[ROM PATCH] OptimalROM 15-5 Stagefright Full Security Patch (And any other OG5 ROM!) - Verizon Galaxy S 5 Android Development

Developed out of this project:
https://forum.xda-developers.com/ve...-cid-11-6-0-security-patches-5-0-5-1-t3522355
--------------------------------------------
If you are running OptimalROM 15-5 (latest version) or any previous variants or ROMs based on pre PB1 images you are vulnerable to stagefright!
You may be wondering why you are vulnerable because Verizon rolled out stagefright patches when OG5 was released, which is what OptimalROM is based on. Unfortunately stagefright had further developments found later on, so another patch was later applied in PB1 (possibly OK3, I have not done checks on OK3), so any OG5 ROM is vulnerable to these new findings!
You can verify this is true on your device by using Zimperium's SF detector.
https://play.google.com/store/apps/d...frightdetector
--------------------------------------------
I am not an experienced android developer. I am only a poweruser, so I am not familiar enough to provide you with flashable zips. Perhaps a developer can assist with this!
Instead you can follow this guide to achieve a stagefright vulnerability free device.
Pre-Updating
This is where you get the patched files.
Since I am not a known developer on XDA, I will provide the steps I did that you can skip by downloading the .zip I provide. All of the files in the zip come directly from a stock PB1 install.
Skip this section if you just want to apply my zip without jumping ROMs to acquire the files yourself.
0. If you choose to do this, use SafeStrap and make a backup of all your partitions, that way when you finish you can easily restore to your OptimalROM with your configuration and data
1. Wipe everything (except extSD) and flash the PB1 ROM with Odin https://www.androidfilehost.com/?fid=24438995911970571
2. Root following the traditional OK3/PB1 root guide https://forum.xda-developers.com/verizon-galaxy-s5/general/root-method-og5-ok3-t3290370
2.5 (Optionally use SuperSUme to remove kingroot and install SuperSU) - I did this on my run
3. Update BusyBox through GooglePlay store. Install BusyBox. (needed to properly install SafeStrap)
4. Reinstall SafeStrap (do it now so you can easily recover)
5. Download some sort of filemanager that has root access and can mount system as read/write. I used Root Explorer (full version)
6. Grant root to filemanager and navigate to /system/lib
7. Select libutils.so, and every stagefright file. You will have selected a total of 34 files if done correctly.
-- Note: In Root Explorer I used search for "libutils" to find libutils, and searched "stagef" to find the other 33 files.
8. Copy these 34 files to a new folder on your extSD
9. Load SafeStrap, wipe everything (except extSD!) and restore your backup you took before you started this.
You just got all the patched files and need to only apply them to your current OptimalROM installation!
Here is the zip if you choose to skip the above steps!
https://www.androidfilehost.com/?fid=385035244224409960
Mirror:
http://www.filedropper.com/optimalrom-stagefright-securitypatch-pb1-based
Name: optimalROM-stagefright-securitypatch-PB1-based.zip
Size: 2807757 bytes (2 MB)
SHA1: CE3D6109C6EDD03352AF4E4DA03C64B5620938B2
Patching Vulns
This is where you apply the patched files.
1. Use your read/write root access capable filemanager and select ONLY libutils.so
2. Use Copy and paste the file to /system/lib
-- Confirm the overwrite request (and for some filemanager, confirm mount as read&write)
IT will FREEZE. Leave it alone!!!!
The screen will become unresponsive, but eventually it will reboot by itself.
Once this happens, you may appear to hang on the Samsung bootlogo. DO NOT touch!
The startup takes up to 6 minutes.
Once your system finishes starting, you may get a message saying "SYSTEM is not responding, KILL or WAIT or REPORT" Choose WAIT, it should work as usual.
3. Open Stagefright Detector. Verify that one of your vulnerabilities is gone (and replaced with a new name for the same CV).
4. Open your filemanager again. This time copy the other 33 files from your extSD and confirm all replacements in /system/lib
--Your system will not freeze this time. Once it completes, continue.
5. Reboot
6. Open Stagefright Detector
-- Hooray, no vulnerabilities!
Enjoy OptimalROM 15-5 with protection against stagefright!
Hopefully in the future flashable zips will make this easier once I learn how that works.

Just an FYI, I tested this against the new 6.0 firmware (QB2).
No change to stagefright, so if you choose to stay on 5.0 / OptimalROM, this patch is still adequate.
If any developer is familiar with making a flashable zip, please post/PM me.

Related

[SCRIPT] Multiboot via loop file, completely rewritten [25/10]

The script is now completely rewritten and a lot easier to use.
This is the general walkthrough for this script, if you have more questions than this answers please ask in this thread.
Download and unpack the script to the root of your sdcard, the easiest way to do this is to download it to the root of the sdcard and do the following:
1. start terminal session
2. cd /sdcard
3. tar xvf MakeLoopROM-Android-V11.tar
===============================================================================================================================
NEW! READ THIS! - The original ROMs and Packages are now stored in /sdcard/MakeLoopROM/original-roms and /sdcard/MakeLoopROM/original-packages. Copy the ROMs and packages
that you want to convert into those folders!
===============================================================================================================================
Ok, once you're done there you're ready to start the script, it's now completely menu driven.
1. start terminal session
2. cd /sdcard/MakeLoopROM
3. sh startup
That will start up the menu, for a new ROM work your way from 1 - 4 to make your first loop ROM, at the end of 4 it will be ready for installation, for upgrades that install into
existing loop files (that you have made once with step 1) start at step 2.
The menu options and how they work:
1. Make system, data or both loop files
This option will allow you to do just what it says, make the system and data images you'll install your ROM into, it's very
straightforward but i'll give a brief summary of how
it works.
"Do you want to make an image file to hold the system for this ROM? (not neccessary if it's an upgrade from a previous ROM) Y
for yes N for no."
Pretty straightforward, if you don't have a system loop file enter y for yes, if you're going to upgrade then running this
step is completely unneccessary but since you have
chosen to run it, press no.
"What do you want to call your system image? (give it a name you'll remember, like cm-7-system for a cm-7 loop install)"
Name the system loop file, call it whatever you want but make it something relevant to the ROM or you'll end up wondering what
that file is for when you stumble upon it at a
later time. it'll be stored under /multiboot/system-loop-files when it's done.
"What size do you want your system image to be (in MB's)? (WARNING: if you make it too small your ROM +other packages like
gapps might not fit, make it 250)"
The size of /system for the loop ROM, read the thread you downloaded the ROM from to find out what size is ok, i just use 250
for everything in case i want to reuse it with full
at a later time.
"Do you want to make an image file to hold the data for this ROM? (not neccessary if it's an upgrade from a previous ROM or
you want to share a data image with another ROM)
Y for yes N for no."
Same as with the system loop file, if you don't have one, you'll want one, if you're upgrading you shouldn't be running this
step but there is another time when you want to say
no to this, when you want to share a loop file with another installation (not with NAND ROMS). Like for example if you want to
share the data partition between CM-10 and PA-JB.
"What do you want to call your data image? (give it a name you'll remember like cm-7-data for a cm-7 loopinstall)"
Same as for the system loop file, just name it something relevant, the name is of no importance to it's function.
"What size do you want your data image to be (in MB's)? (This file will hold all of your data, don't skimp on the size)"
How many apps do you plan to install? 10 - 50 - 500?
Make it a size that you can live with and that will fit on your sdcard, it really depends on how many apps you'll install.
2. Make a Loop ROM
It's exactly what it says, this will make your loop ROM ready for installation.
"Available ROMs:"
just enter the number that's next to the ROM you want to convert, if it's not there it's because you didn't copy it to /sdcard
/MakeLoopROM/original-roms, you can do so now and
hit r to refresh the list.
"You previously created the system loop file [nameofyourfile], do you want to use it for this ROM? (y/n)"
You'll only get this question if you created a system loop file by going through step 1. If you did so and that's the file you
want to use (check the [nameofyourfile]) then
answer y for yes, otherwise you answer n for no and the following question comes up.
"Available system loop files:"
This choice will only come up if you answered no to the previous question or didn't make your system loop file with the script
in step 1 during this session. Anyways, just enter
the number next to the file you want to use as a system loop file.
"You previously created the data loop file [nameofyourfile], do you want to use it for this ROM? (y/n)"
See the system loop file above, this is the same but for the data loop file
"Available data loop files:"
See the system loop file above, this is the same but for the data loop files
Do you want this installation to format the data image used with this ROM?
Answer Y for yes if it's a new installation and N for no if you are upgrading
and want to keep the data on the data image. (Say yes if you would run wipe
data/factory reset in recovery if this was a normal install)
Y if this is a new install or you're reusing an old data loop file that you want to wipe.
when done hit enter to get back to the menu.
3. Make a loop package (such as gapps)
This, like it says, is for converting non-rom packages (not kernel packages though) such as gapps or bravia or what have you.
"Available packages:"
type the number that is next to the package you want to convert, if the package isn't there you didn't copy it to /sdcard
/MakeLoopROM/original-packages
"You previously created the system loop file [nameofyourfile], do you want to use it for this ROM? (y/n)"
You'll only get this question if you created a system loop file by going through step 1. If you did so and that's the file you
want to use (check the [nameofyourfile]) then
answer y for yes, otherwise you answer n for no and the following question comes up.
"Available system loop files:"
This choice will only come up if you answered no to the previous question or didn't make your system loop file with the script
in step 1 during this session. Anyways, just enter
the number next to the file you want to use as a system loop file.
Repeat No. 3 for all your packages
4. Make (or update) NAND boot image.
This will read the information in your boot partition and store it as boot.img under /sdcard/multiboot so you can boot back to
your NAND installed ROM by running step 6 or
flashing nandboot.zip (also stored under /sdcard/multiboot) from cwm.
Run this every time you update your NAND ROM so the boot.img is fresh.
"This script will update your nand boot.img in the multiboot folder to the version of boot.img you're currently running, make
sure you're running the updated ROM and not
a loop ROM before hitting Y for yes here. If you're not sure type N for no."
If you updated your NAND ROM or haven't run this option before you have to say y for yes here, you have to run this option at
least once or you can't boot back to NAND. Just
make sure you've got your NAND ROM booted and not a loop rom because this will take the boot partition content of your
currently running ROM.
5. Remove a loop installation
If you've come this far you know what you're doing in this option. I'm not going to go through all combinations but they are
self-explanatory.
6. Boot an installed ROM.
Exactly what it says, just remember that even non-installed ROMs may be listed here, if you happen to try to boot to one of
those it will hang at boot, in that case, pull the
battery, reboot to recovery (press and hold vol down while you press power) and use the boot zips that have been created for
your roms.
the Boot zips are located in /sdcard/multiboot/nandboot.zip for the NAND and /sdcard/multiboot/loop-roms
/[namofyoursystemloopfile]/[nameofyourROM]boot.zips
I think that's all, if there is any questions, feel free to ask.
Android version: MakeLoopROM-Android-V11.tar
MD5: 1b33ad6c3078711444c01867e436b65a
===============================================DEPRECATED==============================================================
It took a while but i managed to sort out how to boot to loop filesystems stored on the SD-card.
This means that you don't have to partition anything and you can have as many ROMs installed as you can fit on your SD-card.
You don't have to worry about a2sd/S2E/mounts2sd or anything like that (just make your data partition large enough to hold your apps, you can share the data partition between as many loop ROMs as you like) but this doesn't prevent it either, your sd-ext partition will be untouched and mountable by any ROM you install into a loop file (if the ROM supports sd-ext, that is). Swap will work just fine too.
The script is self explanatory but there are a few things it doesn't explain so i'll explain it here.
Here we go:
1a. Download the MakeLoopROM(version).zip and unpack it to any directory of your choice, just remember where you put it, if you're going to do this under cygwin i suggest you put it in a directory that is easily accessible from the cygwin terminal (IE cygwin/home/"yourusername") and if you're using Linux, just unzip it to your home directory.
1b. Download the MakeLoopROM-Android.tar and unpack it to the root of your sdcard or copy the file to the root directory of your sdcard, open up a terminal session and run tar -xvf MakeLoopROM-Android.tar.
2. Copy the rom and gapps and whatever other package you want to convert to the MakeLoopROM directory that was created during the unzipping above.
3a. In Linux, open up a terminal, cd to the MakeLoopROM directory and type sudo ./makelooprom (losetup requires root permissions).
3b. In windows, open up the cygwin terminal, cd to the MakeLoopROM directory and type ./makelooprom-cygwin
3c. On Android, open up a terminal session, type su and hit enter, type cd /sdcard/MakeLoopROM and hit enter and then sh mkrom and hit enter.
4. Follow the instructions, it should be easy enough to understand.
5. If you want to convert a gapps package and/or other packages you repeat step 3 but type ./makeloopgapps instead of ./makelooprom it'll work for any package you want to install into your loop files, root is not needed for this step.
5a. For android you type sh mkgapps to make gapps and other packages.
6. To be able to reboot back to NAND (the ROM on your phones internal storage) you need to copy the boot.img of your current ROM into the multiboot directory.
6a. The android version now copies the running boot.img if you answer yes when you get the question if you want it to so there is no need to copy it in another way.
After you're done converting your ROM and the packages you'll find all important stuff in the multiboot folder within the MakeLoopROM directory, just copy the whole folder to the root of your SD-card (if you are running on android this step is unneccessary, the script will copy the files for you). You'll find your image files under multiboot (if you created them) along with the "nameofyourrom"boot.img and boot"namofyourrom".sh that you'll need to boot into the ROM from another ROM and finally under loop-roms/[nameofyoursysimage] you'll find all your converted ROMs and packages, ready for installation.
Now you're ready to install the loop ROM and the loop packages, it installs like any other ROM/package via your recovery of choice (I recommend my CWM Touch 6.0.1.1, it's what this is tested on but it should work fine on any recovery).
To switch between ROMs you open up a terminal window, type su to get root permissions, cd to the multiboot folder (cd /sdcard/multiboot) and type sh bootnand.sh to switch to your internal ROM or boot"nameofrom".sh (bootcm-7.2.0-blade.sh if you installed cm-7.2.0-blade for example) for any of the loop roms. You can also install script manager and script manager widgets and make widgets for those scripts on your homescreen, that way rebooting to another rom is as easy as pressing the icon on your homescreen.
I'm sure there'll be a lot of questions about things i haven't thought of, but if you should fail or do something wrong then just hit ctrl-c and start over, the script cleans up and restarts the build.
Thanks to:
[email protected] for some ideas.
championswimmer for some scripts from his Kernel Kitchen.
Tilal for suggestions that helped fix running this script on the phone itself as well as the app he's making to make reboots between the different installs much easier and better.
[email protected] for being a very patient tester.
Files:
Linux version: MakeLoopROM-Linux.tar
MD5: 8907e2519276f4abcbb5bab0de168ae5
Windows Cygwin version: MakeLoopROM-Windows.zip
MD5: 096921e7a08eba98329bb7ec486068f0
Android version: MakeLoopROM-Android-V8.tar
MD5: f4ee326faf65bd032a95a1e2b4e8bc9f
25/10:
* Completely rewritten, it's now entirely menu driven with choices so you don't have to type filenames.
* Fixed faulty boot flashing
* Now copies a flashable zip of each loop ROM and NAND ROM boot images to /sdcard/multiboot for NAND and /sdcard/multiboot/loop-roms/[nameofyoursystemloopfile/[nameofyourrom]boot.zip so you can flash it via CWM if you need to.
* Includes a cross compiled version of bash for arm to fix a lot of scripting problems.
12/10:
* Streamlined, a LOT faster now.
* Possible fix for the random faulty boot.img flashing when switching between ROMs, need feedback on this.
* Removed unnecessary file creation (all of it runs within one loop file and questions (if you create the system and data images you won't get the question twice, it checks if your ROM is a JB rom without your interference).
* Added cleanup script, to use it run sh cleanup as su and follow the instructions.
* Lots of other bits and pieces that makes it safer and faster to use.
3/9:
* Fixed the Android version to work with CM7 roms [changed let=size to size=$(expr], thanks to Sulthekk for the heads up on that
* Added a failsafe to the Android version on creation of system loop file if it already exists and on giving the script a name for system and data image that doesn't exist. You get one retry, if you can't get it right after that... It is possible to multitask on android, just open a file manager if you forgot the name of the system or data image.
* Fixed the Linux and Windows versions to work with JellyBean ROMs, thanks to jpeg729 for the heads up on that
* Change the file names to reflect which version is which
1/9:
* Finally fixed the problems with no permissions running the script on some ROMs.
1/9:
* Added the choice to copy your currently running roms boot.img to your multiboot automatically, no user interaction needed for the process.
31/8:
* Changed the android version to a tar to keep file permissions intact.
* Fixed it up so it runs on CM-10 and PA as well as all other roms (i hope).
30/8:
* Release of the Android version, now runs completely on your phone.
28/8:
* Changed the Linux version to tar format to ensure that permissions are correctly set.
* Fixed the Cygwin version so it can make the data and system image files, they will be formatted on install and if it's a new installation you have to choose y to format the data image file or it will not have a filesystem.
* Changed a few misspellings in user interaction texts and tried to make it easier to understand.
Woah. Cwm and Multiboot in a week's time?
When you getting your RD status?
Good work man
Sent from my Ouya
QuantumFoam said:
Woah. Cwm and Multiboot in a week's time?
When you getting your RD status?
Good work man
Sent from my Ouya
Click to expand...
Click to collapse
I've got one third project that i'm about to wrap up and after that i'll just do incremental updates on those three while devoting my time to kernel development which is sorely needed.
Found a util for windows called winDD, i'll check it out and include it in the next version if it's of any use. That will fix the problem with not being able to create the loop files on windows.
I've built makebootfs and makebootimg for android and will include them along with a script that works on android in the next release.
I'll make the next release a tar version along with a zip version for windows users, this is to preserve file permissions.
Any other suggestions are most welcome.
After a lot of issues i finally got the Android version ready, i've tested it and it works fine on my phone, both the makelooprom-android and the makeloopgapps.
I had to cross compile perl and the mkbootfs and mkbootimg files to run on armv6l which took a while because i kept getting errors, both are included with the script.
Then there was a problem with running split-bootimg.pl on the sdcard, fat32 doesn't support symbolic links so i had to make three different loopfiles within the script to use for bootimg-contents ramdisk-contents and output.
Anyway, now it runs just fine, try it out.
New version up and running.
Only for zte blade ?
Sent from my B15Q using XDA Free mobile app

[GUIDE] [how to] Update OTA Vodafone smart II without lose Full Recovery, ROOT...

Hi,
I will try to make a short tutorial how to make OTA update 4 ( in my case ) without losing (if you have) Menu Full Recovery, Root, Boot from the first version of sw that comes / came preinstalled in the phone.
From the About phone -> Software update
check availability update OTA's and download it but WARNING :
WITHOUT install it yet as you lose RECOVERY menu ... !
update.zip file will be downloaded on SDCard in dir. downloaded, from where it will be moved to the PC for editing, it is recommended to delete the folder completely from SD once you've moved the file.
The archive will be edited to remove from it, the update to Recovery and Boot and if you want also some preinstalled applications.
You have to delete the following from archive:
recovery - complet
patch\boot.img.p
patch\fota-bootloader.img.p
patch\system\bin\btld.p
patch\system\bin\recovery.p
I wiped myself in the past also these applications that were preinstalled, so I deleted form this archive:
custpack\app\FBAndroid_20120723_1.9.7-preload.apk
custpack\app\Twitter-3.2.2-release.apk
custpack\JRD_custres\app\LiveWallpapersPicker-res.apk
custpack\JRD_custres\app\LiveWallpapers-res.apk
custpack\JRD_custres\app\MagicSmokeWallpapers-res.apk
custpack\JRD_custres\app\VisualizationWallpapers-res.apk
attached script edited by me acording to my needs ( to be able to attach I have to put the extension TXT);
I removed from script:
- checking all applications version
- install the version that I have previously uninstalled
-update for Recovery and Boot :
you will have to edit the update script from:
META-INF\com\google\android\updater-script
You will copy the modified archive on SDCard and install from the recovery menu: Install ZIP from SD, then it will restart the phone and you will have to restore the phone to Factory, so back-up you'r data first.
If you want after it reboots and starts initializing, may again enter in the Recovery menu and delete from there, Cahe, Dalvik, User time...
here you have original OTA 4 from Vodafone Romania file update.zip untouched:
http://www.2shared.com/file/5Ct2jhTX/update.html
and here you have modified file acording to my needs, tested and instaled from recovery zip, working 100% in my phone:
http://www.2shared.com/file/XOMD87w-/update01.html
All the best.

OTA update bootloop fix [S-ON] [BU] [Stock Rooted ROM]

Hi, I found a way to fix this bootloop which happens after you flash the latest ota update if you have unlocked and rooted your stock rom.
I own a HTC E8 China Unicom [M8Sw - dual sim], but I think it will work on other variants.
It is the SU binary/files which are preventing the phone from updating correctly.
You can also restore a clean unrooted TWRP backup and do the OTA update.. it will work just fine.
This tutorial is for those who don't want to lose their app data and modifications.
To be able to update... you need to fully unroot the phone before. Well, this was previously not possible due to system write protection.
(There are also other methods of unrooting. (deleting the SU files manually with the file manager of TWRP recovery) This doesn't work, I have tried it myself..often cause bootloops.)
But now we have a custom recovery mod which enables us to write to the system partition and thus can fully unroot with SuperSU app itself.
Requirements:
-some expertise with adb/flashing/twrp recovery management will be needed.
-stock firmware.zip, inside the OTA zip file, where you will find you stock recovery,boot image, etc
-Stock ROM, rooted with no modified existing system files
-TWRP Recovery from @Captain_Throwback works fine. I used the 2.8.6.0 one. http://forum.xda-developers.com/one-e8/orig-development/recovery-twrp-touch-recovery-t3060188
-untouched Stock Kernel Modules (IMPORTANT)
-SchKernel Extra 3.3, to gain write permission to /system http://forum.xda-developers.com/one-e8/general/schkernel-extra-3-3-t3200090
[UPDATE: SchKernel Extra has been updated to 3.5 and the old one is not available for download on the other thread. You can find attached at the bottom of this section ver3.3 which I had used. Please don't use ver3.5 as a user has reported having bootloop with that.)
-Battery +80 charge recommended...the process gonna demand a lot of power.
-Patience... loads of it....
Disclaimer: I am not responsible if you brick or damage you phone!!
Before you flash anything, be sure to have a working twrp full backup of you phone! In case anything goes wrong.
STEPS:
1. Copy the untouched kernel 'modules' folder [found in system/lib/ in your phone] to another location ( for e.g. to your internal phone memory), you're gonna need it later.
2. Flash the twrp recovery if you haven't already and boot into TWRP recovery.
3. flash SchKernel Extra 3.3 kernel mod. It will launch the aroma installer. There will be options as overclocking/underclocking etc..
I left everything on STOCK option, disabled Swipe2sleep, unselected the everything in the optional addition page. Then went to install it.
4. Reboot, and open SuperSU app, go into setting, tap the FULL UNROOT option, this might take a while. The first time, when the unrooting notice shows and it seems that the app is not doing anything, you might be required to exit the app by pressing home button. Then open the app again and redo FULL UNROOT option. If you exit the app and when re-opening it, the "unrooting notice" is still there, then it means it is working. This might take a bit of trial and error.
5. Ultimately, SuperSU app will close. Then you will need to reboot. You will see that SuperSU is gone and that you have no root access.
6. Now, turn it off again to go to fastboot. Connect to PC and flash the stock boot.img via adb to restore the stock kernel.
8. Then, in twrp recovery, mount /system partition and got to advanced >> file manager..
9. Now browse to /system/lib/ and delete the 'modules folder'.
This is because the SchKernel Extra 3.3 kernel mod flashed previously has modified your kernel modules and when you will try to update the OTA, the stock recovery will report that the kernel modules (xxxxx.ko) has be modified and it will stop the OTA update process.
10. Remember the previous untouched stock 'modules' folder you copied previously, now move it to /system/lib/HERE , to replace the deleted folder.
[DO STEP 9 BEFORE - Don't try to overwrite the folder, it won't be possible. It said operation failed for me. ]
Optional: You might also want to delete su.d folder in \system and init.d folder in system\etc
these files were for the custom kernel and won't be needed anymore.
11. Reboot into fastboot mode, connect to PC (if not already), flash stock recovery.
12. Now, you're good to flash the OTA updates. :good:
-Download it, if not already done.
If ever you have downloaded from PC and copied it to phone, and for whatever reason the phone is not detecting the zip file and asking for install.
Just move it to you exeternal SD card and rename it to "ptt.zip" , go into stock recovery and go down the list to "apply update from SD card"
and it should flash the zip file. When done, select the reboot option and it will say reboot to flash firmware.zip and the will boot. :fingers-crossed:
When booting it will take some time (3 to 8 mins), and then go to the "Android is updating - optimizing apps" screen. This might take a lot of time if you have a lot of apps installed. The phone might get really hot during this process.
When the OS finally boot completely there will be an "HTC" screen and an exclamatin mark in the notification bar. NO WORRIES, it is the just the update working. It will go away when the update is fully processed.
After OTA update is done, you can make a twrp backup of the unrooted system, so that you can restore it for future OTA updates.
If some steps are confusing, feel free to ask for any clarification
Hope I helped you. Don't forget to hit thanks
problem
hi after i flashed SchKernel Extra 3.3 my phone just turned off and won't turn on. what should i do?
neekless said:
hi after i flashed SchKernel Extra 3.3 my phone just turned off and won't turn on. what should i do?
Click to expand...
Click to collapse
how did you flash it exactly?
Did you flash it thought TWRP recovery?
also...what variant of HTC e8 are you using?
Thank you for this guide. :good:
For the newbies, here are exact instructions for each step. TWRP is required; presumably you have this because you've rooted your phone. (If you haven't rooted your phone, what are you doing here?)
Note that rebooting to TWRP can be accomplished in several ways:
Long-press the power button; when prompted choose Reboot. When the screen goes black, press and hold the Volume Down key. This will take you to hboot; from there choose Recovery.
Enable developer mode from settings, plug in to a computer, and issue the command adb reboot recovery.
Also note that it is prudent to do a full TWRP backup to external storage (microSD, USB OTG) before anything else, so you have a good recovery point if things go wrong.
To copy the system/lib/modules directory, you can use a root-enabled file explorer or TWRP. To do it in TWRP:
Reboot to TWRP.
In TWRP, select Mount. Make sure that system is checked.
Back to the main TWRP menu, select Advanced.
In the advanced menu, select File Manager. Then navigate to /system/lib/modules.
Tap on Select, then Copy Folder. Navigate to a new location - I used /sdcard/Backup - and tap Select again. Don't use your external SD or USB-OTG, they may not preserve permissions correctly.
To flash the SchKernel Extra, copy the ZIP file to your device, reboot into TWRP, and select Install. From there, navigate to where you copied the ZIP file and select it; then follow the prompts as sanijsnj specified.
Removing SuperSU works exactly as described. Don't forget to reboot at the end (although it may not be necessary).
To flash the stock boot, in a cmd window where you have the Android SDK, typically in the sub-folder platform-tools enter: fastboot flash boot boot.img (boot.img from the OTA ZIP).
To delete and restore /system/lib/modules, follow the steps above, starting of course from your saved 'modules' directory and copying to /system/lib.
To flash the stock recovery, again in the cmd window enter: fastboot flash recovery recovery.img (recovery.img from the OTA ZIP).

Best Method to Re-flash & Re-root Plus Have Internal Storage Working

Hey Guys -
I have had my A9 for about 2 months and love it. When I first purchased it, I rooted it using the method pinned to this forum which seemed to work well. Soon afterwards, I found out that when I inserted and tried to format an SD card as "internal", it wouldn't work and result in it showing as "corrupted." I soon found out that this seemed to be due to the root replacing the original boot.img which messes with encryption. Since the root was posted, SuperSU has been updated and that step has changed supposedly.
Now that I have some time, I want to fix this issue. Before doing so, I've read through many posts and think I have a plan. I wanted to post the steps I need to follow as I understood them to make sure my plan is correct and will result in not only being able to format an SD internally and be rooted, but also a working phone Below are the specs of my phone, the steps I think it may take to resolve, and a few questions I have after reading through numerous posts. Any help is appreciated!
Phone Specs
Some as currently listed in Settings
- HTC One A9
- AT&T USA
- Rooted / s-off
- Android 6.0 / Sense 7.0g
Software Number: 1.10.502.3
Kernel: 3.10.73-perf-g28d66e0
Baseband: [email protected]_29.05_F
Build: 1.10.502.3 CL635081 release keys
Android Security Patch Level: 2015-10-01
Steps to Fix
1. Backup any data desired (I have a nightly Titanium backup)
2. Download RUU for same version (1.10.502.3) from http://forum.xda-developers.com/one-a9/general/wip-ruu-htc-one-a9-t3240344
Should I use newer version or are those for different carriers?
3. Apply RUU (via embedded EXE or try to extract and apply using adb/fastboot)
4. Once phone is restored, make a backup of boot.img from phone just in case it's needed later
5. Install TWRP via adb/fastboot
6. Install SuperSU via TWRP
At this point (if I can make it to this point), test and see if the phone's rooted and I can format the SD internally. If so, great. If not, continue with the following steps...
7. Download & flash modded boot.img from A9 Root post
8. Install TWRP via adb / fastboot
9. Install SuperSU via TWRP
10. Flash original boot.img backed up in step #4 to my phone (since modded one was only needed initially to install SuperSU) So that encryption keys match and I may successfully format sd cards for internal use
My Questions
1. Are the steps above basically the process i need to perform or is there a better / easier way? I don't know if I could flash a common boot.img from an RUU or if it needs to be flashed to phone first for encryption purposes. Even if I can, I've tried to extract it from ruu.zip before and could not
2. Should I use an RUU for a newer version (over 1.10.502.3) or are those for different carriers and not work with my AT&T phone?
3. Does it make a difference if I install the RUU via embedded EXE or extract and apply using adb/fastboot?
4. What versions of TWRP & SuperSU should I use?
Any additional suggestions would be appreciated - I just want to get this resolved once and for all! - Thanks!
bzowk said:
Hey Guys -
I have had my A9 for about 2 months and love it. When I first purchased it, I rooted it using the method pinned to this forum which seemed to work well. Soon afterwards, I found out that when I inserted and tried to format an SD card as "internal", it wouldn't work and result in it showing as "corrupted." I soon found out that this seemed to be due to the root replacing the original boot.img which messes with encryption. Since the root was posted, SuperSU has been updated and that step has changed supposedly.
Now that I have some time, I want to fix this issue. Before doing so, I've read through many posts and think I have a plan. I wanted to post the steps I need to follow as I understood them to make sure my plan is correct and will result in not only being able to format an SD internally and be rooted, but also a working phone Below are the specs of my phone, the steps I think it may take to resolve, and a few questions I have after reading through numerous posts. Any help is appreciated!
Phone Specs
Some as currently listed in Settings
- HTC One A9
- AT&T USA
- Rooted / s-off
- Android 6.0 / Sense 7.0g
Software Number: 1.10.502.3
Kernel: 3.10.73-perf-g28d66e0
Baseband: [email protected]_29.05_F
Build: 1.10.502.3 CL635081 release keys
Android Security Patch Level: 2015-10-01
Steps to Fix
1. Backup any data desired (I have a nightly Titanium backup)
2. Download RUU for same version (1.10.502.3) from http://forum.xda-developers.com/one-a9/general/wip-ruu-htc-one-a9-t3240344
Should I use newer version or are those for different carriers?
3. Apply RUU (via embedded EXE or try to extract and apply using adb/fastboot)
4. Once phone is restored, make a backup of boot.img from phone just in case it's needed later
5. Install TWRP via adb/fastboot
6. Install SuperSU via TWRP
At this point (if I can make it to this point), test and see if the phone's rooted and I can format the SD internally. If so, great. If not, continue with the following steps...
7. Download & flash modded boot.img from A9 Root post
8. Install TWRP via adb / fastboot
9. Install SuperSU via TWRP
10. Flash original boot.img backed up in step #4 to my phone (since modded one was only needed initially to install SuperSU) So that encryption keys match and I may successfully format sd cards for internal use
My Questions
1. Are the steps above basically the process i need to perform or is there a better / easier way? I don't know if I could flash a common boot.img from an RUU or if it needs to be flashed to phone first for encryption purposes. Even if I can, I've tried to extract it from ruu.zip before and could not
2. Should I use an RUU for a newer version (over 1.10.502.3) or are those for different carriers and not work with my AT&T phone?
3. Does it make a difference if I install the RUU via embedded EXE or extract and apply using adb/fastboot?
4. What versions of TWRP & SuperSU should I use?
Any additional suggestions would be appreciated - I just want to get this resolved once and for all! - Thanks!
Click to expand...
Click to collapse
First off, this isn't Development.
Secondly, I explained to you how to fix this in the very root thread you linked several times.
Thirdly, there's a newer, official RUU from HTC right on their ROM Downloads website. I'd start by installing that (though I also have a recovery-flashable version of that ROM in my Base ROM thread).
Fourthly, with access to an official RUU, and my ROM decrypt script, you have access to the stock boot.img (which is also in the firmware zip in my Base ROM thread), which you can use as your baseline for restoring the verity key to the ramdisk, thereby allowing you to use adopted storage without any issues. Note however that I was only able to use adopted storage with the "forceencrypt" flag enabled.
Fifthly, you can't just restore the stock boot image (at least not if you want to stay rooted). You can be both rooted and encrypted, but you have to first make sure SuperSU is flashed and set up prior to allowing the device to be encrypted again (adopted storage only works with an encrypted device, and then you won't be able to access your storage with TWRP).
OK, OK - sorry.... It had been a while since posting and honestly forgot about that thread - my fault.
I decided to start fresh so have already restored the phone to HTC's latest RUU (1.27.502.5 ATT) as I already had it downloaded. I've also flashed TWRP 2.8.8.1 to the phone, but am obviously prompted to enter a password when I try to enter recovery. Based off what I've read, the steps below seem to be what I need to do so that I may be rooted + still have encryption for internal sd formatting. Is it correct (or close to it)
Using an Ubuntu 14.04 x86 VM...
1. Download & extract your decrypt script to a temp folder in linux vm
2. In Windows, run same RUU I applied and copy out rom.zip from %temp%
3. Rename "rom.zip" to "rom_a9.zip"
4. Copy rom_a9.zip to the ""place_rom_zip_here" folder of your extracted script in the vm
5. Run ./decrypt-htc and wait for script to complete to get img files
On Phone (Currently has same RUU installed + TWRP but not rooted)
6. Root phone using original method of flashing modded boot.img, install SuperSU, and get rooted
7. Once done and rooted, flash boot.img I extracted using your script above to phone via adb
Once that's done, it should be rooted + have encryption thus allowing me to use internal sd card, right? Sorry to be such a bother - just want to get this fixed and done with
Thanks!
bzowk said:
OK, OK - sorry.... It had been a while since posting and honestly forgot about that thread - my fault.
I decided to start fresh so have already restored the phone to HTC's latest RUU (1.27.502.5 ATT) as I already had it downloaded. I've also flashed TWRP 2.8.8.1 to the phone, but am obviously prompted to enter a password when I try to enter recovery. Based off what I've read, the steps below seem to be what I need to do so that I may be rooted + still have encryption for internal sd formatting. Is it correct (or close to it)
Using an Ubuntu 14.04 x86 VM...
1. Download & extract your decrypt script to a temp folder in linux vm
2. In Windows, run same RUU I applied and copy out rom.zip from %temp%
3. Rename "rom.zip" to "rom_a9.zip"
4. Copy rom_a9.zip to the ""place_rom_zip_here" folder of your extracted script in the vm
5. Run ./decrypt-htc and wait for script to complete to get img files
On Phone (Currently has same RUU installed + TWRP but not rooted)
6. Root phone using original method of flashing modded boot.img, install SuperSU, and get rooted
7. Once done and rooted, flash boot.img I extracted using your script above to phone via adb
Once that's done, it should be rooted + have encryption thus allowing me to use internal sd card, right? Sorry to be such a bother - just want to get this fixed and done with
Thanks!
Click to expand...
Click to collapse
Re-read my post. If you flash the stock boot.img, you will no longer be rooted.
And as I said in the original thread, you need to pull the rooted boot.img and add the verity key from the stock one to it. Also you'll need to add the forceencrypt and verify flag back.
P.S. You also need to re-read the instructions in the decrypt thread. You don't have to rename anything anymore.
Good Afternoon -
OK - sorry to frustrate you, but I think I finally have it figured out. I started from scratch, re-read many posts, and took notes. I was a little confused on the last part so wanted to verify, please...
I've already unpacked the boot.img from the latest HTC A9 (AT&T) RUU and have the two folders. I restored the same RUU to my phone, flashed TWRP 2.8.8.1, backed up the boot.img, and unpacked it before realizing that I should have probably rooted it first.
Correct me if I'm wrong, but here's all I need to do to finish....
1. Download modified A9 boot.img from top of root thread
2. Flash modded boot.img using fastboot
3. Verify TWRP is still installed then use it to install SuperSU 2.67 (latest)
4. Back up boot partition just like I did before in TWRP
5. Unpack it on PC to create ramdisk and split_img folders
6. Copy verity_key from unpack of the actual RUU and overwrite one in rooted unpack
7. Edit the file fstab.qcom in the ramdisk folder of the rooted unpack in Notepad++ and add the "verify" flag after the wait flag on the fist uncommented line - save
8. Repack rooted boot.img
9. Flash phone with repacked boot.img using fastboot
10. Reboot & enjoy a rooted phone + encryption allowing sd internal formatting
Promise not to bug anymore if I can just get this resolved.
Thanks again for your assistance!
UPDATE
Hmm - was just prepping and went to download modded file from root thread's first post. Doesn't seem to have one that matches newest build of RUU I flashed - if I'm interpreting it correctly. Researching further, but if know of alternate method or another solution to get through steps 1 & 2 about (assuming they are correct), I'd appreciate it. Thanks
bzowk said:
Good Afternoon -
OK - sorry to frustrate you, but I think I finally have it figured out. I started from scratch, re-read many posts, and took notes. I was a little confused on the last part so wanted to verify, please...
I've already unpacked the boot.img from the latest HTC A9 (AT&T) RUU and have the two folders. I restored the same RUU to my phone, flashed TWRP 2.8.8.1, backed up the boot.img, and unpacked it before realizing that I should have probably rooted it first.
Correct me if I'm wrong, but here's all I need to do to finish....
1. Download modified A9 boot.img from top of root thread
2. Flash modded boot.img using fastboot
3. Verify TWRP is still installed then use it to install SuperSU 2.67 (latest)
4. Back up boot partition just like I did before in TWRP
5. Unpack it on PC to create ramdisk and split_img folders
6. Copy verity_key from unpack of the actual RUU and overwrite one in rooted unpack
7. Edit the file fstab.qcom in the ramdisk folder of the rooted unpack in Notepad++ and add the "verify" flag after the wait flag on the fist uncommented line - save
8. Repack rooted boot.img
9. Flash phone with repacked boot.img using fastboot
10. Reboot & enjoy a rooted phone + encryption allowing sd internal formatting
Promise not to bug anymore if I can just get this resolved.
Thanks again for your assistance!
UPDATE
Hmm - was just prepping and went to download modded file from root thread's first post. Doesn't seem to have one that matches newest build of RUU I flashed - if I'm interpreting it correctly. Researching further, but if know of alternate method or another solution to get through steps 1 & 2 about (assuming they are correct), I'd appreciate it. Thanks
Click to expand...
Click to collapse
You don't need anything from that root thread. Everything there is deprecated (which I've said several times).
If you already have the stock boot.img unpacked and ready to go, all you have to do is flash SuperSU, then back up the rooted boot.img that you now have on your device thanks to SuperSU. Unpack that boot.emmc.win and add the verity_key from the stock ramdisk and replace the fstab.qcom with the one from the stock ramdisk. Repack, flash to your device via fastboot or TWRP, and your device will encrypt on that first boot and you'll be good to go.
Just to make sure - you did a Format Data in TWRP prior to flashing SuperSU, correct?
Captain_Throwback said:
You don't need anything from that root thread. Everything there is deprecated (which I've said several times).
If you already have the stock boot.img unpacked and ready to go, all you have to do is flash SuperSU, then back up the rooted boot.img that you now have on your device thanks to SuperSU. Unpack that boot.emmc.win and add the verity_key from the stock ramdisk and replace the fstab.qcom with the one from the stock ramdisk. Repack, flash to your device via fastboot or TWRP, and your device will encrypt on that first boot and you'll be good to go.
Just to make sure - you did a Format Data in TWRP prior to flashing SuperSU, correct?
Click to expand...
Click to collapse
Thanks -
Well, that's the thing... One of the two unpacked boot.img I have currently is wrong. The two I have are:
- One unpacked boot.img extracted from latest RUU using your script in linux
- One unpacked boot.img backed up from unrooted phone which only had TWRP flashed
That was part of my question. I know that the 2nd unpacked boot.img above is worthless as the phone needed to be rooted prior to me backing it up. The question for me is how to flash superSU onto the phone (which currently has the same latest RUU + TWRP 2.8.8.1 installed) if I can only access TWRP is a read-only mode as I'm prompted for password upon booting to recovery. That's why I brought up the legacy root method as I don't know of an alternative... unless SuperSU doesn't require write permissions to whatever TWRP has locked down currently.
Once I can root it, backup it's boot, and unpack it; I just need to literally copy & overwrite the "verity_key" and "fstab.qcom" files (assuming the only difference is the fstab.qcom I'm overwriting doesn't have the verify flag), repack, then flash back to phone via fastboot, right?
Thanks for your patience!
bzowk said:
Thanks -
Well, that's the thing... One of the two unpacked boot.img I have currently is wrong. The two I have are:
- One unpacked boot.img extracted from latest RUU using your script in linux
- One unpacked boot.img backed up from unrooted phone which only had TWRP flashed
That was part of my question. I know that the 2nd unpacked boot.img above is worthless as the phone needed to be rooted prior to me backing it up. The question for me is how to flash superSU onto the phone (which currently has the same latest RUU + TWRP 2.8.8.1 installed) if I can only access TWRP is a read-only mode as I'm prompted for password upon booting to recovery. That's why I brought up the legacy root method as I don't know of an alternative... unless SuperSU doesn't require write permissions to whatever TWRP has locked down currently.
Once I can root it, backup it's boot, and unpack it; I just need to literally copy & overwrite the "verity_key" and "fstab.qcom" files (assuming the only difference is the fstab.qcom I'm overwriting doesn't have the verify flag), repack, then flash back to phone via fastboot, right?
Thanks for your patience!
Click to expand...
Click to collapse
Once you Format Data in TWRP and reboot recovery, you can flash SuperSU and you will be rooted. You just have to back up the boot.img after flashing SuperSU on the unencrypted device to re-enable verity so that adopted storage will work.
P.S. And no, the verify flag isn't the only difference. As I also said earlier (I'm constantly repeating myself), the device must be encrypted for Adopted Storage to work, so the forceencrypt flag from the stock fstab must also be present. That's why it's easier just to replace the whole file. The problem you have at the end of the day is that, while you'll be rooted and be able to use adopted storage in Android, you still won't be able to access said storage (or /data) in TWRP.
Captain_Throwback said:
Once you Format Data in TWRP and reboot recovery, you can flash SuperSU and you will be rooted. You just have to back up the boot.img after flashing SuperSU on the unencrypted device to re-enable verity so that adopted storage will work.
P.S. And no, the verify flag isn't the only difference. As I also said earlier (I'm constantly repeating myself), the device must be encrypted for Adopted Storage to work, so the forceencrypt flag from the stock fstab must also be present. That's why it's easier just to replace the whole file. The problem you have at the end of the day is that, while you'll be rooted and be able to use adopted storage in Android, you still won't be able to access said storage (or /data) in TWRP.
Click to expand...
Click to collapse
Great - Thanks!!
Just to make sure, below's my plan with a small question @ step #5. Does it get your stamp of approval?
Phone (A9) already had latest RUU restored (same RUU I ran against your script to pull boot.img from) and TWRP 2.8.8.1 flashed
1. Boot into TWRP & bypass initial screen prompting for password
2. Format Data
3. Reboot back into TWRP
4. Flash SuperSU 2.76 zip
5. Reboot to system then back to TWRP and backup boot partition? / Stay in TWRP and backup boot partition? / Reboot back into TWRP and backup boot partition?
6. Unpack backed up boot partition from phone
7. Copy "verity_key" & "fstab.qcom" files from ramdisk folder in unpacked RUU boot and paste into & overwrite same files in ramdisk folder of unpacked boot from rooted phone
8. Repack rooted phone boot (which includes both new files)
9. Flash newly packed boot.img to phone using fastboot
10. Enjoy
I really appreciate your help and patience with me!
bzowk said:
Great - Thanks!!
Just to make sure, below's my plan with a small question @ step #5. Does it get your stamp of approval?
Phone (A9) already had latest RUU restored (same RUU I ran against your script to pull boot.img from) and TWRP 2.8.8.1 flashed
1. Boot into TWRP & bypass initial screen prompting for password
2. Format Data
3. Reboot back into TWRP
Click to expand...
Click to collapse
Good so far . . .
bzowk said:
4. Flash SuperSU 2.76 zip
Click to expand...
Click to collapse
I'm sure this is just a typo, but that should be 2.67, not 76 (there is no 2.76).
bzowk said:
5. Reboot to system then back to TWRP and backup boot partition? / Stay in TWRP and backup boot partition? / Reboot back into TWRP and backup boot partition?
Click to expand...
Click to collapse
Bolded the correct one above (no need to leave TWRP as the necessary modifications have already been made).
bzowk said:
6. Unpack backed up boot partition from phone
7. Copy "verity_key" & "fstab.qcom" files from ramdisk folder in unpacked RUU boot and paste into & overwrite same files in ramdisk folder of unpacked boot from rooted phone
8. Repack rooted phone boot (which includes both new files)
Click to expand...
Click to collapse
Looks good . . .
bzowk said:
9. Flash newly packed boot.img to phone using fastboot
Click to expand...
Click to collapse
TWRP can also flash the new image, but fastboot is probably the most reliable way to do it.
bzowk said:
10. Enjoy
Click to expand...
Click to collapse
Hopefully . . . You'll likely get a reboot on the first boot (possible multiple reboots), as SuperSU needs a reboot to install the necessary files. Since your device will also encrypt on that initial boot, I'm not sure whether there will be a conflict or not.
bzowk said:
I really appreciate your help and patience with me!
Click to expand...
Click to collapse
Guess we'll see if it all works out . . .
Thanks!
I proceeded by formatting data, booting directly back intoTWRP, flashing SuperSU, backing up the boot partition, then mounting and copying it over to my PC. The boot.img size was 65,536kb - the same size as the one I unpacked from the RUU. Once unpacked, it was missing the verity_key file and the fstab.qcom file was different + missing the verify flag.
I replaced those two files, then ran repackimg.bat which created image-new.img which I renamed to boot.img. Interesting, though, that this file was only 45,890kb. If it's a repack, shouldn't it be the same or similar? Anyways, the phone was still in TWRP (hadn't booted to system since before the format data) so booted it into bootloader directly and tried flashing boot using my new 45mb boot.img.
If failed - but - my phone was only at 17% power. Don't know if that's why it failed or not so it's charging right now while still in the bootloader. Below is what was echoed when I tried flashing it:
Code:
c:\adb>fastboot flash boot boot.img
target reported max download size of 800000000 bytes
sending 'boot' (45890 KB)...
OKAY [ 3.488s]
writing 'boot'...
(bootloader) HOSD CL#656287
FAILED (remote: 4 RU_BATTERY_LOW please connect charger (17% < 30%))
finished. total time: 4.506s
The reason I didn't boot to system is that I thought that was when the encryption might take place. Going to wait until above 30% power then try flashing again. Powered down to charge, but plan to boot straight back into bootloader to flash. If you see anything that stands out or that I need to do otherwise, please let me know. Otherwise, I'll report back what the result was after getting above 30%.
Thanks again!
bzowk said:
Thanks!
I proceeded by formatting data, booting directly back intoTWRP, flashing SuperSU, backing up the boot partition, then mounting and copying it over to my PC. The boot.img size was 65,536kb - the same size as the one I unpacked from the RUU. Once unpacked, it was missing the verity_key file and the fstab.qcom file was different + missing the verify flag.
I replaced those two files, then ran repackimg.bat which created image-new.img which I renamed to boot.img. Interesting, though, that this file was only 45,890kb. If it's a repack, shouldn't it be the same or similar? Anyways, the phone was still in TWRP (hadn't booted to system since before the format data) so booted it into bootloader directly and tried flashing boot using my new 45mb boot.img.
If failed - but - my phone was only at 17% power. Don't know if that's why it failed or not so it's charging right now while still in the bootloader. Below is what was echoed when I tried flashing it:
Code:
c:\adb>fastboot flash boot boot.img
target reported max download size of 800000000 bytes
sending 'boot' (45890 KB)...
OKAY [ 3.488s]
writing 'boot'...
(bootloader) HOSD CL#656287
FAILED (remote: 4 RU_BATTERY_LOW please connect charger (17% < 30%))
finished. total time: 4.506s
The reason I didn't boot to system is that I thought that was when the encryption might take place. Going to wait until above 30% power then try flashing again. Powered down to charge, but plan to boot straight back into bootloader to flash. If you see anything that stands out or that I need to do otherwise, please let me know. Otherwise, I'll report back what the result was after getting above 30%.
Thanks again!
Click to expand...
Click to collapse
The repack is smaller because the backup uses "dd" to copy the entire block device. Not all that space is actually used after compression. That's nothing to worry about.
And these devices are very picky about flashing only when there's sufficient battery, so I'm sure that's the only reason it failed. TWRP, however, doesn't care how much battery you have, so you could always flash the new boot.img in recovery.
Captain_Throwback said:
The repack is smaller because the backup uses "dd" to copy the entire block device. Not all that space is actually used after compression. That's nothing to worry about.
And these devices are very picky about flashing only when there's sufficient battery, so I'm sure that's the only reason it failed. TWRP, however, doesn't care how much battery you have, so you could always flash the new boot.img in recovery.
Click to expand...
Click to collapse
Hey, hey, hey - think it worked!!
Once I got above 30%, I flashed without issue. I rebooted and was able to format an sd internally successfully, too. Now, I just need to verify it's rooted, but think it is. Thank you so much for your help! I'm going to write a guide for newbs like me to use in the future soon.
Thanks again!
bzowk said:
Hey, hey, hey - think it worked!!
Once I got above 30%, I flashed without issue. I rebooted and was able to format an sd internally successfully, too. Now, I just need to verify it's rooted, but think it is. Thank you so much for your help! I'm going to write a guide for newbs like me to use in the future soon.
Thanks again!
Click to expand...
Click to collapse
If your adopted storage doesn't show as corrupted, and you're able to open the SuperSU app in your app drawer and not get a message that no su binary is installed, you should be good to go .
bad topic

[Guide] Alternative method for applying OTA to the Pixel (no ADB or fastboot needed)

Alternative Option For Applying December (or any other OTA updates) without using ADB or Fastboot.
Pros:
+ No need for fastboot or ADB
+ Can be done without a PC
+ OTA is applied from within Android, using Android's normal update process
+ Retains root
+ Retains any installed Magisk Modules
Cons:
- Until Magisk is updated, requires that you fake a backup by compressing a stock boot image and renaming the resulting file.
- Only works on phones with duel partitions
- Slightly harder to do without a PC
The Pixel 4/4XL has duel partitions. This allows for an alternative option for installing OTA updates without losing root (Magisk) or wiping data. The process is outlined in the Magisk guide here: https://github.com/topjohnwu/Magisk/blob/master/docs/tutorials.md
The problem with following that guide is that since there is no TWRP for Pixel 4 / Android 10, most of us patched Magisk into a stock boot image manually, leaving us without an automatically created backup. Then, when you attempt to uninstall Magisk and restore the backup boot image, you get a message stating "No backup image found". However, it is easy to copy a stock boot image to your phone and have Magisk treat it as a backup. Magisk can then uninstall itself, you apply the OTA without restarting, reinstall Magisk by patching OTA image in the inactive partition, then reboot. After reboot you will be running the OTA version with Magisk patched in.
The process is a little easier if you have a PC, but it can be done completely on the phone itself, without any other hardware.
Here is a full process:
Requirements:
A rooted Pixel with Magisk Manager installed
A file explorer app that has a root broswer (I use Total Commander)
A text editor that can open arbriatry files (I used Quick Edit)
A tool to zip files (I used 7-Zip on a Windows PC, then transfered the file via USB, but you can do this completely without a computer)
The unpatched boot.img file that corresponds to your current build. (Get it from https://developers.google.com/android/images#coral
Create a backup image that Magisk can auto-restore
On your Android phone, open the following file: /sbin/.magisk/config
Copy the SHA1 hash (you want to copy everything after the = sign)
Download the factory image that corresponds to your current build. Extract the zip, then from the zip extract the boot.img file (Yes, there is a zip within a zip). This is easier to do on a computer, but can be done directly on the phone.
Create a new .gz archive that contains the boot.img file and nothing else. On Windows, I used 7zip for this, selecting gzip as the method, and using all of the defaults.
Rename the .gz achive to the following: 'stock_boot_<hash>.img.gz' where <hash> is the SHA1 hash that you coped from the Magisk config file.
Copy the .gz file to your phone and place it in the /data directory. The full path on your phone should be /data/stock_boot_<hash>.img.gz.
You can now follow the rest of the guide from https://github.com/topjohnwu/Magisk/blob/master/docs/tutorials.md, but an abbreviated version is included
Uninstall Magisk and Apply the OTA
Launch Magisk Manager on your phone
Select "Uninstall", then choose "Restore Images". Magisk will be uninstalled and you will be back to running stock boot.
Go to Settings --> Systems --> Advanced --> System Update, then check for and apply updates. You will need to select "resume" to force the update to happen immediately. DO NOT RESTART THE PHONE. The December update can take a while. I was on the "optimizing apps" message for a good 20 - 30 minutes.
After the udpate has been installed, the screen will have the option to restart. Don't select it.
Install Magisk to the updated boot and restart
Start Magisk Manager
Select Install (we are installing Magisk, not Magisk Manager)
When prompted, choose to install to an inactive partition
Read the warning and confirm. The OTA boot image will be patched with Magisk.
Restart your phone.
You should now have the OTA update (verified by checking Settings --> About Phone --> Build number)
You should also have a new stock_boot_<hash>.img.gz file in your /data directory. Next time there is an OTA update, you can skip the first part of this and go straight to uninstalling Magisk and applying the OTA.
Thanks to reyqn and Nephiel for commenting on https://github.com/topjohnwu/Magisk/issues/1870.
Hi. What do you mean " Copy the SHA1 hash " because in /sbin/magisk/config. i don't see any file name SHA1 hash?
Sent from my Pixel 4 XL using Tapatalk
GrimEcho said:
...when you attempt to uninstall Magisk and restore the backup boot image, you get a message stating "No backup image found"...
...Create a backup image that Magisk can auto-restore
On your Android phone, open the following file: /sbin/.magisk/config
Copy the SHA1 hash (you want to copy everything after the = sign)
Download the factory image that corresponds to your current build. Extract the zip, then from the zip extract the boot.img file (Yes, there is a zip within a zip). This is easier to do on a computer, but can be done directly on the phone.
Create a new .gz archive that contains the boot.img file and nothing else. On Windows, I used 7zip for this, selecting gzip as the method, and using all of the defaults.
Rename the .gz achive to the following: 'stock_boot_<hash>.img.gz' where <hash> is the SHA1 hash that you coped from the Magisk config file.
Copy the .gz file to your phone and place it in the /data directory. The full path on your phone should be /data/stock_boot_<hash>.img.gz....
Click to expand...
Click to collapse
I think they fixed Magisk/Magisk Manager: Opened Magisk Manager ==> Tapped Uninstall ==> Tapped Restore images
Not getting this message: "No backup image found"
Appreciate the instructions to "Create a backup image that Magisk can auto-restore.":good:
---------- Post added at 11:44 AM ---------- Previous post was at 11:10 AM ----------
DinarQ8 said:
Hi. What do you mean " Copy the SHA1 hash " because in /sbin/magisk/config. i don't see any file name SHA1 hash?
Click to expand...
Click to collapse
Everything after SHA1= in sbin/.magisk/config (file) is the 'hash'.
Thanks for this guild.... I just wondering if we could use EX kernel Manager (or anything similar) to flash the stock boot.img (so everything returned to stock), then apply OTA, then use Magisk Manager to patch the inactive slot...
Although this requires another app, but we don't need to create backup specific for MM... Just a stock boot.img is needed...
Haven't tried this yet... Will try on Jan update.....
For some reason if the config file says recoverymode=true then magisk will still not find the backup image. If you change it to recoverymode=false then you can continue on with the rest of the steps. I wonder why?
StoicSage said:
For some reason if the config file says recoverymode=true then magisk will still not find the backup image. If you change it to recoverymode=false then you can continue on with the rest of the steps. I wonder why?
Click to expand...
Click to collapse
Or you can Open Magisk Manager, Tap Advanced Settings and uncheck Recovery Mode.
DinarQ8 said:
Hi. What do you mean " Copy the SHA1 hash " because in /sbin/.magisk/config. i don't see any file name SHA1 hash?
Sent from my Pixel 4 XL using Tapatalk
Click to expand...
Click to collapse
/sbin/.magisk/config is the name of the file. There is no extension to it, but it is a text file.
Open the file in an editor and the last line should have the SHA1 hash.
Homeboy76 said:
I think they fixed Magisk/Magisk Manager: Opened Magisk Manager ==> Tapped Uninstall ==> Tapped Restore images
Not getting this message: "No backup image found"
Appreciate the instructions to "Create a backup image that Magisk can auto-restore.":good:
---------- Post added at 11:44 AM ---------- Previous post was at 11:10 AM ----------
Everything after SHA1= in sbin/.magisk/config is the 'hash'.
Click to expand...
Click to collapse
I think it depends on what method you used to originally root the Pixel 4. If you copied over a .boot.img file to the phone, then used Magisk Manager to patch the file while you didn't have root then Magisk won't make a backup, since it doesn't have access to copy the backup /data. But if you have root when you use Magisk Manager to create a patch (via TWRP, or because root is still enabled from an in memory magisk), then it can copy the file.
lssong99 said:
Thanks for this guild.... I just wondering if we could use EX kernel Manager (or anything similar) to flash the stock boot.img (so everything returned to stock), then apply OTA, then use Magisk Manager to patch the inactive slot...
Although this requires another app, but we don't need to create backup specific for MM... Just a stock boot.img is needed...
Haven't tried this yet... Will try on Jan update.....
Click to expand...
Click to collapse
I think this would work as long as you can flash stock using Ex Kernal Manager while Magisk is still installed, and don't have to reboot. Magisk needs root access to be able to patch the OTA in the inactive slot, so if you flashed stock, then restarted, Magisk Manager couldn't access the inactive slot any longer (I think). I haven't used EX Kernal Manager though, so I'm not positive.
GrimEcho said:
I think this would work as long as you can flash stock using Ex Kernal Manager while Magisk is still installed, and don't have to reboot. Magisk needs root access to be able to patch the OTA in the inactive slot, so if you flashed stock, then restarted, Magisk Manager couldn't access the inactive slot any longer (I think). I haven't used EX Kernal Manager though, so I'm not positive.
Click to expand...
Click to collapse
O think you are absolutely right! The key is "do not reboot after flash the stock boot.img" so MM can still do the magic on patch the inactive partition. Your original idea does open a good avenue on OTA without PC.. which saves a lot of troubles......
GrimEcho said:
I think it depends on what method you used to originally root the Pixel 4. If you copied over a .boot.img file to the phone, then used Magisk Manager to patch the file while you didn't have root then Magisk won't make a backup, since it doesn't have access to copy the backup /data. But if you have root when you use Magisk Manager to create a patch (via TWRP, or because root is still enabled from an in memory magisk), then it can copy the file.
Click to expand...
Click to collapse
I did this while on the November 2019 Factory Image:
- opened MM, tapped uninstall, tapped restore images (root gone)
- downloaded December 2019 Factory Image
- extracted the boot.img
- opened MM, tapped install, tapped install, tapped patch a file, selected the December boot.img
- After, it finished patching the boot.img, there was a backup file in /data folder.
I could be wrong but I think the key to ensuring a back up file is made it to turning off Recovery Mode prior to patching the boot.img: Open MM, tap Advanced Settings, and uncheck Recovery Mode.
Amazing this worked! Thanks so much.
Just to note: I had to use QuickEdit to set the RECOVERYMODE=false unchecking the box in Magisk didn't seem to work for me.
One question, I'm now on "Security patch level: November 5, 2019". I'm pretty sure my stock boot.img was from October some time. To get the December update, should I download the latest factory image and redo the process? Therefore, everytime we want to do an OTA, we must download the latest factory image and extract the boot.img?
foaf said:
Amazing this worked! Thanks so much.
Just to note: I had to use QuickEdit to set the RECOVERYMODE=false unchecking the box in Magisk didn't seem to work for me.
One question, I'm now on "Security patch level: November 5, 2019". I'm pretty sure my stock boot.img was from October some time. To get the December update, should I download the latest factory image and redo the process? Therefore, everytime we want to do an OTA, we must download the latest factory image and extract the boot.img?
Click to expand...
Click to collapse
Short answer is yes to the factory image and extracting the boot.img every month before taking the ota. Just make sure the OTA and factory image build numbers match :good:
**UPDATE** - flashing the boot.img from the October Factory Image seems to have fixed the touch screen issue. So, now I gotta figure out why the OTA keeps failing...
I have question, I attempted this method but the update would not install... I kept getting an installation error. So, I just reinstalled Magisk from the Magisk Manager. However, when I rebooted the touch screen no longer works... So I can't unlock my phone.
What is the easiest way to fix this? I was on the original factory image (October) and I bought the phone directly from Google (non-carrier version).
I've attempted to just flash-all using the Dec factory image from fastboot (using key-combo to get into fastboot) but I get the flash in fastbootd error. I'm assuming flash-all from the correct October factory image will fix me up, but I honestly can't remember exactly which October factory image came with the device. Any help would be greatly appreciated.
ihuntinde said:
**UPDATE** - flashing the boot.img from the October Factory Image seems to have fixed the touch screen issue. So, now I gotta figure out why the OTA keeps failing...
I have question, I attempted this method but the update would not install... I kept getting an installation error. So, I just reinstalled Magisk from the Magisk Manager. However, when I rebooted the touch screen no longer works... So I can't unlock my phone.
What is the easiest way to fix this? I was on the original factory image (October) and I bought the phone directly from Google (non-carrier version).
I've attempted to just flash-all using the Dec factory image from fastboot (using key-combo to get into fastboot) but I get the flash in fastbootd error. I'm assuming flash-all from the correct October factory image will fix me up, but I honestly can't remember exactly which October factory image came with the device. Any help would be greatly appreciated.
Click to expand...
Click to collapse
Can't you flash the December image but do it manually? Pain in the ass but should get it done.
p70shooter said:
Can't you flash the December image but do it manually? Pain in the ass but should get it done.
Click to expand...
Click to collapse
I tried to flash-all the December image but it kept failing with flash with fastbootd. Even though I have the most up to date platform-tools.
I believe I know what I did though... I didn't read the instructions clearly and i used the december boot image when i uninstalled magisk.... I'm attempting it again doing the instructions exactly as it states... fingers crossed...
foaf said:
Amazing this worked! Thanks so much.
Just to note: I had to use QuickEdit to set the RECOVERYMODE=false unchecking the box in Magisk didn't seem to work for me.
One question, I'm now on "Security patch level: November 5, 2019". I'm pretty sure my stock boot.img was from October some time. To get the December update, should I download the latest factory image and redo the process? Therefore, everytime we want to do an OTA, we must download the latest factory image and extract the boot.img?
Click to expand...
Click to collapse
If you are willing to wait for the OTA updates then you don't need to keep doing the download/extract/zip process. After the first OTA update, when you use Magisk to root patch the inactive partition with the installed OTA, Magisk will create a new backup. So next time there is an OTA, you can just uninstall Magisk and restore. It should now find the backup.
ihuntinde said:
I tried to flash-all the December image but it kept failing with flash with fastbootd. Even though I have the most up to date platform-tools.
I believe I know what I did though... I didn't read the instructions clearly and i used the december boot image when i uninstalled magisk.... I'm attempting it again doing the instructions exactly as it states... fingers crossed...
Click to expand...
Click to collapse
Yep, it sounds like that is the issue. It can be easy to mix up. You need to fake a restore of the boot image for the version your phone is currently on (pre-OTA). But after you apply the OTA and install Magisk to the inactive partition, Magisk will create a new backup of a new unpatched boot image with the OTA applied, so each update will roll forward.
@GrimEcho
man, thx you so much. I've just updated from dec to jan ota build, without any issues! xD
This worked beautifully. Unfortunately it only moved me up to December. Will be great if I don't have to remake the boot.img file to go to January.
Recovery mode being on in magisk caused this to fail. I had to edit the config file as mentioned by another, kill magisk then it worked at next launch. Toggling it off within magisk left the flag active in the config file.
Appreciate the writeup.

Categories

Resources