Tool to Unlock Bootloader in ASUS ZenPad 3S 10 Z500M (P027)
This software essentially unlocks the bootloader in your tablet. I've developed a way to switch a Mediatek bootloader into an unlocked state using root privileges. Luckily, the Z500M does give us temporary root access to run this tool. The result is an "Orange State" boot mode, which disables boot partition verification. As a bonus, this procedure does not erase your data like a typical unlock routine does. It also does not require a PC except to start the temporary rooted image. Note that your tablet will still lack fastboot flashing functionality. But flashing by other means is still possible.
WARNING: Running this tool should be pretty safe. But I don't encourage anyone to try this. Before trying this out, consider the risks and drawbacks involved. By unlocking, you are essentially giving up the security of your device. It's also possible that a future firmware update will relock the bootloader or become incompatible with this tool.
This software is only for ASUS model Z500M/P027. Do not try it on any other device. It will not work. Support for other Mediatek devices may be added in the future. (That's why this is posted in the general forum rather than the ZenPad 10 one.)
And by the way, I don't own this tablet.
DISCLAIMER
This software is for educational purposes only. Anything you do that is described in this post is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.
REQUIREMENTS
A ZenPad Z500M tablet upgraded to Android N
A rooted/patched boot image such as one made by Magisk Manager (method 1)
Temporary root with Magisk or other superuser manager installed (method 1)
TWRP image (method 2)
Knowledge of adb/fastboot and of basic Linux command shell
INSTRUCTIONS
Method 1
Read all of these instructions and make sure you understand them before starting
If you don't have an offline patched boot image, use Magisk Manager to make one from the stock boot.img of your current firmware. Transfer it to your PC.
Reboot your tablet into fastboot mode--either hold vol. down + power to power up, and select Fastboot. Or run 'adb reboot bootloader' while in Android.
Connect your tablet to a PC and run fastboot boot patched_boot.img to start the rooted image in tethered mode
Download the tool zip file to your tablet.
Extract the zip to your /data/local/tmp folder.
Open a root shell with adb shell, then run 'su'
Change your shell current directory to that folder (cd /data/local/tmp)
Run this command to unlock or lock the bootloader
Code:
sh unlockbl.sh
Follow the instructions on the screen and type the requested confirmation into the prompt.
Check for completion or any error messages. Report them here.
If no errors, you are unlocked and may modify your boot partition (e.g. install root).
Method 2
Read all of these instructions and make sure you understand them before starting
If you don't have TWRP for your tablet, download the latest image to your PC from this thread.
Download the tool zip file to your tablet.
Extract the zip to your /data/local/tmp folder. (For this method, most other folders should work as well due to permissive selinux mode)
Reboot your tablet into fastboot mode--either hold vol. down + power to start up and select Fastboot, or run 'adb reboot bootloader' from Android
Connect your tablet to a PC and run fastboot boot twrp-*.img to start TWRP in tethered mode
At the TWRP welcome screen, do not select to modify the system partition and touch Keep System Read-only instead. Doing otherwise will render your tablet unbootable.
Mount system in TWRP in read-only mode. Mounting in read/write mode will render your tablet unbootable.
Open a shell with adb shell on your PC or open TWRP's built-in terminal
Change your shell current directory to the folder that you extracted the tool zip into (cd /data/local/tmp)
Run this command to unlock or lock the bootloader
Code:
sh unlockbl.sh
Follow the instructions on the screen and type the requested confirmation into the prompt.
Check for completion or any error messages. Report them here.
If no errors, you are unlocked and may modify your boot partition (e.g. install root).
DOWNLOAD
Current Version
Unlock Tool v0.6a
Changelog
v0.6a
Actually improve compatibility with TWRP
v0.6
Handle units with blank bootloader configs
Improve compatibility with TWRP
Improve text wrapping for TWRP's terminal
v0.5
Major overhaul to remove the need for kernel module
v0.2
Made compatible with other FW versions
v0.1
First release
CREDITS
@amartolos for being a kick-ass tester
If anyone wants to develop a full Android app around this script, be my guest.
Also, that Thanks button will not click itself...
reversed :silly:
I got this after typing "Yes, I want to unlock"
Extracting binaries
Inserting kernel module
Testing kernel module
Oops! Something went wrong. Aborting
Your system has not been modified
Exit code 126
Click to expand...
Click to collapse
When running script with terminal on tablet I got exit code 1 on the same stage.
Joh14vers6 said:
I got this after typing "Yes, I want to unlock"
When running script with terminal on tablet I got exit code 1 on the same stage.
Click to expand...
Click to collapse
Were you running a basic boot image or did you boot the patched boot image?
amartolos said:
Were you running a basic boot image or did you boot the patched boot image?
Click to expand...
Click to collapse
I booted from the patched boot image. Latest FW. Script will not run without (temp)root.
I haven't been able to get magisk to make a patched boot.img
Any help appreciated.
Can we use the patched boot image you posted from the other thread? "Z500M_signed_patched_boot.tar"? https://forum.xda-developers.com/showpost.php?p=74303280&postcount=72
2. Install Magisk Manager and create an offline patched boot image from the stock boot.img if you don't have one.
Apologies. I have Magisk installed on my Nexus 6 but I would not consider myself an expert. With that device I installed the Magisk zip file in TWRP recovery and then installed Magisk Manager. After installation of Magisk Manager on the Z500M and launching the app it asks if I want to install the Magisk 15.2 zip. Should that be done?
At this time I haven't done this and I don't see any method for creating the patched boot image. Can someone direct me via a link or explanation on how to do this?
There's another thread that contains this info: Click Here
ExtremeRyno said:
Can we use the patched boot image you posted from the other thread? "Z500M_signed_patched_boot.tar"? https://forum.xda-developers.com/showpost.php?p=74303280&postcount=72
Click to expand...
Click to collapse
Yes
Sent from my P01MA using Tapatalk
Joh14vers6 said:
I got this after typing "Yes, I want to unlock"
Extracting binaries
Inserting kernel module
Testing kernel module
Oops! Something went wrong. Aborting
Your system has not been modified
Exit code 126
Click to expand...
Click to collapse
When running script with terminal on tablet I got exit code 1 on the same stage.
Click to expand...
Click to collapse
Hmm, that sounds like a permissions problem. Before running the script, can you turn off Selinux enforcement somehow? Try running 'setenforce 0' or maybe there's a setting in Magisk that controls this. Bear with me, I'm trying to get to the bottom of this...
Has anyone besides amartolos gotten this to work yet?
I ran the tool successfully and it said to reboot and Root. While rebooting it says:
Orange State
Your device has been unlocked and can't be trusted
Your device will reboot in 5 seconds
Then I can't get a root to take.
Edit: I found the problem. After you run the script, run magisk to root before you reboot, while you are still in temp root status.
Sent from my P01MA using Tapatalk
loner. said:
I ran the tool successfully and it said to reboot and Root. While rebooting it says:
Orange State
Your device has been unlocked and can't be trusted
Your device will reboot in 5 seconds
Then I can't get a root to take.
Click to expand...
Click to collapse
Yep, you got it! In order to have persistent root, you actually have to install it to your boot partition while booted up with temporary root.
loner. said:
Edit: I found the problem. After you run the script, run magisk to root before you reboot, while you are still in temp root status.
Click to expand...
Click to collapse
Word
diplomatic said:
I got this after typing "Yes, I want to unlock"
Hmm, that sounds like a permissions problem. Before running the script, can you turn off Selinux enforcement somehow? Try running 'setenforce 0' or maybe there's a setting in Magisk that controls this. Bear with me, I'm trying to get to the bottom of this...
Has anyone besides amartolos gotten this to work yet?
Click to expand...
Click to collapse
I tried SELinuxModeChanger to set Selinux to permisive and tried setenforce 0 and both give same exit code 1 from the terminal.
Joh14vers6 said:
I tried SELinuxModeChanger to set Selinux to permisive and tried setenforce 0 and both give same exit code 1 from the terminal.
Click to expand...
Click to collapse
What firmware version do you have installed? And are you running this from the /data/local/tmp directory?
diplomatic said:
What firmware version do you have installed?
Click to expand...
Click to collapse
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.
Joh14vers6 said:
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.
Click to expand...
Click to collapse
Last two numbers should be .27
I checked and yes there is a update, but I don't think I can install it. Since I and already rooted. The size of the update seems to be a security update.
---------- Post added at 05:16 PM ---------- Previous post was at 05:11 PM ----------
Has anyone who successfully rooted this device able to do the update after?
I'm glad to see that Asus is releasing security updates even if it does break the unlock. My biggest fear buying this tablet was that it would not be updated. I opted for the update and will hope for an updated patch from @diplomatic.
As an aside. I would encourage anyone in this thread to give hit the "Thanks" button for diplomatic!
EDIT: I just checked and see my last update brought me to WW_14.0210.1711.30_20171206. That's different than the 1/4/2018 update showing on the website which is WW_14.0210.1709.30 and what @Joh14vers6 shows.
Joh14vers6 said:
FW WW_14.0210.1709.30 from 04 jan 2018 and yes, I ran from that folder.
Click to expand...
Click to collapse
OK everyone, this is important... I found an incompatibility between the new FW's kernel and the tool. You have to use the patched boot image from FW 1709.27 for temporary root... In the meantime, I have to fix it to be able to run under the new FW. But it won't be compatible with the old. And I hope it still unlocks...
Related
HOW TO UNROOT (ALMOST) ALL ANDROID DEVICES (SIMPLIFIED)
Firstly, in order to unroot your android device, you need:
1) An update available for your phone or an old nandroid backup that has a previous version of your phone android version
2) A nandroid backup done before you attempt the following steps below
Once the above conditions are met, you are ready to UNROOT your phone!
Before you read the procedure, read how it works
below and get a better picture:
HOW
Firstly, one known method of unrooting is to install an available system update. However, stock updates are signed with official keys and custom recoveries only accept updates signed with their custom keys.
So, to unroot, you need to have stock recovery installed. One way to get your phone`s stock recovery back is contained in the update zip.
The update zip is the key, literally. Look through it and you will find (usually in the system folder) a file called recovery.img, which will be used as your new stock recovery.
By flashing in the image into recovery, you can now install updates, keep your previous applications, enjoy being unrooted and updated.
There are other unroot options that tailor to specific android phones and versions, but this solution should work on all android phones.
Why unroot? Because sending in a rooted phone for repair will void your warranty. Also, by having a rooted phone, you run the risk of a rogue rooted application that does unwanted stuff to your phone.
PROCEDURE
Step 1) If you still have your original stock recovery that came with your phone, continue. Else search for my previous thread: "[RECOVERY] Reverting to original(STOCK) recovery" and follow the steps there. You can use the update file you used to revert to stock recovery here as well or vice versa
Step 2) Reboot you phone
Step 3) Check for system updates and download them
Step 4) Wait until phone reboots. All your applications and user settings will be retained.
Step 5a) Open up a terminal emulator on your phone and enter "su" (Check if unroot)
Step 5b) If you cant turn your phone on to check if unrooted, boot into recovery mode, open up adb enter:
Code:
adb shell
su
Step 6) If you get "permission denied" or something like that from step 5a/5b,
CONGRATULATIONS! YOUR PHONE HAS BEEN SUCCESSFULLY UNROOTED!
Step 7) If you don`t want to void your warranty, you should unistall applications that require root, especially Superuser
To date, I have rooted and unrooted my phone (Backflip) 3 times without any problems. In case your phone can`t be booted up, only to the bootloader or recovery, DO NOT WORRY! You can use the adb (android debug bridge) to flash in the stock recovery, push/pull the updates and reboot the phone into recovery mode or normal mode!!!
Useful ADB commands
Reboot Phone
Code:
adb shell
reboot
Reboot Phone into recovery mode
Code:
adb shell
reboot recovery
Flash a new recovery image temporarily (resets when rebooting)
Code:
adb shell
flash_image recovery /sdcard/recovery.img
Flash a new recovery image that does not reset when rebooting
Code:
adb shell
flash_image recovery /sdcard/recovery.img
exit
adb shell
cd system
su
mount -o rw,remount /dev/block/mtdblock1 /system
rm recovery.img
mount -o ro,remount /dev/block/mtdblock1 /system
exit
exit
Push file to sdcard
Code:
adb push file.blah /sdcard/file.blah
Push file to sdcard
Code:
adb pull /sdcard/file.blah file.blah
Here`s wishing you good luck and a belated happy new year!
Err.. Pretty cool info there but what if you don't meet above three requirements? I mean there are noobs like me who'd rather jump onto flashing while forgetting about nandroids etc. I guess there should be a one click unroot utility for all android devices like we have for rooting.
im really confused.
if the phone has been rooted (using fastboot oemunlock - yes) then how can we "unroot" this device? till today there has not been a way to do so.
but if what ur suggesting relocks the bootloader (removes the cross at bootup) then woohoo!
The main point
ok, i think you guys dont understand what my point on unrooting is...
What im trying to say is:
Updating your phone software with an original OTA update on the original rom the came with your phone will automatically reset root. However, custom roms and recoveries dont accept OTA updates, so you need to flash back your original recovery first, nevermind if you have a custom rom.
If you don`t meet the requirements, then i`m sorry, you`ll just have to wait for an available system update like me. However if you get one, be sure to come back here if you want to unroot.
Creating a one/two click-unroot application
Actually, you may be right. The unroot procedures can also be carried out by adb alone , not by user interaction. So a desktop application can be created that automates the process
1) Open adb shell
2) Enter su
3) Pull the update zip from the phone
4) Recursive/y search the zip for the file recovery.img
5) Run 'flash_image recovery recovery.img'
6) Run 'adb reboot' to reboot phone
7) Phone will install update on stock update when rebooting complete
8) When update installed, root will be removed and your phone will be updated as well!
We can send keystrokes to the adb for the adb shell.
siidheesh said:
Actually, you may be right. The unroot procedures can also be carried out by adb alone , not by user interaction. So a desktop application can be created that automates the process
1) Open adb shell
2) Enter su
3) Pull the update zip from the phone
4) Recursive/y search the zip for the file recovery.img
5) Run 'flash_image recovery recovery.img'
6) Run 'adb reboot' to reboot phone
7) Phone will install update on stock update when rebooting complete
8) When update installed, root will be removed and your phone will be updated as well!
We can send keystrokes to the adb for the adb shell.
Click to expand...
Click to collapse
Shouldn't be too hard, probably only a simple script would suffice I'll see what I can come up with (if I can do anything ). Supply the script with your required update zip to make it work in a different way (maybe, I'm not great with details)
Automated Script
Can someone please clarify that this would work (as an unroot script):
1. Opens ADB shell
2. Enters su
3. (User) Supply script with stock update.zip - in case it's not on phone (correct if this is unnecessary)
4. recovery.img extracted from update.zip
5. recovery.img flashed to phone via 'flash_image recovery recovery.img'
6. Reboots phone via 'adb reboot'
That installs stock recovery, but what if there was no OTA update to install for that particular device? That's the only problem I can see with such a script, so I'm hesitant to make it right now (besides, I don't have my Nexus with me at the moment, so I couldn't test it).
Dumb question but would flashing a stock update.zip from the stock recovery remove root? Or does it have to be OTA? Never having done it before I'm not sure.
Edit: If it did have to be OTA, maybe you could find the original update.zip (ie. no updates before it) and flash that, so there would be a higher chance of an OTA update?
Different definitions
Sorry people, when i mean ota update, i dont just over-the-air updates, i am referring to original updates for your original android system that came with your phone.
siidheesh said:
Sorry people, when i mean ota update, i dont just over-the-air updates, i am referring to original updates for your original android system that came with your phone.
Click to expand...
Click to collapse
So just to clarify, you could install any stock ROM for your device and it would remove root? Specifically if it was installed through stock recovery.
Thanks, hopefully I might be able to make some progress after this
not as easy as it seems
jonathongrigg said:
Can someone please clarify that this would work (as an unroot script):
1. Opens ADB shell
2. Enters su
3. (User) Supply script with stock update.zip - in case it's not on phone (correct if this is unnecessary)
4. recovery.img extracted from update.zip
5. recovery.img flashed to phone via 'flash_image recovery recovery.img'
6. Reboots phone via 'adb reboot'
That installs stock recovery, but what if there was no OTA update to install for that particular device? That's the only problem I can see with such a script, so I'm hesitant to make it right now (besides, I don't have my Nexus with me at the moment, so I couldn't test it).
Dumb question but would flashing a stock update.zip from the stock recovery remove root? Or does it have to be OTA? Never having done it before I'm not sure.
Edit: If it did have to be OTA, maybe you could find the original update.zip (ie. no updates before it) and flash that, so there would be a higher chance of an OTA update?
Click to expand...
Click to collapse
You cant make an unroot script that easily. Im halfway working on a .net application that does it on desktop.
Also, almost all great things come with a *catch*. In this case, you need to wait for an ota update to be available. Or if you took a nandroid backup some time back and updated your version, you can revert back to the old verison and update again.
siidheesh said:
You cant make an unroot script that easily. Im halfway working on a .net application that does it on desktop.
Also, almost all great things come with a *catch*. In this case, you need to wait for an ota update to be available. Or if you took a nandroid backup some time back and updated your version, you can revert back to the old verison and update again.
Click to expand...
Click to collapse
Oh well, I didn't realise I figured you could do it all from the command line, so a script of some kind might do. That said I wasn't entirely sure as I couldn't test the theory (no phone )
siidheesh said:
In this case, you need to wait for an ota update to be available. Or if you took a nandroid backup some time back and updated your version, you can revert back to the old verison and update again.
Click to expand...
Click to collapse
Another win for stock Android phones No waiting months for OTA updates! Well good luck on your .NET application, I only know Java and Python, so I can't really help you there, sorry.
dont know
my phone (Backflip) isnt a very popular phone and there`s only one rom for it. to date, i`be only tried unrooting via stock updating. Stock roms may work too, but im not sure...
adb shell
jonathongrigg said:
Oh well, I didn't realise I figured you could do it all from the command line, so a script of some kind might do. That said I wasn't entirely sure as I couldn't test the theory (no phone )
Click to expand...
Click to collapse
actually, i did mention that the unroot procedure can be done entirely from the adb shell, which is also in command line. im just making a program to enter those lines in automatically. normal batch scripts cant write to the adb shell as it is a separate shell in the command prompt...
What about doing a factory reset?
hi, would these unroot methods still work on the new updated highly secured samsung galaxy s2?
because i got the phone simlocked hoping to unlock it for t-mobile so rooted the phone but it was been unsuccessful at taking the sim lock off, so i wanted to make sure that this will still work on this phone.
Also after unroot i assume the yellow triangle will disappear, right?
oh yea thanks for replies and help in advance. Love the site
total noob here, I rooted my tab awhile bk, now needs warranty. I used 'superoneclick', but didnt backup anything first that i know of. U mention nandroid backup, update available for my phone, where do I get that, and how? Embarrassed I know nothing about these terms, trying to learn. Could u help me, please?
where can I find the recovery.img?
thanks
Does this work on all roots?
Read this whole guide before starting.
This is for the 8th gen Fire HD8 (karnak).
Current version: amonet-karnak-v3.0.1.zip
This is based on @xyz`s original work, but adds some features such as reboot to hacked BL.
It also intends to simplify the installation process.
If you are already unlocked you can simply update by flashing the ZIP-file in TWRP.
NOTE: If you are on a firmware lower than 6.3.1.2 this process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
What you need:
A Linux installation or live-system
A micro-USB cable
Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
1. Extract the attached zip-file "amonet-karnak-v3.0.1.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings
3. Start the script:
Code:
sudo ./fireos-step.sh
NOTE: If you are on a firmware newer than 6.3.0.1, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
WARNING: There have been numerous reports that would indicate a hardware-change that doesn't allow access to the bootrom.
When bricking these devices there is currently no known way to unbrick.
This makes the hardware-method currently the safest option.
To brick firmware 6.3.1.2 use the attached brick-karnak.zip, boot into fastboot
Code:
adb reboot bootloader
and run
Code:
./brick-6312.sh
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
After you have confirmed the bricking by typing "YES", you will need disconnect the device and run
Code:
sudo ./bootrom-step.sh
Then plug the device back in.
The device will reboot into TWRP.
You can now install Magisk from there.
Going back to stock
Extract the attached zip-file "amonet-karnak-return-to-stock.zip" into the same folder where you extracted "amonet-karnak-v3.0.1.zip" and open a terminal in that directory.
Then run:
Code:
sudo ./return-to-stock.sh
Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 6.3.0.0 or newer, otherwise you may brick your device)
Important information
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Thanks to @Kaijones23 for testing.
Unbricking / Unlocking with Firmware 6.3.1.2+
If Recovery OR FireOS are still accessible (or your firmware is below 6.3.1.2) there are other means of recovery, don't continue.
If your device shows one of the following symptoms:
It doesn't show any life (screen stays dark)
You see the white amazon logo, but cannot access Recovery or FireOS.
If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).
Make sure the device is powered off, by holding the power-button for 20+ seconds
Start bootrom-step.sh
Plug in USB
In all other cases you will have to open the device.
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
Open the device and short the pin marked in the attached photo to ground while plugging in.
1. Extract the attached zip-file "amonet-karnak-v3.0.zip" and open a terminal in that directory.
2. start the script:
Code:
sudo ./bootrom-step.sh
It should now say Waiting for bootrom.
3. Short the device according to the attached photo and plug it in.
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:
sudo ./fastboot-step.sh
8. Wait for the device to reboot into TWRP.
9. Use TWRP to flash custom ROM, Magisk or SuperSU
Checking USB connection
In lsusb the boot-rom shows up as:
Code:
Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone
If it shows up as:
Code:
Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.
dmesg lists the correct device as:
Code:
[ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00
Reserved #2
Reserved #3
This is very cool @k4y0z!
Now we can use boot-recovery.sh & boot-fastboot no?
Regards!
Rortiz2 said:
This is very cool @k4y0z!
Now we can use boot-recovery.sh & boot-fastboot no?
Regards!
Click to expand...
Click to collapse
Yes, that is also supported.
k4y0z said:
NOTE: If you are on a firmware lower than 6.3.1.2 this process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
NOTE: If you are on a firmware newer than 6.3.0.1, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)[/COLOR]
Click to expand...
Click to collapse
So do you need to open the case to run this exploit on the newest firmware, or can you just brick to install older lk/preloader, and go from there?
Kctucka said:
So do you need to open the case to run this exploit on the newest firmware, or can you just brick to install older lk/preloader, and go from there?
Click to expand...
Click to collapse
On 6.3.1.2 mtk-su has been fixed, so unless you already have root (or another way to get temp-root is found), bricking isn't an option and you will have to open the case.
If you do have root the script will do the bricking for you.
@k4y0z For people who already used the steps in xyz's thread and are running your TWRP and LineageOS, is there anything here that we're missing? Or is this just a new method to arrive at the same results?
jibgilmon said:
@k4y0z For people who already used the steps in xyz's thread and are running your TWRP and LineageOS, is there anything here that we're missing? Or is this just a new method to arrive at the same results?
Click to expand...
Click to collapse
k4y0z said:
This is based on @xyz`s original work, but adds some features such as reboot to hacked BL.
It also intends to simplify the installation process.
If you are already unlocked you can simply update by flashing the ZIP-file in TWRP.
Click to expand...
Click to collapse
Additionally it adds support for the boot-recovery and boot-fastboot scripts.
And a script to enable UART output for the kernel.
So nothing essential if you are already using the updated TWRP.
Ran this pup on a unit that I was keeping unrooted (aside from occational temp root via mtk-su) as a control but was becoming painful to use/maintain. Also missed TWRP. Worked like a champ with zero issues ... aside from stumbling over my own stupidity. Used Lubuntu live 18.04 and Magisk 19.3/7.3.2. Staying on FireOS 6.3.0.1 (w/hijacks) for now until a fully vetted custom ROM becomes available.
Thanks for the great tool and accompanying guidance.
I have added unbricking/bootrom instructions in Post #2
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
bibikalka said:
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
Click to expand...
Click to collapse
I think yeah:
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
Click to expand...
Click to collapse
So I got a HD8 2018 today and it came with OS version that forced me to connect to WiFi and update itself. I was pretty pissed but I used this guide to get root easily.
I had Arch based linux installed which gave problems while running script, so I made bootable Ubuntu usb and that worked fine. Thank you everyone involved in developing this hack.
madman said:
So I got a HD8 2018 today and it came with OS version that forced me to connect to WiFi and update itself. I was pretty pissed but I used this guide to get root easily.
I had Arch based linux installed which gave problems while running script, so I made bootable Ubuntu usb and that worked fine. Thank you everyone involved in developing this hack.
Click to expand...
Click to collapse
For future reference you can avoid the presumed forced WiFi connect by putting in a bogus password; once authentication fails a 'skip' option will appear.
bibikalka said:
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
Click to expand...
Click to collapse
Rortiz2 said:
I think yeah:
Click to expand...
Click to collapse
Yes, exactly.
Rortiz2 said:
I think yeah:
Click to expand...
Click to collapse
k4y0z said:
Quote:
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
Yes, exactly.
Click to expand...
Click to collapse
OK - tried to upgrade to the latest update-kindle-Fire_HD8_8th_Gen-NS6312_user_1852_0002517056644.bin using the suggestions above, and got a hardcore Amazon logo bootloop.
My actions. I had the old unlock, so I flashed the zip in this thread first. New TWRP showed up - so far so good. Then I flashed the Amazon update zip as is, thinking the updated TWRP would do its magic. Flashed Magisk, tried to reboot. No go - Amazon logo bootloop. No recovery either. So it feels that I lost the unlock, and, perhaps LK & preloader & TZ got overwritten with the new versions from the Amazon update zip.
Any recovery here other than opening the case?
bibikalka said:
OK - tried to upgrade to the latest update-kindle-Fire_HD8_8th_Gen-NS6312_user_1852_0002517056644.bin using the suggestions above, and got a hardcore Amazon logo bootloop.
My actions. I had the old unlock, so I flashed the zip in this thread first. New TWRP showed up - so far so good. Then I flashed the Amazon update zip as is, thinking the updated TWRP would do its magic. Flashed Magisk, tried to reboot. No go - Amazon logo bootloop. No recovery either. So it feels that I lost the unlock, and, perhaps LK & preloader & TZ got overwritten with the new versions from the Amazon update zip.
Any recovery here other than opening the case?
Click to expand...
Click to collapse
That is strange, I've had no issues installing that firmware unmodified through TWRP.
So you can't boot neither normal or recovery?
Does it say something in the corner when trying to boot recovery?
You can try the boot-fastboot.sh script to get into hacked fastboot.
k4y0z said:
That is strange, I've had no issues installing that firmware unmodified through TWRP.
So you can't boot neither normal or recovery?
Does it say something in the corner when trying to boot recovery?
You can try the boot-fastboot.sh script to get into hacked fastboot.
Click to expand...
Click to collapse
Cannot boot anywhere - no message about booting recovery either. When you tried installing unmodified firmware, was that on HD8 2018, or some other tablet? I wonder if perhaps there are some differences with HD8 2018 given that it's Nougat.
I will try the hacked fastboot, but most likely - will have to open the case.
Howdy! I got a gionee a1 lite device recently and I cannot manually reboot the phone to bootloader through recovery mode or fastboot via adb pc tools. Someone here enlightened me that the device's fastboot is disabled which is a bummer.
I'm aware now that some manufacturers disable their devices' bootloaders for reasons unknown. Has anyone been able to root a device with a disabled fastboot? Please help me out.
Trunks614 said:
Howdy! I got a gionee a1 lite device recently and I cannot manually reboot the phone to bootloader through recovery mode or fastboot via adb pc tools. Someone here enlightened me that the device's fastboot is disabled which is a bummer.
I'm aware now that some manufacturers disable their devices' bootloaders for reasons unknown. Has anyone been able to root a device with a disabled fastboot? Please help me out.
Click to expand...
Click to collapse
Methods that involve flashing the device won't do you any good. You'll have to try methods that involve using an app to root the device for you, which have not been useful to root android since android Lollipop/Marshmallow was released.
Droidriven said:
Methods that involve flashing the device won't do you any good. You'll have to try methods that involve using an app to root the device for you, which have not been useful to root android since android Lollipop/Marshmallow was released.
Click to expand...
Click to collapse
Is there possibly any app or other method that doesn't involve unlocking bootloader to root android nougat? Kingroot and kingoroot have been ineffective so far.
It's a misconception to think that device's bootloader must get unlocked before device's Android can get rooted.
Rooting Android simply means a suitable SU binary - by whatever method - gets installed. IMO the easiest method to do this is by means of ADB.
jwoegerbauer said:
It's a misconception to think that device's bootloader must get unlocked before device's Android can get rooted.
Rooting Android simply means a suitable SU binary - by whatever method - gets installed. IMO the easiest method to do this is by means of ADB.
Click to expand...
Click to collapse
I have a ported twrp ready to flash but I'm hesitant because I heard flashing a recovery while bootloader is locked could bork the device. Flashing twrp seems to be the only step now to root the phone, should I give it a try or avoid the risk?
My POV: TWRP isn't needed at all to root a device's Android.
jwoegerbauer said:
My POV: TWRP isn't needed at all to root a device's Android.
Click to expand...
Click to collapse
I needed the twrp to flash magisk. Is there some other method to root an android 7 device that doesn't involve twrp or unlocking bootloader?
I already told you a method: no more to say by me ...
jwoegerbauer said:
I told a method: no more to say by me ...
Click to expand...
Click to collapse
Please put me through or post the link to the method.
1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot
jwoegerbauer said:
My POV: TWRP isn't needed at all to root a device's Android.
Click to expand...
Click to collapse
My POV: it isn't exactly as simple as connect to adb and issue a few commands, that is just a fact. I'm speaking from experience, just isn't that simple in all cases. If you can get the device to accept temp root via adb, then, yes, it "can" be that simple, the problem is, temp root via adb isn't an option on ALL android devices.
jwoegerbauer said:
1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot
Click to expand...
Click to collapse
Thank you. I tried this, unfortunately I got a "device not found" error even though "adb devices" did.
Droidriven said:
My POV: it isn't exactly as simple as connect to adb and issue a few commands, that is just a fact. I'm speaking from experience, just isn't that simple in all cases. If you can get the device to accept temp root via adb, then, yes, it "can" be that simple, the problem is, temp root via adb isn't an option on ALL android devices.
Click to expand...
Click to collapse
I'm really confused ...
With no line in this thread it was mentioned / suggested / recommended to install a temporary root.
I kindly ask you to stop hopping into a thread and post off-topic content. TIA
@Trunks614
When ADB triggers "no devices found" then it's mostly caused by wrong ADB-driver used.
jwoegerbauer said:
@Trunks614
When ADB triggers "no devices found" then it's mostly caused by wrong ADB-driver used.
Click to expand...
Click to collapse
Will "apply update from SD card" work the same way?
jwoegerbauer said:
1. Download latest version of SuperSU.zip onto PC
2. Install ADB on PC ( systemwide accessible !!! ) if not already done yet
3. On phone enable USB debugging, if not already done yet, and reboot phone
4. Connect phone with PC via USB cable that came with phone
5. Run a Windows command script ( .BAT-file ) that contains these lines
Code:
@echo off
adb devices
adb reboot recovery
timeout /t 10 /nobreak >nul
echo In Recovery menu shown on device select "Update from ADB" and apply
echo Press any key when done ...
pause >nul
adb sideload <PATH-TO-SUPERSU.ZIP-FILE-ON-PC-HERE>
adb reboot
Click to expand...
Click to collapse
SuperSU is a deprecated project, that is why and how Magisk came to prominence. Anyone still using SuperSU is taking a real chance of compromising the security of their device at the system level. If SuperSU is used to gain root, it is highly recommended to convert to Magisk root after gaining root via SuperSU.
i have the same problem, zte A5 2019 fastboot disabled, by the way you can try mtk easy-su
Discussion thread for the 2023 Walmart ONN Google TV.
Link to an OTA https://android.googleapis.com/packages/ota-api/package/7f458c58073555f202dda7c4f0cd90b149ef98e1.zip
for those who dont care to root but still want to de-bloat and change launcher.
That's a great video. I haven't "supercharged" any of mine yet, but I'll get to it (someday) lol.
I have the new onn. 2023 model 4k GTV Box and notice that the following file does not exist: android.hardware.usb.host.xml in /system/etc/permissions.
I'm not sure but i think missing that file might be keeping my device from seeing a new air remote (RF Mode) i have that has backlighting, 3 media keys, 0-9 keypad, Del key, Voice and supports bluetooth (working) and a 2.4g RF dongle that comes with it (dongle not working). A Windows PC detects the donglee and installs drivers for it.
2 usb keyboards i have tested work on the onn with no problems. I found out about this because I heard that a RF remote might solve some issues relating to audio compared to bluetooth mode. I have tried this:
C:\adb>adb kill-server
C:\adb>adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
C:\adb>adb usb
restarting in USB mode
C:\adb>adb devices
List of devices attached
GUSA2310018722 device
C:\adb>adb remount
/system/bin/sh: /system/bin/remount: inaccessible or not found
C:\adb> adb push android.hardware.usb.host.xml /system/etc/permissions
failed to copy 'android.hardware.usb.host.xml' to '/system/etc/permissions/andro
id.hardware.usb.host.xml': couldn't create file: Read-only file system
7 KB/s (119 bytes in 0.015s)
C:\adb>
Click to expand...
Click to collapse
Note that GUSA2310018722 is the onn serial number, and the adb utility with the xml file came from this site (about a different device):
USB Host Mode (Android)
nutsaboutnets.com
Is there some way to copy or install this xml file without rooting my device (never done a root before)? I did confirm the file does not exist with adblink2 and it's GUI File manager. Any help would be great.
hello all
So as far as root goes it is possible. There is a merg request waiting for it to be looked at and approved to be put into Magisk. I've read that topjohnwu the maintainer of Magisk doesn't really want to support multi-ramdisk. The other way to do it would be to manually patch it via the command line.
treypop said:
The other way to do it would be to manually patch it via the command line.
Click to expand...
Click to collapse
What command line did you use that worked? I was only able to get it to work using third party tools for lz4 and cpio, and a hex editor. But not using the magisk script directly. So, if you could list your command line...
unlocking bootloader kills widevine L1?
ziddey said:
unlocking bootloader kills widevine L1?
Click to expand...
Click to collapse
It does not.
Functioner said:
What command line did you use that worked? I was only able to get it to work using third party tools for lz4 and cpio, and a hex editor. But not using the magisk script directly. So, if you could list your command line...
Click to expand...
Click to collapse
I was referring to what you said in the onn android tv thread where you said you can manually patch it with the command line
Finally found one in stock. I'm assuming the bootloader can't be unlocked for ~3-4 days? Currently greyed out in developer options with "Connect to the internet or contact your carrier"
ziddey said:
Finally found one in stock. I'm assuming the bootloader can't be unlocked for ~3-4 days? Currently greyed out in developer options with "Connect to the internet or contact your carrier"
Click to expand...
Click to collapse
Setting the OEM unlocking toggle in developer options isn't required to unlock the bootloader. Just using the standard fastboot commands will work
Using fastboot to unlock the bootloader will erase everything
whats the adb code to root it? dont want t wait for a what if secnario for magisk to be updated. thx.
Just picked one of these up yesterday thinking it was the old model back in stock. It's cool that this new one supports AV1 I just hope the issues with the remote are gone.
BTK19 said:
Setting the OEM unlocking toggle in developer options isn't required to unlock the bootloader. Just using the standard fastboot commands will work
Using fastboot to unlock the bootloader will erase everything
Click to expand...
Click to collapse
What's the point in unlocking the bootloader without root? What can be achieved?
YoXDAyy said:
Just picked one of these up yesterday thinking it was the old model back in stock. It's cool that this new one supports AV1 I just hope the issues with the remote are gone.
What's the point in unlocking the bootloader without root? What can be achieved?
Click to expand...
Click to collapse
I didn't say there was a point in it i just said it could be done
treypop said:
So as far as root goes it is possible. There is a merg request waiting for it to be looked at and approved to be put into Magisk. I've read that topjohnwu the maintainer of Magisk doesn't really want to support multi-ramdisk. The other way to do it would be to manually patch it via the command line.
Click to expand...
Click to collapse
So then extracting the boot.img from the above posted ota .zip and patching it in magisk and then flashing the patched boot.img with fastboot isn't an option?
talksickisil said:
So then extracting the boot.img from the above posted ota .zip and patching it in magisk and then flashing the patched boot.img with fastboot isn't an option?
Click to expand...
Click to collapse
No it is not an option. You have to patch it through something like a custom recovery.
Fastboot works on the new "onn google tv" device for flashing, so long as the bootloader is unlocked.
Though for magisk use, the boot partition is not involved. Rather, it is the vendor_boot partition.
The wait on root for this device is not because of flashing. The wait is for some version of magisk to automatically handle patching a supplied vendor_boot image. The root already works, it's the patching that is missing.
Functioner said:
Fastboot works on the new "onn google tv" device for flashing, so long as the bootloader is unlocked.
Though for magisk use, the boot partition is not involved. Rather, it is the vendor_boot partition.
The wait on root for this device is not because of flashing. The wait is for some version of magisk to automatically handle patching a supplied vendor_boot image. The root already works, it's the patching that is missing.
Click to expand...
Click to collapse
Are you able to unpack, patch, and repack it manually? If so, can you provide some details on the steps? Thanks.
PrefaceLuckily, it looks like Infinix is following the general trend of Android root solutions being more straightforward than in the recent past. Besides the usual spiel about your warranty being voided, and the annoying chirp each time you boot your phone, this hopefully won't present any problems for you if you do end up rooting your phone.
Notices
Still, I'm not responsible for anything bad that will happen to your phone if you do this, and there's no support guaranteed either from me or your OEM/support centre.
There's quite a few steps to this, and naturally you're gonna need a few more things to setup before you even start.
Your phone's data will be reset, please backup everything you'd like to keep before rooting your phone (now and in general).
You do need to know some things already, mainly what ADB and Fastboot are, and how to keep your working environment clean and straightforward.
Please do review all the tools you're working with, be sure that you personally trust all the software you're running.
And last but not least, you won't be able to update your phone through OTA updates anymore unless you go back to stock firmware.
The process
Make an environment for easy access:
Setup ADB and Fastboot (either as a local executable or a global environment variable to that executable).
Setup an easy to access directory with the Google Fastboot driver in it.
Grab your firmware's boot.img file, or grab the one attached to this post, or from here (and skip to the preliminary work section):
1. Download your phone's current ROM.
2. Extract it, as it should be a simple .zip file.
3. Look for the file of the same name (boot.img).
4. Copy it to your phone's storage, anywhere works.
Install the Magisk APK (from their Github).
Once it's installed, Magisk's app frontend allows you to patch your stock boot.img with itself, the gist of it is:
Click on Install within the app, in the "Magisk" section of the main menu.
Click "Select and patch a file", a file selection menu will show up, select the stock boot.img, then start the installation.
Magisk should spit out a patched boot.img named in the format of magisk_patched_[random_strings].img, in your phone's /sdcard/Download/ directory.
Copy that back into our working directory, and rename it to magisk_patched.img for easier usage.
Now, let's do some preliminary work, in any order, really:
Have Powershell or CMD open in the directory of all your tools, alongside the patched image.
Click to expand...
Click to collapse
From here on out, if you have to use adb as a command, and it's not a global environment variable, use ./adb while in the working directory instead, the same goes for fastboot.
Click to expand...
Click to collapse
Make sure that the adb daemon (adbd) is properly detecting your phone:
Enable developer options.
Enable ADB debugging.
Run adb devices to start the server daemon for ADB, and see if ADB detects your phone.
Authorize your PC for ADB debugging if it prompts you to.
Click to expand...
Click to collapse
Infinix's implementation of Fastboot will exit back out of itself and into normal boot after 60 seconds of inactivity, which makes this a tad annoying, although you can simply send it any input to reset that timer.
Click to expand...
Click to collapse
Let's start:
Restart the phone into Fastboot, adb reboot bootloader loader, it'll take a second, the phone is slow.
Unlock flashing 3rd party software, fastboot flashing unlock, the phone will prompt you on the screen to confirm doing this. Yes, this will void your warranty.
Flash magisk_patched.img to both A and B virtual partitions, fastboot flash boot_a magisk_patched.img and then fastboot flash boot_b magisk_patched.img.
That should be it! fastboot reboot to boot normally!
Be sure to also run the Magisk app so it finishes setting itself up, with another reboot, naturally.
TechnicalitiesThe Infinix Hot 30 Play does have a dedicated vbmeta partition, it's advised that you also flash it alongside flashing the patched boot.img for Verified Boot, but that's not necessary if you don't want to tinker with your super partition's crypto keys.
Thank yous- topjohnwu for their work on Magisk.
- ansh_/ and their post/guide on rooting the Infinix Hot 11, that I used originally.
Addendum
Using fastboot with MediaTek SoCs will be a bit of a pain as their driver availibilty is limited, if it doesn't get installed by Windows automatically, you have a few options:
Grab the Google's Pixel driver, and install it in realtime during fastboot.
Try to install the VCOM driver from a source you trust.
For grabbing the Google one, you'll have to:
Extract the driver somewhere easy to access.
Open Windows' Device Manager.
Plug in your phone during fastboot to your Windows PC.
Replace the "Unknown" entry for your phone with the Google driver in device manager, within the 60 second window it stays open in.
Note that you'll have to do this every time you go into fastboot.