[HOW-TO] Root BNTV450 Nook 7 (ST16C7BNN) using Magisk. - NOOK Tablet 7" Guides, News, & Discussion

Root your "Barns & Noble Nook 7" BNTV450 using Magisk's Patch Boot Image File option.
BE CAREFUL!
There are always risks involved when you start messing around with a device.
If something goes wrong, you may end up with a non-working "bricked" device.
This is especially true when you start flashing partitions. (In this case boot.)
Disclaimer
I am not responsible for your non-working "bricked" devices.
I have a few of my own.
Requirements
Barns & Noble Nook 7" BNTV450
A computer with working adb and fastboot
USB cable
WiFi connection
Magisk Manager (Link below)
Stock boot image (Link below)
Tested on:
BNTV450-v1.0.2-20161230 Security patch October 5, 2016
BNTV450-v2.0.4-20170927 Security patch August 5, 2017
BNTV450-v2.0.5-20170110 Security patch November 5, 2017 ota update
macOS 10.13.x
Windows 7 Pro
Steps
Unlock bootloader
Boot Magisk patched boot image
Pull stock boot and recovery images from device
Use Magisk to patch pulled stock image
Test and flash new patched boot image
Notes:
Google updates were needed to get everything working correctly.
PlayServices and WebView
Mac users. As with some other devices, I had to unplug and plugin the USB cable between some of the fastboot commands.
fastboot flash boot patched_boot.img and fastboot boot bntv4-recovery.img
Magisk:
There have been a lot of changes in Magisk since I originally used it to root.
Way too many to mention so, just the basics that apply to this device.
Newer versions of Magisk use the Download directory instead of creating and using the MagiskManager directory.
Some apps search for this directory and used it to determine if the device is rooted.
If you previously used Magisk to root and have a MagiskManager directory, you will want to delete it.
To update Magisk Manager.
Use the update option, it will download and install the newest version.
To update Magisk.
The safest way is to patch the boot image again. Test and flash.
The Direct Install option works but, may lead to a non-desirable outcome.
To uninstall Magisk.
Test boot your original boot image to make sure it works.
Check with Magisk Manager, it should say Magisk not installed.
If so, then flash your stock boot image back using fastboot.
If your stock boot image will not boot, then you are stuck with Magisk patched boot images.
Hardware Keys:
Power and Volume Up = Recovery Mode
Power and Volume Down = Factory Mode
It will show on the bottom Left (Sideways on the top left) Detecting boot mode. With bootloader unlocked it flashes this message very fast so you might not see it.
I still can not produce the same results continuously across mine. The newer ones, that came with v2.0.5 seem to work but, the older ones still it's a 50 % chance if I can get it to work. The bricked ones, do not seem to register the key combo on boot.
Files Needed
Magisk
xda Magisk forum. Link
Magisk and MagiskManager Official github downloads. Link
Boot Images
Magisk patched boot image downloads. Link
Stock recovery and boot image downloads. Link
Credits and Thank You:
@topjohnwu - The creator and brilliant mind behind Magisk.
Everyone who has helped me learn through the years.
Last edited 23.Sep.2018

"QUICK" Guide - BNTV450 Nook 7
Unlock Bootloader
THIS WILL VOID YOUR WARRANTY.
Unlocking the bootloader WILL wipe and Factory Reset your device. Make sure to copy, backup and logout of everything before you begin.
Note: adb and fastboot need to be installed and working.
On device
Go to Settings - About and tap on the build number seven times to enable Developer options.
Go to Settings - Developer options and Enable OEM unlocking and USB debugging
Connect to computer and Allow USB debugging?
On computer
Code:
adb reboot bootloader
Wait for device to boot into fastboot mode then.
Code:
fastboot flashing unlock
On device
Follow the prompts on the device.
Unlock bootloader?
If you unlock the bootloader,you will be able to install custom operating system software on this phone.
A custom OS is not subject to the same testing as the original OS, and can cause your phone and installed applications to stop working properly.
To prevent unauthorized access to your personal data,unlocking the bootloader will also delete all personal data from your phone(a "factory data reset").
Press the Volume UP/Down buttons to select Yes or No.
Yes (Volume UP):Unlocking(may void warranty).
No (Volume Down): Do not unlock bootloader.
After it returns to fastboot mode, use the power button to turn off, unplug it from computer and then turn on.
It will reboot a few times, including an Erasing... screen.
Once device reboots, run through the initial setup.
Note: Sometimes mine would get stuck on the nook .... animation screen. Give it a few minutes (I wait at least 5 minuets) then power off and power back on.
Note: You will now have the annoying boot delay and "Orange State" message.
Orange State
Your device has been unlocked and can't be trusted
Your device will boot in 5 seconds

"QUICK" Guide - BNTV450 Nook 7
Root using Magisk.
MagiskManager 6.0.0 Download
Magisk 17.2 patched v2.0.5 Download
Using Magisk Manager and the provided Magisk patched boot image.
Note: When booting an image from "fastboot", you should not see the initial "orange boot" screen.
Make sure to grant permission if and when prompted on device.
Some of the adb and fastboot commands may require input on the device.
On device
Go to Settings - About and tap on the build number seven times to enable Developer options.
Go to Settings - Developer options and Enable USB debugging
Connect to computer and Allow USB debugging?
On computer
Code:
adb reboot bootloader
Wait for device to boot into fastboot mode then.
Code:
fastboot boot m172_v205_boot.img
Wait for device to boot then.
Reminder. Make sure to grant permission if and when prompted on device.
Code:
adb install -r MagiskManager-v6.0.0.apk
adb shell su -c "dd if=/dev/block/mmcblk0p7 of=/sdcard/bntv4-boot.img"
adb shell su -c "dd if=/dev/block/mmcblk0p8 of=/sdcard/bntv4-recovery.img"
adb pull /sdcard/bntv4-boot.img
adb pull /sdcard/bntv4-recovery.img
Test the images you just made.
Code:
adb reboot bootloader
Wait for device to boot into fastboot mode then.
Code:
fastboot boot bntv4-recovery.img
Wait for device to boot into recovery mode then.
On device
In Stock Recovery use the volume down key to highlight Reboot to bootloader and press the power button.
Wait for device to boot into fastboot mode then.
On computer
Code:
fastboot boot bntv4-boot.img
Wait for device to boot then.
On device:
If you haven't setup WiFi, do so now.
Open MagiskManager
Tap on Install
Select Install
Select Patch Boot Image File
Tap on Internal storage
- Note: If Internal storage is not displayed. Tap on the 3-dot menu (upper right corner) and select Show SD card.
Scroll down and tap on bntv4-boot.img
When Magisk is done patching the image file, select CLOSE
You can close MagiskManager as well.
Copy and test your Magisk patched boot image.
On computer
Code:
adb pull /sdcard/download/patched_boot.img
adb reboot bootloader
Wait for device to boot into fastboot mode then.
Code:
fastboot boot patched_boot.img
On device
Open MagiskManager
Note: You should see that Magisk is installed and active.
To do a quick check.
On Computer
Code:
adb shell
[email protected]:/ $su
[email protected]:/ #exit
[email protected]:/ $exit
If it worked, and you are ready to say goodbye to stock Non-root.
Code:
adb reboot bootloader
fastboot flash boot patched_boot.img
fastboot boot bntv4-recovery.img
Once it's booted into Recovery, unplug the device.
On device
In Stock Recovery use the volume down key to highlight Wipe cache partition and press the power button.
-- Wiping /cache...
Formatting /cache...
Cache wipe complete.
Then with Reboot system now highlighted press the power button.
You are now rooted and running Magisk.
Last edited 23.Sep.2018
Links to my shell logs.
Unlock bootloader. Pastbin
Root. Pastbin

volume button does not react
Hi
unlocking does not work
As mentioned in the other discussion, the volume up button does not seem to react and so the unlocking does not work. Also one user suggested using the reset button after pressing the volume up button for the unlock; that also does not work for me
Do u have any other suggestions to unlock ?;

arrmusic said:
Hi
unlocking does not work
As mentioned in the other discussion, the volume up button does not seem to react and so the unlocking does not work. Also one user suggested using the reset button after pressing the volume up button for the unlock; that also does not work for me
Do u have any other suggestions to unlock ?;
Click to expand...
Click to collapse
I never ran into this problem. So short answer - No.
Can you point me to that other discussion?
What do you get if you run fastboot oem lks
fastboot oem unlock is supported on this device. You could give that command a try and see if there is a difference.
Not sure what you have tried.
I would start with "Factory Reset" in stock recovery. Skip through the initial setup and try again.
Note: Developer option menu has a toggle at the top, make sure it is turned On.
Sent from my BNTV450 using XDA Labs

Volume up button not recognised while fastboot unlock
Hi
Here is the discussion thread that I was referring to where people are stuck with unresponsive volume up button for fastboot unlock
https://forum.xda-developers.com/nook-7/help/nook-rootable-t3510289
I didn't do the factory reset. So maybe I will do that and see if it works.

unlock not working
Hi
Just to further update you on your reply; i did a factory reset and tried to unlock the bootloader but i get to the same problem; the volume button does not respond; so stuck with the message 'press the volume up button to unlock the bootloader'
I did the fastboot oem lks and that commands executes well and it gives me a OK output.
Cheers & New year greetings!

Any update on the unlock issue
Hi
Is there any update on the unlock issue i reported some time back? My last update on this was executing the command => 'I did the fastboot oem lks and that commands executes well and it gives me OK output.'
not sure if my last update was interpreted in the right way; it does nothing when i type fastboot oem lks except saying it is OK (which i suppose is the expected output of fastboot oem lks). So i do not know how to get around the volume keys not being recognised to go further in unlocking
I still can not use the volume keys for the unlock as it does not seem to react. just stuck a bit on this

@arrmusic I guessed it it looked more like this.
Code:
fastboot oem lks
...
(bootloader) lks = 1
OKAY [ 0.000s]
finished. total time: 0.000s
lks = 0 would be unlocked.
I am looking for a way to un-brick these. I think that may be the best way to correct the button problem also.
What os version are you running? (BNTV450-vx.x.x-20xxxxx)
What do you get when you run fastboot flashing get_unlock_ability ?
Tested a few things tonight.
I was NOT able to re-lock the bootloader on either of my rooted devices.(BNTV450-v2.0.4)
Found some more inconsistencies with power and volume key boot combinations. (Among other things.)
"FAILED (remote: not support on security)" apparently is not just for unlocked devices.
Sent from my BNTV450 using XDA Labs

not able to unlock yet
Hi
Many thanks for your reply.
I seem to have the software version v1.0.2;
I tried to find by googling v2.0.4 but i am not able to find that security update anywhere to download; do you have the v2.0.4 file? can i have it somehow?
I ran the commands u had mentioned in your previous reply.
fastboot flashing get_unlock_ability
...
(bootloader) unlock_ability = 16777216
OKAY [ 0.012s]
finished. total time: 0.012s
fastboot oem lks
...
(bootloader) lks = 1
OKAY [ 0.004s]
finished. total time: 0.008s

What is the origin of the boot.img?
What is the origin of the boot.img? I'd rather not just flash something without knowing where its come from.

74178951237895321 said:
What is the origin of the boot.img? I'd rather not just flash something without knowing where its come from.
Click to expand...
Click to collapse
v2.0.3 boot came from a supposed "N" rom for this device and was the first boot image I was able to make bootable. It was still API 23 "M" by the way.
I would have to find and unpack the original file to see what I edited to make it bootable.
All others are "dd" copies from my own device(s).
I am working on updating the OP and the "Quick Guide"
Boot Images
Download Magisk 15.3 patched v2.0.5 (Preferred and current boot image.)
Sent from my ford using XDA Labs

Scatter file for Mediatek MT8163, opening the tablet
Can you post the scatter file for the Mediatek MT8163?
I've been trying to make my own image dumps for the Nook 7, but have run into an issue where the device won't stay in a readable mode for SP Flash Tools long enough while the battery is still connected. So, the solution for most phones is to disconnect the battery and have it powered over USB only so that it won't go past the preloader and into the charging mode.
But I can't get the darned thing open! My phone has a similar style housing and I had to use a suction cup on the glass while prying at the edges to gain access. But for the Nook 7 its just not working.
Edit: This started while trying to soft load TWRP to make the image dumps. When I do
Code:
fastboot boot twrp.img
It tells me that the kernel address lies outside of memory. Its possible to supply an address to load it at with the fastboot command which you are supposed to learn from the scatter file. I found what I thought was a valid MT8163 scatter file but using the address found within did not fix the issue.
I forgot you mentioned that you didn't pull the original image from your device yourself. I've been trying to root this without relying on images from others. Your latest guide to pulling and modifying your own boot.img is a decent enough middle ground for me to use. Thanks.

@74178951237895321
Sent from my Nexus 7 (2013) using XDA Labs

I was able to get a successful root by following the steps in this thread in combination with those mentioned in this one. ipdev, just to satisfy my curiosity, where did you find this "N rom" image?

ipdev said:
So we hit a snag using Magisk 15.4+ to patch a stock boot image on this device.
Click to expand...
Click to collapse
So, I was dumb and went through with updating Magisk without checking this thread first, and now my tablet's stuck in a bootloop that I can't seem to get out of. @ipdev, do you have any ideas on how this happened/how to get out of it? The tablet can't get past the "Orange state your device has been unlocked etc. etc." screen, and I can't get it to boot into recovery either (using Power+Volume Down, is the combination something else on this tablet?). fastboot won't discover it either, probably because it reboots within seconds and never gets to a point where it could be recognized. I'm thinking of letting it bleed out until its battery dies (unfortunately, the battery is soldered and glued in, so I can't just disconnect it), and checking on it in the morning to see if it will be cooperative enough to let me flash the modified Magisk image.

@saagarjha
I have a few in the same condition. As you noticed, the battery is soldered in so the best you can do is disconnect the screen. (Connector to the right of battery.)
One of these days, I was going to try sp flashtools to see if I could recover one of mine. (I'm not sure if it works with these.)
Sent from my Nexus 5 using XDA Labs

I let the tablet run out of battery and then plugged it back in again and it immediately got stuck in the same bootloop, so it looks like it's actually bricked rather than just pretending. I think SP Flash Tools is the way to go at this point; we'd have to find a functioning preloader driver and scatter file to do that, however. It might be possible to simulate disconnecting the battery by shorting the battery's leads, but I'm not sure if this would work (or is even safe to do).

I was having trouble with unlocking the boot loader on my v1 launch version of this Nook. Recently I dropped it and got a new one via the replacement plan - this one was marked 'v2', came with a 2.x firmware that I wasn't able to even get on my launch Nook 7.
Anyway, this one unlocked without any problems. Thought this might be helpful to anybody having trouble unlocking the bootloader. Consider the revision of the Nook you have. Maybe the solution here is flashing the v2 firmwares to the v1? Hard to say.

unable to unlock
So I did "adb reboot bootloader" and the tablet rebooted and says "=> FASTBOOT mode..." on the screen.
I then did "fastboot flashing unlock" on the computer. Nothing happened on the device and my computer says "< waiting for device >". Could anyone please let me know what I did wrong? Thank you very much.

Related

Messed up my Shield Tablet

I found my Shield Tablet again today. I tried to install a costom ROM once, but I think I failed with rooting my tablet. The reason for this is, that i had no clue what i was doing.
I would like to have a fully functional tablet again, but i still have no clue what to do.
I try to describe the current status.
- I have a Shield Tablet 16GB Wlan with Android 5.1.1
- With Root Checker: No root.
- In the Bott menu it shows that the device is unlocked.
- There is a SuperSU app, but i get a notification , that the SU binary needs to be updated. If I do that it fails every time and tells me to reboot. After that nothing changed. Same Problem.
- There is a OTA Update, when i try to restart my tablat this comes up:
Root Access Possibly Lost Fix?
THIS CANNOT BE UNDONE
1. YES fix root (/system/xbin/su)
2. NO do not fix
After testing both, no changes
I tried to find a solution on my own for the last 3h, but I just failed over and over again.
Root access is optional for me now, i don't need it, but it would be nice to have it.
Could someone tell me what I should do? (Or post a link to instructions wich fits to my problems)
Thanks in advance
What version of software are you on? I recommend downloading the last Marshmallow recovery image available (for the original Shield, it's package 4.4), unzip the contents to give you the various images, and then flash using Fastboot. Just boot the tablet while holding down the power+vol down key, then release when the screen lights up. Plug into your PC, and run the Minimal ADB+Fastboot (google it, I think version 1.4 is latest).
Download site from Nvidia: https://developer.nvidia.com/gameworksdownload
Follow the instructions in the recovery package. Basically like this, assuming your images are in your fastboot directory:
SHIELD TABLET RECOVERY IMAGE FLASHING INSTRUCTIONS
To follow the instructions in this guide, you will need adb and fastboot.
These tools are provided as part of the Android SDK:
http://developer.android.com/sdk/index.html
Before flashing this recovery image to your SHIELD TABLET, connect your SHIELD TABLET
via USB to the PC where you downloaded this recovery image.
Next, put your SHIELD TABLET into fastboot mode using one of the following methods:
SW method:
- Boot to android home screen
- Connect the device to linux/windows system
- Open terminal (on linux); command prompt (on windows).
- Type "adb reboot bootloader" in terminal/command prompt
HW method:
- Turn off the device
- Press "Volume Down" -> "Power", hold "Volume Down" and leave Power buttons till device boots
To flash this recovery image to your SHIELD TABLET, run the following commands from
the directory where you extracted the recovery image package. If this is the
first time you have done this procedure, you must unlock the bootloader (see
below):
fastboot flash recovery recovery.img
fastboot flash boot boot.img
fastboot flash system system.img
fastboot flash userdata userdata.img
fastboot flash staging blob
Unlocking the Bootloader
Your SHIELD TABLET may have shipped with a locked bootloader. To update the device,
you must unlock the bootloader using the following:
- fastboot oem unlock
- Press the "Volume Down" button to select "Unlock bootloader" option on device
- Press the "Power" button to confirm the unlock. Your device's bootloader is now unlocked.

[GUIDE] How to unlock bootloader on Nokia 3

*Unlocking bootloader will remove all your data!*
I'm using Windows 7, and that's the steps i did. (it should be simmilar for other systems too)
Getting code:
Code will look simmilar to this: DB1ED223C5537BA756FB0671E425D650
Method 1 (no root):
Go to
https://passwordsgenerator.net/md5-hash-generator/ copy paste serial number and click generate. Then you should see code in "MD5 Hash of your string". You can also go to simmilar md5 hash generator sites, but this site automatically converts small letters to big letters.
Method 2 (root):
Okay, this is new method that is much easier and you don't need to send IMEI and wait for @the_laser to give you code. Go to terminal emulator, type su and execute it. Then type this and execute it:
redweaver said:
Actually the command is
echo -n NE1GAM4770133666 |md5sum |tr [:lower:] [:upper:]
If you don't use the -n flag, the newline character is also passed and you get a different result
Click to expand...
Click to collapse
Unlocking bootloader:
Download platform-tools which activates adb and fastboot commands (first you need Nokia 3 driver installed if you didn't)
Nokia 3 driver: http://www.devfiles.co/download/3iK0k7Sv/Nokia_3_USB_Drivers.zip
platform-tools Windows: http://www.devfiles.co/download/KtLsN6fX/platform-tools-latest-windows.zip
platform-tools Mac: http://www.devfiles.co/download/OkrfluP0/platform-tools-latest-darwin.zip
platform-tools Linux: http://www.devfiles.co/download/vk5DudZX/platform-tools-latest-linux.zip
Enable usb debugging in Developer options before running adb. To get Developer options, go to settings, about phone and press build number 7 times. Also enable OEM unlock.
Now Connect phone to computer via usb and enable usb file transfer, run cmd as administrator, then type this command which runs adb:
chdir C:/Users/John/Desktop/platform-tools (this is just a example, you need to type your own location of platform-tools)
then type this command to check is your device connected to adb, it will show serial number of your device, if it hangs at waiting device, then you need to reinstall drivers (if you're doing this first time, then it will ask to allow usb debugging on your computer, just tick always allow from this computer and click OK)
adb devices
then type this command to reboot to recovery (you can boot to recovery by holding power on + volume up (only with usb connected) if this command doesn't works)
adb reboot recovery
when booted to recovery, choose reboot to bootloader option with volume sliders (this will boot to fastboot)
when booted to fastboot, it will show text 'FASTBOOT MODE' in down-left corner
now type this command to check is your device connected properly to fastboot.
fastboot devices
if it show characters like 0123456789ABCDEF or simmilar then it is connected properly, if it hangs on waiting device, then you need to reinstall drivers like mentioned above.
Android Nougat (7.0 & 7.1.1):
Now type these commands to unlock bootloader
fastboot.exe -i 0x2e04 oem key (type your key after oem key)
fastboot.exe -i 0x2e04 oem unlock
then press volume up, when asked
Android Oreo (8.0 & 8.1):
First download NE1-0-215H.lk.bin:
https://my.pcloud.com/publink/show?code=XZaLMs7ZclQ2wvKwSb0ofUraMmrsiHh6uk1X
Now type these commands to unlock bootloader
fastboot oem dm-verity <your_unlock_key>
fastboot flash lk NE1-0-215H.lk.bin
fastboot reboot-bootloader
Proceed your unlock procedure.
If you have problem on flashing the lk partition, you can use MTK Smart Phone Flash Tool to flash lk partition manually.
After lk partition flashed, you may encounter "Red State" when booting the phone. Ignore that and boot your phone to Fastboot mode directly with OST LA.
That is it, i tried to explain for you to understand everything i did to unlock bootloader.
Credits:
@the_laser for codes, some additional steps and corrections. Also thanks for new method. @redweaver for new method.
@Hikari_kalyx for Android Oreo method. @bigrammy for NE1-0-215H.lk.bin link.
way to enter recovery without adb -
power off phone
press and hold volume up + power on buttons, insert cable immediately
countdown will start on phone, hold both keys until countdown ends, then IMMEDIATELY release power on key, still holding volume up
you will enter recovery shortly
after installing TWRP it is very important - DO NOT allow /system modification until supersu package installation ! ( or you will require reflashing phone with OST )
another note - can't enter recovery by combination volume-up + power button, if phone not connected to computer
one man reported, that even he successfully flashed TWRP image with "fastboot flash recovery <twrp image>", he still got original recovery.
workaround is to use "fastboot boot <twrp image>" - as we need to have USB cable connected to enter TWRP recovery anyway, not big problem.
the_laser said:
way to enter recovery without adb -
power off phone
press and hold volume up + power on buttons, insert cable immediately
countdown will start on phone, hold both keys until countdown ends, then IMMEDIATELY release power on key, still holding volume up
you will enter recovery shortly
after installing TWRP it is very important - DO NOT allow /system modification until supersu package installation ! ( or you will require reflashing phone with OST )
another note - can't enter recovery by combination volume-up + power button, if phone not connected to computer
one man reported, that even he successfully flashed TWRP image with "fastboot flash recovery <twrp image>", he still got original recovery.
workaround is to use "fastboot boot <twrp image>" - as we need to have USB cable connected to enter TWRP recovery anyway, not big problem.
Click to expand...
Click to collapse
Someone told me that if you flashed twrp, that it automatically removes data encryption. Is that true?
EDIT: i find out that is not true, it asks for some password to decrypt data, but the problem is that idk what is the password
DON'T install xposed! It bootlops.
EDIT: My fault, it actually work but you need to wait more than usual to boot.
That is great guys.
Do we have a working recovery yet?
nafnist said:
That is great guys.
Do we have a working recovery yet?
Click to expand...
Click to collapse
I use this twrp https://1drv.ms/u/s!AsmTb5aqoY12mDZqDZbPOp47QVMV
I have stock recovery, but I use fastboot command 'fastboot boot recoveryname.img' when I need TWRP, and that's awesome because I don't lose stock recovery which is useful to flash OTAs and Nokia zips. I flashed SuperSu 2.79 just fine, but expect some crashes like software update, device monitor crash, but actually everything works, software update works just fine.
SkaboXD said:
Someone told me that if you flashed twrp, that it automatically removes data encryption. Is that true?
EDIT: i find out that is not true, it asks for some password to decrypt data, but the problem is that idk what is the password
Click to expand...
Click to collapse
TWRP can't handle Android 7.x default disk encryption, just press "cancel" and we need to use sdcard as storage for backups and packages because of this
Can I return the bootstrapper lock?
Where are you getting the codes from @the_laser?
abetterlie said:
Where are you getting the codes from @the_laser?
Click to expand...
Click to collapse
Yes
shokohiw said:
Yes
Click to expand...
Click to collapse
you mean to get bootloader locked again?
yes you can just instead of oem unlock type oem lock
I mean where are you getting the OEM unlock keys from?
SkaboXD said:
you mean to get bootloader locked again?
yes you can just instead of oem unlock type oem lock
Click to expand...
Click to collapse
abetterlie said:
I mean where are you getting the OEM unlock keys from?
Click to expand...
Click to collapse
idk, ask @the_laser
the bootloader I unlocked how to install root and twrp
shokohiw said:
the bootloader I unlocked how to install root and twrp
Click to expand...
Click to collapse
link for twrp
https://1drv.ms/u/s!AsmTb5aqoY12mDZqDZbPOp47QVMV
when downloaded, copy twrp to folder platform-tools and rename it to recovery.img
reboot to fastboot, then type this command:
fastboot flash recovery recovery.img
then reboot, fastboot reboot
if it didn't worked, use this command just to boot to twrp (you need to do this everytime when you are connected to PC)
fastboot boot recovery.img
To install root, first disable system modification on twrp then flash this zip for root.
This is not the latest version of SuperSU, but newest releases have some problems and crashes. (at least for me). This is last version that works for me.
That is it.
Thank you!
Is it possible after unlocking, installing twrp and root, to return the device to factory settings for ota updates? If so, how?
shokohiw said:
Is it possible after unlocking, installing twrp and root, to return the device to factory settings for ota updates? If so, how?
Click to expand...
Click to collapse
on twrp, there is a option wipe, click on it, then you will see option swipe to factory reset. then wait and reboot.
And you can now enable system modification if you want (it is recommended to enable it because some zips fails to flash because this option is disabled)
After installing TWRP and rebooting, does not want to boot Android, weighs in on the initial splash screen what to do
Your device has failed verification and may not work properly
shokohiw said:
After installing TWRP and rebooting, does not want to boot Android, weighs in on the initial splash screen what to do
Your device has failed verification and may not work properly
Click to expand...
Click to collapse
Weird, when it says your device has failed verification?
For me reboot works fine

The Complete Pixel 3 How-To Guide (newbie friendly!)

There's a ton of information out there, but finding it can sometimes be a challenge, especially for a newbie. And then there's posts to read through, in case a process has changed and it's only talked about in a single place, buried any number of pages back. So this is my attempt to put all Pixel 3 how-to's into a single thread. Everything below is what worked for me, from start to finish, with a fresh phone directly from Google that was bootloader-locked, unrooted, and running stock Android. Comments are welcome and encouraged: if something doesn't work for you, or you have a better/quicker/more reliable way of doing something, or maybe I made a mistake...let me know!
A few things:
Everything in this guide was tested on a "regular" Pixel 3 (blueline). It should all work exactly the same on a Pixel 3 XL (crosshatch), as long as you download the appropriate files (specifically the factory/OTA images and TWRP). I'm posting this in both blueline and crosshatch forums.
This first post will have links to files and the tools you need, as well as general things (like how to enable debugging and boot into recovery). The second post has how-to's for the big stuff (flashing images, TWRP, unlocking, etc).
I'm not responsible for anything you do. Follow these guides at your own risk. Doing so may also void your warranty.
Files and URLs
Official Android files
Factory (wipes device and requires unlocked bootloader): https://developers.google.com/android/images
Full OTA (leaves data intact, can be done via ADB sideload): https://developers.google.com/android/ota
Preview/beta OTA: https://developer.android.com/preview/download-ota.html
TWRP
XDA thread: https://forum.xda-developers.com/pixel-3-xl/development/twrp-3-2-3-0-pixel-3-xl-t3861623
Download: https://dl.twrp.me/crosshatch/
Magisk
XDA thread: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
ADB and Fastboot
Google USB drivers: https://developer.android.com/studio/run/win-usb
SDK platform tools: https://developer.android.com/studio/releases/platform-tools
Download the ZIP and open (no need to extract the whole thing)
Copy the files below to their own directory (you will use this directory for all ADB/Fastboot commands):
adb.exe
AdbWinApi.dll
AdbWinUsbApi.dll
fastboot.exe
General
Enable USB debugging
Download Google USB drivers (see above)
Download SDK platform tools and copy required files to their own directory (see above)
Enable USB debugging (Settings > About > tap Build 7 times > back > Developer options)
Plug phone into computer and when "Allow USB debugging" box comes up, check the box and allow (may need to have adb daemon running on the computer already, see below)
Fastboot mode (using hardware keys) aka bootloader
Power off
Hold VOL- and press/hold PWR until bootloader (fastboot) comes up
Recovery mode (using hardware keys)
Get into Fastboot mode (see above)
Use VOL buttons to find Recovery in the list, use PWR to select (should boot to broken android image)
Hold PWR and press VOL+ once to get into recovery
Useful ADB and Fastboot commands
Enable USB debugging (see above)
ADB (used while phone is "on" and booted up):
Use "adb devices" to ensure the computer is authorized
Use "adb reboot bootloader" to get into Fastboot
Fastboot mode
Use "fastboot devices" to verify computer can see your phone
Update #1: Items below marked through were removed since they don't really apply to Android 10.
Update #2: Edited to reflect changes in root with Android 11.
A quick note: everything below is assuming you're using Windows 10. When it says "Type...", this assumes you've opened a command window in the location of adb/fastboot and that all files referenced are in the same directory and (in some cases) renamed as I reference them (short names without spaces simplifies things). If you're using Powershell, you will probably need to change "adb" and "fastboot" to read ".\adb" and ".\fastboot" so Powershell will use the local files.
Unlocking the bootloader
THIS WILL WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
In Developer Options, enable OEM unlocking and confirm (it may ask you to input fingerprint or PIN/pattern/password)
Boot into Fastboot mode (see above)
Type to unlock:
Code:
fastboot flashing unlock
Use VOL+ key to get the options on the screen to read "Unlock the bootloader" and use PWR button to select
Type to reboot:
Code:
fastboot reboot
Locking the bootloader
THIS WILL WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
Boot into Fastboot mode (see above)
IMPORTANT: restore stock recovery if you replaced it with TWRP (this should prevent the "Can't find valid operating system" issue)
Type to lock:
Code:
fastboot flashing lock
Use VOL buttons to find "Lock the bootloader" and use PWR to select
Type to reboot:
Code:
fastboot reboot
Factory reset via fastboot (can also do this without wiping data)
THIS COULD WIPE YOUR PHONE, SO MAKE SURE EVERYTHING IS BACKED UP!
Download factory image ZIP and unzip all files into their own folder
Unlock bootloader (see above)
Reboot into Fastboot mode
You have 2 options:
Register the location of fastboot.exe with the PATH system variable and run "flash-all.bat"
Wipe data: just run "flash-all.bat" and call it a day
Do not wipe data: open "flash-all.bat" in a text editor (careful not to double-click and run it!), remove the "-w" from the last line to disable the wiping of data, then save, close, and run
Move the 3 files (bootloader IMG, radio IMG, image ZIP) into the ADB folder, rename for simplicity if you want, launch cmd or Powershell, and run the commands below (which come from "flash-all.bat")
Wipe data: type out commands below, but at last line, add "-w" flag: fastboot -w update image.zip
Do not wipe data: type out commands below as written (no "-w" flag)
The commands:
Code:
fastboot flash bootloader bootloader-blueline-XXXX.img
fastboot reboot bootloader
[wait for reboot]
fastboot flash radio radio-blueline-XXXX.img
fastboot reboot bootloader
[wait for reboot]
fastboot update image-blueline-XXXX.zip
Note: The last command (update image) will launch the red "fastbootd" screen, so don't worry and be patient while the command line tells you what's happening. The phone will reboot on its own into the Android system (not fastboot) afterward.
Root Android 10+ using Magisk (Canary channel)
This must be done after every update, and you cannot use the patched file from a different phone!
Unlock bootloader (see above)
Download factory image (not OTA, see link above)
Download and install Magisk Manager Canary (see link above)
In Magisk Manager settings, set Update Channel to "Canary"
Extract boot.img from image-blueline-XXXX.zip found in the factory image you downloaded
Place boot.img on your phone's internal storage
Open Magisk Manager and do:
tap "Install" button (next to "Magisk" in first block on the main screen)
"Select and Patch a File" option
Find boot.img file you just placed on your phone
tap "Let's Go"
When finished, move the newly-created magisk_patched.img file over to your computer's ADB directory
Reboot into bootloader
Type:
Code:
fastboot flash boot magisk_patched.img
fastboot reboot
Open up Magisk Manager and make sure everything's good!
Note : if you get stuck in fastboot mode or in a boot loop, flash the stock boot.img to both slots and try again
Code:
fastboot flash boot boot.img --slot all
Optional:
for adblocking, tap "Systemless hosts" in Magisk Manager, then install AdAway using F-Droid
install a performance kernel like Kirisakura for Bluecross (R)
Updating Android 10+ while rooted
You can't take an OTA while rooted, so updating Android 10+ (as in monthly updates) can be one of two ways.
Method #1 (faster, but more chance for issues)
Download OTA ZIP and move it to ADB folder (don't unzip it)
This does not require an unlocked bootloader, but does require USB debugging (see above)
Get boot.img from the factory image (see first post on where to download this) and place your ADB directory
Reboot into bootloader / fastboot and type to restore stock boot to both slots:
Code:
fastboot flash boot --slot all boot.img
fastboot reboot bootloader
[wait for reboot]
Use VOL buttons to select "Apply update from ADB"
Type (where filename is the name of the file you want to sideload):
Code:
adb sideload filename.zip
Wait for it to finish, will take you back to Recovery when it's done
Reboot using menu
Method #2 (takes longer, but best bet for minimal issues)
Follow "Factory reset via fastboot" instructions (see above, make sure you don't wipe your data!)
Take the OTA in the official way (through Android)
Follow "Root Android 10+ using Magisk Canary" instructions (see above)
Boot into TWRP (3.3.0-0 or higher)
Download TWRP IMG and place in ADB folder (rename the file to twrp.img)
If not already done, unlock the bootloader (see above)
Reboot into bootloader
Type to boot TWRP (it will restart and should boot into TWRP):
Code:
fastboot boot twrp.img
OPTIONAL: Replace recovery by installing TWRP
Your phone should automatically mount, so move twrp.img from PC to Download folder on phone's internal storage
Advanced > Install Recovery Ramdisk > choose TWRP IMG > Swipe to install
Back > Fix Recovery Bootloop > Reboot System > Do Not Install when asked if TWRP should install app
Root using Magisk (18.1 or higher)
Download Magisk ZIP and move to device
Boot into TWRP (see above)
Enter your PIN/pattern/password to decrypt (unnecessary if you are not using security on your phone)
Swipe to Allow Modifications (to system)
Install > find and select the Magisk ZIP > Slide to install
Wipe cache > Reboot system > Do Not Install when asked if TWRP should install app
Open Magisk Manager to verify latest and to install modules
"Can't find valid operating system" booting issue
Unlock your bootloader again (see above)
Follow steps for "Factory reset via fastboot" (see above) and keep the wipe flag
After it reboots, power off (press PWR and select "Power off" from menu)
Follow steps for "Locking the bootloader" (see above)
After it reboots into Fastboot mode, have it start using the PWR button
Android Recovery / "Cannot load Android system" booting issue
This can happen for a number of reasons, but the fix is the same: "Factory reset via fastboot" (see above). You probably do not need to wipe user data, so you can omit the "-w" flag.
If you still get the error message, select the "Try again" option. If it still doesn't work, try "Factory reset via fastboot" again, as well as "Try again". If it doesn't work this time, you probably have no choice but to do a factory reset (in which you will definitely lose your data).
If it happens after flashing Magisk in TWRP, though, you've got a slightly different issue and the problem will persist no matter how many times you flash the factory images and re-install Magisk. This is probably due to something leftover in the previous Magisk installation that conflicts with the new installation. There are two ways to handle this.
First and easiest: uninstall Magisk Manager app before rebooting into the bootloader and running fastboot commands. Then proceed as usual (sideload OTA or flash factory images via fastboot, boot TWRP, and flash Magisk). All guides for this are above. This method preserves any modules you have installed.
Second and more complete (if the above method still gives you trouble):
download to your phone the Magisk ZIP, Magisk Uninstaller ZIP, and Magisk APK from this XDA thread
uninstall the Magisk Manager app
reboot to bootloader
using fastboot, boot into TWRP using IMG (you don't need to replace boot with TWRP)
flash Magisk Uninstaller ZIP
wipe Dalvik
flash Magisk ZIP
wipe Dalvik
reboot system (do not install TWRP)
install Magisk Manager APK and re-install any modules
I just have a couple questions pls-
1) Do the above instructions work on the Verizon Pixel 3 XL
2) I'm currently runned the official Android Q Beta (April 5). Do I need to leave the beta, then restore back to stock Android P (and do I do all those updates before starting root instructions)?
Should I be concerned if my phone hasn't informed me of an April update?
I don't remember if I unlocked the bootloader before or after the updates to the March security update. Does it matter?
farfegnugen said:
I just have a couple questions pls-
1) Do the above instructions work on the Verizon Pixel 3 XL
2) I'm currently runned the official Android Q Beta (April 5). Do I need to leave the beta, then restore back to stock Android P (and do I do all those updates before starting root instructions)?
Click to expand...
Click to collapse
Is your bootoader Locked or Unlocked?
---------- Post added at 08:08 AM ---------- Previous post was at 08:07 AM ----------
mcwups1 said:
Should I be concerned if my phone hasn't informed me of an April update?
I don't remember if I unlocked the bootloader before or after the updates to the March security update. Does it matter?
Click to expand...
Click to collapse
No it does NOT matter which build you unlocked your BL
*edit*
Try to go into settings and force the update or you can always flash the entire factory img for april
farfegnugen said:
I just have a couple questions pls-
1) Do the above instructions work on the Verizon Pixel 3 XL
2) I'm currently runned the official Android Q Beta (April 5). Do I need to leave the beta, then restore back to stock Android P (and do I do all those updates before starting root instructions)?
Click to expand...
Click to collapse
1.) If you somehow have an unlocked bootloader, yes, it would work for the Verizon Pixel 3 XL. However, I was under the impression that Google will not unlock the BL for the Verizon variant and there is currently no way to "hack" it.
2.) It should work the same whether you're on P or Q, though if you want to remain with Q, make sure you download the beta files directly from Google (rather than the P images) and use Magisk 19.0 instead of 18.1.
mcwups1 said:
Should I be concerned if my phone hasn't informed me of an April update?
I don't remember if I unlocked the bootloader before or after the updates to the March security update. Does it matter?
Click to expand...
Click to collapse
You can force it to check for updates; when you unlocked the BL shouldn't matter if you're using a patched boot image.
HACK3DANDR0ID said:
Is your bootoader Locked or Unlocked?
---------- Post added at 08:08 AM ---------- Previous post was at 08:07 AM ----------
No it does NOT matter which build you unlocked your BL
*edit*
Try to go into settings and force the update or you can always flash the entire factory img for april
Click to expand...
Click to collapse
I haven't done anything to the phone since I got it 3 weeks ago but hoping to. Can the VZ version be unlocked? If so please point me in the right direction.
farfegnugen said:
I haven't done anything to the phone since I got it 3 weeks ago but hoping to. Can the VZ version be unlocked? If so please point me in the right direction.
Click to expand...
Click to collapse
No, but they working on finding a way to unlock it: [Bounty] Unlock Bootloader VZW Pixel 3 XL by coolhandz
Homeboy76 said:
No, but they working on finding a way to unlock it: [Bounty] Unlock Bootloader VZW Pixel 3 XL by coolhandz
Click to expand...
Click to collapse
Thanks so much for the info! Its difficult trying to find the current status of all the diff devices' root statuses.
Thanks for this guide, when using the flash-all.bat and wiping the device will this method flash to both slots?
CadTechBGMC said:
Thanks for this guide, when using the flash-all.bat and wiping the device will this method flash to both slots?
Click to expand...
Click to collapse
yes, if you are flashing with wipe all option (without removing -w) it does flash to both slots.
Regarding getting to fastboot:
Since I have flashed April security update and after lightly bricking my Pixel 3Xl, (I have not lost data but I was unable to boot till solving the brick), the phone doesn't stay in fastboot when I use the adb command to get into it and all I can do to get to stay in fastboot is the power and volume down combo for more than 40 seconds.
I have my pixel working perfectly with root and kirisakura kernel but it is a bit of a pain getting to boot TWRP from fastboot for flashing stuff.
EMJI79 said:
Regarding getting to fastboot:
Since I have flashed April security update and after lightly bricking my Pixel 3Xl, (I have not lost data but I was unable to boot till solving the brick), the phone doesn't stay in fastboot when I use the adb command to get into it and all I can do to get to stay in fastboot is the power and volume down combo for more than 40 seconds.
I have my pixel working perfectly with root and kirisakura kernel but it is a bit of a pain getting to boot TWRP from fastboot for flashing stuff.
Click to expand...
Click to collapse
yeah if i try to get into fastboot directly from a power on state it doesn't stick on fastboot blinks for a second and then starts with reboot process, probably we are pressing it too long.
what i do normally is to power off the device first wait for few seconds then then use key combination to get it to fastboot from power-off state. Booting from fastboot to twrp never had any issues unless i had messed up the twrp installation due to some mess i did.
SacredDeviL666 said:
yeah if i try to get into fastboot directly from a power on state it doesn't stick on fastboot blinks for a second and then starts with reboot process, probably we are pressing it too long.
Click to expand...
Click to collapse
I have to press the keys 40 seconds even from power off.
EMJI79 said:
I have to press the keys 40 seconds even from power off.
Click to expand...
Click to collapse
definitely not 40seconds from power off state for me. not sure whats happening there
Maybe a short video would be a help to some of us newbies
Dumb question. Probably gonna upgrade from an original Pixel XL soon. As long as I buy it from store.google.com, I should be able to unlock the bootloader without worrying about a crack/hack, correct? Thanks!
Drashnar said:
Dumb question. Probably gonna upgrade from an original Pixel XL soon. As long as I buy it from store.google.com, I should be able to unlock the bootloader without worrying about a crack/hack, correct? Thanks!
Click to expand...
Click to collapse
That is correct. I made the same switch from an OG Pixel and Pixel XL to P3 and P3XL right after release. Unlock the bootloader before you mess around a lot since it will do a factory reset.
How about backups? Does anyone backup and restore, or not?
If so, how do you do it with this 2 partition system?
installed and I like it. I cant get the clock off the lock screen. all settings says it is off.
wished it had MicroG installed instead of gapps

[GUIDE] [TA-1032] How to unlock bootloader, install TWRP and Magisk

Code:
TRY THIS AT YOUR OWN RISK! This could brick your phone. It shouldn't but it can. If you brick your phone, or anything stops working on your phone, YOU are responsible.
Reboot combinations:
Fastboot: Shutdown and with USB cable hold power and volume down until it says FASTBOOT MODE at the bottom
Recovery: Shutdown and with USB cable hold power and volume down until the
Code:
Please release key to power off *
dissapears.
Unlocking Bootloader
Code:
Note: This will delete all user data! Backup all your data before doing this!
This part of the guide is part of the tutorial made by @Arin59 at https://forum.xda-developers.com/nokia-3/how-to/method-to-unlock-bootloader-nokia-3-pie-t4012285
First of all convert your serial number (should look like NE1*************) to MD5 Hash and enable OEM Unlock in developer options.
Then reboot to fastboot and type
Code:
fastboot oem key {HASH}
then type
Code:
fastboot flashing unlock
.
To reboot to Android, run fastboot reboot.
Installing TWRP
Code:
This will delete your user data, but it should be already deleted.
You can use any TWRP image made for this device but I had the most success with https://forum.xda-developers.com/nokia-3/development/twrp-teamwin-recovery-nokia-3-t3762512 .
Flash your TWRP Image chosen with
Code:
fastboot flash recovery your-recovery-image.img
and then reboot to recovery.
In TWRP go to Wipe and then Format Data and type yes.
Install Magisk
Install Magisk normally.
< waiting for device >
I put the phone in fastboot mode and ran fastboot with the oem key md5 hash command but it just said "< waiting for device >". I think it might be because I forgot to install the Nokia 3 USB drivers. I'm using a linux computer, do I need to find OS specific drivers?
edit: And now my phone is stuck in fastboot mode and for some reason will not shutdown no matter how long I hold down the power button for.
Totalitor said:
I put the phone in fastboot mode and ran fastboot with the oem key md5 hash command but it just said "< waiting for device >". I think it might be because I forgot to install the Nokia 3 USB drivers. I'm using a linux computer, do I need to find OS specific drivers?
edit: And now my phone is stuck in fastboot mode and for some reason will not shutdown no matter how long I hold down the power button for.
Click to expand...
Click to collapse
If you're using a linux computer, you should try running the command with sudo.
If it doesn't work, try with another cable (or computer if it doesn't work) and try again.
#AC said:
If you're using a linux computer, you should try running the command with sudo.
If it doesn't work, try with another cable (or computer if it doesn't work) and try again.
Click to expand...
Click to collapse
Thanks. I've since got it working. For some reason I had to use the -i argument (the interface argument) along with the code for the device (0x2e04) "fastboot -i 0x2e04 <command>".
However, I've recently bypassed the "NO COMMAND" screen and gained access to TWRP custom recovery but in trying to shut down the phone, it shuts down fine but only boots up in fastboot mode. Even using the fastboot reboot command from adb tools boots it up in fastboot mode. This is a problem as I need to boot it in its normal mode so I can download the magisk.zip file required for installing magisk but I seem to be unable to do so.
Totalitor said:
Thanks. I've since got it working. For some reason I had to use the -i argument (the interface argument) along with the code for the device (0x2e04) "fastboot -i 0x2e04 <command>".
However, I've recently bypassed the "NO COMMAND" screen and gained access to TWRP custom recovery but in trying to shut down the phone, it shuts down fine but only boots up in fastboot mode. Even using the fastboot reboot command from adb tools boots it up in fastboot mode. This is a problem as I need to boot it in its normal mode so I can download the magisk.zip file required for installing magisk but I seem to be unable to do so.
Click to expand...
Click to collapse
Try holding volume up and down at the same time while holding the power button.
#AC said:
Try holding volume up and down at the same time while holding the power button.
Click to expand...
Click to collapse
Thanks, it worked.
Though I tried wiping, but it didn't solve the booting issue. Unsure how to proceed at this point. I feel like I've tried everything. Actually, I just checked my /boot folder and it's empty...is that why it's always booting into fastboot?
I tried using adb to sideload the magisk.zip file but then the phone rebooted into stock recovery??
Any and all guides on this say to download the magisk.apk either into the SD card or internal storage, but I don't have a micro SD card and I can't access the normal mode of the phone to download anything.
What can I do?
I've flashed TWRP successfully but forgot to download the magisk.apk. Now whenever I boot up my phone, it boots into stock recovery mode automatically, even if I tell TWRP to reboot into system it reboots into Stock Android recovery. I can still access TWRP by holding down the up + power buttons on boot though, but I can't access the normal mode of the phone anymore.
I tried using TWRP's sideload feature with ADB tools to sideload Magisk.zip and it said it succeeded but in using TWRP's install feature to find the zip file, it wasn't in /sideload/ or /storage/ as both were empty.
How can I temporarily restore normal functionality so I can simply download the Magisk manager.apk?

Unlock TCL 20y (6156D) phone. Possible?

Hello,
I have a TCL 20y (model 6156D) phone and i'm trying to gain root access in any way.
I've tried to enable oem unlocking and go to fatboot mode, but the command
fastboot oem unlock returns "FAILED (remote: 'Command not supported in default implementation')".
On producer website i can't find this model and in the "repair software" this model (6156D) is missing.
I don't have any recovery file (stock or trwp), and i don't know how to dump original recovery to file (for install magisk, but anyway i think i can't flash modified versions without unlock bootloader).
Is there anything i can try?
---
Edit: I finally found the original flash tool at the following url:
Modello
www.tcl.com
https://www.tcl.com/content/dam/tcl-html/TCTService/support/tcl-20-r-5g/Mobile_Upgrade_S_Gotu2_v1.1.5_Setup.exe
It seems to support model 6156 and, with connected phone, it has downloaded a lot of files and created a folder "6156D-2ALCWE12\ANAJEAJ0" (model\version) with a lot of files with MBN extension and a zip with system.img inside.
Maybe these files may be useful to root the phone. Anybody knows how to open MBN files?
--
Edit: I've notice a strange thing. When I boot to recovery, i see two interesting options:
- Enter fastboot: this stats "fastbootd", a graphical menu with a few reboot options. In this phase the computer recognizes the phone with fastboot driver and list it with "fastboot devices" command.
- Reboot to bootloader: this clear the screen, writes "FASTBOOT>" in the low position of the screen. In this phase the computer recognizes the phone with adb driver and don't list it in fastboot devices nor adb devices.
I've also tried to flash magisk apk (renamed as zip) with adb sideload, but as expected i got Error 21.
Is there a way to sign any root manager or su binary and install it using this method?
What am i doing wrong?
Hi!
I've managed to unlock the bootloader on a TCL 20Y by following this guide: https://romprovider.com/tcl-20y-unlock-bootloader/.
I used the mtk_gui utility, which is really straightforward. The only tricky thing was going into brom/preloader mode - sometimes it works, other times it doesn't.. The trick is to hold both volume buttons while plugging in the USB cable to the computer.
Then, I've also managed to root the device with Magisk by patching both the boot_a.img and boot_b.img images and flashing them using fastboot by following the official guide: https://topjohnwu.github.io/Magisk/install.html.
Haven't yet played with the orange state disabler as I've read that it can result in a brick.
BR
Hey there!
With bevvare's help I was also able to root my TCL 20Y without much issue, though I encountered a few minor differences and details so we agreed it would be good if I wrote them down here.
Regarding the first guide used to unlock the bootloader:
The mtk_gui utility packed in the, as of today, latest release of mtkclient (1.52) refused to launch. That wasn't too bad seeing as the guide provides the necessary commands, but it's something to keep in mind.
In addition, I found that the phone would stop accepting commands after the first one was issued or after the log got too long*. This might have only been an issue on my end, but just in case, this is how i ran each command:
-Turn the phone off
-Hold the power button along with both vol+ and vol- (you may plug in the phone at this stage)​-While in the Recovery Mode screen, issue the command on your terminal​-Select the option to restart the device in the recovery screen, then hold both vol+ and vol- until the terminal starts printing output (the phone's screen will stay off while this happens)​-After the command has executed, unplug the phone (probably optional) and hold all three buttons again to restart and boot into recovery​Repeat as needed​​
* Remember how I mentioned the command seemed to fail if the log got too long? Well, this is what happened to me with the very first command on the guide (the one that erases three partitions at once). Just to be sure, I erased them separately using the same command.​​PS: booting into recovery first may not even be needed, I just found it easier that way.​
The guide provides two unlock commands, the first one being python mtk xflash seccfg unlock, this ran without issue and triggered the orange state warning on boot. The second command (fastboot flashing unlock) refused to work, but the bootloader was nonetheless unlocked.
Also, the guide provides the relock command right after the unlock one as if it were the next step to take. This might be obvious, but don't relock your bootloader until after you're done flashing the new boot image (even then there's no real reason to relock it).
Regarding Magisk's guide on patching boot.img:
Magisk failed to patch boot_b.img. This turned out to not be a problem because my device was using the boot_a partition as the active one (I used this guide to check https://krispitech.com/check-partition-slot-a-b/ )
In order to get the necessary files, namely boot_a.img and vbmeta_a.img, I used this guide to dump all the partitions within the phone into my PC: https://forum.xda-developers.com/t/...sing-mtk-client-oppo-reno6-5g-mt6877.4406069/
You may also decide to dump only the two partitions you need, in which case you could issue the following command instead: python mtk rl boot_a,vbmeta_a boot_a.img,vbmeta_a.img (this assumes your phone is also using partition A, adjust as needed).
If you used the above guide to dump all the partitions, the files you need will have the .bin extension, just rename them so they are .img files instead.
I recommend flashing vbmeta_a.img (it's optional and doesn't need to be patched in the Magisk app like boot_a.img). Otherwise your device will print a spooky warning at boot about being corrupt and demand you press the power button, which is annoying.

Categories

Resources