported phones on the recovery software list would never include my BLU device, saying something to the order of the source needing to be recompiled (as I recall) or something to that order which never seemed to happen. So are there additional steps for getting the phone to the point it will take this image other than the steps you outlined for unlocking the boot loader? Or what do I need to be aware of?
Also, do you have a backup of the factory image available in case something goes wrong, with basic instructions on how to recover the phone back to the factory version? Or is there something I can install or do on this phone to create a backup copy on my own?
Again I am sorry to have to ask for what to some appears a simple procedure. I do appreciate your going to the effort when you have already contributed so much with your images. Thank you!
Donphillipe said:
I appreciate your patience with someone who only dabbles in this hobby. When you say that the install image is TWRP only, what exactly does this mean?
I know I have owned several BLU phones and each time I tried to install a high-end recovery tool in the past, the list of supported phones on the recovery software list would never include my BLU device, saying something to the order of the source needing to be recompiled (as I recall) or something to that order which never seemed to happen. So are there additional steps for getting the phone to the point it will take this image other than the steps you outlined for unlocking the boot loader? Or what do I need to be aware of?
Also, do you have a backup of the factory image available in case something goes wrong, with basic instructions on how to recover the phone back to the factory version? Or is there something I can install or do on this phone to create a backup copy on my own?
Again I am sorry to have to ask for what to some appears a simple procedure. I do appreciate your going to the effort when you have already contributed so much with your images. Thank you!
Click to expand...
Click to collapse
The recovery image (TWRP) works for this device.
Yes recovery images, just like android roms are specific to each different device. This one has been edited to work for Studio XL 2
The TWRP is a custum recovery needed to install the custom ROM
The steps are complete, you shouldn't need anything else (need adb and fastboot)
Yes stock recovery image is available. Installing back to stock recovery is same steps as installing custom recovery.
both can be done as described with fastboot. Or both can be installed using SPFT (smart phone flash tool)
I dont take responsibility for possible damages!'
1. When you unlock the bootloader, all your data will be erased!
2. When you try to lock the bootloader, your data will be erased and you will lose the API.
3. YOU CAN RECEIVE OTA UPDATES WITH THE BOOTLOADER UNLOCKED!
Download the tool: https://forum.xda-developers.com/mi-a2/how-to/mi-a2-toolkit-unlock-bootloader-root-t3834585
1. Unlock the bootloader (I will not go into detail, the tool is intuitive, follow the tool's instructions!.)
2. Start your phone and enable USB debugging.
3. Put your cellphone in Fastboot.
4. In the tool, use option 4 (This will not install TWRP, just start) (follow the tool's instructions!)
5. When entering TWRP, if prompted, check "Keep system read only".
6. Open in the tool folder "Open CMD here"
7. Run the command: adb shell
8. Now enter the following command: "setprop persist.camera.HAL3.enabled 1" without quotation marks, and enter. - This command enables the required core API for GCAM.
9. Now type "exit" to exit adb.
10. Go back to the phone, in TWRP -> Reboot -> System -> Do Not Install
Ready.
I did this tutorial quickly. Any questions, use the comments!
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
kaiwanted said:
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
Click to expand...
Click to collapse
The tool just has the August picture. But the functions used for the gcam works in the September patch.
Yes. I have.
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
asuturo said:
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
Click to expand...
Click to collapse
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Rafaelboxer said:
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Click to expand...
Click to collapse
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
This command should tell you which slot is active:
fastboot getvar current-slot
ki69 said:
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
Click to expand...
Click to collapse
I got the september boot.img from another topic and rooted
Still no working solution for the ones that have setember update, and don´t want to root or use magisk??? I think the problem is that TWRP does not work with september update. Any easy way to downgrade to August again??
I'm thinking of installing Camera2API/GCamera, but I wonder if it's worth it. What are the real benefits? Does this make the camera compatible with more applications (eg Snapchat), avoiding them from making a screen of the camera ?
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
ricardohnn said:
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
Click to expand...
Click to collapse
If you did a search on that 'persist' command, you'd find that it does persist, to many of the tables that type of information is stored in. It does not change the info in the properties file in 'System'. It does change the 'Data' partition, but that's okay, as there's only 1 of those (used no matters which slot boots up). The reason for booting on the non-active partition is a twrp / dual slot phone type of thing. I know it works as I've done it, but the 'setprop persist' changes the one and only Data partition, which both slots use, that's why it works.
ricardohnn said:
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
Click to expand...
Click to collapse
I thought the patched image would have some su capabilities also, but it doesn't. It only installs the Magisk stub, which you can further install magisk from. Magisk is a great and sophisticated app. Has numerous Magisk modules which do a wide variety of things. But if you don't need any of those things, and don't need root, it's pretty over the top for just setting the cam2api, imho.
ricardohnn said:
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
Click to expand...
Click to collapse
If you change 'System' directly you will not get any OTA updates, so yer right, don't change that. There's no need to consider changing it anywhere else, as the 'setprop persist etc' command populates all the tables for you. 'System' is not affected and OTA updates will continue. There's no removing Magisk, restoring boot image, reinstalling etc etc etc.
One thing I would warn others about, using the various 'Tools'. You don't know what commands they are running, so you can't be sure what they will do. I say that because one of the tools I recently downloaded and went through and found the commands in it. The first thing it did after booting TWRP was to mount 'System' as Read / Write!! Why does that matter? From what I've read, doing that stops OTA from happening. Just mounting it R/W will change the date stamp on it concerning modifications, and that's all the OTA needs to know to say 'it's been modified'.
good luck, cheers
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
ricardohnn said:
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
Click to expand...
Click to collapse
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
AsItLies said:
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
Click to expand...
Click to collapse
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
minnuss said:
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
Click to expand...
Click to collapse
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
About the setprop, even after the reboot isn't returning the prop, so that's why i am not sure if it is actually keeping it after twrp boot.
About the AB partition... well...
it's more or less like this...
let's say some simple partition scheme....
Preloader
Boot
System
Vendor
ODM
Data
So the phone will probably have many boot images type... like the usual boot.img or recovery.img (before treble) etc.
The boot.img will have the kernel image bla bla bla... since this is a google update, i believe that the AB partition procedures starts here (meaning all the relevant code of checking whether is A or B)
Google wanted to make things faster for the OEM (Samsung, LG etc) so they wanted to separate their ****s from google's one.
So (if things didn't change) you will have the following partitions now (actually i am not sure if they kept the system AB, but i believe so, since it seems to be working in other phones like that )
BootA
BootB
SystemA
SystemB
VendorA
VendorB
OEMA
OEMB
Data
So let's say google wants to update some security patches, from kernel til android, it will have to update boot and system. So in a OTA (changes if it is a google phone or a branded phone) before treble, it would update like... download the image containing boot and system into cache partition or data partition (depending the OTA size), after the download the update manager apk would set as a update booting and reboot your phone. Once booted, the phone would copy the partitions to the correct place (not being detailed) and rereboot. After the rereboot, if everything went normal, it would delete the downloaded image from your data/cache partition.
Now it's different like... instead of sending the update to the data partition and copying. It has a flag to set whether you are in A or B partition.
If you are (for eg.) in A partition, it will download the OTA to the B partition. (consider that in an untouched phone, A and B would have identical copies). So after downloading it, the flag is set to the B partition and reboot the phone. When booting, this time, it will not follow the A booting flow, like...
Before the update booting process would be
BootA
SystemA
VendorA
ODMA
Data
After the update the boot process will be
BootB
SystemB
VendorB
ODMB
Data
But i didn't update the vendor or ODM... why not keep in A? Because it's too hard to manage it.
So if anything fails in this update, it can easily go back into A booting process (which means you have a backup of your old boot).
Since system is too big, i am not sure if the system AB exists (it would just take up too much space... but anyway...).
It is also not a way to prevent bootloop, it is related to update. If an update fails (say, the image is corrupted or has no signature etc) the boot will change back, but if the update is "correct" it will boot as it should, even if the image is bad.
So again... when we do the fastboot boot boot.img, we are copying this boot into some cache or data to boot up, instead of our original boot. When we reboot, it will use the original boot. So, is there a difference from using twrp flashed and booted?
I know that fastboot boot will trigger different booting process (meaning signatures verifying etc) but don't think that it will not mount a partition or something...
Well... anyway... so after the reboot, when you setprop in TWRP, the getprop returned the prop correctly? I recall something about getprop not returning the prop but camera2 was enabled anyway with the setprop... well... can you just confirm one thing for me?
The steps you used was... fastboot flash patchboot and then reboot into twrp and then reboot back to usual partition.
You didn't do fastboot boot patched boot -> twrp -> reboot
Right?
---------- Post added at 09:44 AM ---------- Previous post was at 09:42 AM ----------
AsItLies said:
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
Click to expand...
Click to collapse
Oh didn't see this one. OK...
Damn... hmm... strange... well thanks anyway...
---------- Post added at 09:50 AM ---------- Previous post was at 09:44 AM ----------
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
Oh by the way, i saw one part
"But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images. "
I think this is wrong (at least if TWRP team didn't change stuff), but all images are bootable images... (by all images i mean... boot.img recovery.img Flashing.img).
I once thought that they used a common kernel image, but in fact, all the booting process image has the kernel image copied (literally) to prevent brick. So even with a corrupted boot img, you still can boot into recovery or into download mode.
So that's why TWRP must have a kernel.
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
AsItLies said:
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
Click to expand...
Click to collapse
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
ricardohnn said:
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
Click to expand...
Click to collapse
What version of TWRP did you use, there is now two versions, I used last one, from a few days ago, and in first try I did manage to boot from fastboot, not flash it, but ADB did not worked.
So, if adb did work for you, maybe it was earlier version ?
Anyway, as you say, it is not permanent setprop, maybe because the twrp is not stable one, or maybe it needs to be flashed to work, not just booted.
I personally do not have doubts that this tutorial works, I just did not want to flash twrp. :good:
Red Magic 5G Bootloader Unlock Guide: OR get ROOT & TWRP without unlocking the BL!!!
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
WARNING: ANY BOOTLOADER UNLOCK METHOD INVOLVES THE RISK OF BRICKING YOUR DEVICE PERMANENTLY. WHILE THERE IS USUALLY A WAY TO RECOVER, DO NOT ATTEMPT THIS PROCEDURE IF YOU DO NOT KNOW WHAT YOU ARE DOING. BAD THINGS CAN HAPPEN. YOU HAVE BEEN WARNED!!! YOU MAY BE LEFT WITH A USELESS BRICK!!! READ ALL FURTHER WARNINGS EXPERIMENTAL METHOD IN ORIGINAL DOWNLOAD FILE WORKS, I'M USING IT
If you want a NOOB guide look at this post: https://forum.xda-developers.com/nu...beginner-tutorial-unlock-bootloader-t4131585/
Also note a user has managed to fix the FP sensor post BL unlock, see this post here: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
Still, I suggest root bypass it's better.
MegaNZ Link for Root without unlocking the Bootloader, and without breaking the FP, also includes instructions for installing BlackMagic5G (explanation below), adding HD VOLTE, how to restore from a brick, and some other cool tricks: https://mega.nz/file/igphSCTD#OybJo9t1zwvJ0bdbAcN2BCqxWXAfHdhk3JFB4_5xkVc
I suggest you flash my BlackMagic5G and don't unlock your bootloader at all - just root. It's CN 2.52 ROM based. You'll get VOLTE, , GApps installed, Rooted with Magisk, TWRP, debloated, YouTube Vanced, AdAway, SmartPack Kernel Manager, etc. - looks like the Global / NA variant of the ROM. Almost perfect except still uses Messages and Phone from Nubia. Plus you will enable Face Unlock not available in the Global or NA versions of the ROM, and FP will still work! Click on the Google Search bar widget and the mic icon takes you to the Google Assistant, the left icon is Google Feed, type in the middle bar for a Google Search. Has 1Weather Free weather widget that looks great, and Google Calendar widget for your whole month of activities. Translate, Lens, Chrome, all the Google Apps are there. And the Chinese Nubia apps are nearly all GONE!
MegaNZ Link for BlackMagic5G Beta - IT'S ONLY THE DATA PARTITION + ROOTED KERNEL + NA SPLASH SCREEN, you NEED to 1) install the Red Magic 2.52 ROM below FIRST 2) Root using the first link posted above 3) Flash restore this from TWRP: https://mega.nz/file/r9hF2BwS#RrAXiFWSBNX8dLqfrH8nNHo_uigPC8uYXonwhALhGbo
MegaNZ Link for the Red Magic 5G CN 2.52 ROM: https://mega.nz/file/aoxBFAqY#EDt2OZBGTME4ZGKnERKpK_t-aJT_rWgD0aqBFkilRcY
*** NOW THE BOOTLOADER UNLOCK INSTRUCTIONS ***
Go to Settings / About phone / Build Number (NX659_J_ENCommon_V3.08 on North American Variant), click 7 times, Now you are a developer message appears, go back a menu to Settings / Other system settings / Developer options.
Enable:
OEM unlocking "Allow the bootloader to be unlocked"
USB debugging "Debug mode when USB is connected"
Install Minimal ADB and Fastboot (Windows 10 in this example): https://www.androidfilehost.com/?fid=746010030569952951
Default install path is:
C:\Program Files (x86)\Minimal ADB and Fastboot\
Go to the Search button on the bottom on Windows 10, type cmd, Command Prompt will appear in the menu. Right click it and Run as Administrator. All commands to be typed will be run in this Command Prompt window (referred to as terminal) unless otherwise stated to run on the phone.
Now Terminal window appears (it says Administrator: Command Prompt in the heading):
Text displayed is:
Microsoft Windows
(c) 2020 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
Typed in terminal:
cd "c:\Program Files (x86)\Minimal ADB and Fastboot"
I now connected the phone to a USB port on the PC.
On the phone, a Window appeared:
"Allow USB debugging?"
The computer's RSA key fingerprint is:
[36 digit code] Example:
C8:A17:E2:01:F6:A1
:368:10:E8:33:20:FB:
93:7D
Always allow from this computer (it's my computer so I clicked it since I trust the computer)
CANCEL / ALLOW (I clicked ALLOW)
Typed in terminal:
adb reboot bootloader
The phone reboots. Once the phone screen boots, in the center it says: Now you are in fastboot mode.
From the terminal I typed:
fastboot oem nubia_unlock NUBIA_NX659J
The terminal now displayed:
...
(bootloader) START update nubia fastboot unlock flag!!!
(bootloader) START set state to 1 ok!!!
In the terminal I typed:
fastboot flashing unlock *** DO NOT TYPE THIS IF YOU WANT TO KEEP A WORKING FP!!! READ TOP OF POST!!! AVOID THIS WITH THE EXPERIMENTAL METHOD OF ROOT WITH NO BL UNLOCK ***
Now a screen appeared on the phone with a big <!> red icon in the left corner. The rest in white text is a warning message. "By unlocking the bootloader, you will be able to install custom operating system on this phone. A custom OS is not subject to the same level of testing as the original OS, and can cause your phone and installed applications to stop working properly-
Software integrity cannot be guaranteed with a custom OS, so any data stored on the phone while the bootloader is unlocked may be at risk.
To prevent unauthorized access to your personal data, unlocking the bootloader will also delete all personal data on your phone.
Press the Volume keys to select whether to unlock the bootloader, then the Power Button to continue."
I selected UNLOCK BOOTLOADER and my device was completely erased. The factory OS loaded then. This process takes some time to complete.
Now the device rebooted with a warning message, and a big <!> yellow icon in the left corner.
"The boot loader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device.
Visit this link on another device:
g.co/ABH"
Now the device reloads the firmware apparently and wipes all user data. Upon setting up the phone, the fingerprint display registration comes up and asked to place my finger on the back of the phone. There is no fingerprint sensor on the back of the Redmagic 5G! It is under the screen! So this step must be skipped. The ROM setup is corrupt or incomplete, a beta possibly. I setup the phone then went into Settings / Security to try to add a fingerprint. The button to add fingerprint then appears. Once I click the button, I get this error:
Loss of fingerprint calibration data
Loss of fingerprint calibration data was detected.
Currently unable to complete fingerprint entry,
please contact Nuia after-sales service via
4007006600
See the XDA post for recalibrating the FP: https://forum.xda-developers.com/nu.../guide-calibration-finger-print-loss-t4132961
ROOT FOR ALL DEVICES:
(These files are included in the tools download zip, Magisk 20.4 and MagiskManager-v7.5.1.apk, but this is the official source as updates post): Go to XDA and Download Magisk Manager and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power, release the power button once the screen shows it loading, hold the volume up down until you see TWRP pop up). Flash Magisk from TWRP Install / Zip / sdcard / Magisk.zip reboot and you'll have root.
BL unlock first method was tested on North American variant and it works. But it breaks your FP sensor and gives you an annoying boot prompt.
If at any time you want to remove the OEM Bootloader unlock, you plug into the PC, go to the terminal for Minimal ADB and Fastboot, type:
adb reboot fastboot
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing lock (screen will prompt to relock BL, choose to Relock)
The phone should reboot and install the original software. BUT...
If it says you are corrupted well, you have more issues.
You'll have to reflash the stock recovery.img, reboot to stock recovery, wipe data, wipe cache, and flash the CN update.zip rom to a flash drive FORMATTED TO FAT32 (annoying as hell) But you NEED a USB-C to OTG Adapter to attach a Flash Drive / SDCARD this way). If you don't have one, you better reflash TWRP using the prior instructions and flash the update.zip from there. Install, select the update.zip, flash. Wipe Data, Cache, ART/Dalvik. Reboot.
Now it should WIPE the entire phone and be back to normal Android 10 setup non rooted, no unlocked bootloader. Always beware of data loss doing root functions!!! Always be prepared to setup your phone entirely over again. Google Backup is very good to turn on before you do any of this stuff if you have already installed apps.
*** WARNING - THIS BYPASS METHOD COULD GO AWAY AT ANYTIME. IT SHOULD EVENTUALLY BE FIXED BY NUBIA ***
mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse
You were able to actually install TWRP? Not just boot it? I thought A10 devices cant have twrp permanently installed?
That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.
mslezak said:
That is a very good question my friend. I had to reflash it several times while rooting so it appears you are correct.
Now a window when I FIRST installed popped up and said make Recovery read only so a system update. can't overwrite it, to this I didn't even pay attention. So assuming that question does lock down recovery, it should stick.
Click to expand...
Click to collapse
So its not permanent? Thats what I thought.
Well it could be permanent...
VZTech said:
So its not permanent? Thats what I thought.
Click to expand...
Click to collapse
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.
mslezak said:
What I was trying to say is that I've never had a phone where I had to select "prevent recovery from being overwritten" so I just clicked off the message. Had I selected "keep TWRP from being overwritten" then possibly it sticks. It's just a matter of making the recovery partition READ ONLY.
Click to expand...
Click to collapse
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Can anyone send me backup of the super partition?
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Future updates...
VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
Yes what I've been told by prior Redmagic Users 3 and 3S is the ROM is released, as long as your boot.img is not patched with Magisk, it can be installed through the menus in Settings / About Phone / Update or someplace like that. You just download the ROM to the appropriate folder on the phone.
So far I have 1 link to a China ROM update here: https://ui.nubia.cn/rom/detail/65
Now on how to install the ROM, I use the Chrome browser set to autotranslate webpages. Most of the Chinese will be translated from here: https://bbs.nubia.com//thread-1136030-1-1.html
Basically it's going to wipe your device clean, and you can use a Nubia backup tool which will save all your items to a folder. Which then you should copy to your PC before installing the new ROM. Then it gives you instructions to get that data back onto your updated device.
apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.
VZTech said:
Your probably screwed. I had this issue on a rm3s. You will need an unbrick tool. It was released for the rm3s about 4 mos after release. NUBIA should have true fastboot images available for download, but they dont.
Click to expand...
Click to collapse
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---
apersomany said:
I accidentally flashed an image to the super partition with twrp thinking it was the system partition (it technically is tho) and it bricked my phone and messed up twrp.
Only stock recovery works but the stock recovery cannot fix it by installing a full ota from a otg drive.
I do have a backup on my phone but it is inaccessable.
Could anyone please send me a backup of the super partition or have any idea on how to fix this?
(I tried to use edl and backup my data to recover my backup of the super partition but it seemed like it needed a programmer binary from qualcomm)
Click to expand...
Click to collapse
You should be able to flash the latest ROM via EDL mode if you've ever used EDL mode before, it usually requires shorting pins together in the device, although some recoveries will let you just boot into EDL mode if the phone still boots. It will be detected. Although on this device with the dynamic partition, I don't know how you would flash these in EDL mode... dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm that do not look like fastboot flashable parts. Possibly the unbrick tool for Redmagic 3/3S could be modified to do this for you.
mslezak said:
That's because of the super (dynamic) partition, see from the latest (and only) ROM:
Excerpt of the ROM installation script where it delineates the dynamic vs non dynamic partitions - you have product w/ a file transfer list, then vendor, system, and odm, The other files (boot.img, dtbo.img, splash.img, etc. and other various files) should be flashable with fastboot.
# Update dynamic partition metadata
assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
unmap_partition("product");
block_image_update(map_partition("product"), package_extract_file("product.transfer.list"), "product.new.dat.br", "product.patch.dat");
unmap_partition("vendor");
block_image_update(map_partition("vendor"), package_extract_file("vendor.transfer.list"), "vendor.new.dat.br", "vendor.patch.dat");
unmap_partition("system");
block_image_update(map_partition("system"), package_extract_file("system.transfer.list"), "system.new.dat.br", "system.patch.dat");
unmap_partition("odm");
block_image_update(map_partition("odm"), package_extract_file("odm.transfer.list"), "odm.new.dat.br", "odm.patch.dat");
# --- End patching dynamic partitions ---
Click to expand...
Click to collapse
Yes those .img files can easily be fastboot flashed. Unfortunately it wont solve his problem. He needs the nubia unbrick tool, which is tough to get. I dont understand why Nubia makes things difficult. They should provide proper Fastboot files.
I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.
apersomany said:
I already tried edl (not to flash, but to recover my backup of the super partition) but it seems like it needed a firehose binary. I still can use bootloader, fastbootd, recovery. It's just that the recovery fails at assert dynamic partition update thing with a error 7 (probably because my super partition turned into a normal partiton). I tried to flash a super empty image made with lpmake and try flashing the ota but that didn't work. I think if someone gives me a backup of the super partition I could flash that and that could work. I also had an idea of flashing a super partition of another devices factory image to make my super partition a dynamic partition, but I couldn't find any online.
Click to expand...
Click to collapse
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.
mslezak said:
I get a Global Device on Monday. I'll try to use Qualcomm tools to make a brick restore image of Global. If I get one made I'll post all the tools to restore the device on Mega.nz. Because of the super partition it has to be done this way. Not via TWRP as you know. I'm working on Dev tools for this device as fast as possible.
Click to expand...
Click to collapse
Thank you so much!
Okay I can't add anything special but daaamn this community is amazing. So much help I love you all
To relock BL repeat the instructions with 1 different command
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
mslezak said:
{Mod edit}
***Bootloader Unlock Instructions for the Nubia Redmagic 5G + installing TWRP:***
Settings / About phone / Build # click 7 times, now your a dev message appears, good back a menu, go to Additional Settings / Developer Options
Enable:
ADB debugging, + OEM unlock
Connect phone to PC, approve device on phone RSA key for USB debugging
From Minimal ADB and Fastboot:
adb reboot bootlader
fastboot oem nubia_unlock NUBIA_NX659J
fastboot flashing unlock
(approve on phone with volume keys to unlock and hit the power button, now you'll get an annoyng mesage on boot as insecure unlocked BL) *ALL YOUR DATA WILL BE WIPED*
Next:
fastboot flash recovery recovery-TWRP-3.4.1B-0324-NUBIA_REDMAGIC_5G-CN-wzsx150.img
fastboot reboot recovery
Enter TWRP, set to not be removed by updates if prompted.
Boot up the device, setup as a new device. You're on stock ROM / kernel now unlocked.
Once you get up and running you'll want APK Mirror app to install stuff on the China Variant it's in the Nubia Playstore. Gboard download as well and set as default it's a lot easier than the Chinese keyboard that swaps between Chinese and English. Set size extra tall for this huge phone (I prefer anyhow). Chrome go download it from APK Mirror app as well. Then go to XDA and Download Magisk Manager and download it and install the APK. Download the latest Magisk as well from the Manager. You can then reboot to Recovery (volume up + power). Flash Magisk from TWRP reboot and you'll have root.
Note on my testing the fingerprint did not work after unlocking the bootloader. It says to contact Nubia support at some odd number. Hopefully they fix this.
Click to expand...
Click to collapse
Just in case if somebody need a Chinese version of official ROM v2.46 for RedMagic 5G.
Code:
https://mega.nz/file/vc0DiabR#npahTop-JXZ9Mwv-lA7G6DxTG2qqOOAf6AwW8NdEEKw
mslezak said:
Just replace
fastboot flashing unlock
with
fastboot flashing lock
Again you approve to lock on the phone prompt with the volume keys and your phone will be wiped and all will be back to normal, you'll be locked. And back to phone setup.
I'd edit the original post but the moderators took away my rights!!! Because I posted a Telegram link WHY - how do you expect development to get better???
BTW anyone with a NEW phone arriving that can record the FP failures and all errors please contact me so I can send to Nubia. They are waiting for me to reproduce the error but I already setup my new phone... Thinking I wouldn't be the ONLY ONE to contact [email protected] ... Guys you want developer support on this phone or not. Contribute please.
Click to expand...
Click to collapse
we found out that using the cn rom it all works without even unlocking the bootloader, even while oem unlock was disabled in dev options but there is some kind of vbmeta img required. a full guide is incoming.
VZTech said:
The issue with that could be any future updates though. Rm uses there own recovery for that. They don't provide fastboot images either I believe
Click to expand...
Click to collapse
You can flash their NX659J-update.zip files directly from TWRP that's how we restored our bricked devices already. So OTA updates no, but you can download them anyway and flash from TWRP directly. Yes we have to figure out a concrete restore method which isn't 100% working yet. I.e. all your data is lost this way apparently AT THIS MOMENT... MORE TO COME.
Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
LaikaXv1 said:
Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Click to expand...
Click to collapse
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
I'm glad to see that there is finally a root solution for this device. I have 2 Onn 8 first gen, Android 9 tablets and I use the Magisk module: Universal SafetyNet Fix to
pass.
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Let us all know if this works. I work in a Walmart electronics department and have not bought one of the 2nd gen devices because I had assumed that it could not be rooted. I am temped just for a new challenge, even though I really don't need a new device.
Have you been able to create a backup of the stock rom? Is it flashed with spflashtool like the older device?
Thanks
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
Ah, I didn't hit reply. Oops!
I'm not new to XDA persay, but I'm not usually the one making guides and actually saying things haha.
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Boox17 said:
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Click to expand...
Click to collapse
It sounds like maybe you did not unlock the bootloader first?
martyfender said:
It sounds like maybe you did not unlock the bootloader first?
Click to expand...
Click to collapse
Yeah exactly what it was
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
I'm stuck in a boot loop. Does this work with a 100011885 that has Android 11 or did I just brick it cause I didn't pay attention.
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
bowb said:
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
Click to expand...
Click to collapse
Did you get this working?
Valiante said:
Did you get this working?
Click to expand...
Click to collapse
No.
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
did you happen to upload this image yet? if so, got a link?
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
pj_dev said:
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
Click to expand...
Click to collapse
Unfortunately, the numbers are important. Are you able to get to fastbootd? If you can get to fastbootd, I would recommend trying to change to boot slot. Newer androids actually have two boot partitions for updating purposes. You can check which boot partition you're using with `fastboot getvar current-slot` which should return "a" or "b". Then do `fastboot set-active x` and replace x with whichever slot is NOT active as determined by the previous command. If the other boot slot is still intact, this would hopefully result in a bootable device. I haven't tried this myself, but this is what I would try if I were in your situation.
If this doesn't work, I would try flashing stock with sp flash tool, which doesn't need fastboot if you can't access that. It's a leaked mediatek tool, so there isn't an official site to get it from unfortunately. I got it from here: https://androidmtk.com/smart-phone-flash-tool but use your discretion. And get v5, because that's what most of the guides use. Then you can try flashing the 3561 stock firmware here: https://forum.xda-developers.com/t/stock-stock-backups-images-otas.3998227/post-82619259
If you can get it to boot at this point and want to de-walmart it, I would recommend just flashing a GSI rather than messing around with the stock rom. You can find the GSI's here: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list
LaikaXv1 said:
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
Click to expand...
Click to collapse
Lol, remember those copy-pasted guides where they provide the wrong TWRP images and it messes up the device
So the 8" Onn actually has a boot-ramdisk it appears. On the 7" Onn Surf (100005206), there is no boot-ramdisk, so the alternative is patching a recovery.img and allowing Magisk to hijack the /recovery partition. The only drawback is, anytime you need to reboot, using hardware keys as though booting into recovery is necessary.
inzane105 said:
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
Click to expand...
Click to collapse
I'm in a similar situation, my friend got an RCA Atlas 10 Pro-S from Goodwill for $1. It had an FRP lock on it though, and we ultimately managed to get to the home screen by enabling TalkBack and watching the support video to open the browser. Then, we installed Lawnchair to access the home screen. The settings app worked, but Developer Options would not open.
GetDroidTips has published a software called Miracle Box, claiming that it can unlock MediaTek bootloaders, as well as bypass FRP. However, a VirusTotal scan indicates that it is likely malware. I tried running it in a virtual machine and it asked if I wanted to run a process impersonating "svchost.exe" as Administrator. I airgapped the virtual machine, and Miracle Box said it needed Internet access for licensing, however GetDroidTips said it was free. I suspect that this was a fake software crack.
I am aware of a program called SP Flash Tool, but that won't work because I am on Linux, and not Windows. I doubt it would work under WINE, as it requires special device-specific drivers that also only work on Windows. I have a spare Lenovo IdeaPad 110-15ACL, however I don't have the drivers needed to set up Windows 7 on it. I could, of course, use Windows 10, but I have heard it is bad for flashing, and it is very slow anyway. (I did, however, buy an SSD for it, perhaps this will speed it up enough to be somewhat usable?)
I also found an open-source MediaTek exploit script called MTKTools. It did not work, and it told me to hold all hardware buttons before plugging the device in. It still did not detect the tablet. It told me that I could also short TP1 to ground, however I could not find Test Point 1 on the tablet's motherboard.
There are no custom recoveries or FRP unlocking guides for this device, likely because it's an obscure Android 7.1 tablet from back in 2014. I wouldnt be able to flash them anyway as the bootloader is locked. It has 2 GB of RAM and the processor cores are Cortex-A35s so I'm not sure that this is worth unlocking. On the other hand, it costs over $100 from Walmart.
I am worried that the device was stolen, as it had a password, and once I reset it from Recovery mode, it had an FRP lock. If it is indeed stolen, I can't return it, due to the "as is" nature of Goodwill, and besides, I have disassembled it several times as well. Should I be concerned about the ethical implications of unlocking this device?
Does this work on Android 11? I have the Onn. 100011885 model, according to my settings app.