Database Info

[Q] Cache partition problem, HELP!

Hi,
I am trying to change my rom using CWM. I made my phone S-off. Than installed CWM. While trying to wipe all user data before rom install, it stuck. So I took the battery off. Now it gives error in CWM screen:
E: Can't mount /cache/recovery/command
E: Can't mount /cache/recovery/log
E: Can't open /cache/recovery/log
E: Can't mount /cache/recovery/last_log
E: Can't open /cache/recovery/last_log
So I read a bit and tried to format the cache partition from mounts and storage section. It gives
Error formatting /cache!
message.
I can go into fastboot, CWM and hboot.
I can install rom zip from sdcard.
I have a backup created with CWM.
I can't boot into Android, I can't restore my backup.
I tried to push recovery again using fastboot but it freezes there too.
I used recovery-clockwork-5.0.2.0-saga.img file while installing CWM on the first place. Now it is the installed one.
I have SDK and tools like adb and fastboot.
Please help!

1. Download Android Flasher to your PC
2. Download 4EXT Recovery image
3. Reboot the phone to bootloader (there should be FASBOOT USB written somewhere on the screen)
4. Flash the image with the Android flasher (check the "already in fastboot" box)
5. Wipe all partitions and try to install a custom ROM
If not working see the "before eMMC replacement" guide in my signature

Thank you very much for your detailed and quick response. I really appreciate it
I did what you told but, android flasher froze so I shut it down. After that I went to the topic on your signature and checked if the emmc is fried but it is not and responding well. Then I went to the post that is about the partition size. I ran
cat /proc/mtd
command in adb shell and got no partitions listed at all.
Now what should I do?
Again I can not install the recovery you mentioned. Is there anything that I can do with CWM which is already installed and working?
Also as far as I read from other topics, some are mentioning about putting the PG88DIAG.zip file which hboot is searching for in the bootloader startup to the phone and making it un rooted and re root it afterwards. But I could not find the zip file named PG88DIAG.zip so I could not try that. Is there anything you can say about it?
Regards;
y.

ysayita said:
Thank you very much for your detailed and quick response. I really appreciate it
I did what you told but, android flasher froze so I shut it down. After that I went to the topic on your signature and checked if the emmc is fried but it is not and responding well. Then I went to the post that is about the partition size. I ran
cat /proc/mtd
command in adb shell and got no partitions listed at all.
Now what should I do?
Again I can not install the recovery you mentioned. Is there anything that I can do with CWM which is already installed and working?
Also as far as I read from other topics, some are mentioning about putting the PG88DIAG.zip file which hboot is searching for in the bootloader startup to the phone and making it un rooted and re root it afterwards. But I could not find the zip file named PG88DIAG.zip so I could not try that. Is there anything you can say about it?
Regards;
y.
Click to expand...
Click to collapse
Freezing during fastboot command execution is not a good sign at all. Nevertheless if the eMMC check is stating that your card is initializing properly then you should be able to restore your phone.
Desire S in not mounting in /mnt so you cannot see partitions there
Rename the image from my previous post to recovery.img and try to flash it with fastboot (be sure that you have your serial as output of the "fastboot devices" command): fastboot flash recovery recovery.img
If not working go through the eMMC guide again - especially point 4. Note your hboot version - if it is the Revolutionary one you have to change it

amidabuddha said:
Freezing during fastboot command execution is not a good sign at all. Nevertheless if the eMMC check is stating that your card is initializing properly then you should be able to restore your phone.
Desire S in not mounting in /mnt so you cannot see partitions there
Rename the image from my previous post to recovery.img and try to flash it with fastboot (be sure that you have your serial as output of the "fastboot devices" command): fastboot flash recovery recovery.img
If not working go through the eMMC guide again - especially point 4. Note your hboot version - if it is the Revolutionary one you have to change it
Click to expand...
Click to collapse
Again thank you.
I did the procedure from the fastboot directly as you told but when it sends the file and begins the write procedure, it freezes. So I went to the eMMC topic again to step 4 and tried to change the hboot version to 0.98.2000 from current 6.98.1002 which is revolutionary by the way. But in android flasher I have this log output
Code:
sending 'hboot' (1024 KB)...
OKAY [ 0.196s]
writing 'hboot'...
(bootloader) image update is bypassed!
OKAY [ 0.029s]
finished. total time: 0.225s
also in the screen I see
Code:
Can not roll back hboot version
message at the bottom in red.
So I tried to do it again with fastboot and in command prompt I wrote
Code:
fastboot flash bootloader <img file>
but this time I got this output
Code:
fastboot flash bootloader ..\hboot_0.98.000
0_361a7ba6_0310.img
sending 'bootloader' (1024 KB)... OKAY [ 0.197s]
writing 'bootloader'... FAILED (remote: partition does not exist!)
finished. total time: 0.222s
Then I renamed the zip file to PG88DIAG.zip and pushed it to /sdcard/ using adb. After rebooting hboot, it asked if I wanted to start the update and I chose yes. But again at the end it gave the same message with the android flash:
Code:
Can not roll back hboot version
at the bottom in red.
I can not change hboot version to the required 0.98.2000 version with the methods mentioned.
Is there anything else I can do?

The proper command is
Code:
fastboot flash hboot hboot.img
but this is what the Andorid FLasher did
try the following: boot to Recovery, connect to PC, copy the hboot.img file to your SDcard, open command prompt and type:
Code:
adb devices [I](your device serial number should be displayed)[/I]
adb shell [I](there should be a command prompt with the # symbol in front if not type "su" without the quotes)[/I]
dd if=/sdcard/hboot.img of=/dev/block/mmcblk0p18[I][/I]
if not working try to unmount/mount the SDcard:
Code:
adb devices [I](your device serial number should be displayed)[/I]
adb shell [I](there should be a command prompt with the # symbol in front if not type "su" without the quotes)[/I]
umount /sdcard [I](not a typo the command is umount, not u[B]N[/B]mount)[/I]
mount /sdcard
dd if=/sdcard/hboot.img of=/dev/block/mmcblk0p18[I][/I]

I copied the file to the SDCard. Then in adb shell
Code:
~ # ls /sdcard/
ls /sdcard/
~ # umount /sdcard
umount /sdcard
umount: can't umount /sdcard: Invalid argument
~ # exit
exit
adb push ..\hboot.img /sdcard/
1627 KB/s (1048576 bytes in 0.629s)
adb shell
~ # ls sdcard
ls sdcard
hboot.img
~ # dd if=/sdcard/hboot.img of=/dev/block/mmcblk0p18
dd if=/sdcard/hboot.img of=/dev/block/mmcblk0p18
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 11.191921 seconds, 91.5KB/s
~ # reboot bootloader
reboot bootloader
It still has the same hboot.
After that;
Code:
fastboot flash hboot ..\hboot.img
sending 'hboot' (1024 KB)... OKAY [ 0.201s]
writing 'hboot'... INFOimage update is bypassed!
OKAY [ 0.028s]
finished. total time: 0.231s
Again result is same with AndroidFlasher or installing with zip file from hboot.
Code:
Can not roll back hboot version.
Is there a some kind of write protection? Is there a possibility of mmcblk0p18 not being the right partition section?
Again, thanks a lot!

Yes there is a write protection and this is the reason why I always recommend to change it right after the S-OFF procedure.
Anyway search in the forum for hboot over alpharevx or 2.00.2002 and try them with dd. This is you only way to restore with RUU. But for me this is an indication of bad eMMC and I am surprised that you have positive output of the dmesg command. Also you can push the hboot.img to /data/temp and dd from there
Sent from my Desire S using Tapatalk

How about RUU-ing your way back to stock, re-rooting it, and restoring your backup? Assuming there is later RUU.exe with higher HBOOT version, compatible with your CID.
And when I say RUU-ing, I mean stock HTC RUU.exe, not Android Flasher.
And if RUU fails, you can be sure it's your eMMC...

amidabuddha said:
Yes there is a write protection and this is the reason why I always recommend to change it right after the S-OFF procedure.
Anyway search in the forum for hboot over alpharevx or 2.00.2002 and try them with dd. This is you only way to restore with RUU. But for me this is an indication of bad eMMC and I am surprised that you have positive output of the dmesg command. Also you can push the hboot.img to /data/temp and dd from there
Sent from my Desire S using Tapatalk
Click to expand...
Click to collapse
I found something that may be relevant. The problem is that, before dd'ing I need to get su rights so every guide I read requires to enter the su command and acquire those rights on before the dd command. But the problem is that, when I enter the adb shell, it seems that I already have the su rights (I have the # mark on the command line) and if I enter su again, it says it is not recognized. So could this be the reason why the partition seems to be overwritten and it is not, me not having su rights while dd'ing? If that's the case, how could make the su command work?
Thanks a lot.
Regards;
y.

Jack_R1 said:
How about RUU-ing your way back to stock, re-rooting it, and restoring your backup? Assuming there is later RUU.exe with higher HBOOT version, compatible with your CID.
And when I say RUU-ing, I mean stock HTC RUU.exe, not Android Flasher.
And if RUU fails, you can be sure it's your eMMC...
Click to expand...
Click to collapse
As far as I learned today, because that my bootloader is s-off'ed by revolutionary, the bootloader contained in RUU cannot overwrite it. So installing RUU without getting the stock bootloader with hboot 0.98 is not an option. But thanks anyway, any tiny bit of help is really precious.
Regards,
y.

ysayita said:
I found something that may be relevant. The problem is that, before dd'ing I need to get su rights so every guide I read requires to enter the su command and acquire those rights on before the dd command. But the problem is that, when I enter the adb shell, it seems that I already have the su rights (I have the # mark on the command line) and if I enter su again, it says it is not recognized. So could this be the reason why the partition seems to be overwritten and it is not, me not having su rights while dd'ing? If that's the case, how could make the su command work?
Thanks a lot.
Regards;
y.
Click to expand...
Click to collapse
# prompt means root privileges, so this should not be the case. The strange is that you do not have any I/O errors.
Try this and this
also post here the output of
Code:
fastboot getvar all
(hide your IMEI)

amidabuddha said:
# prompt means root privileges, so this should not be the case. The strange is that you do not have any I/O errors.
Try this and this
also post here the output of
Code:
fastboot getvar all
(hide your IMEI)
Click to expand...
Click to collapse
(bootloader) version: 0.5
(bootloader) version-bootloader: 6.98.1002
(bootloader) version-baseband: 3805.06.02.03_M
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.47.468.2
(bootloader) serialno:
(bootloader) imei:
(bootloader) product: saga
(bootloader) platform: HBOOT-7230
(bootloader) modelid: PG8810000
(bootloader) cidnum: HTC__M27
(bootloader) battery-status: good
(bootloader) battery-voltage: 4198mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: 361a7ba6
(bootloader) hbootpreupdate: 12
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.025s
First guide seems to be pulled off. First, trying the other one.
Thanks.
y.

amidabuddha said:
# prompt means root privileges, so this should not be the case. The strange is that you do not have any I/O errors.
Try this and this
also post here the output of
Code:
fastboot getvar all
(hide your IMEI)
Click to expand...
Click to collapse
Now, I read from somewhere that /system should be mounted before dd'ing so I mounted it from recovery's mounts and storage menu. Than I tried to dd again and I got this output:
Code:
~ # dd if=/data/tmp/hboot.img of=/dev/block/mmcblk0p18
dd if=/data/tmp/hboot.img of=/dev/block/mmcblk0p18
dd: writing '/dev/block/mmcblk0p18': I/O error
1+0 records in
0+0 records out
0 bytes (0B) copied, 5.013903 seconds, 0B/s
So what can be the problem? Is it mean that chip is fried?
Edit:
I got dmesg output again and it seems responding well:
Code:
dmesg | grep mmc0
<3>[ 6.956176] mmc0: No card detect facilities available
<6>[ 6.956817] mmc0: Qualcomm MSM SDCC at 0x00000000a0500000 irq 98,0 dma 7
<6>[ 6.956939] mmc0: Platform slot type: MMC
<6>[ 6.957183] mmc0: 4 bit data mode disabled
<6>[ 6.957305] mmc0: 8 bit data mode enabled
<6>[ 6.957427] mmc0: MMC clock 144000 -> 50000000 Hz, PCLK 96000000 Hz
<6>[ 6.957672] mmc0: Slot eject status = 0
<6>[ 6.957794] mmc0: Power save feature enable = 1
<6>[ 6.958038] mmc0: DM non-cached buffer at ffa0f000, dma_addr 0x0ba0d000
<6>[ 6.958160] mmc0: DM cmd busaddr 0x0ba0d000, cmdptr busaddr 0x0ba0d300
<6>[ 7.111846] mmc0: new high speed MMC card at address 0001
<6>[ 7.113494] mmcblk0: mmc0:0001 M4G2DE 2.10 GiB
y.

Your eMMC is fine according to this command but it may be failed by another reason...
The first guide is pulled off but there is an attachment at the first post..try it as well as 2.00.2002
Mount data before "dd", not system, or mount them all. Try all possible combinations, because in general you should change the hboot first. You cannot proceed otherwise. Then take a look here, because you will not be able to find a RUU for your version.
You can try falshing hboot with a Goldcard as well

amidabuddha said:
Your eMMC is fine according to this command but it may be failed by another reason...
The first guide is pulled off but there is an attachment at the first post..try it as well as 2.00.2002
Mount data before "dd", not system, or mount them all. Try all possible combinations, because in general you should change the hboot first. You cannot proceed otherwise. Then take a look here, because you will not be able to find a RUU for your version.
You can try falshing hboot with a Goldcard as well
Click to expand...
Click to collapse
I tried both and result is the same.
Also I mounted data and tried. Again same error with I/O.
When I try to mount /system first and then /data, I got error mounting /data. And when /data first and then /system, I got error mounting /system. So I could not try with both of them mounted.
I read about creating Goldcard but I can not get the CID with this code
Code:
cat /sys/class/mmc_host/mmc1/mmc1:*/cid
So I can not move further in gold card creation.

Goldcard without device
Also wipe all and try a custom rom again

amidabuddha said:
Goldcard without device
Also wipe all and try a custom rom again
Click to expand...
Click to collapse
I had a goldcard at last. Then I tried to install the RUU with goldcard in device. But it keeps freezing at rebooting bootloader phase.
So I tried to flash with fastboot again but result is as below:
Code:
sending 'hboot' (1024 KB)...
OKAY [ 0.185s]
writing 'hboot'...
(bootloader) image update is bypassed!
OKAY [ 0.029s]
finished. total time: 0.214s
And I get
Code:
Can not roll back hboot version
message again.
Then I tried putting P88IMG.zip to goldcard and tried to flash from there in hboot but again the same cannot rollback message appeared and froze.
So I went back to adb shell and tried dd'ing from /sdcard/hboot.img but I/O error persists.
So I am aware that I am running out of choices but, please keep suggesting.
Thanks,
y.

This was mentioned at the first hboot link that I gave you. There is a problem sometimes with region specific or branded devices.
But honestly I have no idea why you cannot replace it via dd. Sorry, but out of suggestions
Maybe you should try at the Revolutionary freenode IRC channel - they are the experts in this field after all....

amidabuddha said:
This was mentioned at the first hboot link that I gave you. There is a problem sometimes with region specific or branded devices.
But honestly I have no idea why you cannot replace it via dd. Sorry, but out of suggestions
Maybe you should try at the Revolutionary freenode IRC channel - they are the experts in this field after all....
Click to expand...
Click to collapse
Thank you for your deep interest and kind efforts, I really appreciate it. As you suggested, I contacted with the guys in Revolutionary freenode IRC channel and they helped me. But there were no solution for it right now. I am going to try my chance with HTC Service. Hope they can do something about it.
Regards;
y.

[Q] Phone not mounting and unable to flash roms

I downloaded Paranoid Android OTA update (from pa_hammerhead-4.43-20140715 to pa_hammerhead-4.44-20140722), planned on a clean flash but it automatically started to install the update. Once installed had a notification saying "UIDs on the system are inconsistent, you need to wipe your data partition or your device will be unstable", incase it was an unstable version of PA i flashed the older version back but the UID notification kept coming up. So i attempted a clean flash (factory reset through twrp) but it failed. So i did as the phone originally said and wiped the data partition. It can no longer mount the External Memory, as soon as i boot the phone all apps crash. It will not connect to any computer so i cannot move a stock ROM on to the phone to restore it. The laptop does acknowledge when it is connected but fails to install drivers.

braddover said:
I downloaded Paranoid Android OTA update (from pa_hammerhead-4.43-20140715 to pa_hammerhead-4.44-20140722), planned on a clean flash but it automatically started to install the update. Once installed had a notification saying "UIDs on the system are inconsistent, you need to wipe your data partition or your device will be unstable", incase it was an unstable version of PA i flashed the older version back but the UID notification kept coming up. So i attempted a clean flash (factory reset through twrp) but it failed. So i did as the phone originally said and wiped the data partition. It can no longer mount the External Memory, as soon as i boot the phone all apps crash. It will not connect to any computer so i cannot move a stock ROM on to the phone to restore it. The laptop does acknowledge when it is connected but fails to install drivers.
Click to expand...
Click to collapse
I've never seen "uid's on the phone are inconsistent" before. Can you boot into fastboot and does your pc recognize the device when you so? I'd start by flashing the system.img in fastboot and see if that'll work. If it doesn't I'd flash the entire factory image. Back up first though.
Sent from my Nexus 5 using XDA Free mobile app

ok, first of all make sure you've got adb tools on your pc. Then reboot in recovery mode (twrp or philz) and open a prompt in the platform-tools folder; now type the following:
adb shell
e2fsck /dev/block/platform/msm_sdcc.1/system
e2fsck /dev/block/platform/msm_sdcc.1/userdata
e2fsck /dev/block/platform/msm_sdcc.1/cache
continue to press enter if requested, then exit prompt.
Now download the rom you want to install, place it under platform-tools; then (if on twrp) go to "advanced" then "adb sideload", check the two checkbox and swipe. Open again the prompt from the platform-tools folder and type:
adb sideload "rom-name".zip
then reboot
Let me know how it goes.
EDIT:
if you miss drivers you can google them from google's website, then extract them in a folder (e.g. c:/drivers). Connect phone in recovery mode, look for it as "nexus 5" in device manager, open the properties to update drivers and point the location to the folder where you put the drivers in (c:/drivers). Then reboot recovery and see how it goes.

After this update mine cycles back to recovery
I've got a similar problem. This same update (from pa_hammerhead-4.43-20140715 to pa_hammerhead-4.44-20140722) has me stuck in recovery. I have cwm v6.0.4.5 and after flashing this update the phone goes back to recovery when trying to reboot. Usb storage isn't working from recovery so I can't put a different rom into the storage.
Any ideas on the best way to solve this? I'd be super excited if I didn't have to delete the data on the phone.
braddover said:
I downloaded Paranoid Android OTA update (from pa_hammerhead-4.43-20140715 to pa_hammerhead-4.44-20140722), planned on a clean flash but it automatically started to install the update. Once installed had a notification saying "UIDs on the system are inconsistent, you need to wipe your data partition or your device will be unstable", incase it was an unstable version of PA i flashed the older version back but the UID notification kept coming up. So i attempted a clean flash (factory reset through twrp) but it failed. So i did as the phone originally said and wiped the data partition. It can no longer mount the External Memory, as soon as i boot the phone all apps crash. It will not connect to any computer so i cannot move a stock ROM on to the phone to restore it. The laptop does acknowledge when it is connected but fails to install drivers.
Click to expand...
Click to collapse

Akly said:
I've got a similar problem. This same update (from pa_hammerhead-4.43-20140715 to pa_hammerhead-4.44-20140722) has me stuck in recovery. I have cwm v6.0.4.5 and after flashing this update the phone goes back to recovery when trying to reboot. Usb storage isn't working from recovery so I can't put a different rom into the storage.
Any ideas on the best way to solve this? I'd be super excited if I didn't have to delete the data on the phone.
Click to expand...
Click to collapse
USB storage doesn't exist on the nexus 5.
Use adb push.
Click the link to the sticky thread in my signature. Then from there, find the "adb and fastboot. What is it?" thread.
Everything you need is there
Sent from my Nexus 5 using Tapatalk

Fastboot
jd1639 said:
I've never seen "uid's on the phone are inconsistent" before. Can you boot into fastboot and does your pc recognize the device when you so? I'd start by flashing the system.img in fastboot and see if that'll work. If it doesn't I'd flash the entire factory image. Back up first though.
Sent from my Nexus 5 using XDA Free mobile app
Click to expand...
Click to collapse
Thanks for your reply, but that is what I tried before creating this post I also tried adb sideload in twrp but every time I swipe to run it, it says failed

braddover said:
Thanks for your reply, but that is what I tried before creating this post I also tried adb sideload in twrp but every time I swipe to run it, it says failed
Click to expand...
Click to collapse
Sounds like the flash memory may be corrupt.
I think your only choice is fastboot flash /LG flash tool.
We should try that and see what errors you get,

rootSU said:
Sounds like the flash memory may be corrupt.
I think your only choice is fastboot flash /LG flash tool.
We should try that and see what errors you get,
Click to expand...
Click to collapse
Thanks very much, I shall give it a go and get back to you

_MirageX_ said:
ok, first of all make sure you've got adb tools on your pc. Then reboot in recovery mode (twrp or philz) and open a prompt in the platform-tools folder; now type the following:
adb shell
e2fsck /dev/block/platform/msm_sdcc.1/system
e2fsck /dev/block/platform/msm_sdcc.1/userdata
e2fsck /dev/block/platform/msm_sdcc.1/cache
continue to press enter if requested, then exit prompt.
Now download the rom you want to install, place it under platform-tools; then (if on twrp) go to "advanced" then "adb sideload", check the two checkbox and swipe. Open again the prompt from the platform-tools folder and type:
adb sideload "rom-name".zip
then reboot
Let me know how it goes.
EDIT:
if you miss drivers you can google them from google's website, then extract them in a folder (e.g. c:/drivers). Connect phone in recovery mode, look for it as "nexus 5" in device manager, open the properties to update drivers and point the location to the folder where you put the drivers in (c:/drivers). Then reboot recovery and see how it goes.
Click to expand...
Click to collapse
Thanks very much I shall give it a go and get back to you, I've actually got a mac book pro, is it worth sponging off a mate and using his windows machine for this to avoid driver/connection issues that may not be to do with my current issue?

braddover said:
Thanks very much I shall give it a go and get back to you, I've actually got a mac book pro, is it worth sponging off a mate and using his windows machine for this to avoid driver/connection issues that may not be to do with my current issue?
Click to expand...
Click to collapse
You can do, but if you click the link in my signature to the sticky thread, then from there go to the "adb and fastboot what is it?" thread, there is link to a Mac Installer script which should be enough to resolve the issue. But failing that, yeah windows.

Hi can you run the following commands in your terminal when the phone is connected in recovery or in android with enabled usb debugging:
adb shell
cat /proc/partitions
and post the outcome here?

rootSU said:
You can do, but if you click the link in my signature to the sticky thread, then from there go to the "adb and fastboot what is it?" thread, there is link to a Mac Installer script which should be enough to resolve the issue. But failing that, yeah windows.
Click to expand...
Click to collapse
ok....so i gave that a crack, almost every process failed. This is what came up:
bradleys-mbp:hammerhead-krt16m Brad$ ./flash-all.sh
sending 'bootloader' (2506 KB)...
OKAY [ 0.287s]
writing 'bootloader'...
FAILED (remote: flash write failure)
finished. total time: 0.487s
rebooting into bootloader...
OKAY [ 0.094s]
finished. total time: 0.094s
sending 'radio' (42033 KB)...
OKAY [ 1.664s]
writing 'radio'...
FAILED (remote: flash write failure)
finished. total time: 2.885s
rebooting into bootloader...
OKAY [ 0.092s]
finished. total time: 0.092s
archive does not contain 'boot.sig'
archive does not contain 'recovery.sig'
archive does not contain 'system.sig'
ERROR: usb_write failed with status e00002c0
--------------------------------------------
ERROR: usb_write failed with status e00002c0
getvar:version-bootloader FAILED (command write failed (Invalid argument))
finished. total time: 0.000s
I also tried the longer method but same issues

Change USB cable and port also?
Sent from my Nexus 5 using Tapatalk

rootSU said:
Change USB cable and port also?
Sent from my Nexus 5 using Tapatalk
Click to expand...
Click to collapse
Just tried it, still nothing
came up with.....
bradleys-mbp:hammerhead-krt16m Brad$ ./flash-all.sh /Users/Brad/Desktop/hammerhead-krt16m
sending 'bootloader' (2506 KB)...
OKAY [ 0.307s]
writing 'bootloader'...
FAILED (remote: flash write failure)
finished. total time: 0.508s
rebooting into bootloader...
OKAY [ 0.097s]
finished. total time: 0.097s
sending 'radio' (42033 KB)...
OKAY [ 1.694s]
writing 'radio'...
FAILED (remote: flash write failure)
finished. total time: 2.915s
rebooting into bootloader...

Its not looking good. Don't forget to do what @bitdomo asked
Sent from my Nexus 5 using Tapatalk

bitdomo said:
Hi can you run the following commands in your terminal when the phone is connected in recovery or in android with enabled usb debugging:
adb shell
cat /proc/partitions
and post the outcome here?
Click to expand...
Click to collapse
Thanks for your reply, I hope I have done this correctly....this is what it came up with in TWRP
bradleys-mbp:~ Brad$ adb shell
~ # cat/proc/partitions
/sbin/sh: cat/proc/partitions: not found
i can't run the ADB sideloader in twrp as it fails every time, also I cannot enable USB debugging as i cannot get that far in to my phone to enable it

E: unable to mount
More info: when trying to do anything in twrp the main issue seems to be that it always comes up with "E: unable to mount" followed by either /persist or /cache

braddover said:
More info: when trying to do anything in twrp the main issue seems to be that it always comes up with "E: unable to mount" followed by either /persist or /cache
Click to expand...
Click to collapse
There's a thread to fix persist by @bitdomo. Its in the root guides section of Sticky roll-up in my signature
Sent from my Nexus 5 using Tapatalk

braddover said:
Thanks for your reply, I hope I have done this correctly....this is what it came up with in TWRP
bradleys-mbp:~ Brad$ adb shell
~ # cat/proc/partitions
/sbin/sh: cat/proc/partitions: not found
i can't run the ADB sideloader in twrp as it fails every time, also I cannot enable USB debugging as i cannot get that far in to my phone to enable it
Click to expand...
Click to collapse
There is a space between cat and /proc/partitions.
The link to the guide to fix persist is here http://forum.xda-developers.com/google-nexus-5/general/guide-to-fix-persist-partition-t2821576

bitdomo said:
There is a space between cat and /proc/partitions.
The link to the guide to fix persist is here http://forum.xda-developers.com/google-nexus-5/general/guide-to-fix-persist-partition-t2821576
Click to expand...
Click to collapse
Whoops silly me!
This is what it brought up when i added the space:
bradleys-mbp:~ Brad$ adb shell
~ # cat /proc/partitions
major minor #blocks name
179 0 30535680 mmcblk0
179 1 65536 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 512 mmcblk0p3
179 4 512 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 2048 mmcblk0p7
179 8 1024 mmcblk0p8
179 9 512 mmcblk0p9
179 10 512 mmcblk0p10
179 11 512 mmcblk0p11
179 12 3072 mmcblk0p12
179 13 3072 mmcblk0p13
179 14 512 mmcblk0p14
179 15 16384 mmcblk0p15
179 16 16384 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 22528 mmcblk0p18
179 19 22528 mmcblk0p19
179 20 22528 mmcblk0p20
179 21 3072 mmcblk0p21
179 22 512 mmcblk0p22
179 23 512 mmcblk0p23
179 24 512 mmcblk0p24
179 25 1048576 mmcblk0p25
179 26 30720 mmcblk0p26
179 27 716800 mmcblk0p27
179 28 28551146 mmcblk0p28
179 29 5 mmcblk0p29
179 32 4096 mmcblk0rpmb
I also tried to fix persist, it doesn't seem to have worked.
Running your first command gave me this and did not repair anything:
bradleys-mbp:~ Brad$ adb shell
~ # e2fsck /dev/block/platform/msm_sdcc.1/by-name/persist
e2fsck 1.41.14 (22-Dec-2010)
/dev/block/platform/msm_sdcc.1/by-name/persist: recovering journal
Superblock needs_recovery flag is clear, but journal has data.
Run journal anyway<y>? y
yes
e2fsck: unable to set superblock flags on /dev/block/platform/msm_sdcc.1/by-name/persist
So i tried the next step which produced this:
bradleys-mbp:~ Brad$ adb shell
~ # make_ext4fs /dev/block/platform/msm_sdcc.1/by-name/persist
Creating filesystem with parameters:
Size: 16777216
Block size: 4096
Blocks per group: 32768
Inodes per group: 1024
Inode size: 256
Journal blocks: 1024
Label:
Blocks: 4096
Block groups: 1
Reserved block group size: 7
Created filesystem with 11/1024 inodes and 1102/4096 blocks
However i still do not have access to be able to copy the files over...

[GUIDE][BRICKED] [BOOTS ONLY TO RECOVERY][All ASUS TRANFORMERS]

This is a general users guide to unbrick your Transformer tablet.
This guide will help you if your Asus tablet will only boot into recovery
and the command
Code:
adb reboot-bootloader
does not work to get you booted back to bootloader screen ..
If the above command works then skip to the first fastboot command ..
WHAT YOU NEED
An Asus tablet that will only boot into recovery …
Woking adb and fastboot on your PC
Windows drivers (if using Windows)
A fully charged tablet
Asus data cable
Stock firmware blob (from Asus's web site, make sure you get the right one)
_that's bootit.ko (unzipped and placed with fastboot.exe)
Downloads
Asus Stock firmware---MAKE SURE YOU GET THE CORRECT SKU FOR YOUR TRANSFORMER TABLET
click me
_that's bootit.ko----click me
INSTRUCTIONS
Extract your stock firmware in your downloads folder twice...You will see a blob file rename it boot.blob and move it to the same folder as your fastboot.exe or if in linux to your home folder
Unzip the bootit.ko and place it wth the above blob file.
Let start with this command to make sure that your PC can see your table as an ADB device in recovery
Code:
adb devices
OUTPUT
Code:
[email protected] ~ $ adb devices
List of devices attached
015c7d7a445c260c recovery
Then lets push the bootit.ko to the root of the device like this
Code:
adb push bootit.ko /
OUTPUT
Code:
[email protected] ~ $ adb push bootit.ko /
673 KB/s (27690 bytes in 0.040s)
Then lets insmod this .ko file
Code:
adb shell insmod /bootit.ko
This should reboot the tablet into the bootloader menu, lets verifiy.
Once in the bootloader screen lets make sure your PC can see the device in fastboot.
Code:
fastboot devices
OUTPUT
Code:
[email protected] ~ $ fastboot devices
015c7d7a445c260c fastboot
So now its time to erase the misc & cache partitions, as that is most likely the partitions that is making it boot to recovery...
Code:
fastboot erase misc
OUTPUT
Code:
[email protected] ~ $ fastboot erase misc
erasing 'misc'...
OKAY [ 1.021s]
finished. total time: 1.021s
Code:
fastboot erase cache
OUTPUT
Code:
[email protected] ~ $ fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 2.096s]
finished. total time: 2.096s
Once these two command run with OKAY as the OUTPUT .
It is time to make sure we can reboot into the bootloader with the hardware buttons
So from where you are at in the bootloader screen use the VOL DOWN & POWER buttons to boot the tab back into the bootloader screen ..
Run these command in fastboot in this order
The next command is to just verify your computer can see your device
Code:
fastboot devices
OUTPUT
Code:
[email protected]:~ > fastboot devices
015d2bbce2501405 fastboot
Code:
fastboot erase system
OUTPUT
Code:
[email protected]:~ > fastboot erase system
******** Did you mean to fastboot format this partition?
erasing 'system'...
OKAY [ 2.954s]
finished. total time: 2.954s
Code:
fastboot erase recovery
OUTPUT
Code:
[email protected]:~ > fastboot erase recovery
erasing 'recovery'...
OKAY [ 1.945s]
finished. total time: 1.945s
Code:
fastboot -w
OUTPUT
Code:
[email protected]:~ > fastboot -w
erasing 'userdata'...
OKAY [ 23.188s]
formatting 'userdata' partition...
Creating filesystem with parameters:
Size: 29618601984
Block size: 4096
Blocks per group: 32768
Inodes per group: 8192
Inode size: 256
Journal blocks: 32768
Label:
Blocks: 7231104
Block groups: 221
Reserved block group size: 1024
Created filesystem with 11/1810432 inodes and 157662/7231104 blocks
sending 'userdata' (139133 KB)...
writing 'userdata'...
OKAY [ 26.358s]
erasing 'cache'...
At this point it will either hangs on erasing 'cache'
Or it will give you an error, either way you will need to
reboot the tablet back into fastboot with the hardware buttons
Once that is done continue on the path
Code:
fastboot erase boot
OUTPUT
Code:
[email protected]:~ > fastboot erase boot
erasing 'boot'...
OKAY [ 1.209s]
finished. total time: 1.209s
Code:
fastboot erase misc
OUTPUT
Code:
[email protected]:~ > fastboot erase misc
erasing 'misc'...
OKAY [ 0.978s]
finished. total time: 0.978s
Code:
fastboot erase cache
OUTPUT
Code:
[email protected]:~ > fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 2.843s]
finished. total time: 2.843s
Code:
fastboot -i 0x0B05 flash system boot.blob
During the sending/writing process of this step you will get the blue bar on your screen.....
OUTPUT
Code:
[email protected]:~ > fastboot -i 0x0B05 flash system boot.blob
erasing 'system'...
OKAY [ 2.339s]
sending 'system' (800927 KB)...
OKAY [133.094s]
writing 'system'...
[OKAY [178.036s]
finished. total time: 313.469s
Code:
fastboot -i 0x0B05 reboot
OUTPUT
Code:
[email protected]:~ > fastboot -i 0x0B05 reboot
rebooting...
finished. total time: 0.020s
Let it boot into stock ROM ...

Credits
@_that for his bootit.ko
TEAM CROMBi and TEAM ZOMBi-X @sbdags @hardslog

Troubleshooting
Here is some troubleshooting
Check out this thread for fasboot.exe, adb.exe and driver help ...CLICK ME

@lj50036
A typo on your very first command: adb device?
Edit: What would you recommend if the userdata is corrupted and have only fastboot/adb? fastboot format data-partition? Thanks...

LetMeKnow said:
@lj50036
A typo on your very first command: adb device?
Edit: What would you recommend if the userdata is corrupted and have only fastboot/adb? fastboot format data-partition? Thanks...
Click to expand...
Click to collapse
Fixed let me know if you see anymore ..
Thx @LetMeKnow

LetMeKnow said:
@lj50036
A typo on your very first command: adb device?
Edit: What would you recommend if the userdata is corrupted and have only fastboot/adb? fastboot format data-partition? Thanks...
Click to expand...
Click to collapse
I am going to get to this once you have fastboot back and you can boot with hardware buttons then its just like @Buster99's
guide but there is one very important command that he leaves out ..
I will post the rest of the guide after bit ...
Thx Josh

Here is the original thread where the bootit module was tested for the first time -> http://forum.xda-developers.com/showthread.php?t=2291974
The problem was that the installed recovery was too old and incompatible with the bootloader and so could not access the eMMC at all. The bootloader command to boot to recovery is stored in the MSC partition (mmcblk0p3), and the recovery could not clear it. Since the bootloader checks the MSC partition before checking for volume-down, it is impossible to get to fastboot without some additional kick in the butt (aka "bootit.ko").
The correct bootit.ko file to use is the one in "bootit-bootloader.zip": http://forum.xda-developers.com/attachment.php?attachmentid=1985941&d=1369339132 - the older version turned out to be too weak. Note that this is a zipped kernel module, not a recovery-installable ZIP. You need to unzip it on your PC before adb push.
After making it to the bootloader menu and working fastboot, you can fastboot flash a current version of TWRP and install the custom ROM of your choice. No real need for the stock blob, unless you want to make sure you have the current bootloader and a known working ROM.
Here is another thread where bootit.ko didn't help, maybe it was really a hardware problem. But lots of good background info from me. -> http://forum.xda-developers.com/showthread.php?t=2437376
And here is another success story -> http://forum.xda-developers.com/showthread.php?p=47525770

_that said:
Here is the original thread where the bootit module was tested for the first time -> http://forum.xda-developers.com/showthread.php?t=2291974
The problem was that the installed recovery was too old and incompatible with the bootloader and so could not access the eMMC at all. The bootloader command to boot to recovery is stored in the MSC partition (mmcblk0p3), and the recovery could not clear it. Since the bootloader checks the MSC partition before checking for volume-down, it is impossible to get to fastboot without some additional kick in the butt (aka "bootit.ko").
The correct bootit.ko file to use is the one in "bootit-bootloader.zip": http://forum.xda-developers.com/attachment.php?attachmentid=1985941&d=1369339132 - the older version turned out to be too weak. Note that this is a zipped kernel module, not a recovery-installable ZIP. You need to unzip it on your PC before adb push.
After making it to the bootloader menu and working fastboot, you can fastboot flash a current version of TWRP and install the custom ROM of your choice. No real need for the stock blob, unless you want to make sure you have the current bootloader and a known working ROM.
Here is another thread where bootit.ko didn't help, maybe it was really a hardware problem. But lots of good background info from me. -> http://forum.xda-developers.com/showthread.php?t=2437376
And here is another success story -> http://forum.xda-developers.com/showthread.php?p=47525770
Click to expand...
Click to collapse
Thx _that I did update the OP with the correct bootit.ko ...

lj50036 said:
Thx _that I did update the OP with the correct bootit.ko ...
Click to expand...
Click to collapse
Great stuff! Thanks for this thread Josh!
Now , if I understand this correctly, the insmod command injects a command into the kernel to boot straight to the bootloader before checking misc to break that 'forced reboot to recovery' cycle.
Kinda correct?
In another thread @_that stated once that
Code:
fastboot getvar all
does not return misc as a supported partiton and that
Code:
fastboot erase misc
only "theoretically" erases misc partition. Is that confirmed now?
You guys are great! So much fun to learn this...

I tried to follow this but i get this output:
After pushing bootit.ko to the root and insmod, the transformer reboots directly in the bootloader.
When try fastboot devices, nothing happens just the next line to fill in a command.
Also, when trying then to fastboot erase misc, it hangs with 'waiting for devices'..

lvrijn said:
I tried to follow this but i get this output:
After pushing bootit.ko to the root and insmod, the transformer reboots directly in the bootloader.
When try fastboot devices, nothing happens just the next line to fill in a command.
Also, when trying then to fastboot erase misc, it hangs with 'waiting for devices'..
Click to expand...
Click to collapse
Did you have a working fastboot driver on your PC before you got into this pickle?
Give us a detailed description on why you tried this procedure.

berndblb said:
Did you have a working fastboot driver on your PC before you got into this pickle?
Give us a detailed description on why you tried this procedure.
Click to expand...
Click to collapse
Thanks for the advice.
It was not the driver, if was my fastboot and adb .exe, i think an old version?
I now downloaded from here http://forum.xda-developers.com/showthread.php?t=2588979
And these are working!
So if someone ever have problems command doesn't recognize fastboot commands, its not always the driver! It can also be the fastboot.exe
This transformer is working again !

lvrijn said:
Thanks for the advice.
It was not the driver, if was my fastboot and adb .exe, i think an old version?
I now downloaded from here http://forum.xda-developers.com/showthread.php?t=2588979
And these are working!
So if someone ever have problems command doesn't recognize fastboot commands, its not always the driver! It can also be the fastboot.exe
This transformer is working again !
Click to expand...
Click to collapse
Great to see you up and running...:good:
I did add a Troubleshooting post number 3
The Josh

berndblb said:
Great stuff! Thanks for this thread Josh!
Now , if I understand this correctly, the insmod command injects a command into the kernel to boot straight to the bootloader before checking misc to break that 'forced reboot to recovery' cycle.
Kinda correct?
In another thread @_that stated once that
Code:
fastboot getvar all
does not return misc as a supported partiton and that
Code:
fastboot erase misc
only "theoretically" erases misc partition. Is that confirmed now?
You guys are great! So much fun to learn this...
Click to expand...
Click to collapse
No, I dont think it injects anything into the kernel as there may not even be one in the LNX partition ..
The bootit.ko module comes from the source of the kernel code..
Also the /misc partition is a full partition as shown here ..
Code:
mmcblk0p3
Offset: 1292369920 (0x4d080000)
Size: 2097152 (0x200000)
File system size: 512 * 4096 = 2097152 (fully occupies partition)
Linux rev 1.0 ext3 filesystem
Not mounted
Permissions: GID system can manipulate
Contains: Empty file system
Purpose: Recovery /misc
Referenced by: /system/lib/libandroid_runtime.so recovery ramdisk: /etc/recovery.fstab
Note: File system is referenced in recovery as emmc, not ext3!
Thx Josh

lj50036 said:
No, I dont think it injects anything into the kernel as there may not even be one in the LNX partition ..
Click to expand...
Click to collapse
I think berndblb meant that insmod injects something into the *currently running* kernel, which it does. It's used for loading additional kernel modules, usually drivers. When a module is loaded, its "init" function is called by the kernel so that it can hook its functionality into the proper kernel subsystems. My bootit.ko's init function simply reboots the tablet - without properly terminating processes, unmounting filesystems, etc. - so it should only be loaded when no partitions are mounted.

_that said:
I think berndblb meant that insmod injects something into the *currently running* kernel, which it does. It's used for loading additional kernel modules, usually drivers. When a module is loaded, its "init" function is called by the kernel so that it can hook its functionality into the proper kernel subsystems. My bootit.ko's init function simply reboots the tablet - without properly terminating processes, unmounting filesystems, etc. - so it should only be loaded when no partitions are mounted.
Click to expand...
Click to collapse
Nothing like _that to put you in your place....

lj50036 said:
Nothing like _that to put you in your place....
Click to expand...
Click to collapse
I'm trying to get back to a working recovery. Now I get a cycle of TWRP splash screens. This method looks promising because it appears to rebuild all of the partitions. I can use the Vol Down + Power keys to get to the bootloader (us_epad-10.6.1.14.10-20130801 A03. Can I skip to the fastboot steps? I had Crombi-kk running with rom2sd before I broke something trying to upgrade to zombie-x.
Thanks!

awilson77584 said:
I'm trying to get back to a working recovery. Now I get a cycle of TWRP splash screens. This method looks promising because it appears to rebuild all of the partitions. I can use the Vol Down + Power keys to get to the bootloader (us_epad-10.6.1.14.10-20130801 A03. Can I skip to the fastboot steps? I had Crombi-kk running with rom2sd before I broke something trying to upgrade to zombie-x.
Thanks!
Click to expand...
Click to collapse
You can skip all the way down to the command "fastboot erase misc". It should kick you out of twrp cycling...good luck..:fingers-crossed:

LetMeKnow said:
You can skip all the way down to the command "fastboot erase misc". It should kick you out of twrp cycling...good luck..:fingers-crossed:
Click to expand...
Click to collapse
Thx!

Back up and running! Thanks!!!

[HELP] Nexus 5 die, can't enter recovery mode (only Bootloader mode)

Hello,
My phone fell to the floor and since than can't boot.
I see the google logo and then it turning off.
I can't enter recovery mode.
I can enter bootloader mode, tried to re-flash the rom (factory) with -w (wipe) and still can't boot / enter recovery mode.
Any suggestions?
Thanks!

time for a new phone

If the screen is okay, get a nexus 5 with a busted screen and swap internal components.

I have the same problem, but allow me to add some more details:
When trying to go to recovery, i got a dead droid with a red sign on it. See my post on android enthusiasts: /questions/169999/stuck-in-bootloop-and-flash-recovery-doesnt-work-on-nexus-5/170395 (can't post url from my account)
From fast boot, I could flash a recovery (my fastboot is unlocked) but it gave no results: still had the dead droid (tried with twrp, cwm, and stock rom).
After that I gave up trying to get back my data and tried flashing the whole stock rom, but it when bad. Now when trying to flash anything I got errors:
Code:
$ sudo ./fastboot flash cache cache.img
target reported max download size of 1073741824 bytes
erasing 'cache'...
OKAY [ 0.125s]
sending 'cache' (13348 KB)...
OKAY [ 0.630s]
writing 'cache'...
FAILED (remote: flash write failure)
finished. total time: 0.936s
- or -
Code:
$ sudo ./fastboot flash system system.img
target reported max download size of 1073741824 bytes
erasing 'system'...
FAILED (remote: failed to erase partition)
finished. total time: 0.118s
The only good news is I realized I could boot to any arbitrary recovery without flashing it with:
Code:
$ sudo ./fastboot boot recovery.img.twrp
Most functions on recory wouldn't work (it says it can't mount most partitions), but from where I can get an
Code:
adb shell
. I tried various steps but without success so far:
Code:
~ # e2fsck /dev/block/platform/msm_sdcc.1/by-name/recovery
e2fsck 1.41.14 (22-Dec-2010)
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/block/platform/msm_sdcc.1/by-name/recovery
The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
Code:
~ # e2fsck /dev/block/platform/msm_sdcc.1/by-name/system
e2fsck 1.41.14 (22-Dec-2010)
system: clean, 1939/65536 files, 254904/262144 blocks
Code:
~ # e2fsck /dev/block/platform/msm_sdcc.1/by-name/cache
e2fsck 1.41.14 (22-Dec-2010)
/dev/block/platform/msm_sdcc.1/by-name/cache: recovering journal
Superblock needs_recovery flag is clear, but journal has data.
Run journal anyway<y>? y
yes
e2fsck: unable to set superblock flags on /dev/block/platform/msm_sdcc.1/by-name/cache
I think I managed to somehow mess up my partition system, and I don't know much how to recover it, anyone have clues or can suggest something ?

You may need to replace the power button on the motherboard. If the phone keeps booting and then restarting when the Google logo appears, the power button might be your culprit. It was for me, and after a trip to my local repair shop, it is as good as new.

Fvolfrine said:
You may need to replace the power button on the motherboard. If the phone keeps booting and then restarting when the Google logo appears, the power button might be your culprit. It was for me, and after a trip to my local repair shop, it is as good as new.
Click to expand...
Click to collapse
The power button works fine on my phone. It's isn't constantly rebooting, but it gets stuck at the booting animation. I can use the power normally in the bootloader and it behaves as expected.

biaib said:
The power button works fine on my phone. It's isn't constantly rebooting, but it gets stuck at the booting animation. I can use the power normally in the bootloader and it behaves as expected.
Click to expand...
Click to collapse
I have the same problem sir.
were you able to solve your issue?
If yes please explain how?

If the phone is stuck at the boot animation, try flashing the oldest Kit Kat ROM from the Google site: https://developers.google.com/android/images

ahiel2 said:
Hello,
My phone fell to the floor and since than can't boot.
I see the google logo and then it turning off.
I can't enter recovery mode.
I can enter bootloader mode, tried to re-flash the rom (factory) with -w (wipe) and still can't boot / enter recovery mode.
Any suggestions?
Thanks!
Click to expand...
Click to collapse
Well I Still am trying to fix that issue since almost 2 years now.....
My guesses are that eMMC is damaged when you thre your phone.
If you do find a solution please do let me know.
Thanks!

[CLOSED]HaHaHack Dis: No Magisk REQUIRED!!!!

Magisk is no more...
I present a new fool proof method of flashing su to Android 10_Q and above!!
I ranted and ranted about variant=user/user-debug/eng builds that I got no-where... people thinkin am dissin john wu, nah, I respect what I've learnt from his app forcing me to connect online, I want su without connecting, in order to secure my own fone.
Introducing proof!!
Simple. Instead of flashing boot.img
Flash boot-debug.img from stock.
This address's the lack of adb root.
Logs:
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash vbmeta vb
lankmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.000s]
Writing 'vbmeta' OKAY [ 0.000s]
Finished. Total time: 0.016s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.515s]
Finished. Total time: 1.404s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
MyTwrp.img
Sending 'recovery' (26086 KB) OKAY [ 0.718s]
Writing 'recovery' OKAY [ 0.406s]
Finished. Total time: 1.139s
D:\0\AdbStation>fastboot reboot-recovery
Rebooting into recovery OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
adbd is already running as root
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # mount -o remount,rw /system_root
mount: '/system_root' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /system
mount: '/system' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /
'/dev/block/dm-1' is read-only
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # ls
acct d init.environ.rc metadata sbin
apex data init.rc mnt sdcard
bin debug_ramdisk init.usb.configfs.rc odm storage
bugreports default.prop init.usb.rc oem sys
cache dev init.zygote32.rc proc system
charger etc init.zygote64_32.rc product ueventd.rc
config init lost+found product_services vendor
Armor_X5_Q:/ # cd apex
Armor_X5_Q:/apex # ls
com.android.apex.cts.shim [email protected]
[email protected] com.android.resolv
com.android.conscrypt [email protected]
[email protected] com.android.runtime
com.android.media [email protected]
com.android.media.swcodec com.android.tzdata
[email protected] [email protected]
Armor_X5_Q:/apex # exit
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.577s]
Writing 'recovery' OKAY [ 0.312s]
Finished. Total time: 0.889s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # exit
------------------------
Pay attention, the first part above, I flashed a twrp...
Below, I flash stock images... without closing adb window.
--------------------------------------------------------------
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.499s]
Finished. Total time: 1.373s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.484s]
Writing 'recovery' OKAY [ 0.328s]
Finished. Total time: 0.811s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # exit
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # cd /system
Armor_X5_Q:/system # cd bin
Armor_X5_Q:/system/bin # ls
Edit'd not relevant.. too long the things we can do list pissed one off...
Armor_X5_Q:/system/bin #
No MORE MAGISK!!!
It'a a feature of Android 10 and over lol... says so in the android docs....
who needs su when you have root?
SYSTEM_AS_ROOT
Voila...
it's in the understanding.
YouRoot

1) what is this
2) you could've pastebin'd the log files bruh
{Mod edited language - Regards Oswald Boelcke}

I dont use pastebin. I wanted to post my proof here. My call. thanks for the suggestion though, I mean, why send a good hack to another site when I would not have found it if it were not for comin here?
Surely xda deserve some credit, which I give by posting my flashing log here...
I know all will find what I posted will work to write a ro system.
Su and Magisk ARE dead, john wu says so...
I say this is why.
Flash boot-debug.img instead of boot.img gives
adb root
adb shell
# <- the point of root!!!
Ps, I may be a bro to my 3 sister's, but I aint no bro... :O
I find what they cant see, because they gave away the sight to see, what I see, they no longer can
Until I light the way....

Pachacouti said:
I dont use pastebin. I wanted to post my proof here. My call. thanks for the suggestion though, I mean, why send a good hack to another site when I would not have found it if it were not for comin here?
Surely xda deserve some credit, which I give by posting my flashing log here...
I know all will find what I posted will work to write a ro system.
Su and Magisk ARE dead, john wu says so...
I say this is why.
Flash boot-debug.img instead of boot.img gives
adb root
adb shell
# <- the point of root!!!
Ps, I may be a bro to my 3 sister's, but I aint no bro... :O
I find what they cant see, because they gave away the sight to see, what I see, they no longer can
Until I light the way....
Click to expand...
Click to collapse
1. ROOT su binary is already included in GSI builds (original author is phhusson and not topjhonwu) since the begining of the project. It's not a new thing. Here Magisk came to Hide this feature !
2. Magisk doesn't give only ROOT ... but the "systemless option" for the dynamic modules that is the half part of the whole package !
3. Have you tested SafetyNet ???
4. TWRP is already a root method since you can access to /data partition and other partitions too !
5. Oh yeah, it looks like you have an old device without dynamic partitions (aka SUPER) ...
Cheers

im not using gsi, i'm using stock ma man, stock!
it's actually genuine root with stock!
Allbeit different from what we used to call root, it is ultimately a rooted boot-debug, as in:
#
Oh, for the record everyone, I'm on an A-only arm64-v8a Armor x5, the mt6762 which also claims to be mt6765, running lates updated Android 10_Q, no, NOT PIE. System-as-Root
and I would not be writtng in the system_1.32 thread if I did not have a super.img partition...
which I am currently flashing using nothing more than replacing my stock boot.img with the stock boot-debug.img, though I had to unlock bootloader to do this...
couldn't chmod the system_1.32 if the # did not show, true or false?
No Magisk... No su... the secret is in adb root not being available in user OR production builds, so use boot-debug.img to be able to type adb root to type adb shell to get #
No twrp. Stock recovery is not available, using boot-debug.img, so I flash twrp anyway.
Beat that!!!
You CANT, cause it's true... following magisk makes you think you need root when you were already given it in stock rom, (only viable if you see boot-debug.img beside your boot.img in stock folder), now if this is true, and obviously it is, then why did john wu not notice?
too busy waiting on me...
Time for a BIG update from magisk then? Not. (needed, pmsl)
Selfie Clappin Syndrome has left the buiding...
Ps, attempting magisk on boot-debug.img kills all adb and root access gained by not doing so.
I can and do flash my twrp, and have done so now, from lopstom into recovery, since normal stock recovery does NOT show when using boot-debug.img, and system_1.32 has just given me rw access in twrp, so systemrw actually works with no su or magisk installed.
On with testing...
And for the record, this is where I found out what you now know:
VTS testing with debug ramdisk | Android Open Source Project
source.android.com
works on Android 10_q stock, NOTE THIS IS FOR GSI ON ANDROID 11
Im on stock. nuff said.
Oh, look... debug vendor... debug... yum yum

Oh, and safety net pass's, because the debug is legit (stock boot-debug.img) lol, oh look, no magisk...

The downside is... I'm sitting with a completely rooted fone... with no root apps.
busybox is replaced with, yup, you guessed it, toybox! not by me, but comes as stock...
last I heard before discovering this was toybox IS the new busybox...
It's actually like linux without the 'custom' - in adb shell lol...
And it is indeed the desktop launcher kicking us out of writing to system in the first place, when rooting, since the desktop launcher cannot run root commands,, as it has no root rights. forcing PIE and earlier roots simply wont cut it...
I have to say it folks... upgrade...
And write some updated apps that dont hold us back!!
Oh, and I'd forget a ro system, cause even with systemrw, it's only in twrp it's of use to me, but cant save anything TO it, so kinda pointless to me for now... then I remind myself this is written for pie lol...
Edit, and I'll add this:
With only one phone to work on, so no experience in a/b partitioning, I'll assume (bein the mother of all f'up's lol) that the reason a/b partitions exist is because a pie bootloader is 2 bootloader's, split into 2 when remixed into android 10, seperating the pie users access to variant=eng being available, to having to flash boot-debug.img since windows 10.
Here's the kicker... I have yet ot flash any cusstom rom.
From stock I flash boot-debug.img, and twrp recovery, followed by the backup super_fixed.bin created by system_1.32, reboot into twrp and can instantly mount system/vendor as is expected of system_1.32, the script is only required once, if you make a back up that is...
Yet I cannot load any custom rom the usual way... twrp may show mounting system, but even when fastbooting TO system, in adb or twrp, I have to reflash a super, so forget writing overlay file systems pandering to big companies, write a writable system knowing it's all contained in a SUPER image using boot-debug as root scource.
I can however, flash a super and load an entirely different OS, rw across the board... if I flash a super.img
The kicker is having a completely new root that comes with the fone and how it works...
su is pointless, as is magisk, you are already root.
Get it?
magisk takes this away.
so if your on android 10 and over... forget magisk, load your boot-debug, and take control of your new root tool.
magisk cant see the countless other mount points made for each file for each app for each gif for each bit of binary, each has it's own mount point lol...
it's gettin that way
Final point. Open a folder, go INTO it, and run any exe. While exe is running, attempt to delete folder exe is contained in. Now you know why you cant write a ro system. Close the exe, and viola!!
You cant mount a folder you already occupy in gui of fone. Ahem.. remount /system.
It's like typing su to get #
forget su
#
The greatest trick is convincin people of security when there is in fact none when it comes to software.
Their greatest security is their idiocy.
The PARTITIONS of history have taught us not to doubt insanity and it's virtues...

And for problems mounting systemrw, no problem, no root!!
Android OverlayFS Integration with adb Remount

Thank you for your efforts in a root solution.

Usin the above convoluted method, I can indeed rw the ro system.
I deleted childspace apk as test. It worked.
Using only this order:
Place stock boot.img, recovery.img and boot-debug.img in the adb folder.
Also place your 'here's one I made earlier' magisk_patched_bootloader.img here.
Now the nippage:
1: Unlock stock bootloader. Reboot into bootloader, after granting adb keys.
2: Flash boot-debug - NOTHING ELSE.
3: Reboot into fone gui.
4: adb root
adb disable-verity
adb reboot - (boot into bootloader)
5: Flash magisk'd boot.img
6 (optional, I did this) Flash backed up Super_fixed.bin (had to rename to img)
7: flash twrp...
Now you can do what you want.
After this I removed the magisk'd bin, returned to my debug and the childspace app I removed stayed removed from a ro system.
So yeah, there's your door, blank vbmetas prevent rw access using this method. Use your real vbmeta when flashing boot-debug, boot debug will NOT work with magisk installed, I tried every utha way... all we really need is a nu su app that works using this method instead of simlinkin the heck out of ...
Now how to do this without the magisk step, and keep it..?
user-debug (are not user or debug img's, but the third lol)
Now they ARE hard to find, need to make one, not my cup of tea...

something to add..
Busybox 1.31 Install error on Android 9 -- SOLVED · Issue #93 · meefik/busybox
OK, I managed to solve the installation issue with Android 9 on the Samsung Galaxy Tab S6. Here's how I did it: root the tablet by installing twrp, dm_verity and magisk boot into Android install ro...
github.com

Hi Pachacouti. Thanks for your interest in my SystemRW project. I hope it was helpful to you.
Pachacouti said:
Oh, and safety net pass's, because the debug is legit (stock boot-debug.img) lol, oh look, no magisk...
Click to expand...
Click to collapse
Where can I find this stock boot-debug.img file that you're talking about? I can't find it inside my stock Xiaomi firmware (MIUI).
Pachacouti said:
system_1.32 has just given me rw access in twrp, so systemrw actually works with no su or magisk installed.
Click to expand...
Click to collapse
Yes that's true my SystemRW script should work regardless of whether Magisk is installed yet or not. All you need for it to work is a root shell in recovery.
Have fun!

lebigmac said:
Hi Pachacouti. Thanks for your interest in my SystemRW project. I hope it was helpful to you.
Where can I find this stock boot-debug.img file that you're talking about? I can't find it inside my stock Xiaomi firmware (MIUI).
Yes that's true my SystemRW script should work regardless of whether Magisk is installed yet or not. All you need for it to work is a root shell in recovery.
Have fun!
Click to expand...
Click to collapse
To answer your first question, take the boot-debug.img from here, the first you see, and try it. if it is the same size, it will most likely work
Be aware that this is a 32mb in size bootloader, others are 64mb, they obviously wont work.
This is not to say a 64mb boot-debug.img will NOT work, it simply wont FIT.
Then be aware of a/b or a-only.
If you check the first post, from where I flashed all stock, I flashed the boot-debug.img to boot, NOT recovery. I am attempting to create a working twrp'd version for my fone, but I'm too slow for the instant gratificationist in me lol... using stock vbmeta... in otherwords, it would work, cause it's all legit, and how android 10, 11, and 12 actually work.
I find your script is a perfect find to see if we can indeed write to anything, now how to move what access you have in twrp to include mounting these 3 partitions dm-1, 2, 3, while in the actual gui...
Again, if you cant get into recovery, flash twrp to recovery after flashing boot-debug.img, It does work, but I think settings in recovery are not needed when booted to boot-debug, so the recovery is actually not necessary, but we're used to it, so NEED...
Edit, here's my boot-debug, thought I was in another thread lol..
And FFS, DONT try magisk with this, root is destroyed when doing so, this is not me dissin john wu, it's google fighting back... respect da john wu saaaa
Ps, enjoy this misunderstanding:
I flashed and ran systemrw_1.32 with NO root, no twrp, no recovery, I did it all in adb using nothing but boot-debug.img flashed to boot, with legit vbmeta.
In user builds, flashing blank vbmetas is what actually cause's the inability to manipluate ro system.
At least since PIE. Android 10_q and over... different ball game.

Pachacouti said:
And for problems mounting systemrw, no problem, no root!!
Android OverlayFS Integration with adb Remount
Click to expand...
Click to collapse
forreal

Did you know....
A few years back, when alcohol 120% came out, I downloaded a dvd that turned out to be corrupt. The image supplied by Alcohol 120% always came with an mdf file, and the disk image itself. Mdf is actually the md5 hash of the dvd.
When attempting to burn disk, I accidently chose the mdf, (md5 hash) instead of the actual disk image, and it turned out that the mdf hash reproduced the disk image byte for byte.
In otherwords, the 4.7gig dvd image was never necessary. That's 4.7gig reproducable from an md5 hash of say 100kb in size.
Now imagine this in fones. Dont store the file, store it's hash.
The CIA hate me now...

Anyway, here is the process so far:
Grab the boot-debug.img below, if it works for you good.
From stock, unlocked bootloader, set adb keys:
fastboot flash boot boot-debug.img
fastboot reboot <- just to see what we got
adb root
adb disable-verity <- the proper way to disable verity. No blank vbmetas required.
adb reboot
adb wait-for-device
adb root
adb remount <- wont work, because boot-debug.img is not a user-debug version of boot-debug.img, so I need to use a magisk'd boot to gain 'other' access.. later...
Note: adb shell avbctl disable-verification is only available in user-debug builds, so instead of boot-debug.img, prob look like user-debug.img. Notice how I disable it below.
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img 2>nul >nul <- Notice how I flash genuine vbmeta, including the end part '2>nul >nul' to flash twrp to recovery. This clears the way to flash super without flashing blank vbmetas... this will reset when flashing stock boot, so no problem to a dev...
fastboot flash recovery MyTwrp.img (rebooted after just to make sure the recovery stayed after typing '2>nul >nul' after the vbmeta) -it stayed.
fastboot flash super super_fixed.img <- Same test as above, now reboot into twrp to test rw capabilities. Mine all working.
fastboot reboot-recovery <- Go immediately to mount, tick system and vendor, if tick stays, voila, mine stays ticked...
Do twrp test using adb:
adb shell
# mount -o rw,remount rootfs /
Find way to install su lol, this is where I'm at now.
Dont say install the killer of su...

I then do:
Armor_X5_Q:/ # ls -l `which su`
total 1608
dr-xr-xr-x 4 root root 0 2021-09-27 13:00 acct
drwxr-xr-x 2 root root 40 2021-09-27 13:00 apex
lrwxrwxrwx 1 root root 11 2021-09-10 01:30 bin -> /system/bin
lrwxrwxrwx 1 root root 50 2021-09-10 01:30 bugreports -> /data/use
r_de/0/com.android.shell/files/bugreports
drwxrwx--- 6 system cache 4096 2010-01-01 00:03 cache
lrwxrwxrwx 1 root root 19 2021-09-10 01:30 charger -> /system/bin/
charger
drwxr-xr-x 4 root root 0 1970-01-01 00:00 config
lrwxrwxrwx 1 root root 17 2021-09-10 01:30 d -> /sys/kernel/debug
drwxrwx--x 55 system system 4096 2021-09-27 12:25 data
drwxr-xr-x 2 root root 0 2021-09-10 01:30 debug_ramdisk
lrwxrwxrwx 1 root root 12 2021-09-10 01:30 default.prop -> prop.de
fault
drwxr-xr-x 19 root root 3540 2021-09-27 13:00 dev
lrwxrwxrwx 1 root root 11 2021-09-10 01:30 etc -> /system/etc
drwxrwxrwx 13 root root 32768 1970-01-01 00:00 external_sd
-rw-r--r-- 1 root root 46380 2021-09-10 01:34 file_contexts
-rw-r--r-- 1 root root 865607 2021-09-10 01:30 file_contexts.bin
lrwxrwxrwx 1 root root 16 2021-09-10 01:30 init -> /system/bin/ini
t
-rwxr-x--- 1 root root 7073 2021-09-10 01:30 init.rc
-rwxr-x--- 1 root root 103 2021-09-10 01:30 init.recovery.hlthchrg.
rc
-rwxr-x--- 1 root root 58 2021-09-10 01:30 init.recovery.ldconfig.
rc
-rwxr-x--- 1 root root 312 2021-09-10 01:30 init.recovery.logd.rc
-rwxr-x--- 1 root root 8824 2021-09-10 02:14 init.recovery.microtrus
t.rc
-rwxr-x--- 1 root root 3686 2021-09-10 02:00 init.recovery.mt6762.rc
-rwxrwx--- 1 root root 854 2021-08-28 14:20 init.recovery.prepdecry
pt.rc
-rwxr-x--- 1 root root 213 2021-09-10 01:30 init.recovery.service.r
c
-rwxr-x--- 1 root root 7862 2021-09-10 01:30 init.recovery.usb.rc
drwxr-xr-x 3 root root 0 2021-09-10 01:30 license
drwxr-xr-x 5 root system 100 2021-09-27 13:00 mnt
drwxrwx--x 6 system system 4096 2021-01-01 09:33 nvcfg
drwxrwx--x 8 root system 4096 2021-01-01 08:06 nvdata
drwxr-xr-x 2 root root 0 2021-09-10 01:30 odm
-rw-r--r-- 1 root root 0 2021-09-10 01:30 odm_file_contexts
-rw-r--r-- 1 root root 0 2021-09-10 01:30 odm_property_contexts
drwxr-xr-x 2 root root 0 2021-09-10 01:30 oem
drwxrwx--x 5 system system 4096 2021-01-01 09:33 persist
-rw-r--r-- 1 root root 32079 2021-09-10 01:30 plat_file_contexts
-rw-r--r-- 1 root root 9476 2021-09-10 01:30 plat_property_contexts
dr-xr-xr-x 359 root root 0 1970-01-01 00:00 proc
drwxr-xr-x 12 root root 4096 2009-01-01 00:00 product
-rw-r--r-- 1 root root 0 2021-09-10 01:30 product_file_contexts
-rw-r--r-- 1 root root 0 2021-09-10 01:30 product_property_contex
ts
lrwxrwxrwx 1 root root 24 2021-09-10 01:30 product_services -> /sy
stem/product_services
-rw-r--r-- 1 root root 7414 2021-09-10 01:48 prop.default
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_f
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_s
-rw-r--r-- 1 root root 0 2021-09-10 01:30 relink_binaries-timesta
mp
-rw-r--r-- 1 root root 0 2021-09-10 01:30 relink_libraries-timest
amp
drwxr-xr-x 3 root root 0 2021-09-10 01:30 res
drwx------ 2 root root 0 2020-06-05 06:41 root
drwxr-x--- 2 root root 0 2021-09-10 01:30 sbin
drwxrwx--- 13 media_rw media_rw 4096 2021-09-27 13:06 sdcard
-rw-r--r-- 1 root root 465178 2021-09-10 01:30 sepolicy
drwxr-xr-x 2 root root 0 2021-09-27 13:00 sideload
drwxr-x--x 2 root root 0 2021-09-10 01:30 storage
dr-xr-xr-x 14 root root 0 2021-09-27 13:00 sys
drwxr-xr-x 7 root root 0 2021-09-27 13:09 system
drwxr-xr-x 21 root root 4096 2009-01-01 00:00 system_root
drwxrwxr-x 2 root shell 120 2021-09-27 13:07 tmp
drwxr-xr-x 5 root root 0 2021-09-10 01:55 twres
-rw-r--r-- 1 root root 0 2021-09-10 01:30 twrp_ramdisk-timestamp
-rw-r--r-- 1 root root 5900 2021-09-10 02:03 ueventd.mt6762.rc
-rw-r--r-- 1 root root 2969 2021-09-10 02:02 ueventd.rc
drwxrwxrwx 2 root root 0 2021-09-27 13:01 usbotg
drwxr-xr-x 14 root shell 4096 2009-01-01 00:00 vendor
-rw-r--r-- 1 root root 7759 2021-09-10 01:30 vendor_file_contexts
-rw-r--r-- 1 root root 218 2021-09-10 01:30 vendor_property_context
s
-rw-r--r-- 1 root root 0 2021-09-10 01:30 vendor_service_contexts
Armor_X5_Q:/ #
Edit:
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_f
drwxrwx--- 4 system system 4096 2010-01-01 00:10 protect_s
Why dm-1, 2, 3, cant be mounted even in root.

Pachacouti said:
Magisk is no more...
I present a new fool proof method of flashing su to Android 10_Q and above!!
I ranted and ranted about variant=user/user-debug/eng builds that I got no-where... people thinkin am dissin john wu, nah, I respect what I've learnt from his app forcing me to connect online, I want su without connecting, in order to secure my own fone.
Introducing proof!!
Simple. Instead of flashing boot.img
Flash boot-debug.img from stock.
This address's the lack of adb root.
Logs:
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash vbmeta vb
lankmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.000s]
Writing 'vbmeta' OKAY [ 0.000s]
Finished. Total time: 0.016s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.515s]
Finished. Total time: 1.404s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
MyTwrp.img
Sending 'recovery' (26086 KB) OKAY [ 0.718s]
Writing 'recovery' OKAY [ 0.406s]
Finished. Total time: 1.139s
D:\0\AdbStation>fastboot reboot-recovery
Rebooting into recovery OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
adbd is already running as root
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # mount -o remount,rw /system_root
mount: '/system_root' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /system
mount: '/system' not in /proc/mounts
1|Armor_X5_Q:/ # mount -o remount,rw /
'/dev/block/dm-1' is read-only
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # ls
acct d init.environ.rc metadata sbin
apex data init.rc mnt sdcard
bin debug_ramdisk init.usb.configfs.rc odm storage
bugreports default.prop init.usb.rc oem sys
cache dev init.zygote32.rc proc system
charger etc init.zygote64_32.rc product ueventd.rc
config init lost+found product_services vendor
Armor_X5_Q:/ # cd apex
Armor_X5_Q:/apex # ls
com.android.apex.cts.shim [email protected]
[email protected] com.android.resolv
com.android.conscrypt [email protected]
[email protected] com.android.runtime
com.android.media [email protected]
com.android.media.swcodec com.android.tzdata
[email protected] [email protected]
Armor_X5_Q:/apex # exit
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.577s]
Writing 'recovery' OKAY [ 0.312s]
Finished. Total time: 0.889s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # exit
------------------------
Pay attention, the first part above, I flashed a twrp...
Below, I flash stock images... without closing adb window.
--------------------------------------------------------------
D:\0\AdbStation>adb reboot bootloader
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot
-debug.img
Sending 'boot' (32768 KB) OKAY [ 0.764s]
Writing 'boot' OKAY [ 0.499s]
Finished. Total time: 1.373s
D:\0\AdbStation>fastboot --disable-verity --disable-verification flash recovery
recovery.img
Sending 'recovery' (20646 KB) OKAY [ 0.484s]
Writing 'recovery' OKAY [ 0.328s]
Finished. Total time: 0.811s
D:\0\AdbStation>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
/system/bin/sh: su: inaccessible or not found
127|Armor_X5_Q:/ # exit
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # cd /system
Armor_X5_Q:/system # cd bin
Armor_X5_Q:/system/bin # ls
Edit'd not relevant.. too long the things we can do list pissed one off...
Armor_X5_Q:/system/bin #
No MORE MAGISK!!!
It'a a feature of Android 10 and over lol... says so in the android docs....
who needs su when you have root?
SYSTEM_AS_ROOT
Voila...
it's in the understanding.
YouRoot
Click to expand...
Click to collapse
So, your bootloader is unlocked and your bootimage-debug gives root to you and the entire world. In other words, here is the key to my house, and by the way, there is no lock. And by another way, there will be nothing left in the house soon. Nice.

optimumpro said:
So, your bootloader is unlocked and your bootimage-debug gives root to you and the entire world. In other words, here is the key to my house, and by the way, there is no lock. And by another way, there will be nothing left in the house soon. Nice.
Click to expand...
Click to collapse
Oi... EVERY rooted fone has an unlocked bootloader, your point being?
Oh... I'm taking away profit from some... never noticed until you came along.. {Mod edit}
And you trust magisk... {Mod edit}
That would not tell you of THIS exploit:
{Mod edit: Disrespectful behaviour removed - Regards Oswald Boelcke}

Edit:
(Do all this offline... )
Flash magisk'd boot, but in gui, dont update internet, in fact, dont run it.
Install busybox-1.31.1-46.apk (do all this offline) but u cant install it yet, because magisk has no internet, but busybox will give you an option to install to, or edit the install.sh to say install dir / instead of /system, it did install what it could to the required directory, and if magisk'd bootloader grants su to busybox...
(it did in mine...) Reboot back into bootloader
Then reflash boot-debug.img, flash stock recovery, and reboot again, wot no magisk?
Now see:
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb remount
/system/bin/remount exited with status 2
remount failed
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
Armor_X5_Q:/ #
D:\0\AdbStation>adb root
restarting adbd as root
D:\0\AdbStation>adb remount
/system/bin/remount exited with status 2
remount failed
D:\0\AdbStation>adb shell
Armor_X5_Q:/ # su
Armor_X5_Q:/ # ^C
130|Armor_X5_Q:/ #
130|Armor_X5_Q:/ #
Notice it said nothing of user build or production build, and oh, you need to cntrl/c to exit this... then type exit... but notice who is logged in before :/
Su working in my fone, now to try with boot.img
Rememer: All stock