How to create a pre-rooted stock rom? - General Questions and Answers

Hello,
I have a phone that I would like to root, unfortunately the bootloader is locked. There are some pre-rooted stock roms around that you could flash using fastboot without unlocking the bootloader. Unfortunately the latest version of the firmware is not available in pre-rooted form.
I downloaded the lastest official firmware (an update.zip package) from the website of the manufacturer and installed it on my phone using the stock recovery. Now the only thing that I need to do is modify the system image and flash it back in the phone.
I converted the system.new.dat file that was included inside the zip package into a raw image that I can easily mount and modify from my computer (I use Debian Jessie). How could I modify the system image to include the su binary and a Superuser up (SuperSu, or equivalent) and convert it into a format that I can flash using fastboot?
I'm running Android 6.0.1 with SELinux set to enforce. The device is an Asus Zenfone 2 Laser ZE550KL. I've posted here because the process of modding a stock rom should be almost doable regardless of the phone manufacturer

Related

Official OTA Update Links and OTA updating modified systems

Don't forget to thank me and Radii it means a lot to us!
Click to expand...
Click to collapse
Upon discovering the reason people being given an error trying to flash OTAs in my TWRP recovery image I decided I would come up with a work around while I work out a way to fix it.
The following solution is group work between me and Radii.
If you came here just for OTA links then click HERE
Click below spoiler if you haven't installed TWRP on your device and you want to OTA update and then install TWRP.
First you need to download the version you would like, in theory you could backdate although this hasn't been tested and it may misbehave. For example the latest version as of 16/10/2015, build number cm-12.1-YOG4PAS38J.
On the spread sheet you will need two files, the fastboot and the signed. In the fastboot ZIP there is a file called recovery.img. Copy this to your android SDK platform tools folder. Now with the signed ZIP you either copy that to the same folder (platform-tools). Put your phone into fastboot mode and type.
Code:
fastboot -i 0x2b4c boot recovery.img
Or the name of the recovery if you renamed it.
Your phone will boot into Cyanogen OS Recovery. From there click Apply Update (Top option) and click ADB Sideload. Then type,
Code:
adb sideload cm-12.1-YOG4PAS38J-ham-signed.zip
Or whatever you renamed it to.
Reboot and you're done! Now you'll need to install TWRP to flash things like SuperSU and Xposed.
To install TWRP you need to download the latest TWRP image from HERE move that to platform-tools and type (with your phone in fastboot mode/bootloader mode of course)
Code:
fastboot -i 0x2b4c flash recovery "recovery.img"
Changing the name in the quotations to the name of the recovery and removing the quotes.
Click below spoiler if you have installed TWRP on your device and you want to OTA update and restore/preserve TWRP
Do the same as above, I have discovered it's impossible to preserve because Cyanogen will auto-write it's own recovery to the recovery parition.
Nerdy stuff
If you're wondering why you can't OTA without going through all this then it's because Cyanogen OS will do checks to see if the System has been r/w mounted. If so then it will stop all OTAs from installing. Simple when you think about it.
FAQ
Q: Why isn't TWRP still installed after installing the OTA? A: Because Cyanogen OS will write over the recovery partition with Cyanogen Recovery
Q: Will I lose all my data? A: Don't wipe and no, you can dirty flash to preserve data.
Thanks for your work, really appreciated.
However, it sucks a bit that we have tons of work just for the OTA updates if we want root, i guess we should annoy Cyanogen to add a Superuser option to CyanogenOS...
othe01 said:
Thanks for your work, really appreciated.
However, it sucks a bit that we have tons of work just for the OTA updates if we want root, i guess we should annoy Cyanogen to add a Superuser option to CyanogenOS...
Click to expand...
Click to collapse
It's designed to be shipped with devices like Samsung or LG's ROMs they'll never add that option.
Sent from my Z1 using Tapatalk
Breadcrust said:
It's designed to be shipped with devices like Samsung or LG's ROMs they'll never add that option.
Sent from my Z1 using Tapatalk
Click to expand...
Click to collapse
Why not? root is a normal option in CyanogenMod, why wouldn´t the "commercial" edition not support it? I see no reason they can´t add it to PrivacyGuard.
Here one of the forum admins said hes telling the team to add it -> http://community.cyngn.com/t/reques...-thethering-and-inbuilt-superuser-access/97/2
Breadcrust,
did you try this method used for oneplus one phones with CyanogenOS?
https://forums.oneplus.net/threads/flashable-zip-cm12-enable-integrated-superuser.297089/
https://github.com/julian-klode/bacon-superuser/
From what i´ve read OTA updates are working with it and all we need to do is update the recovery after installing a new ota, the script on github creates the patched boot files automatically, we just have to change the config to use the ZUK files.
All theory tho...as i don´t have my phone yet.
othe01 said:
Breadcrust,
did you try this method used for oneplus one phones with CyanogenOS?
https://forums.oneplus.net/threads/flashable-zip-cm12-enable-integrated-superuser.297089/
https://github.com/julian-klode/bacon-superuser/
From what i´ve read OTA updates are working with it and all we need to do is update the recovery after installing a new ota, the script on github creates the patched boot files automatically, we just have to change the config to use the ZUK files.
All theory tho...as i don´t have my phone yet.
Click to expand...
Click to collapse
I'll look into it at sunrise it currently 3:23AM here so can't do it now
P.s thanks for waking me :3
Sent from my Z1 using Tapatalk
@othe01
No COS device allows you to flash incremental OTA if your /system partition is modified. Your quoted package puts compatible su binary in /system & flashes boot-debuggable kernel so that root can be achieved from both app & ADB. It has nothing to do with OTA. Your only choice is to get the signed zip & flash it manually.
@Breadcrust
It would be nice to put incremental OTA zip links too. My posts regarding OTA links also contain them.
:highfive:
Titokhan said:
@othe01
No COS device allows you to flash incremental OTA if your /system partition is modified. Your quoted package puts compatible su binary in /system & flashes boot-debuggable kernel so that root can be achieved from both app & ADB. It has nothing to do with OTA. Your only choice is to get the signed zip & flash it manually.
@Breadcrust
It would be nice to put incremental OTA zip links too. My posts regarding OTA links also contain them.
:highfive:
Click to expand...
Click to collapse
sounded different here: [FLASHABLE ZIP] [CM12] Enable integrated superuser
But is prolly just a misunderstanding from my side.
How exactly does CyanogenOS check if System is modified and can´t we patch the check with an xposed module?
@othe01
He must used the signed zip to update. Regarding OTA faliure, I've discussed the issue here: http://forums.yuplaygod.com/index.php?threads/15124/
You need to registered in the forum to read, so I've uploaded a PDF of the same: https://drive.google.com/file/d/0B9zZIJPXbMsubkFBYmZ4eGtMQjQ/view?usp=sharing
I personally own OnePlus One & YU Yureka so already have a good experience with these things.
The whole procedure is clearly explained - no 'Xposed' module can bypass it. You can, in theory, deploy a file based OTA (I've already requested it through YU developers) instead of block based OTA or patch the update-binary to return always true (unmodified) value while checking the state of partitions.
:good:
@Titokhan I will post them later
Sent from my Z1 using Tapatalk
@Breadcrust can you please help me if you can, I have problem flashing any ota (increments or full), it return error " this package is for device:Z1 this device is k9", all ota was installed directly till unlocked bootloader and root .
aaswar said:
@Breadcrust can you please help me if you can, I have problem flashing any ota (increments or full), it return error " this package is for device:Z1 this device is k9", all ota was installed directly till unlocked bootloader and root .
Click to expand...
Click to collapse
Issue is noted method is in post
Sent from my Z1 using Tapatalk
@Breadcrust
cm-12.1-20150805-EXPERIMENTAL-YOG4PAP1CG-ham: http://forum.xda-developers.com/showpost.php?p=63390843&postcount=223
@Breadcrust
for clarification:
-isn't "cm-12.1-YOG4PAS38J-ham-signed-fastboot.zip" is the same as "cm-12.1-YOG4PAS38J-ham-signed.zip", but with the recovery image include, can sideload this file using the same process you mentioned?
-if the phone is rooted, boot with the COS recovery and sideload the "cm-12.1-YOG4PAS38J-ham-signed.zip" will not work as the system partition is already been modified by the root process, am I right?
aaswar said:
@Breadcrust
for clarification:
-isn't "cm-12.1-YOG4PAS38J-ham-signed-fastboot.zip" is the same as "cm-12.1-YOG4PAS38J-ham-signed.zip", but with the recovery image include, can sideload this file using the same process you mentioned?
-if the phone is rooted, boot with the COS recovery and sideload the "cm-12.1-YOG4PAS38J-ham-signed.zip" will not work as the system partition is already been modified by the root process, am I right?
Click to expand...
Click to collapse
re: above
if using cos recovery and sideload via abd or from file the full signed version , and your have root, it will work, root will be lost though.
fastboot zip has recovery signed doesn't. you need to flash recovery extracted from the fastboot zip and then flash the signed full zip using cos either using abd or sideload file onto system
I flash the rom, but when I insert CDMA SIM into slot one, there is no signal
and there is no option to choose band from the menu.
would you please instruct on how to get CMDA works?
@taitai
As you can see here, it is not an CDMA device.
As regards technical faults as well we're unable to help in most cases as ROMs are from Cyanogen and unedited.
Sent from my Z1 using Tapatalk
I have a chinese version of Z1 and it has CDMA capability
None of them do. They're the exactly the same under the hood.
Sent from my Z1 using Tapatalk

convert a block Based OTA.zip to a standard file based install.zip

i would like to convert a block based ota update to a standard update.zip so that i can install on my unlocked bootloader phone without reflashing again.

Rooted MHA-L29C567B183 Flashable

Is there anyway to flash a full ROM already rooted older version for this model?
This would remove the step to return to factory initial condition to take the upgrade? (I know the device is young, but some established phones this is the way to do it if bootloader and modem is up to date) so the first question is possible to create such a ROM and post?
You could use https://forum.xda-developers.com/android/help/extract-dat-marshmallow-lollipop-easily-t3334117
extract system.img from update.app, unpack system.img using Imgextractor.exe.
Unpack boot.img from update.app.
Extract boot.img using Android Image Kitchen.
Preroot ramdisk.
Make a flashable zip from extracted system.img and boot.img. Set up permissions, copy files..., etc in updater-script. Make the script flash boot.img.
Done. (In theory, I've not built a rom for any Huawei device yet.)
But to answer your question: Yes.
Just look at the KangVIP roms over in Development. You could just build a stock rom with root.
Edit: Imgextractor actually saves permissions to a file.
Edit 2: You could just flash the newer boot.img in TWRP and root it there, then extract boot image using dd and include that in your rom.
OR use su in /system/bin/
Edit 3: Any rom makers here? Would VENDOR and PRODUCT need to be extracted and flashed as well? (Assuming you're on a pre B183 C567 stock rom)
Nevermind, system.img is unextractable :/
Or the tool I use is not compatible with android N.
That would be awesome I'm stuck on c636 and have no way of going to c567 without paying.
Your headed in a direction, lots of us owners have been waiting for...
Sent from my MHA-L29 using Tapatalk
Benefits of 567 over 636?

[ROOT]Root Guide for Huawei MediaPad M5

DISCLAIMER: I'm not responsible for anything that happens to your device. Use the steps below at your own risk . Be mindful of the facts unlocking bootloader voids your warranty and also hard resets your device - ALL YOUR DATA, SETTINGS, FILES AND APPS WILL BE DELETED. Rooting your device voids warranty as well. I own the Chinese SHT-AL09 8.4" LTE device and tested this root procedure ONLY WITH THIS MODEL. However, I believe there is a good chance the steps below will work for all other models of MediaPad M5, including WiFi only variants and 10" models. You MUST unlock your bootloader first. Do NOT use ramdisk image I provide in the steps below for any other model besides SHT-AL09 - doing so is guaranteed to render your device unusable. Ramdisk I provided is ONLY for SHT-AL09. You will need to extract your own ramdisk from stock firmware, specific to your device model
Credits:
@Wirmpolter - this root method largely based on his Magisk guide for Mate 9
@topjohnwu for creating the awesome Magisk Manager, which was used to patch ramdisk image with superuser binary
People, who created HuaweiUpdateExtractor
@magnumlove who pointed me in the right for developing root method in this post
This site, for hosting stock firmware for Huawei MediaPad M5
1. First, you will need to unlock the bootloader of your M5. Follow this guide
2. Transfer this patched ramdisk image to your device
Note for users with version of M5 other than SHT-AL09: Do NOT use the above ramdisk image. Download the full stock rom (update.zip) from the site I linked in the credits. Extract UPDATE.APP file from the zip. Then use HuaweiUpdateExtractor to extract ramdisk.img specific to your device. If you get errors in HuaweiUpdateExtractor - uncheck first 2 checkboxes for checksum verification on Settings tab and try again
3. Once bootloader is unlocked, install latest Magisk Manager from the official Magisk thread
4. Once Magisk Manager gives you a pop-up prompt to either download Magisk zip or patch the boot image file - chose to patch the boot image, but instead of boot.img select ramdisk.img from step 2. Magisk Manager should give you a message the image was successfully patched. It will be saved as patched_boot.img in MagiskManager folder on your sdcard. If it does not say success - do NOT proceed
5. Transfer the newly created patched_boot.img back to your PC
6. If you already have ADB and Fastboot tools installed on your PC you can just use what you've got. If not - get them from here
7. Connect your M5 to PC via USB cable
8. Run command prompt. If your ADB and Fastboot are installed as system app - you can do this from any path in CMD. If not - you need to switch in CMD to your ADB and Fastboot folder. Either way, the patched ramdisk patched_boot.img file must be in the same path, from which you will be running commands below in CMD window
9. Type "adb " in CMD window to start android debug bridge
10. Type "adb reboot-bootloader" and wait until your device restarts in Download mode
11. Once in Download mode, type "fastboot flash ramdisk patched_boot.img" - you should see some output from flash procedure, indicating successful flash
12. Once patched ramdisk is flashed, type "fastboot reboot"
That is it - you're done. Once your device reboots it will be rooted.
Note 1: Magisk Manager has it's own built-in superuser app and uses Systemless root, which works completely differently - you will not see external, standalone app like SuperSU or SU you might be familiar with in your App Drawer. The way to control the superuser app is from Magisk Manager itself: Settings->Superuser section
Note 2: I don't do tech support via PM, so don't PM me for help or with questions. Use the thread instead, and some other XDA members or myself will probably help you. Good luck!
Note 3: You may find some links to Huawei stock firmware in the 2nd post
UPDATE - August 6, 2018
Huawei officially approved 8.0.0.171 firmware with GPU Turbo for installation on SHT-AL09 devices. If you're doing first time root - just follow the original steps above. If you are already rooted and want to upgrade to 8.0.0.171 - follow the steps below:
1. Boot into download mode:
Code:
adb reboot-bootloader
from CMD window
2. Flash stock recovery from 8.0.0.171 to your device in fastboot:
Code:
fastboot flash recovery_ramdisk recovery_ramdis.img
3. Download and install the official OTA through Settings (full or just the update)
4. Boot into download mode again and flash patched ramdisk from 8.0.0.171
Code:
fastboot flash ramdisk patched_boot.img
5. OPTIONAL: If you were using TWRP or any custom recovery - you will need to reflash it back
Code:
fastboot flash recovery_ramdisk twrp.img
or whatever you named your custom recovery image
REMINDER: Do NOT use ramdisk image I provided for any other model besides SHT-AL09 - doing so is guaranteed to render your device unusable. This patched ramdisk is ONLY for SHT-AL09. You will need to extract your own ramdisk from stock firmware, specific to your device model
Needless to say, all the images you are going to flash must reside in the same directory, from which you are going to be running the CMD commands. If your ADB/Fastboot folder is not in your WIndows' PATH environmental variable - the images must be placed in the same folder where ADB/Fastboot binaries are, and CMD commands must be run from that folder.
C5Longhorn said:
Yes, they still work. I have the same model and build as you and I'm rooted.
Sent from my Pixel 3 XL using Tapatalk
Click to expand...
Click to collapse
I'm considering buying an SHT-W09 with firmware version 8.0.0.200 (C567), but I'd like to know if I can root it first. I do not know if the bootloader has been unlocked. Since you have the same version, can you confirm that it's possible to unlock and root, and if so, sketch out how it's done? I'm confused about whether it's possible with this firmware.
samiller said:
I'm considering buying an SHT-W09 with firmware version 8.0.0.200 (C567), but I'd like to know if I can root it first. I do not know if the bootloader has been unlocked. Since you have the same version, can you confirm that it's possible to unlock and root, and if so, sketch out how it's done? I'm confused about whether it's possible with this firmware.
Click to expand...
Click to collapse
Unlocking is possible *only* if you've gotten already your unlock code. As this service was suspended about 2 years ago there is no easy way to get it unlocked.
Small request to developers, or people with access to reliable file hosting: I don't have a developer account, so all the files I linked or referenced in the OP are hosted on free hosting sites. That file hosting has expiration date and max downloads limit, so the files will become inaccessible sooner rather than later. Please upload these files to reliable hosting and create a post with the links. I will link your post in the OP as a mirror.
In the meantime, mirror for SHT-W09 firmware: https://mega.nz/#!asVjmZrR!bW2OmXgTjnyVN4pqb9fA7OzAJ4bzil7YZxNW14qoCmk
I can confirm that this works on the 10.8" wifi model using the devices relevant ramdisk.img.
Hello, can somebody test sixaxis controller tool with root and magisk? There is a Trial in Google Play Store, that is called sixaxis compatibility checker without purchise the App. Maybe i want to buy the Tablet, but only with Dualshock 4 Support...
Just a heads up, been following threads on this forum for flashing a GSI. Now that you guys can root, you can also make backups of your own stock system image if you can't find one from Firmware Finder. Then you can safely try flashing the GSI.
@MishaalRahman well it's bit like chicken egg dilemma. As we do not have a stock system image for e.g. SHT-W09 we cannot patch the ramdisk.img and so we cannot get the stock system image ...
Thanks Apo11on, great to have root so soon for the M5! Do you know if there's a way to get Xposed working? I tried the Xposed Framework SDK 26 from inside Magisk, but it put me in a boot loop.
Question is, for those of us with the Non Pro version, can this still be done.
@OHP Yes. The OP did it with the 8.4" version which has no pro option.
I'm looking to buy the Chinese 10" wifi version myself but need Google Play Store + Services on it which I'm guessing the Chinese version doesn't have. Is one of the firmwares at the website you link to a global version of the firmware that will work on this model?
OHP said:
Question is, for those of us with the Non Pro version, can this still be done.
Click to expand...
Click to collapse
Doesn't matter what version you have as long as you have access to your device firmware and the ramdisk.img. You really need to reread the guide.
magnumlove said:
Doesn't matter what version you have as long as you have access to your device firmware and the ramdisk.img. You really need to reread the guide.
Click to expand...
Click to collapse
Problem I have is :
CMR-W09C432B123 (8.0.0.123) from download headlines.
notice the Bold letter.
my Firmware on device:
CMR-W09C432123 (8.0.0.123)
obliviously it could be nothing but I wouldn't want to brick my tablet :fingers-crossed:
OHP said:
Problem I have is :
CMR-W09C432B123 (8.0.0.123) from download headlines.
notice the Bold letter.
my Firmware on device:
CMR-W09C432123 (8.0.0.123)
obliviously it could be nothing but I wouldn't want to brick my tablet :fingers-crossed:
Click to expand...
Click to collapse
I have exactly the same tablet/firmware as you and it was fine. The additional letter also threw me a little. But if you are unsure, download Huawei Firmware Finder from Google play and it will automatically detect your tablets firmware (which you can download if you wish).
magnumlove said:
I have exactly the same tablet/firmware as you and it was fine. The additional letter also threw me a little. But if you are unsure, download Huawei Firmware Finder from Google play and it will automatically detect your tablets firmware (which you can download if you wish).
Click to expand...
Click to collapse
I took the plunge, and I am sucessfully rooted now :silly:
struggling with this part
2. Transfer this patched ramdisk image to your device
Note for users with version of M5 other than SHT-AL09: Do NOT use the above ramdisk image. Download the full stock rom (update.zip) from the site I linked in the credits. Extract UPDATE.APP file from the zip. Then use HuaweiUpdateExtractor to extract ramdisk.img specific to your device. If you get errors in HuaweiUpdateExtractor - uncheck first 2 checkboxes for checksum verification on Settings tab and try again
I have a CMR-W09 :s i can got the files downloaded and the huwai software not sure how i make a img
The good news is I followed these instructions yesterday and they worked perfectly (SHT-AL09).
The bad news is, I seem to have lost root overnight.
---------- Post added at 06:41 AM ---------- Previous post was at 06:22 AM ----------
And I figured out why I lost root; I was playing around with Developer options and switched the default GPU renderer from 'default' to 'Skia.' Apparently, this disables root access until you switch back. I regained root access on a reboot, lost it again after switching back to Skia, and then regained it after switching back to default.
I got the right image file from the site and huwai extract. I have googled how to use this app but what files do I extract as there appears to be. Alot ? I extracted all of them ? I don't have a ramdisk.img
Also thanks for writting this up. Without it I would be lost
Thanks for the efforts making this thread. Unfortunately my device is SHT-W09 and I'm still waiting for the right firmware. Is there anything I can help, considering I have the device?
@dkk6 I am in the same boat as you. Unfortunately I installed the update to 8.0.0 123 without having the Firmware Finder installed on the device. Do you have installed already the update to 8.0.0 123?
If not, you could install Firmware Finder and provide us with the ota url ...
This works perfectly no issues. i had some how maanged to download the wrong rom first. AND thankfully it did not have a ramdisk in. it is important that your firmware matches the firmware present on the site as explained. This was easy guide to follow now to flash it with somthing other then andriod
AndDiSa said:
@dkk6 I am in the same boat as you. Unfortunately I installed the update to 8.0.0 123 without having the Firmware Finder installed on the device. Do you have installed already the update to 8.0.0 123?
If not, you could install Firmware Finder and provide us with the ota url ...
Click to expand...
Click to collapse
I'm on 8.0.0.101

Android phone root

Hey,
I have an android smartphone called chameleon 5r single that has those biometric functions and staff. it has a modified kernel, not rooted, and not that popular, I could not find any stock rom for it to extract the boot.img file, And I need to root it to customize some functions. It is not rooted, it does not have a custom recovery, And I need to at least dump the boot.img file to create a twrp custom recovery for it. Any recommendations/solutions?

Categories

Resources