[Q] rooting and heimdall - General Questions and Answers

How do I root a Samsung Galaxy xcover 2 using Heimdall, and what files i need?
Heimdall under Linux. and did the tests in an xterm "jazzbo$ sudo heimdall detect" and "jazzbo$ sudo heimdall print-pit". It worket. Printed the pit info and rebooted the phone. So i guess ti will work under Linux.
Can someone tell what file to install and what command line options to use,
Thanks JazzBo

root xcover2 with heimdall
Hi JazzBo
I have managed to root my xcover2 with heimdall. here is your instruction:
download the files provided for Odin from TheBoegl's post: http://forum.xda-developers.com/showthread.php?t=2204889&page=5
then you need to extract the xyz.tar.md5 into the single files
[email protected]# tar tvf S7710XXAMB6_S7710OXEAMB3-20130628.tar.md5
-rwxrwxrwx root/root 7038976 2013-06-27 20:57 boot.img
-rwxr-xr-x root/root 43274652 2013-06-28 20:12 cache.img
-rwxrwxrwx root/root 67875252 2013-02-25 14:39 hidden.img
-rwxrwxrwx root/root 12933416 2013-02-25 14:36 modem.bin
-rwxrwxrwx root/root 393472 2013-02-25 14:35 STE_boot1.img
-rwxrwxrwx root/root 393472 2013-02-25 14:35 STE_boot2.img
-rwxrwxrwx root/root 1023079252 2013-06-28 14:51 system.img
I would recommend you to use the heimdall-frontend.....
then you load the *.pit which you already successfully managed to get from your phone into the heimdall-frontend.
and then you have to seperately load the files into the heimdall-frontend (see attached picture)
good luck
cheers
[email protected]

I tried this. The phone was flashed. But it didn't get rooted.
The reason why i wanted to root it was that it ran slow. A lot of apps started up just to die. I suspected some memory leak or something.
After the flash it run smoothly and all apps works. It is still not rooted.
Jazzbo

Related

[Q] Why not tar for backups?

Ok, I'll admit it, for a lot of things, especially system administration, I prefer the command line.
Is there a reason why I would not use tar to do "full backup" of data (as opposed to TiBackup or the like)?
One advantage is that I can extract a tar on another box and, for example, check it in to a VC system.
Admittedly, busybox tar isn't the most full-featured implementation (no one-file-system option, for example), but I believe it does have an exclude-from-file option that works.
I may be wrong, but I don't think tar on our phones can save ownership and permissions (too lazy to try it out right now). I suppose it wouldn't be too hard to write a script to save any info that tar would not preserve into a properties file and then have a restore script that would read the properties file and chown and chmod every file after extracting.
xviiivx said:
I may be wrong, but I don't think tar on our phones can save ownership and permissions
Click to expand...
Click to collapse
busybox tar appears to work like "any" tar, at least for non-extended attributes (I don't know if the kernel supports xattrs )
Code:
$ tar tvf test.tar | head -n 10
drwxr-xr-x 0/0 0 2011-02-07 20:58 system/etc/
-rw-r--r-- 0/0 15346 2011-02-07 20:58 system/etc/apns-conf.xml
-rw-r--r-- 0/0 25 2011-02-07 20:58 system/etc/hosts
-rw-r--r-- 0/0 99026 2011-02-07 20:58 system/etc/NOTICE.html.gz
-r-xr-x--- 0/2000 1200 2011-02-07 20:58 system/etc/init.goldfish.sh
-rw-r--r-- 0/0 1707 2011-02-07 20:58 system/etc/vold.fstab
-rw-r--r-- 0/0 195 2011-02-07 20:58 system/etc/gps.conf
drwxr-xr-x 0/0 0 2011-02-07 20:58 system/etc/security/
-rw-r--r-- 0/0 91755 2011-02-07 20:58 system/etc/security/cacerts.bks
drwxr-xr-x 0/0 0 2011-02-07 20:58 system/etc/security/drm/
and does appear to preserve links as well
Code:
$ tar tvf test2.tar | head -n 10
lrwxrwxrwx 0/0 0 2011-03-15 12:09 etc -> /system/etc
These were created using busybox tar from /system/etc and of /etc, adb pull-ed, and extracted on another system (Cygwin, in this case).
If you look in the TitaniumBackup directory on the sdcard, each app has 3 files:
appname.apk.gz- I didn't check, but obviously is probably just a backup of the apk
appname.tar.gz (looks like a tar of the /data/data/app dir)
appname.properties- looks like it includes a huge chuck of data for the icon and some misc information, a lot of which appears to be... market information?
I don't know how important the third file is, but it looks like Titanium is using tar. You could download a junk app and try it with that app and see if it works.
Just a guess, but I bet untarring may not be enough, you'll probably have to run the command "pm install" on each apk.
Thanks Fubuya!
That leads me to two useful "conclusions"
tar probably works just fine
TiBackup files are likely extractable on a POSIX box
Yeah, on linux, one is just text and I extracted the other two just fine (tar -zxvf for one and gunzip for the other). It's probably just a matter of finding out if there are any extra tricks you need to know about. Looks like Tibackup has a forum here, if you run into problems maybe they'd be nice enough to translate what's happening on the backend of their backup process.

Need help creating Odin flashable Tar

I am trying to learn how to make an odin flashable Stock Rom Tar file for the SCH-i815 for backup purposes.
After running this command through terminal emulator:
ls -al /dev/block/platform/dw_mmc/by-name​
Terminal emulator spits these out:
lrwxrwxrwx root root 2012-09-08 13:24 CACHE -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2012-09-08 13:24 DATAFS -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2012-09-08 13:24 EFS -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2012-09-08 13:24 FACTORYFS -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2012-09-08 13:24 HIDDEN -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2012-09-08 13:24 KERNEL -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2012-09-08 13:24 LTE -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2012-09-08 13:24 PARAM -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2012-09-08 13:24 RECOVERY -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2012-09-08 13:24 SBL1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2012-09-08 13:24 SBL2 -> /dev/block/mmcblk0p3​
Those are the partitions for my device. After reading around, it seems I can dump them to my sdcard using this command through terminal emulator on my device:
dd if=/dev/block/"mmc_partition_here" of=/SdCard/backup/"mmc_partition_name_here" bs=4096​
Is this correct? and If so, is it recommended that I dump and repackage all partitions in a tar file? or would Recovery, Kernel, Factoryfs, and LTE be enough? Every google result i read seems to imply Kernel, Recovery and Factoryfs are all that is needed, with modem being optional.
I would be dumping this from 100% stock rom with SU.
Once all is dumped, I woul be packaging the files in a tar file using this command:
tar -H ustar -c recovery.img system.img modem.bin zImage> package_name.tar
md5sum -t package_name.tar >> package_name.tar
mv package_name.tar package_name.tar.md5​
Can anyone with experience chime in? I wanna make sure this is correct before i attempt this, I don't want to bork my tab.
Hey!
Never used odin, only heimdall in rare cases, to restore my backups I use terminal emu..
you are correct.
ex. to backup stock rfs system_fs
dd if=/dev/block/mmcblk0p9 of=/sdcard/system.rfs bs=4096
to restore
dd if=/sdcard/system.rfs of=/dev/block/mmcblk0p9
You can flash recovery ,kernel ,data ,modem while system is even running with terminal emulator,
maybe also system while system is running, but I have not tested this..
biopsin said:
Hey!
Never used odin, only heimdall in rare cases, to restore my backups I use terminal emu..
you are correct.
ex. to backup stock rfs system_fs
dd if=/dev/block/mmcblk0p9 of=/sdcard/system.rfs bs=4096
to restore
dd if=/sdcard/system.rfs of=/dev/block/mmcblk0p9
You can flash recovery ,kernel ,data ,modem while system is even running with terminal emulator,
maybe also system while system is running, but I have not tested this..
Click to expand...
Click to collapse
I have pulled System, Kernel and Recovery successfully.
I am able to successfully create and flash Kernel and Recovery tar files separately, but when I try to make a single tar with System, Kernel and Recovery Odin fails and spits this out:
<OSM> Enter CS for MD5..
<OSM> Check MD5.. Do not unplug the cable..
<OSM> Please wait..
<OSM> i185Stock.tar.md5 is valid.
<OSM> Checking MD5 finished Sucessfully..
<OSM> Leave CS..
<ID:0/013> Odin v.3 engine (ID:13)..
<ID:0/013> File analysis..
<ID:0/013> SetupConnection..
<ID:0/013> Initialzation..
<ID:0/013> Get PIT for mapping..
<ID:0/013> Firmware update start..
<ID:0/013> factoryfs.img
<ID:0/013> NAND Write Start!!
<ID:0/013>
<ID:0/013> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)​
I used the following command line entries to create the single tar and md5:
tar -H ustar -c factoryfs.img recovery.img zImage > i185Stock.tar
md5sum -t i185Stock.tar >> i185Stock.tar
mv i185Stock.tar i185Stock.tar.md5​
Any ideas? Would changing the order of the dumps when creating a tar file make a difference?
EDIT: Changing the order when creating the tar file soft bricks it as it fails when it gets to factoryfs Kernel and Recovery I have no problem creating a tar and flashing, but system will fail in Odin during flash. I don't know why system won't flash.
Seems a dumped factoryfs won't flash without some more work done on a linux box: http://forum.xda-developers.com/showpost.php?p=20654525&postcount=15
jivy26 said:
Code:
dd if=/dev/block/mmcblk0p9 of=/sdcard/factoryfs.img bs=4096
That wont flash in odin you still need to make it 512M so quick run down in linux
Download this http://dl.dropbox.com/u/53644280/ext4_utils.zip
So you can view contents of .img
Code:
mkdir tempdir; mount -o loop factoryfs.img tempdir
To repack img w/ 512M
Code:
./mkuserimg.sh -s /some/directory/ ./factoryfs_custom.img ext4 ./temp 512M
Then making a TAR ball.
Click to expand...
Click to collapse
I need someone with a linux box to repack the factoryfs to 852
Thank you for this!!! I, too, am interested in creating an ODIN tar file for my SCH-I815 tablet. I saw this one here for the Verizon Galaxy S III, and perhaps it'll give a clue on how to do it on our tablet.
http://forum.xda-developers.com/showthread.php?t=1777579
AlpineMan said:
Thank you for this!!! I, too, am interested in creating an ODIN tar file for my SCH-I815 tablet. I saw this one here for the Verizon Galaxy S III, and perhaps it'll give a clue on how to do it on our tablet.
http://forum.xda-developers.com/showthread.php?t=1777579
Click to expand...
Click to collapse
I used this, among others, as a guide ;p I have been researching this for a while.
I am able to dump System, Kernel and Recovery. I can even make Odin flashable tar files of Kernel and Recovery. I can't get System/Factoryfs to flash successfully tho, It always fails. I've never used linux before, but I'm thinking i might as well give it a go since I've been unsuccessful thus far.
Gilbot said:
I used this, among others, as a guide ;p I have been researching this for a while.
I am able to dump System, Kernel and Recovery. I can even make Odin flashable tar files of Kernel and Recovery. I can't get System/Factoryfs to flash successfully tho, It always fails. I've never used linux before, but I'm thinking i might as well give it a go since I've been unsuccessful thus far.
Click to expand...
Click to collapse
I'll ask the author of that GS3 ODIN thread to see if he can chime in here.
Any progress on this?
Sent from my SPH-L710 using Xparent SkyBlue Tapatalk 2
No, I put it on the backburner until I can get Linux installed and learn how to use it.
Sent from my SCH-I815 using xda premium

SM-G361F - Pre-rooted rom development

Hello,
I'm not able to build (repackage) correctly system.img for SM-G361F, output is always rejected by both Odin (10.3.7) and Heimdall
I'm trying to repackage (pre-root) system.img taken from "G361FXXU1APA2_G361FOXX1APA1_G361FXXU1APA2_HOME.tar.md5" (taken from ETL factory image named ETL-G361FXXU1APA2-20160202095551.zip )
Step-by-step:
1) tar xvf G361FXXU1APA2_G361FOXX1APA1_G361FXXU1APA2_HOME.tar.md5 system.img
2) simg2img system.img system.img.raw
3) mount system.img.raw /mnt
4) made changes
5a) make_ext4fs -s -g 32768 -b 4096 -T -1 -S file_contexts -f -l 1843M system.repack.img /mnt/
5b) mkuserimg.sh -s /mnt system.repack.img ext4 system 1843M file_contexts
6) tar --owner 0 --group 0 --numeric-owner -H ustar -c system.img > G361F_SYSTEM.tar
7a) Load either system.img through Heimdall (PIT file downloaded through Heimdall is here: http://forum.xda-developers.com/showpost.php?p=65779994&postcount=146 )
7b) Load G361F_SYSTEM.tar in Odin v3.10.7 in AP tab and flash it
On ODIN/Download screen I can see that
1) FRP LOCK: OFF
2) KNOX: 0x0
3) System status: official
4) RP SWREV: S1, L1, M1
Notes
1) I have checked the box "OEM Unlock" in Developers settings to enabled
2) "file_contexts" is taken from booted up device through ADB (adb pull /file_contexts)
3) I've tried repackage the image without making any changes
4) When I compare original and repackaged images ("ls -lsaR" outputs), it seems like owner:group permissions are not persisted
5) I've tried both simg2img/make_ext4fs/mkuserimg.sh from CM12.1 repository (up to date today) and from https://github.com/ASdev/android_img_repack_tools (branch android-5.1.1)
6) I'm not sure about size 1843M, however flashing fails in the same manner when I go with 1536M and 2048M and anything between those two
7) Heimdall fails at about 6% of flashing single (sparse system.img) file with error "Failed to unpack received packet"
OSS Kernel for SM-G361F is here: https://github.com/smarek/G361F-Kernel
OSS Platform for SM-G361F is here: https://github.com/smarek/G361F-Platform
Questions are:
1) Is there anything special to be aware of when building for Samsung devices?
2) Did I miss or misunderstood any step in system.img repackaging process?

[GUIDE|HOW-TO|ROOT] Cube iWork 10 i15-TCL - Root / Recovery / Boot.img [WIN|LINUX]

Code:
*** Disclamer
* Your warranty is now void.
*
* We are not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at us for messing up your device, we will laugh at you.
Hi guys and girls, as you may know it's pretty easy to find here on xda but on other forums (techablets for example) info and files for rooting this tablet, but who has the TCL variant /which is Dual Boot Type C one) will only find outdates files and complex guides; that's the reason why - after spending a lot of time on bootloops and fails trying to figure how the hell modify the boot.img) I finally decided to share what I found here.
First thing first: this guide collects, improves and updates how-to from Laura of techtablets; I also want to thanks @jetfin and @master.pumpgun (aka Tom on techtablets) - they know why!
I will basically divide this guide per two: first section is READY TO FLASH, where you'll find my own boot.img (from and ONLY for the latest available stock build); before flashing this image file PLEASE be sure to check if your version is the same I had when preparing the image; also you should absolutely check the MD5 of all the files you will download from here:
check MD5 on any Linux distro by simply typing
Code:
md5sum /path/to/file/file
on Windows you could maybe use this tool: WinMD5
The second section is DO IT YOURSELF, and it's for users with a different kernel/build version from mine. I'll try to eventually update the boot.img if we will receive any new OTA, which I think will never happen. I'll write the second section as soon as possible, but I can speed work up if requested and if Cube updates
- - - - - - - - - - -​
---> READY TO FLASH
Code:
PLEASE NOTE
While the general procedure here reported remains
always correct, the files provided in this part of the
guide - specially the modified boot.img may not work
into your device is the kernel and build version are different
from the one I had, so please go to Settings, About tablet
and check if your specs meet mine:
[B]Model[/B] i15-TCL
[B]Kernel[/B] 3.14.37-x86_64-L1-R517 [email protected] #1
Sat May 7 17:02:18 CST 2016
[B]Build[/B] i15-TCL_V1.0_20160507
If you want to root your i15-TCL there's an high chance you would not need nothing more than backup your data, install drivers and adb/fastboot tools and flash file you will download here! BUT you need to have the same kernel and build as I had when prepared the boot.img file, which is the latest at the moment I'm writing. If you know about a newer version lease notify me and I'll try to process it again.
Last but not least, please note that is a pretty long and detailed Guide, I tried to explain and illustrate every single step, also covering some very common issues you may have, so please don't blame on me if it's a long story to read, I'm sure that a few newbies will appreciate
First thing to do is to backup data you want to restore because we need to unlock the bootloader (unfortunately there's no way to achieve the root without that, I tried everything I could but it's not possible). Also a general backup of all your partitions (both Windows both Android) could help and make you feel more comfortable. To backup partition please refer this thread on techtablets: The big threads of how-tos. Windows users could also have to install the proper Intel driver attached to end of the post.
Once you did that install adb/fastboot:
if you use Windows you can use this tool;
if you use a Linux distro please check if the package android-tools (more info here is available for your distro, otherwise you may have to install the official Android SDK (info about that here; no need Android Studio).
Into your tablet go to Settings / About tablet and press 7 times the Build number fields to enable Developer options; now go Back and tap the new voice Developer option: be sure that the main switch is ON and so the OEM unlocking and the USB debugging ones.
Connect your tablet to your PC, open the command prompt or a Linux shell and type
Code:
adb devices
you should receive an output like
Code:
adb devices
List of devices attached
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
0123456789ABCDEF device
If not, please please stop and check previous steps, but also:
If you use Linux and you see a udev error about permissions you have two solutions: one is running the adb/fastboot by root/sudo, another one is to let udev correctly recognize your idVendor and so your device (always prefer this last way, if possible!), which you can do by following this great mini tutorial on StackOverflow
If you use Windows 64bit try to install the driver attached below; don't know if they are also available for 32bit.
Now you have the basic stuff prepared and you are ready to go to fastboot/bootloader, so this is the last time you could check if your build is the same I had, so please do it if you missed that step before. Once more, the info you read from Settings / About tablet have to be
Code:
[B]Model[/B] i15-TCL
[B]Kernel[/B] 3.14.37-x86_64-L1-R517 [email protected] #1
Sat May 7 17:02:18 CST 2016
[B]Build[/B] i15-TCL_V1.0_20160507
Into your command prompt or shell type
Code:
adb reboot-bootloader
Your device will now go to fastboot mode. You can use your Volume Down / Volume Up to move choose menu commands and Power button to pick one. At the moment you don't need to pick any, so check if you have these two lines in red:
Code:
[COLOR="Red"]SECURE BOOT - disabled
LOCK STATE - unlocked[/COLOR]
If you have these exact lines you can jump to step10. My bootloader (and also Tom one) was already unlocked; others people reported it was locked, I guess it depends from where we bought the device. So, if your bootloader has those two red lines (which means the bootloader is already unlocked) go to step 10. If you have similar lines but in white and with different text, go to next step
CAUTION: this will permanently erase your userdata partition, which is where you store the applications and their data; you may also have there downloads, music, videos and photos so BE SURE you updated your relevant stuff!! If want to go further type into your command prompt/shell
Code:
fastboot devices
and check if you have the right output, that is
Code:
0123456789ABCDEF fastboot
If so, go on by typing:
Code:
fastboot oem unlock
This will erase your data and finally unlock the bootloader. you'll see something like that
Code:
...
OKAY
[ 0.162s] finished. total time: 0.162s
Now reboot the bootloader: move between the menu with the Volume rockers and press Power when you selected the Restart bootloader command. Wait for reboot, choose Android and you are on bootloader / fastboot mode again. Now you should absolutely have those two lines in red from step 6.
Download modified boot.img rootboot_mod.img and once finished PLEASE CHECK THE MD5 of the file: it should ABSOLUTELY match this one: 53cc4b08b123489e7c73cb013742f35d
Type on command prompt/shell
Code:
fastboot flash boot /path/to/your/file/rootmod_boot.img
Let the magic happen!
Now download the custom TWRP recovery (courtesy of @vampirefo), check if MD5 is correct (3c05a8704f5a77e20a45364c7a822a2b) and flash it with
Code:
fastboot flash recovery /path/to/your/file/i15_recovery.img
Use the Volume rockers to pick the Recovery mode command and press Power to go to recovery. Swipe to allow modification, go to Mount and tap the System checkbox
Download the latest SuperSu recovery flashable version available here, check the MD5 reported in that page and then from your tablet in recovery tap Advanced and then Adb Sideload. Swipe to let sideload mode start and type into your command prompt / shell (and change the path /opt/android-sdk/platform-tools/ with the path where YOU installed adb/fasboot)
Code:
adb sideload /path/to/your/file/supersu_file_you_downloaded.zip
If you are on Linux and you have udev permissions issues again when sideloading proceed like that
Code:
cd /opt/android-sdk/platform-tools
su
Password:
[email protected]*********:/opt/android-sdk/platform-tools# ./adb kill-server
[email protected]*********:/opt/android-sdk/platform-tools# ./adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[email protected]*********:/opt/android-sdk/platform-tools# ./adb devices
List of devices attached
0123456789ABCDEF sideload
[email protected]*********:/opt/android-sdk/platform-tools# ./adb sideload /path/to/your/file/supersu_file_you_downloaded.zip
If you have issues on Windows or still having issues on Linux you can always copy the SuperSu zip to a USB Pen and attach the pen to the tablet using the OTG cable or paste the file to a micro SD.
Reboot your device and it's done!
Doing that instead of using the well know root.bat is much better - IMHO - because we don't have to reboot the device two times and we don't have to uninstall SuperSu and flash a new version to update binaries (SuperSu it is not able to update the binaries by itself, nor by recovery nor by app. Also remember that when a new version os SuperSU will be available: Open SuperSu app, go to Settings and tap on Reinstall. Wait for it to finish and shut down the device. Go to bootloader (or use adb when the device is still on), download latest updated flashable SuperSu zip and flash via recovery).
DOWNLOADS SECTION
rootmod_boot.img
i15_recovery.img
- - - - - - - - - - -​
---> DO IT YOURSELF
WARNING: to do that you need a Linux machine / Virtual machine!
First, be sure to have adb and fastboot working; if issues read the first section for common solutions; you should also have already unlocked your bootloader.
If you did not create a dd backup of your partition I recommend once again to do that; you should at least backup android_boot, android_recovery, android_system (but also consider android_bootloader and android_bootloader2). Please note that to check partition in a human readable mode you can use
Code:
adb shell
ls -las /dev/boot/by-name/*
Now we should create our working folders environment; you can do that by yourself or follow my suggstions.
Open a terminal as normal user; you should be in your home folder; launch the following commands one by one
Code:
mkdir -p Android/iWork10/_working/ ; cd Android/iWork10
mkdir _stockimg ; cd _stockimg
adb shell
su
dd if=/dev/block/by-name/android_boot of=/sdcard/boot.img
cd /sdcard/
md5sum boot.img > bootmd5
exit
please note that you could have to execute the exit command 2 times; just be sure to go back to your terminal into your
Code:
/home/USER/Android/iWOrk10/_stockimg
if su is still not available try to dd the same; for me the bootloader was already unlocked and I had no issue to create the dd image
Then
Code:
adb pull /sdcard/boot.img
adb pull /sdcard/bootmd5
and check if MD5 is OK with
Code:
md5sum -c bootmd5
if error recreate the boot image file, if OK go on.
Now we need to download and extract the Android Bootimg Tools; click this link and save it into the
Code:
/home/USER/Android/
folder; once downloaded (the file it's less than 8 kB) we'll extract the two file in the _working dir so to have all the stuff organized; please note that it's important to keep files organized because we'll decompress and re-compress the boot partition and the kernel it contains; if we don't move files appropriately unneeded stuff could go into the kernel! So please try to understand the process or to follow my steps
Code:
cd ../_working/
tar -zxvf ../../android_bootimg_tools.tar.gz
mkdir bootimg
./unpackbootimg -i ../_stockimg/boot.img -o bootimg/
As you can see we unpacked the stock boot.img to the folder bootimg we just created..
Now let's extract the ramdisk, that is where we were pointing from the start..
Code:
cd bootimg ; mkdir ramdisk ; cd ramdisk
gunzip -c ../boot.img-ramdisk.gz | cpio -i
Now if you are familiar with nano or pico terminal continue on terminal to apply the following mods, otherwise open your file manager to the ramdisk folder, then open the default.prop file and change
Code:
ro.secure=1
to
Code:
ro.secure=0
Save and close the editor.
Open the init.rc file and change
Code:
service media /system/bin/mediaserver
class main
user [COLOR="Red"]media[/COLOR]
to
Code:
service media /system/bin/mediaserver
class main
user [COLOR="Red"]root[/COLOR]
Please note here that if your bootloader was unlocked without your intervention you could have already user root (I had). In that case just leave as it is and close, otherwise save and close.
Go back to your terminal, you should still be into the ramdisk folder, if not navigate with cd to go to that folder and then
Code:
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
Now we have our new ramdisk; at this point we need to open the boot.img-cmdline file that is located into the bootimg folder and copy its content, then go back to the terminal; the terminal should be still in ramdisk folder, so
Code:
cd ..\..\
and we are into the _working folder.
Now the last command, that you CANNOT simply copy and paste. The command is something like that (hold on, don't execute it)
Code:
./mkbootimg --kernel bootimg/boot.img-zImage --ramdisk bootimg/newramdisk.cpio.gz --cmdline 'CONTENT OF YOUR boot.img-cmdline CONTENT HERE; PUT IT BETWEEN SINGLE ' BOTH AT THE START BOTH AT THE END' -o root_boot.img
Please note the double -- for kernel, ramdisk and cmdline options (while single - for -o that stays for output) and also note the single ' peaks that contain the boot.img-cmdline content.. So in my case it will be:
Code:
./mkbootimg --kernel bootimg/boot.img-zImage --ramdisk bootimg/newramdisk.cpio.gz --cmdline 'loglevel=5 androidboot.hardware=cht_cr_mrd_w firmware_class.path=/system/etc/firmware i915.fastboot=1 memmap=4M$0x5c400000 vga=current i915.modeset=1 drm.vblankoffdelay=1 enforcing=0 androidboot.selinux=permissive console=ttyS0,115200n8 bootboost=1 pm_suspend_debug=1 pstore.backend=ramoops' -o ../root_boot.img
BUT PLEASE DON'T COPY AND PASTE THIS ONE; JUST USE YOUR boot.img-cmdline FILE (I'm pretty sure they are identical but cannot be sure, SO USE YOURS)
If the command doesn't give errors or the standard output that describe the usage of a linux command (so like usage: mkbootimg --kernel <filename> --ramdisk <filename> - this means you missed something) we are done, we just need to flash it and root. So we now have our modified boot image which will let the tablet boot a rooted OS without bootloop.
If you haven't do it already go to download latest Recovery Flashable zip of SuperSU from SuperSu webpage and the custom TWRP recovery for this device that you find in the first section (also check MD5) and copy both to your internal of external sdcard (if you are not familiar with sideload)
Reboot your device to bootloader with
Code:
adb reboot-bootloader
Once it's there,
Code:
fastboot flash boot /home/USER/Android/iWork10/root_boot.img
fastboot flash recovery /path/where/you/downloaded/recovery.img
Now use the volume rockers to pick RECOVERY MODE option and press the Power button. The device will boot the TWRP recovery; allow system modifications when asked and finally flash the SuperSu zip file you downloaded and copied to the tablet (or use adb sideload /path/to/supersu/into/your/pc/supersufile.zip)
You may need to adjust settings in TWRP (timezone and language), then reboot the system and you should have rooted your i15-TCL!
It's easy, isn't it?
PLEASE NOTE: If you have errors like adb, fastboot not recognizing your device, don't ask but read the other section where I explain the most common solution for Windows and Linux; same if you don't find links for recovery, SuperSU or other read the first section, thanks!
- - - - - - - - - - -​
THANKS
@jetfin for providing a lot of goodies that saved my ****** last month (wish you all the best for the next future mate!)
@master.pumpgun (aka Tom on techtablets - amazing guy! :good
@vampirefo for custom TWRP for this device
Laura - for all the info she's made available for this device
Great job mate!
It seems very analytical and very useful for people who need a step by step guide.
Unfortunately it requires a full wipe of user data, so for now I am not willing to try this guide.
Sent from my i15-TCL using Tapatalk
RASTAVIPER said:
Great job mate!
It seems very analytical and very useful for people who need a step by step guide.
Unfortunately it requires a full wipe of user data, so for now I am not willing to try this guide.
Sent from my i15-TCL using Tapatalk
Click to expand...
Click to collapse
Well, I feel you, unlocking is always annoying but there are apps which let you backup everything.
I couldn't live without root + Link2SD into the cube!
Thanks for the nice words ?
Inviato dal mio Nexus 7 utilizzando Tapatalk
Hi brainvison,
it`s a nice, correct and clear tutorial, many thanks.
Only one question
Fortunately I have an unlocked bootloader, then I`ll do it from step 10, but I have a same kernel and build version (3.14.37/x86_64-L1-R517 and V1.0) but the date of this version is different (20160913).
What do you suggest, try it? Or could you help me to create a new version of the boot.img, please?
Nice regards
Peter
brainvision said:
Code:
PLEASE NOTE
While the general procedure here reported remains
always correct, the files provided in this part of the
guide - specially the modified boot.img may not work
into your device is the kernel and build version are different
from the one I had, so please go to Settings, About tablet
and check if your specs meet mine:
[B]Model[/B] i15-TCL
[B]Kernel[/B] 3.14.37-x86_64-L1-R517 [email protected] #1
Sat May 7 17:02:18 CST 2016
[B]Build[/B] i15-TCL_V1.0_20160507
Click to expand...
Click to collapse
​
rpeter said:
Hi brainvison,
it`s a nice, correct and clear tutorial, many thanks.
Only one question
Fortunately I have an unlocked bootloader, then I`ll do it from step 10, but I have a same kernel and build version (3.14.37/x86_64-L1-R517 and V1.0) but the date of this version is different (20160913).
What do you suggest, try it? Or could you help me to create a new version of the boot.img, please?
Nice regards
Peter
Click to expand...
Click to collapse
both kernel and build dates are different, aren't them?
I'll try to write the missing section as soon as possible, don't worry..
In the meantime could you please check a few things that could help to understand a few things?
If your bootloader is unlocked you should have no issue doing that; assuming you already have adb working, open a terminal and execute this commands (just "read" commands, no mods here)
Code:
adb shell
uname -a
cat default.prop
If errors try to execute adb root (this does NOT root, it just use adb as root user, it should work with the unlocked bootloader) before adb shell and if possible please report me the output from unameand cat
EDIT: also my advice is to backup your system partitions so to able to go back to stock if needed; at least partitions
Code:
android_boot
android_bootloader
android_bootloader2
android_recovery
android_system
To do that you could check Laura's thread from techtablets or use
Code:
dd if=/dev/by-name/your_partition of=/sdcard/your-partition.img
the if= option is where you choose the partition to backup while the of= one is the resulting file that will be created (an image .img file)
If you agree you could also upload those somewhere on the cloud so we could use them, too, it would be interesting to see what changes.. Naturally the partition I suggested do not contain any personal file, no worry about that (your data is on the android_userdata - or _data, don't remember the name here).
EDIT2: you'll need a Linux machine to mod your boot.img partition, do you have one?
brainvision said:
both kernel and build dates are different, aren't them? yes, both of the are the same date:20160913
the build.prop is:
Code:
[email protected]:/system # cat build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=LMY47I
ro.build.display.id=i15-TCL_V1.0_20160913
ro.build.version.incremental=eng.softteam.20160913.102513
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1
ro.build.version.security_patch=2016-03-01
ro.build.version.base_os=
ro.build.date=Tue Sep 13 10:26:20 CST 2016
ro.build.date.utc=1473733580
ro.build.type=userdebug
ro.build.user=softteam
ro.build.host=pdd-build
ro.build.tags=release-keys
ro.build.flavor=cht_cr_mrd_w-userdebug
ro.product.model=i15-TCL
ro.product.brand=i15-TCL
ro.product.name=cht_cr_mrd_w
ro.product.device=i15-TCL
ro.product.board=i15-TCL
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=x86
ro.product.cpu.abilist=x86,armeabi-v7a,armeabi
ro.product.cpu.abilist32=x86,armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=i15-TCL
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=gmin
# ro.build.product is obsolete; use ro.product.device
ro.build.product=cht_cr_mrd_w
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=cht_cr_mrd_w-userdebug 5.1 LMY47I eng.softteam.20160913.102513 release-keys
ro.build.fingerprint=intel/cht_cr_mrd_w/cht_cr_mrd_w:5.1/LMY47I/softteam09131026:userdebug/release-keys
ro.build.characteristics=tablet
# end build properties
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.dalvik.vm.isa.arm=x86
ro.enable.native.bridge.exec=1
sys.powerctl.no.shutdown=1
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=100m
dalvik.vm.heapsize=174m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
ro.opengles.version=196609
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=5.1_r1
ro.gnss.sv.status=true
ro.hwui.texture_cache_size=24.0f
ro.hwui.text_large_cache_width=2048
ro.hwui.text_large_cache_height=512
drm.service.enabled=true
keyguard.no_require_sim=true
ro.com.android.dataroaming=true
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Ring_Synth_04.ogg
ro.config.notification_sound=pixiedust.ogg
ro.carrier=unknown
ro.config.alarm_alert=Alarm_Classic.ogg
persist.sys.language=zh
persist.sys.country=CN
persist.sys.timezone=Asia/Shanghai
persist.sys.dalvik.vm.lib.2=libart.so
dalvik.vm.isa.x86.features=sse4_2,aes_in,popcnt,movbe
dalvik.vm.lockprof.threshold=500
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
# begin fota properties
ro.fota.platform=IntelZ3735F_5.1
ro.fota.id=mac
ro.fota.type=pad_phone
ro.fota.oem=hampoo-cherrytrail_5.1
ro.fota.device=i15-TCL
ro.fota.version=i15-TCL_V1.0_20160913
# end fota properties
[email protected]:/system #
I'll try to write the missing section as soon as possible, don't worry..
Many thanks
Code:
adb shell
uname -a
cat default.prop
the adb root and the cat is ok, but the uname is not found
the output of the cat is:
Code:
127|[email protected]:/ # cat default.prop
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.sf.lcd_density=240
ro.frp.pst=/dev/block/by-name/android_persistent
persist.intel.ogl.username=Developer
persist.intel.ogl.debug=/data/ufo.prop
persist.intel.ogl.dumpdebugvars=1
ro.ufo.use_msync=1
ro.ufo.use_coreu=1
wifi.interface=wlan0
persist.service.apklogfs.enable=1
persist.core.enabled=0
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=1
ro.modules.location=/lib/modules
ro.dalvik.vm.native.bridge=libhoudini.so
persist.sys.usb.config=mtp,adb
persist.nomodem_ui=true
ro.zygote=zygote32
dalvik.vm.dex2oat-Xms=64m
dalvik.vm.dex2oat-Xmx=256m
dalvik.vm.image-dex2oat-Xms=64m
dalvik.vm.image-dex2oat-Xmx=64m
[email protected]:/ #
EDIT: also my advice is to backup your system partitions so to able to go back to stock if needed; at least partitions
Code:
android_boot
android_bootloader
android_bootloader2
android_recovery
android_system
All of my partitions expect the largest one(maybe windows) were backed up to sd with dd
If you agree you could also upload those somewhere on the cloud so we could use them, too, it would be interesting to see what changes.. Naturally the partition I suggested do not contain any personal file, no worry about that (your data is on the android_userdata - or _data, don't remember the name here).
I will upload it to somewhere, but which partitions are you need (i don't no clearly, how can I determinate, which partition is the boot, bootloader, ...)
the outputs of the /proc/partitions are the following:
Code:
[email protected]:/ # cat /proc/partitions
major minor #blocks name
254 0 102400 zram0
179 0 61071360 mmcblk0
179 1 102400 mmcblk0p1
179 2 102400 mmcblk0p2
179 3 30720 mmcblk0p3
179 4 30720 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 16384 mmcblk0p6
179 7 2621440 mmcblk0p7
179 8 262144 mmcblk0p8
179 9 8388608 mmcblk0p9
179 10 1024 mmcblk0p10
179 11 8192 mmcblk0p11
179 12 102400 mmcblk0p12
179 13 16384 mmcblk0p13
179 14 48361472 mmcblk0p14
179 15 1024000 mmcblk0p15
179 48 4096 mmcblk0rpmb
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 64 15671296 mmcblk1
179 65 15667200 mmcblk1p1
253 0 2600764 dm-0
maybe the *p3 is the bootloader, the *p14 is the windows, maybe the *p9 included the data and *p7 is the system, but don't know, which one is the boot, bootloader2, recovery
EDIT2: you'll need a Linux machine to mod your boot.img partition, do you have one?
Click to expand...
Click to collapse
yes, I have, a debian.
One question, if we have any problem with the upload the modified bootloader, how can i restore the old one (how can I upload (which method, adb, fastboot, or the phone flash?) an original bootloader, if we have a problem with the modded bootloader)
Have you link(s) with the full original windows and andoid image of the i15-tcl? I found to i15-t, i15-td, but not for this version...
Nice regards
Peter
i have the same software version as rpeter. When i first boot in fastboot my bootloader was unlocked and secure boot was disabled. Itried flash twrp and it was succesful. Next i downloaded superSu zip from official website and i flashed it. After reboot i stuck at bootlogo. Can you share me a system image to restore?
The mmcblk0p9 partition is the system? I will share it as soon as possible.
07 is system. 09 is data partition.
https://drive.google.com/file/d/0B_QRR9kog1iZQ2ZaNzdZenQ4MkE/view?usp=sharing
@rpeter I'll read your long reply asap, now just want to tell you that to check partition in a human readable way you should use
Code:
ls -las /dev/block/by-name/*
the partition I would like you to share are
Code:
android_boot
android_bootloader
android_bootloader2
android_system
android_recovery
when using dd of course as I told you can directly point to that name convention (which are nothing but symbolic link) so
Code:
dd if=/dev/block/by-name/android_boot of=/sdcard/android_boot.img
this is for the boot partition, the other the same..
also please before uploading to cloud check the MD5 so we could verify it before installing
are you sure you wrote uname -a the right way? It's weird you don't have it...
About restoration, you could use fastboot in future, I tried it by myself.. the most important are
Code:
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img
I don't think we'll ever need the two bootloader restoration, it's just to go extremely safe but I still don't find a reason to flash them.. But backup anyway!
EDIT: please note the .img extension for the of= part of the dd command!
@boberq sorry for your issue but I have to say that it was obvious: it's not plenty of guides and how-to about this tablet but the few available are also easy to find, and they all clearly state that you need to modify the boot image before rooting, otherwise as you know now, bootloop!
so, if you guys need to immediately root you can send me the boot.img file and I do it for you, otherwise you can wait and do it by yourself - I'm going to write the how-to right now, it should be ready for tomorrow, I guess..
EDIT and yes, we don't have any full restoation image like for other variants, I asked them on Twitter https://twitter.com/CubeHeping (it seems this is their official account that I found via www.51cube.com) - please do the same, maybe they will listen to us
I flashed i15 td rom and it works without auto rotation. If rpeter share images i want flashthe stock.
---------- Post added at 12:52 PM ---------- Previous post was at 12:44 PM ----------
I flashed a i15td rom and everything is fine without auto rotate. Rpeter please share boot and system images, they help me to restore the stock rom.
Ps After first boot if i want enter to recovery , it show red triangle with green android. There was any recovery.
boberq said:
I flashed i15 td rom and it works without auto rotation. If rpeter share images i want flashthe stock.
---------- Post added at 12:52 PM ---------- Previous post was at 12:44 PM ----------
I flashed a i15td rom and everything is fine without auto rotate. Rpeter please share boot and system images, they help me to restore the stock rom.
Ps After first boot if i want enter to recovery , it show red triangle with green android. There was any recovery.
Click to expand...
Click to collapse
stock recovery is not a real recovery there.. Red triangle is the right thing.. BUT if you flashed the custom TWRP with
Code:
fastboot flash recovery recovery.img
you should have noticed that the process failed.. I don't remember the exact output but you should have seen FAILED instead of SUCCESS. If flash succeed you also need stock recovery, I guess, otherwise it should still bootloop after system restore..
@brainvision
Has anything changed about rooting?
I remember that the process was involving resetting in order to unlock bootloader, etc
Sent from my m1 note using Tapatalk
RASTAVIPER said:
@brainvision
Has anything changed about rooting?
I remember that the process was involving resetting in order to unlock bootloader, etc
Sent from my m1 note using Tapatalk
Click to expand...
Click to collapse
nope, and it never will in that direction..
you should definitively make a backup, the more you'll wait the worst it'll be!
I flashed twrp and from it i want flash supersu and i get bootloop. After this i flashed i15td rom andeverything works fine. So can i flash boot,recovery and system image and get stock without root? Or should i flash it using intel flash tool?
boberq said:
I flashed twrp and from it i want flash supersu and i get bootloop. After this i flashed i15td rom andeverything works fine. So can i flash boot,recovery and system image and get stock without root? Or should i flash it using intel flash tool?
Click to expand...
Click to collapse
you can flash them with fastboot indeed and then root again, I finished writing my how-to, I'm formatting it and update the first post in an hour max..
Never looked at Intel Flash Tool, I don't know if it permits the flash of a single partition or if you need a full image provided by OEM, can't help with that..
So i'm waiting for original images from rpeter and i'm goind to flash it. I have a twrp backup with original 20160913 firmware but after bootloop. I can sare it but i think it isnt usefull.
PS
Brainvision , can you share me your original partition images for i15TCL from May? I think it will repair my autorotation.
boberq said:
So i'm waiting for original images from rpeter and i'm goind to flash it. I have a twrp backup with original 20160913 firmware but after bootloop. I can sare it but i think it isnt usefull.
PS
Brainvision , can you share me your original partition images for i15TCL from May? I think it will repair my autorotation.
Click to expand...
Click to collapse
I do NOT recommend you to flash that because you will completely mess things up, having boot, recovery and kernel with a build date and system with a different one! You went to fast on rooting your device without reading stuff, now I suggest you to wait for @rpeter images - but anyway here it is system.img https://mega.nz/#!YBdw1bIT!GibOWLBNyXAhwEiEdXIV3JKKdMM9gXzLIYvppKn0Bgs
EDIT: guys I updated OP with the missing sectioon, please click thanks if you find it useful..
@rpeter before rooting remember to backup partition with dd, then upload when you can but backup before rooting!
if you have suggestion for the guide or you think something is not so clear please tell me that I'll try to improve..
brainvision, boberq, I'm so sorry, yesterday is one of my longest working day...
My gdrive is currently full, bu I created a dedicated place for yours in my server.
The link is: http://rpeter.dyndns.info/xda
user: xda_users
pwd: i15-tcl
It's included all partitions compressed and uncompressed version expect p9 and p14 (data and windows) and the md5 checksum file.
The output of the "identification" is here:
Code:
127|[email protected]:/ # ls -las /dev/block/by-name/*
lrwxrwxrwx root root 2016-11-12 12:21 Basic_data_partition -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2016-11-12 12:21 EFI_system_partition -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2016-11-12 12:21 Microsoft_reserved_partition -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2016-11-12 12:21 android_boot -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2016-11-12 12:21 android_bootloader -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2016-11-12 12:21 android_bootloader2 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2016-11-12 12:21 android_cache -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2016-11-12 12:21 android_config -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2016-11-12 12:21 android_data -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2016-11-12 12:21 android_metadata -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2016-11-12 12:21 android_misc -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2016-11-12 12:21 android_persistent -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2016-11-12 12:21 android_recovery -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2016-11-12 12:21 android_system -> /dev/block/mmcblk0p7
[email protected]:/ #
I will put it somewhere fastest place, when I have enough time to do it
Nice regards
Peter
rpeter said:
brainvision, boberq, I'm so sorry, yesterday is one of my longest working day...
My gdrive is currently full, bu I created a dedicated place for yours in my server.
The link is: http://rpeter.dyndns.info/xda
user: xda_users
pwd: i15-tcl
It's included all partitions compressed and uncompressed version expect p9 and p14 (data and windows) and the md5 checksum file.
The output of the "identification" is here:
Code:
127|[email protected]:/ # ls -las /dev/block/by-name/*
lrwxrwxrwx root root 2016-11-12 12:21 Basic_data_partition -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2016-11-12 12:21 EFI_system_partition -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2016-11-12 12:21 Microsoft_reserved_partition -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2016-11-12 12:21 android_boot -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2016-11-12 12:21 android_bootloader -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2016-11-12 12:21 android_bootloader2 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2016-11-12 12:21 android_cache -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2016-11-12 12:21 android_config -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2016-11-12 12:21 android_data -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2016-11-12 12:21 android_metadata -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2016-11-12 12:21 android_misc -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2016-11-12 12:21 android_persistent -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2016-11-12 12:21 android_recovery -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2016-11-12 12:21 android_system -> /dev/block/mmcblk0p7
[email protected]:/ #
I will put it somewhere fastest place, when I have enough time to do it
Nice regards
Peter
Click to expand...
Click to collapse
great work mate!
Thanks a lot. As you may have read I updated the OP with the new section, hope you'll find useful and clear enough, if not don't hesitate to ask, it will be a pleasure to help and to improve the how-to

Samsung Note 20 Ultra return to stock

Hi,
I've got a Samsung Galaxy Note 20 Ultra 5G C2S SM-N986B (exynos). I managed to root the device successfully and now I've found a hardware fault and need to send it back for warranty so I'm looking to remove the rooting process all together.
I did the following to root it
1. Enabled dev mode, enable OEM unlock + usb debugging
2. Rebooted into download mode
3. Unlock bootloader and checked OEM unlock and USB Debugging still on
4. Rebooted back into download mode
5. Installed TWRP using Heimdall command;
~/src/Heimdall/build/bin/heimdall flash --RECOVERY twrp-3.7.0_11-0-c2s.img --VBMETA vbmeta.img
NOTE: I downloaded the vbmeta.img from https://corsica.nu/vbmeta.img
6. Flashed Magisk through TWRP
7. Format data through TWRP
8. Flash multidisabler for stock rom rooting
adb push multidisabler-samsung-3.5-corsicanu.zip /
This all worked great but after using the phone I found that 4G data wasn't working and I don't think it was before rooting but cannot be sure. This is a second hand phone and the cover looks non-stock and isn't stuck on properly, hence why I want to return on a warranty basis as I believe it's a hardware fault happening here. Sometimes if I shake the phone the 4G works a little of data (700kbps max).
Anyway I've done the following so far to unroot
1. uninstalled completely the root from Magisk app
2. Booted into download screen and reset the boot loader
At this point I'm stuck in the downloading screen with the following error;
: ODIN MODE (SVB Fail)!
: vbmeta: Error verifying vbmeta image: HASH_MISMATCH (3)
: CUSTOM VBMETA
: VBMETA G973FXXS9DTI8, 34489444R
When I hold the vol down + side button for 7 seconds it reboots back into the downloading screen.
Once a Samsung phone is rooted, it trips Knox (efuse) and this cannot be undone. You can still use Odin to flash it back to stock firmware and not rooted, but due to Knox being tripped most places this will void any warranty you may have had, so you are probably stuck with it.
This is the reason people need to thoroughly read and research before rooting their phones, especially Samsung ones as once they have had the bootloader unlocked and rooted it trips the Knox and cannot be reversed.
Yes I'm aware that it might of voided the warranty. I would still like to get it out of this loop that it's currently in and also back to stock just to test if the 4G issue is software based or hardware.
map7 said:
Yes I'm aware that it might of voided the warranty. I would still like to get it out of this loop that it's currently in and also back to stock just to test if the 4G issue is software based or hardware.
Click to expand...
Click to collapse
You will now need to boot into download mode and reflash stock ROM with Odin, that should put it back to stock other than Knox being tripped.
samorgs60 said:
You will now need to boot into download mode and reflash stock ROM with Odin, that should put it back to stock other than Knox being tripped.
Click to expand...
Click to collapse
It's currently in a downloading mode but I cannot flash anything. I get this error on the terminal
➜ samsung_note_20_ultra ~/src/Heimdall/build/bin/heimdall flash --RECOVERY twrp-3.7.0_11-0-c2s.img --VBMETA vbmeta.img
Heimdall v1.4.2
Copyright (c) 2010-2017 Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au/
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Initialising connection...
Detecting device...
Claiming interface...
Setting up interface...
Initialising protocol...
Protocol initialisation successful.
Beginning session...
Some devices may take up to 2 minutes to respond.
Please be patient!
Session begun.
Downloading device's PIT file...
PIT file download successful.
Uploading RECOVERY
100%
RECOVERY upload successful
Uploading VBMETA
100%
VBMETA upload successful
Ending session...
ERROR: Failed to receive session end confirmation!
Releasing device interface...
And this error on the phone;
No signinfo: (RECOVERY)
Custom Binary (RECOVERY) Blocked By OEM Lock
If I hold down voldown + side key for 7 seconds it reboots directly back into the same Downloading screen. I cannot get back to the downloading screen I was at before where I can 'unlock OEM bootloader'. How do I get back there? Do I have to wait until the battery runs out of power?
I just managed to do it.
1. Hold down VolDown + Bixby for 7 seconds
2. As soon as the screen goes blank, hold down VolUp + VolDown + connect USB to PC
This was hard to do and took me a few goes at it, but in the end it worked and I'm now back to the screen where I can do a long press of Volume Up to enter 'Device unlock mode' and unlock the bootloader.
It would be nice to flash the original VBmeta file for this phone where would I get such a file?
Where do I get the Stock ROM for this phone?
map7 said:
I just managed to do it.
1. Hold down VolDown + Bixby for 7 seconds
2. As soon as the screen goes blank, hold down VolUp + VolDown + connect USB to PC
This was hard to do and took me a few goes at it, but in the end it worked and I'm now back to the screen where I can do a long press of Volume Up to enter 'Device unlock mode' and unlock the bootloader.
It would be nice to flash the original VBmeta file for this phone where would I get such a file?
Where do I get the Stock ROM for this phone?
Click to expand...
Click to collapse
Not sure about the VBmeta file, but the stock ROM you can get from sammobile or I use an app on my PC called Frija, just need to enter in the model of your phone, which you have already said is the SM-N986B, then in the CSC box you need to enter in what your country code is DBT is the one I use which is from Germany but I'm in Australia, press check update button then once it has found it, hit the download button.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
map7 said:
I just managed to do it.
1. Hold down VolDown + Bixby for 7 seconds
2. As soon as the screen goes blank, hold down VolUp + VolDown + connect USB to PC
This was hard to do and took me a few goes at it, but in the end it worked and I'm now back to the screen where I can do a long press of Volume Up to enter 'Device unlock mode' and unlock the bootloader.
It would be nice to flash the original VBmeta file for this phone where would I get such a file?
Where do I get the Stock ROM for this phone?
Click to expand...
Click to collapse
s a m f w . com
server google drive.
high speed download.
map7 said:
And this error on the phone;
No signinfo: (RECOVERY)
Custom Binary (RECOVERY) Blocked By OEM Lock
If I hold down voldown + side key for 7 seconds it reboots directly back into the same Downloading screen. I cannot get back to the downloading screen I was at before where I can 'unlock OEM bootloader'. How do I get back there? Do I have to wait until the battery runs out of power?
Click to expand...
Click to collapse
if you have windows os try to recover with samsung switch pc application
or download from samfw and flash via odin
I only have Linux machines. I've compiled Heimdall & the heimdall-frontend. I've used this in the past to install TWRP successfully on many phones but I'm confused on how to flash the stock firmware using this tool.
I've done the following so far;
1. Started heimdall-frontend GUI
2. Downloaded the pit file
3. Download the Stock ROM from https://samfw.com/firmware/SM-N986B/OPS/N986BXXU5GWA5A
4. Unzipped that file and I get the following files
Code:
AP_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT_meta_OS13.tar.md5
BL_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
CP_N986BXXU5GVL2_CP23419976_QB60212932_REV01_user_low_ship_MULTI_CERT.tar.md5
CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
HOME_CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
5. Remove md5 extension from each file
6. Untar each file and I get the following files;
Code:
-rw-r--r-- 1 map7 map7 1.2K Jan 5 13:59 dqmdbg.img.lz4
-rw-r--r-- 1 map7 map7 636K Jan 5 13:59 dtbo.img.lz4
-rw-r--r-- 1 map7 map7 21M Jan 5 13:56 boot.img.lz4
-rw-r--r-- 1 map7 map7 6.4K Jan 5 14:16 C2S_EUR_OPEN.pit
-rw-r--r-- 1 map7 map7 1.6K Jan 5 14:09 cache.img.lz4
drwxr-xr-x 2 map7 map7 4.0K Jan 5 14:30 meta-data
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:07 misc.bin.lz4
-rwxrwxr-x 1 map7 map7 31M Dec 12 14:26 modem.bin.lz4
-rwxrwxr-x 1 map7 map7 4.8M Dec 12 14:26 modem_debug.bin.lz4
-rw-r--r-- 1 map7 map7 1.2K Jan 5 14:09 omr.img.lz4
-rw-r--r-- 1 map7 map7 717K Jan 5 14:10 optics.img.lz4
-rw-r--r-- 1 map7 map7 933M Jan 5 14:10 prism.img.lz4
-rw-r--r-- 1 map7 map7 34M Jan 5 13:56 recovery.img.lz4
-rw-r--r-- 1 map7 map7 5.8G Jan 5 14:28 super.img.lz4
-rw-r--r-- 1 map7 map7 863M Jan 5 14:09 userdata.img.lz4
-rw-r--r-- 1 map7 map7 3.6K Jan 5 14:28 vbmeta.img.lz4
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:28 vbmeta_samsung.img.lz4
7. I unlz4'd each of these to get the img/bin files
8. Then I started to match these files up to the partitions in the heimdall-frontend from my loaded pit file.
9. I then hit start, but it just finished too quick with no error message. It didn't seem to transfer anything.
I'm I even on the right track here?
Have I forgotten a step?
Would it be better to use the heimdall command line? If so which parameters do I use to load this stock image?
Do I have the write ROM?
map7 said:
I only have Linux machines. I've compiled Heimdall & the heimdall-frontend. I've used this in the past to install TWRP successfully on many phones but I'm confused on how to flash the stock firmware using this tool.
I've done the following so far;
1. Started heimdall-frontend GUI
2. Downloaded the pit file
3. Download the Stock ROM from https://samfw.com/firmware/SM-N986B/OPS/N986BXXU5GWA5A
4. Unzipped that file and I get the following files
Code:
AP_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT_meta_OS13.tar.md5
BL_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
CP_N986BXXU5GVL2_CP23419976_QB60212932_REV01_user_low_ship_MULTI_CERT.tar.md5
CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
HOME_CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
5. Remove md5 extension from each file
6. Untar each file and I get the following files;
Code:
-rw-r--r-- 1 map7 map7 1.2K Jan 5 13:59 dqmdbg.img.lz4
-rw-r--r-- 1 map7 map7 636K Jan 5 13:59 dtbo.img.lz4
-rw-r--r-- 1 map7 map7 21M Jan 5 13:56 boot.img.lz4
-rw-r--r-- 1 map7 map7 6.4K Jan 5 14:16 C2S_EUR_OPEN.pit
-rw-r--r-- 1 map7 map7 1.6K Jan 5 14:09 cache.img.lz4
drwxr-xr-x 2 map7 map7 4.0K Jan 5 14:30 meta-data
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:07 misc.bin.lz4
-rwxrwxr-x 1 map7 map7 31M Dec 12 14:26 modem.bin.lz4
-rwxrwxr-x 1 map7 map7 4.8M Dec 12 14:26 modem_debug.bin.lz4
-rw-r--r-- 1 map7 map7 1.2K Jan 5 14:09 omr.img.lz4
-rw-r--r-- 1 map7 map7 717K Jan 5 14:10 optics.img.lz4
-rw-r--r-- 1 map7 map7 933M Jan 5 14:10 prism.img.lz4
-rw-r--r-- 1 map7 map7 34M Jan 5 13:56 recovery.img.lz4
-rw-r--r-- 1 map7 map7 5.8G Jan 5 14:28 super.img.lz4
-rw-r--r-- 1 map7 map7 863M Jan 5 14:09 userdata.img.lz4
-rw-r--r-- 1 map7 map7 3.6K Jan 5 14:28 vbmeta.img.lz4
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:28 vbmeta_samsung.img.lz4
7. I unlz4'd each of these to get the img/bin files
8. Then I started to match these files up to the partitions in the heimdall-frontend from my loaded pit file.
9. I then hit start, but it just finished too quick with no error message. It didn't seem to transfer anything.
I'm I even on the right track here?
Have I forgotten a step?
Would it be better to use the heimdall command line? If so which parameters do I use to load this stock image?
Do I have the write ROM?
Click to expand...
Click to collapse
flash the unzip stock rom with odin.
https://samfw.com/blog/download-odin-all-version.
csc for clean install.
home csc for dirty flash.
map7 said:
I only have Linux machines. I've compiled Heimdall & the heimdall-frontend. I've used this in the past to install TWRP successfully on many phones but I'm confused on how to flash the stock firmware using this tool.
I've done the following so far;
1. Started heimdall-frontend GUI
2. Downloaded the pit file
3. Download the Stock ROM from https://samfw.com/firmware/SM-N986B/OPS/N986BXXU5GWA5A
4. Unzipped that file and I get the following files
Code:
AP_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT_meta_OS13.tar.md5
BL_N986BXXU5GWA5_N986BXXU5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
CP_N986BXXU5GVL2_CP23419976_QB60212932_REV01_user_low_ship_MULTI_CERT.tar.md5
CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
HOME_CSC_OXM_N986BOXM5GWA5_MQB61003468_REV01_user_low_ship_MULTI_CERT.tar.md5
5. Remove md5 extension from each file
6. Untar each file and I get the following files;
Code:
-rw-r--r-- 1 map7 map7 1.2K Jan 5 13:59 dqmdbg.img.lz4
-rw-r--r-- 1 map7 map7 636K Jan 5 13:59 dtbo.img.lz4
-rw-r--r-- 1 map7 map7 21M Jan 5 13:56 boot.img.lz4
-rw-r--r-- 1 map7 map7 6.4K Jan 5 14:16 C2S_EUR_OPEN.pit
-rw-r--r-- 1 map7 map7 1.6K Jan 5 14:09 cache.img.lz4
drwxr-xr-x 2 map7 map7 4.0K Jan 5 14:30 meta-data
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:07 misc.bin.lz4
-rwxrwxr-x 1 map7 map7 31M Dec 12 14:26 modem.bin.lz4
-rwxrwxr-x 1 map7 map7 4.8M Dec 12 14:26 modem_debug.bin.lz4
-rw-r--r-- 1 map7 map7 1.2K Jan 5 14:09 omr.img.lz4
-rw-r--r-- 1 map7 map7 717K Jan 5 14:10 optics.img.lz4
-rw-r--r-- 1 map7 map7 933M Jan 5 14:10 prism.img.lz4
-rw-r--r-- 1 map7 map7 34M Jan 5 13:56 recovery.img.lz4
-rw-r--r-- 1 map7 map7 5.8G Jan 5 14:28 super.img.lz4
-rw-r--r-- 1 map7 map7 863M Jan 5 14:09 userdata.img.lz4
-rw-r--r-- 1 map7 map7 3.6K Jan 5 14:28 vbmeta.img.lz4
-rw-r--r-- 1 map7 map7 2.8K Jan 5 14:28 vbmeta_samsung.img.lz4
7. I unlz4'd each of these to get the img/bin files
8. Then I started to match these files up to the partitions in the heimdall-frontend from my loaded pit file.
9. I then hit start, but it just finished too quick with no error message. It didn't seem to transfer anything.
I'm I even on the right track here?
Have I forgotten a step?
Would it be better to use the heimdall command line? If so which parameters do I use to load this stock image?
Do I have the write ROM?
Click to expand...
Click to collapse
Have issues with heimdall too
But you can try Odin 4 from Mohammad afaneh on github, should work, or u make a windows vm and install the guest iso then you can use odin
Nico1544 said:
Have issues with heimdall too
But you can try Odin 4 from Mohammad afaneh on github, should work, or u make a windows vm and install the guest iso then you can use odin
Click to expand...
Click to collapse
Tried odin4 for linux and also borrowed my brothers Windows 11 machine and tried odin 3.14.4 and both of those also bomb out whilst writing the stock files.
Is it worth sending a file at a time instead of all at once?
I've currently got TWRP loaded, but it I go to wipe I get this error;
Code:
Failed to mount '/system_root' (Block device required)
Failed to mount '/vendor' (Block device required)
Failed to mount '/product' (Block device required)
Failed to mount '/odm' (Block device required)
Failed to mount '/prism' (Block device required)
I've tried installing DynaPatch-v1.5.zip through TWRP and doing a cold boot of the device back into TWRP, then an advanced wipe but still get the same issue and I cannot see 'system' in the list.
After flashing DynaPatch I went back to using heimdall_flash_stock scripts and it worked! I managed to put a stock Android 13 Samsung ROM back onto the phone and relock the bootloader. All the warnings are gone.
repacksuper/heimdall_flash_stock.sh samfw_stock_rom_android_13/Samfw.com_SM-N986B_OPS_N986BXXU5GWA5_fac.zip
I got the heimdall_flash_stock scripts from;
Installing GSI by repacking super.img on SM-A127F and SM-A325F (Linux)
repacksuper =========== Copyleft uluruman 2021-2022 (for LINUX/WSL only) This is the minimalistic set of tools + a script for Linux for the automated ground-up repacking and flashing of the Samsung Galaxy super.img, replacing the stock Android...
forum.xda-developers.com
They really helped get this all going again.

Categories

Resources