I bought a Pixel 2 directly from Google, is it possible Verizon locked my phone? - Google Pixel 2 Questions & Answers

I bought the original Pixel from Verizon and that was a complete waste. Then the Pixel2 was released, and I bought it online (directly from Google). I've had it for a long while.
The first thing I did was oem unlock and flash twrp, Magisk, and Elemental X. I was running the stock rom and just let all of the updates slip past (updating the kernel of course) and had a few issues so I thought I'd factory reset and update the phone.
But I didn't take the sim card out...
When the phone rebooted it behaved *exactly* like the original Pixel if you had the sim card in. It specifically sets up according to what Verizon wants on the phone.
Now, when I go into the developer settings, the oem unlock is greyed out!!!
Does Verizon lock Pixel phones regardless of its origin?
I'm not completely stupid, this just doesn't make sense... Anyone else have this issue?
Honestly, I didn't think something like that was possible. Can anyone here confirm the hardware is the exact same? Is it possible Verizon signing keys can overwrite default/official Google keys?
Or will the phone behave as normal if I reset without the sim in?
Gonna try it and report back after work (gotta wait another 8 hours or so as of writing this).

Exactly how did you update it, and I mean every step you took?

The steps, specifically as possible:
downloaded the original image from Google (https://developers.google.com/android/images)
I grabbed [8.1.0 (OPM1.171019.013, Jan 2018] as that was the version I was running
Extracted zip, extracted the zip inside the zip (to get boot.img)
flashed stock recovery to boot_a and boot_b (using instructions found at https://www.androidexplained.com/pixel-2-restore-stock-recovery/
Reboot
Checked phone to see if it worked fine
Rebooted to [stock] recovery to see if it would load
This is where things get a little sketchy, as I could only confirm the stock recovery was in place. I only saw dead Andy with "No Command"
Reboot to system- everything looks okay so far...
Let phone automagically download and install any/all updates through the System Settings.
Make sure I want to- and then actually, factory reset phone (I did *not* remove the sim card)
Went through the initial setup
wait for it...
At this point, all Verizon default apps were installed on phone during the initial setup (not at user request/Google Play Store):
MyVerizon, Messages+, etc.
Raised an eyebrow, went to settings, enabled Developer Options, checked OEM unlock...
As of this point I have not been able to check if I can [fastboot oem unlock]
Another thing is that the flash-all.sh script refused to work properly, even with a root shell. I made sure to double check usb debug was enabled, udev rules in place, and checked, double checked cables and ports.
I can, however, confirm that I am on OPM2.171026.006.C1
I haven't memorized the list at the Google Images (*.img type) link above, but I'm pretty sure this one is listed as the generic Pixel 2 and not the Verizon variant. I will still attempt to unlock using the fastboot method... let's hope it still works...
Anywho, I work nights so, I won't be able to test anything out until after work, waffle house, and a nap. But I will indeed be back to keep this updated.

allcaps33 said:
The steps, specifically as possible:
downloaded the original image from Google (https://developers.google.com/android/images)
I grabbed [8.1.0 (OPM1.171019.013, Jan 2018] as that was the version I was running
Extracted zip, extracted the zip inside the zip (to get boot.img)
flashed stock recovery to boot_a and boot_b (using instructions found at https://www.androidexplained.com/pixel-2-restore-stock-recovery/
Reboot
Checked phone to see if it worked fine
Rebooted to [stock] recovery to see if it would load
This is where things get a little sketchy, as I could only confirm the stock recovery was in place. I only saw dead Andy with "No Command"
Reboot to system- everything looks okay so far...
Let phone automagically download and install any/all updates through the System Settings.
Make sure I want to- and then actually, factory reset phone (I did *not* remove the sim card)
Went through the initial setup
wait for it...
At this point, all Verizon default apps were installed on phone during the initial setup (not at user request/Google Play Store):
MyVerizon, Messages+, etc.
Raised an eyebrow, went to settings, enabled Developer Options, checked OEM unlock...
As of this point I have not been able to check if I can [fastboot oem unlock]
Another thing is that the flash-all.sh script refused to work properly, even with a root shell. I made sure to double check usb debug was enabled, udev rules in place, and checked, double checked cables and ports.
I can, however, confirm that I am on OPM2.171026.006.C1
I haven't memorized the list at the Google Images (*.img type) link above, but I'm pretty sure this one is listed as the generic Pixel 2 and not the Verizon variant. I will still attempt to unlock using the fastboot method... let's hope it still works...
Anywho, I work nights so, I won't be able to test anything out until after work, waffle house, and a nap. But I will indeed be back to keep this updated.
Click to expand...
Click to collapse
USB debugging is only for ADB, and has nothing to do with fastboot commands. When you attempted to run the flash-all script, were you in ADB or bootloader? In ADB it will fail, because it doesn't recognize fastboot commands. However, in the bootloader, if it's not recognizing fastboot commands, that's a whole different animal. OTAs, when it comes to VZW are dangerous, so it's always best to just sideload them via stock recovery. They should come straight from Google, but I'm afraid that something that you did in the entire process broke that.
In all honesty, all you really needed to do was unzip the latest factory image, run the flash-all script while you were still unlocked, and be done with it. The -w in the script would have taken care of the factory reset for you, as it's a full wipe.
Let us know if what you tried worked, and best of luck ?

I was in the bootloader, I realize adb and fastboot are 2 different entities.... thus far, I'm still locked out... working it now...

An update to this mess:
Still working with known exploits to try and get back to where I was. Looks like I'm gonna have to pull from CVE or ExDB.
Any suggestions from the pros?

allcaps33 said:
I was in the bootloader, I realize adb and fastboot are 2 different entities.... thus far, I'm still locked out... working it now...
Click to expand...
Click to collapse
I do apologize for underestimating your knowledge. That being said, an OTA can't re-lock the bootloader without permission, as that would completely wipe userdata. And, neither can the presence of a SIM card. I fear that, with everything that you did, as far as getting your phone as clean as possible, you may have put the device in limbo, so to speak, and the OTAs, combined with vzw's penchant for locking bootloaders, may have made it susceptible to becoming a Verizon device. Just a thought.

I totally agree with you.
I'm just completely confused how this happened...
As you said, with an unlocked bootloader, it *might* have been possible that through some kind of bug it may have taken something VZW specific... But... The OTA packages don't actually contain the entire ROM do they?
From what I noticed, they're almost all under 80 MB, while the actual ROM packages are (on average) 1.5 GB.
At what point could this crossover happen?
(The reason I bring up package sizes is that would be the most likely reason for an overwrite... I think...)
Can I probe you for more theories? Out of the box solutions never work, perhaps you might trigger ideas within the community.
Thank you very much @DuckRuckus for your help!
Still to this point attempting anything within fastboot seems to just not work...
I can get "fastboot devices" and "fastboot reboot bootloader" to work. But that's about it. No other commands issued get so as a response.

Related

[Q] Nexus has been unusable since 5.0 OTA

As a preface, I keep my Nexus (16GB) stock/unrooted because having it down while flashing ROMs is not an option anymore. I need to the phone to work all the time, period. The irony is ridiculous.
Received the OTA from Sprint a couple of weeks ago, immediately noticed the (often-mentioned) dismal battery life and GPS hasn't been able to connect since that day. As I use GPS daily and need my phone to last for longer than 6 hours--these present full stop problems. This is in addition to the (often mentioned) stuttering/lag/freezing issues which are beyond frustrating as a heavy user. Really Google?!
Over the last week I've:
-Cleared caches multiple times
-Wiped/Factory Data Reset (3 times as it would not allow me to sign into my Google Account or sync apps)
-Spoke with Nexus Support for three hours today, which ended with 'Sorry, you'll have to call Sprint or LG'
-Tried GPS location 'fix' on XDA (didn't work)
-Been unable to send/receive SMS messages for two days
I'm beyond frustrated with this process and with Google for their lack of response in fixing widely-known 5.0 issues...on their own device. This phone is useless at the moment. What are my options? Root and roll back to KitKat? Throw this phone out of the window and go get a G3? I don't want to use a custom ROM/Recovery unless there are no other options.
Thanks for any advice-
993 said:
Over the last week I've:
-Cleared caches multiple times
-Wiped/Factory Data Reset (3 times as it would not allow me to sign into my Google Account or sync apps)
-Spoke with Nexus Support for three hours today, which ended with 'Sorry, you'll have to call Sprint or LG'
-Tried GPS location 'fix' on XDA (didn't work)
Click to expand...
Click to collapse
For the problems you're describing, you really haven't done much to solve it.
Unlock the bootloader, flash a factory image, relock the bootloader.
Why would you speak to Nexus support for 3 hours for? Waste of time
Frankly, I wanted to see if they would even acknowledge any of the issues that appear to be quite common recently with 5.0. They clearly did not, and it was relatively little effort wasted as it was through Hangouts (on a desktop though, phone forgot how to Hangout).
I have not tried to flash the bootloader, as I said I want to keep this phone as OEM as possible. Since that doesn't appear to be an option I will update when it's complete.
993 said:
I have not tried to flash the bootloader, as I said I want to keep this phone as OEM as possible. Since that doesn't appear to be an option I will update when it's complete.
Click to expand...
Click to collapse
Please read the stickies and take advantage of the knowledge base. My suggestion keeps the phone absolutely stock. It's telling that you couldn't recognize that.
I agree, just flash the stock image from fastboot.
Sent from my Nexus 5 using Tapatalk
Wakamatsu said:
Please read the stickies and take advantage of the knowledge base. My suggestion keeps the phone absolutely stock. It's telling that you couldn't recognize that.
Click to expand...
Click to collapse
That isn't what the Nexus rep said (reps have been known to be misinformed). I have read the relevant stickies and am aware of how to use this site. You didn't read my question. As I said, I would rather not flash if there are other viable options. IF this is the only workable solution thus far for people experiencing the above listed issues then OK. Thanks for your suggestion.
993 said:
That isn't what the Nexus rep said (reps have been known to be misinformed). I have read the relevant stickies and am aware of how to use this site. It is telling you didn't read my question. As I said, I would rather not flash if there are other viable options. IF this is the only workable solution thus far for people experiencing the above listed issues then OK. Thanks for your suggestion.
Click to expand...
Click to collapse
Flash the factory image. OTAs sometimes fail to implement properly. What you are describing is almost certainly that. You've already tried everything you can to fix the issues short of flashing. So flash.
You either have bad hardware, or the upgrade didn't install correctly. As others have mentioned, flashing the factory image should work.
993 said:
You didn't read my question. As I said, I would rather not flash if there are other viable options.
Click to expand...
Click to collapse
You said that you don't want to flash a custom rom. A factory image is what is installed on the Nexus by Google. Again, you're betraying a lack of knowledge on this subject.
If you wanted stablity you should of stayed on kitkat, hence why i never updated, you a os i can rely on and thats currently 4.4, as usual android builds at the start have minor issues and we wait for google to fix them.
I usually dont update till the devs can get a functioning build thats suitable for the community.
as above,
Fastboot oem unlock, flash 4.4 or 5.0 google image, relock bootloader
If he doesnt want to flash a custom rom then he should know how to flash a stock rom.
https://developers.google.com/android/nexus/images
I don't even speak to my own family for 3 hours, let alone a complete stranger lol wow
Wakamatsu said:
You said that you don't want to flash a custom rom. A factory image is what is installed on the Nexus by Google. Again, you're betraying a lack of knowledge on this subject.
Click to expand...
Click to collapse
Here's what's been done so far several times over:
Unlocked Bootloader
Installed SDK kit from Google using their walk though
Attempted ADB sideload of Google Factory images (5.0 then 4.4) from appropriate modes on CWM and TW
Attempted Fastboot (works only with CWM, no push/pull)
Multiple Full Wipes in both recoveries
Attempted ADB commands through terminal (W7 Pro - Admin)
Uninstalled, Reinstalled all recommended device driver packages, only recognizes in device manager as 'Google Nexus ADB Device' not Explorer Shell (read relevant FAQs) regardless of driver.
Used multiple USB ports/cables, rebooted PC each change in configuration
Root Toolkit 1.9.9 does not recognize through ADB
As of current, only Bootloader (unlocked) and Recovery mode work. I cannot access the SD card of the device through any means I've tried. The last that the OS booted I ensured that USB debugging was on in Settings. ADB mode in either recovery does not change device recognition on PC, nor does file system appear. System will not boot to ensure debugging setting has remained. Same issues with a laptop with no known prior driver issues.
993 said:
Attempted ADB sideload of Google Factory images (5.0 then 4.4) from appropriate modes on CWM and TW
Attempted Fastboot (works only with CWM, no push/pull)
Click to expand...
Click to collapse
You can't sideload a factory image. Fastboot commands are executed in bootloader, not recovery.
That should read that 'fastboot only responds to commands while CWM is the recovery'.
I can flash recoveries by this method from CMD but anything else (ROMS, etc) show progress but end before completion.
993 said:
That should read that 'fastboot only responds to commands while CWM is the recovery'.
I can flash recoveries by this method from CMD but anything else (ROMS, etc) show progress but end before completion.
Click to expand...
Click to collapse
Dude, you really need to read and understand the stickies before you do something bad to your phone. You are just flailing right now.
And really, all you needed to read was the install instructions on the Google factory image page.
1) Unlock bootloader
2) Unzip the factory image zip
3) Reboot in to bootloader
4) Run the flash-all script in the factory image folder.
This was the first method I tried. I have downloaded the factory image from Google several times and I get an 'unexpected end of data' message in 7zip when extracting my copies. Downloading from Google has been hit or miss with 'unknown network error' that halts the download, not sure what that could be.
I am trying to pinpoint the cause of these issues, as flashing back to factory without good images won't be possible. I understand how straightforward a factory flash should be especially with OEM tools but in my case I keep running into roadblocks.
Disable your antivirus and firewall during the download, that may help.
gee2012 said:
Disable your antivirus and firewall during the download, that may help.
Click to expand...
Click to collapse
Thanks for your suggestion. I disabled MSE + Firewall on the W7 machine and attempted to download [hammerhead-lrx21o-factory-01315e08.tgz] again from Google with the same error result, halting the download before completion.
My main machine, a Chromebook, will download the file completely however the zip cannot be moved without losing file size (downloads the entire 556.3MB, however once moved it magically becomes 417.2MB).
Further, I went to the Sprint Store today (I know) to see what the techs could do about pushing the factory image on the device. After about 30 minutes, they came back with "You should call Google". Brilliant. Now all I need is someone to suggest I call LG and the trifecta will be complete.
993 said:
Thanks for your suggestion. I disabled MSE + Firewall on the W7 machine and attempted to download [hammerhead-lrx21o-factory-01315e08.tgz] again from Google with the same error result, halting the download before completion.
My main machine, a Chromebook, will download the file completely however the zip cannot be moved without losing file size (downloads the entire 556.3MB, however once moved it magically becomes 417.2MB).
Further, I went to the Sprint Store today (I know) to see what the techs could do about pushing the factory image on the device. After about 30 minutes, they came back with "You should call Google". Brilliant. Now all I need is someone to suggest I call LG and the trifecta will be complete.
Click to expand...
Click to collapse
Try LG to see if they will help. Haha had to.
Can you not download on your phone? I'm not familiar with sending MMS but does it work forcing your phone to 1x? I'm trying to think of ideas. What all apps do you have installed?
Sent from my Nexus 5 using XDA Free mobile app

Soft bricked my Mate 8 - can't flash anything anymore

Hey guys,
I've backed myself into a corner here a little and I hope you can guide me to get a working phone again.
I was on Ephemeral Mate 8 for a while now and decided it was time to upgrade. The new ROM I wanted to try mentioned I should have at least firmware version B3XX to flash it, so I thought the easiest way to get there would be to flash a stock ROM again and let the system update function do it's work. I updated from NXT-L29C432B180 to B192 to B560 to B581 (no B3XX offered in between) and somehow managed to get the phone rooted again. Yet I noticed some things (like Bluetooth) not working quite properly anymore (for whatever reason) and so wanted to downgrade again.
Tried to restore one of my old backups from Ephemeral Mate 8: it failed. The backup from stock B581 I made before: no idea where it was stored, but I can't find it anymore and may have accidentally deleted it by now. Currently it seems I don't have any OS installed anymore.
I still have an unlocked bootloader and can access it by pressing power + volume down and can flash a custom recovery via Fastboot (the one I'm currently trying with is this one). However, no ROM I try to flash or backup I want to restore will work anymore, they just fail with varying errors like error 7 or invalid zip file. At some point I tried to wipe almost anything I could before every new try to flash anything (probably a very bad idea), because I thought a clean start would somehow resolve some of the various errors TWRP was throwing at me - obviously it hasn't. I also tried installing the same stock ROM like the first time via dload method, but it always says there is an incompatibility with my current version (probably that I don't have one anymore by now) and fails.
Sadly, I can't remember anymore what everything I tried to flash in between to try and get it working again or where I found it, because it simply is too much. But I'm willing to provide any information I'm able to achieve and try any steps you tell me to get it working again. I'd be very grateful for any help on this and already thank you in advance for any advice.
Sooo... in the meantime I followed this guide and got my phone working again. However, I'm facing another problem now:
When I try to flash TWRP I always get this error and can't find out what it means and how to fix it:
Code:
target reported max download size of 471859200 bytes
sending 'recovery' (17280 KB)...
OKAY [ 0.437s]
writing 'recovery'...
FAILED (remote: image verification error)
finished. total time: 0.454s
Maybe it's related to that somehow the Serial Number of my device has changed in the process? It's now just '0123456789ABCDEF'. I read about fixing it with HCU Client tool, but when trying to repair the Serial Number it just gives me this error:
Code:
2017-06-23 13:11:36.503 Autodetect COM port and phone type start!
2017-06-23 13:11:36.509 Compatible COM ports not found!
2017-06-23 13:11:36.513 ERROR!
Phone not found !
I don't know how to proceed, but don't want to be stuck with stock rom. Any suggestions?
Okay, image verification error obviously had something to do with the B320 rom I flashed. Tried B192 now and recovery flash with fastboot goes through with OKAY... Just that the phone doesn't boot into recovery - it just sits there stuck on boot screen.
Would still be thankful for any hints.
Patneu said:
Okay, image verification error obviously had something to do with the B320 rom I flashed. Tried B192 now and recovery flash with fastboot goes through with OKAY... Just that the phone doesn't boot into recovery - it just sits there stuck on boot screen.
Would still be thankful for any hints.
Click to expand...
Click to collapse
I read somewhere that once you are on EMUI 5 you can't go back to 4. The rollback works to 4.1 which is where I am now with C636B330 but that's it. No further. I was advised to use the DC Phoenix tool and go to 330 which thankfully worked! Do the same and you should be ok I guess.. 4.1 or 5.
I think I'm just going to have to wait for someone like kang to do a Rom based on one of those before I try custom. Unless there already is one? Next time I flash a phone I should really research the pitfalls. That would avoid a week of using a different device!
Bearded_1 said:
I read somewhere that once you are on EMUI 5 you can't go back to 4. The rollback works to 4.1 which is where I am now with C636B330 but that's it. No further. I was advised to use the DC Phoenix tool and go to 330 which thankfully worked! Do the same and you should be ok I guess.. 4.1 or 5.
Click to expand...
Click to collapse
Thanks for the reply! I'm now back on C432B180 with EMUI 4.0 flashed with DC Phoenix and finally managed to flash a TWRP using SRK Tool.
Anything with B3XX or B5XX still just gives me the 'image verification error' mentioned above for any custom recovery and I doubt it would be any different with SRK Tool since it also just makes use of fastboot as it seems to me. So I'm staying with B180 for the moment unless someone has a suggestion on how to get rid of this error.
I'll now try to flash Ephemeral Mate 8 again, since it was the first (and last) custom ROM that worked for me before. I know it's discontinued, but it's the only one I can currently find that doesn't mention to go to B3XX first - which wouldn't work for me.
What worked and didn't work so far:
Tried flashing EM8_41816_SIGNED.zip, which failed without warning and rebooted to fastboot mode mid-process which showed some error involving the word 'panic'.
Managed to root the stock B180 again with SRK Tool, but will continue to try earlier versions of Ephemeral 'cause I really need the Kang Tools. Will update on how that worked out.
Suggestions still welcome on:
How to get rid of 'image verification error' on B3XX and B5XX' so I can try flashing a non-outdated ROM.
Other still available pre-B3XX ROMs I could try.
Any root apps to achieve navbar and status bar modifications similar to Kang Tools, so I could do without a custom ROM and stay with currently achieved rooted stock ROM.
One little edit concerning the 'image verification error': My phone mentions the FRP to be unlocked in fastboot mode, when on B3XX or B5XX which it doesn't on B1XX, so maybe that's related to it? But I don't know exactly what an FRP is or what it means to unlock it.
YEEESSS!!! :victory:
Tried flashing EM8_40416_SIGNED.zip now and went through without errors. Took a few seconds to reboot and it works! Just B170 now it seems, but hey...
My quest to upgrade may have failed graciously, but at least I got a working rooted phone again with Kang Tools - what more can I ask for? And unless someone, somehow, somewhen has a hint for me about this damned 'image verification error' (at least I now know a foolproof way to fix it if I mess anything up again) I'm taking this cautionary tail to heart and won't touch this damned phone's firmware again 'til it turns to dust under my fingers.
And now, as common courtesy commands, my exact steps - from having completely messed up with nothing save stock recovery and fastboot mode working anymore to functioning phone again with root, cutom ROM and Kang Tools - for the sake of the poor souls of the future who may (hopefully not) follow in my footsteps facing the same problems (no guarantees or responsibility whatsoever on my part, just what worked for me):
1. Reboot your phone into fastboot mode (bootloader) by pressing and holding power + volume down together (don't forget to connect the phone to a PC before!). As always, make sure you have enough battery power left before each step! If you don't at this point, try booting into stock recovery by holding power + volume up and charge your phone, then continue.
2. Download:
2.1: DC Phoenix from here. Found here via here.
2.2: File with partition rework and factory firmware from here. Found here.
2.3: NXT-L29C432B180 stock ROM from here (you may need a different version depending on your device!). Found here. (Stock ROMs B3XX or higher may work too, but didn't for me - see above).
3. Buy 15 credits here to use DC Phoenix (it's worth it!), unpack and start DC Phoenix and login with your DC-unlocker credentials. (Edit: If you want to try the new guide mentioned below from step 5 onward, you should consider buying the 'DC-Phoenix + HCU timed license' option for 19 bucks instead.)
4. Follow this guide. You find the mentioned 'UPDATE.APP' file in the stock ROM ('update.zip') file you downloaded before.
5. You should have unbricked your phone and have a working stock ROM again by now. :fingers-crossed: Now on to getting a custom ROM again:
(Edit: I fiddled around with my phone a bit more in the meantime, so if you prefer flashing a TWRP on a B5XX-based stock ROM and finding your way from there, you may want to follow this new guide instead.)
6. In the settings of your phone enable 'Developer options' -> 'USB debugging' if you haven't already (and 'Enable OEM unlock' too just to be sure, don't know if it's necessary, but I did it). If you don't see 'Developer options', tap on 'About phone' -> 'Build number' a few times. Connect phone to your PC.
7. Downloads:
7.1: SRK Tool from here. Found here via here.
7.2: Ephemeral Mate 8 from here. Found here via here. (Later version or other ROMs may work for you, but didn't for me.)
8. Move 'EM8_40416_SIGNED.zip' file (or the one you want to flash) to the external sdcard of your phone.
9. Unpack and start SRK Tool.
10. Select '3. Install Recovery 6.0' -> '2. Huawei Mate 8' -> '2. Install Mate 8 TWRP for Marshmallow (EMUI 4.0)' (may depend on the stock ROM version you flashed before). Confirm requests and follow the instructions.
11. Your phone now reboots. Remove the USB cable connecting it to the PC and press and hold power + volume up to boot into the newly flashed custom recovery.
12. Select your language (it was chinese later on for me, when I didn't!) and press 'Cancel' if asked for a password. When asked to allow changes to system, do it (don't know if necessary, but I did).
13. Select 'Wipe' -> Swipe to Factory Reset'.
14. Go back and 'Format Data' -> type 'yes' and confirm. Reboot the phone and enter custom recovery like before. Factory Reset again. (Don't know if this step is necessary, but I did it.)
15. Go back and select 'Install' -> select and flash the zip file you moved to sdcard before. If no errors occured, reboot your phone. Let it reboot, it may take a few seconds. If you get errors, try starting with step 1 or 11 again (depending on how badly you messed up...) and try a different custom ROM (Follow the instructions there and be aware of prequisites and warnings!). If that doesn't work either, note your errors and ask for help - good luck!
16. Congratulations, you should have a working phone again with Ephemeral Mate 8 custom ROM with Kang Tools, it should be rooted already. :good:
17. Maybe buy the guys, who developed and wrote the mentioned tools and guides to help you on your way, a coffee - they surely deserve it.
Hint: If you only want a rooted stock ROM, reboot your phone after step 12, start SRK Tool again, select option '4. Root' and follow instructions.
Patneu said:
Thanks for the reply! I'm now back on C432B180 with EMUI 4.0 flashed with DC Phoenix and finally managed to flash a TWRP using SRK Tool.
Anything with B3XX or B5XX still just gives me the 'image verification error' mentioned above for any custom recovery and I doubt it would be any different with SRK Tool since it also just makes use of fastboot as it seems to me. So I'm staying with B180 for the moment unless someone has a suggestion on how to get rid of this error.
I'll now try to flash Ephemeral Mate 8 again, since it was the first (and last) custom ROM that worked for me before. I know it's discontinued, but it's the only one I can currently find that doesn't mention to go to B3XX first - which wouldn't work for me.
What worked and didn't work so far:
Tried flashing EM8_41816_SIGNED.zip, which failed without warning and rebooted to fastboot mode mid-process which showed some error involving the word 'panic'.
How to get rid of 'image verification error' on B3XX and B5XX' so I can try flashing a non-outdated ROM.
Any root apps to achieve navbar and status bar modifications similar to Kang Tools, so I could do without a custom ROM and stay with currently achieved rooted stock ROM.
One little edit concerning the 'image verification error': My phone mentions the FRP to be unlocked in fastboot mode, when on B3XX or B5XX which it doesn't on B1XX, so maybe that's related to it? But I don't know exactly what an FRP is or what it means to unlock it.
Click to expand...
Click to collapse
Isn't the FRP related to the 'enable oem lock' option? Glad it's sorted! I might follow this thread in the future to go back to pre EMUI 4.1, but I like the camera options so willing to stick with it for a while!
Hey, I didn't realized, I have the 0123456789ABCDEF serial number too, I'm on B330, after unbricking it with DC phoenix (flashed directly from the "Factory_firmware.." for unbrick it, to B330). Did you solve that?
I think I cannot do much now because I'm waiting for the 14 days using my HW account to request de bootloader unlock code. Altough, my phone says I have the bootloader unlocked (that's because the DC phoenix tool did something). But I've never formerly unlocked my phone.
Don Kronos said:
Did you solve that?
Click to expand...
Click to collapse
Well, sort of... I'm still on this fake ABC... Serial Number, but as you can read above, I at least managed to flash a TWRP again and also to install a custom ROM, if only a B1XX based. Better than nothing, though. Didn't encounter any other downsides of the changed Serial Number 'til now.
If you have a hint concerning the 'image verification error' I'd still be glad to hear, but otherwise I'm fine now.
Patneu said:
If you have a hint concerning the 'image verification error' I'd still be glad to hear, but otherwise I'm fine now.
Click to expand...
Click to collapse
Patneu said:
One little edit concerning the 'image verification error': My phone mentions the FRP to be unlocked in fastboot mode, when on B3XX or B5XX which it doesn't on B1XX, so maybe that's related to it? But I don't know exactly what an FRP is or what it means to unlock it.
Click to expand...
Click to collapse
The FRP (Factory Reset Protection) prevents some "writing" commands of ADB to be executed, thats the reason of the "image verification error". It is the homologue to an iCloud protection of iPhone, but using Google Account. I don't know why it gets locked.. but the DC phoenix can crack that protection.
Don Kronos said:
The FRP (Factory Reset Protection) prevents some "writing" commands of ADB to be executed, thats the reason of the "image verification error".
Click to expand...
Click to collapse
Sounds right, aside from the fact that my FRP doesn't seem to be locked. When I flashed B320 via DC Phoenix or flashed B1XX and updated to B560 via OTA and booted into fastboot mode, it said there "Phone unlocked" and "FRP unlocked". I shouldn't get the 'image verification error' then, right? But I do. If I flash B1XX via DC Phoenix, it says nothing about FRP, whether locked or unlocked, just "Phone unlocked" and I don't get 'image verification error'.
I remember getting a TWRP to flash when I updated from B180 (flashed with the TWRP I had before) to B581 OTA before I used DC Phoenix (even if it threw errors like nothing good), but I don't remember if it said anything about FRP then.
Don Kronos said:
I don't know why it gets locked.. but the DC phoenix can crack that protection.
Click to expand...
Click to collapse
Yeah, it seems so, but it can't flash a custom ROM, can it? Only 'UPDATE.APP' of stock ROMS as far as I can see.
Patneu said:
YEEESSS!!! :victory:
And now, as common courtesy commands, my exact steps - from having completely messed up with nothing save stock recovery and fastboot mode working anymore to functioning phone again with root, cutom ROM and Kang Tools - for the sake of the poor souls of the future who may (hopefully not) follow in my footsteps facing the same problems (no guarantees or responsibility whatsoever on my part, just what worked for me):
Click to expand...
Click to collapse
You just saved my fuc**ing ass bro. Thanks a lot for such detailed steps. I was another prick who got his device bricked. I also fhashed a buch of things and lost track on the number of solutions tried until I came across your post:fingers-crossed: Now i feel solid again and want to continue flashing and messing up with my device. That´s the beauty of android, you can recover your device from almost any state. Thanks a lot. You made my day!
The process really work and it's really easy. Those 15 bucks are worth every penny!
juanq214 said:
The process really work and it's really easy. Those 15 bucks are worth every penny!
Click to expand...
Click to collapse
Glad, I could help you and yeah, they surely are.
Just a few remarks I discovered in the meantime:
- If you want to further mess with your phone after that, be sure to not mess up so badly as to having to use DC Phoenix again, unless within the next 72 hours or you'll have to pay the 15 bucks again (as mentioned here). Other claims made there about "lifetime" are not legit.
- Tried EM8_41816_SIGNED version of Ephemeral Mate 8 (based on B180) again and it works, too. The failure and mid-process 'panic' reboot at first try was caused by unrelated battery (hardware) problems of my device (which I think already started before messing with the firmware), which caused me to think I had more power left than I actually did. :silly:
I solved the battery problems by replacing the battery using this guide, ruining some cheap repair kit, made of too much plastic, in the process and paying altogether around 40 bucks for it and for now, everything runs fine again. :good:
Patneu said:
Glad, I could help you and yeah, they surely are.
Just a few remarks I discovered in the meantime:
- If you want to further mess with your phone after that, be sure to not mess up so badly as to having to use DC Phoenix again, unless within the next 72 hours or you'll have to pay the 15 bucks again (as mentioned here). Other claims made there about "lifetime" are not legit.
- Tried EM8_41816_SIGNED version of Ephemeral Mate 8 (based on B180) again and it works, too. The failure and mid-process 'panic' reboot at first try was caused by unrelated battery (hardware) problems of my device (which I think already started before messing with the firmware), which caused me to think I had more power left than I actually did. :silly:
I solved the battery problems by replacing the battery using this guide, ruining some cheap repair kit, made of too much plastic, in the process and paying altogether around 40 bucks for it and for now, everything runs fine again. :good:
Click to expand...
Click to collapse
I successfully got OTA for L29C432B581. I don't really care much about xposed or magic, all I needed was Nougat update. The only downside is that fast charging is gone, but that is not because of the brick but rather a bug related to the update.
Everything fixed.
Ok, so I'm a little late on this, but because some recent circumstances forced me to mess with my phones firmware again - despite my former new-found resolutions :angel: - I dug into this mess again and finally found the solution for the last unsolved problem I encountered: the dreaded 'image verification error'. So I thought, I'd share it with anyone else out there, who may still be struggling:
If you followed my original instuctions, maybe you got stuck at the same point I did: I originally wanted to install a more recent custom ROM based on Android Nougat, but couldn't for the hell of it flash a working TWRP, because of 'image verification error', when I was on a stock Nougat ROM (B5XX-based) and finally settled for my old B1XX-based Ephemeral Mate 8 ROM once more.
So here's what I did to get a working TWRP flashed with a B5XX-based stock ROM (again, no guarantees, just what worked for me):
1. Depending on how badly you messed up before or at what point you currently are, first you may want to follow some of my original instructions 'til step 5. (All links are still working, as far as I can see.) You then should be good to go with a working B1XX-based stock ROM as a basis for what where going to do now. :fingers-crossed: If you already are, great. :good:
1.1: Attention! If you don't already have a working B1XX-based stock ROM, you may want to slightly differ from my original instructions: instead of buying the 15 credits for DC Phoenix in step 3, you could directly choose the "DC-Phoenix + HCU timed license" option for 19 bucks, so you're already set for everything we're doing later and can mess with your phone as much as you want for the next 72 hours - it may come cheaper in the end and it's easier in any case.
1.2: You may notice afterwards, that if you start adb and type 'adb devices', that the serial number of your device changed to something generic like '0123456789ABCDEF'. We'll fix that later on, along with the 'image verification error', but be sure to note your devices original S/N! You can find it on a sticker at the side of the box your phone came in or in the phones 'Settings' -> 'About phone' -> 'Status' -> 'Serial number'. I don't know where else to recover it, if you lost it.
2. Once you have a working B1XX-based stock ROM as a basis, update it to the latest B5XX-based one (was B582 for me) via 'Settings' -> 'System update'.
2.1: Attention again! You may want to check 'Developer options' -> 'Enable OEM unlock' first, since it was greyed out (while still checked) for me once I updated to B5XX. Don't know if it's necessary to have it enabled, but better safe than sorry so you don't have to start over. (If you don't see 'Developer options', tap 'About phone' -> 'Build number' a few times.)
3. Download:
3.1: HCU Client from here. (Thanks Petr S. for putting me on the right track!)
3.2: Unofficial TWRP for EMUI 5.X from here. Found here. (Official TWRP versions may work for you, but didn't for me.)
4. If you didn't already, buy a sufficient number of credits (don't know how much it will be) to use HCU Client from here or directly choose the "DC-Phoenix + HCU timed license" option for 19 bucks to get the all-round carefree package.
5. Unpack and start HCU Client and login with your DC-Unlocker credentials.
6. Connect your phone to your PC and enable 'Developer options' -> 'USB debugging' (don't know if necessary, but I did).
7. As instructed by HCU Client, type '*#*#2846579#*#*' (minus the quotes) into your phones dialer and select '1. Background Settings' -> '2. USB Port Settings' -> 'Manufacture Mode'. If your phone should be rebooting somewhere in the process, you may need to do this again.
8. Now click 'Read phone info' in HCU Client ('Autodetect' should be checked already) and wait for it to complete. (If you didn't buy a sufficient number of credits or the mentioned license before, HCU Client will simply get stuck instead of just telling you - which I found a little odd. )
9. Click 'Repair UMTS' (acknowledge the warning) and type the original serial number of your device (not the '0123456789ABCDEF' one!) into the 'SN' textfield, check it and hit 'Repair'. (I also retyped the 'IMEI' and 'IMEI 2' numbers, but I guess that was unnecessary.)
10. If now you hit 'Read phone info' again, all the textfields under 'Repair UMTS' (except 'WiFi MAC' and 'Bluetooth MAC') should be filled with the right values. Then click 'Unlock' -> 'Read Bootloader code', note the bootloader code. Your phone will shutdown.
11. Power up your phone again, make sure 'Settings' -> 'Developer options' -> 'USB Debugging' and 'Enable OEM unlock' are still checked and bring it into fastboot mode, then open a command prompt and cd to where your 'Minimal ADB and Fastboot' (or whatever you're using) is installed, if you didn't already, and type 'fastboot devices'. You should see your device with the original serial number again.
12. Unlock your device again with the command 'fastboot oem unlock ' followed by the bootloader code you noted before. Now you should be able to flash the unofficial TWRP you downloaded with 'fastboot flash recovery twrp-3.1.1-1-next.img' (assuming you copied the TWRP image file to your 'Minimal ADB and Fastboot' directory for convenience and didn't rename it).
13. Type 'fastboot reboot' and immediately bring your phone into recovery mode. You should now have a working TWRP with a B5XX-based stock ROM and should be able to flash anything you'd like. :fingers-crossed::good:
You should also be able to flash a Nougat-based custom ROM now, though I didn't try that and settled for the stock ROM rooted with Magisk for personal reasons.
A last word of warning: Be sure to frequently make backups in TWRP before you flash or change anything important like installing or updating Magisk or Xposed modules, because I noticed my system to be a little... wonky at this point.
Don't know if that's related to the way I unbricked my phone with all these DC-unlocker tools or just using Magisk or whatever, but several times after changing something important and rebooting, my phone kind of crashed into fastboot mode with some warning about 'native_boot_fail' and wouldn't boot again until I made a factory reset in recovery and started all over (the first time while writing this guide :silly. Not so bad, as it doesn't happen randomly as long as I don't make any major changes to the system, but you wouldn't want to retype your Google password and setup your system again everytime like I had to do, would you? So, yeah, just make a backup in TWRP before you change anything root-related - and tread a little lightly, as in: don't make to many changes at once - and you should be fine.

Getting root on the BNTV460 is a pain....

Just picked this up for the significant other's bday. Bootloader unlocked it with the instructions from @ipdev, and can report that method works. Can't get root.
Does anyone have this device and have achieved root? I'm a bit perplexed, even flashing a patched boot img isn't getting Magisk on there the way that it should.
Thanks!
Important to Note that the 460 has the exact same EVERYTHING as the 450, including build #s. They just gave it double the internal space is the only difference I've seen.
UPDATE: Just bricked the lil' guy. Since the device is encrypted with every system file having a -sign behind it, I went and frolicked around trying to get Magisk on there via ADB. The only way to do that was to patch the boot-sign .img and since I got the new Magisk, I let it patch, flashed, and now voila, nothing but a bootloop. Off to DM Verity my way out of it lol.
Articul8Madness said:
Just picked this up for the significant other's bday. Bootloader unlocked it with the instructions from @ipdev, and can report that method works. Can't get root.
Does anyone have this device and have achieved root? I'm a bit perplexed, even flashing a patched boot img isn't getting Magisk on there the way that it should.
Thanks!
Important to Note that the 460 has the exact same EVERYTHING as the 450, including build #s. They just gave it double the internal space is the only difference I've seen.
UPDATE: Just bricked the lil' guy. Since the device is encrypted with every system file having a -sign behind it, I went and frolicked around trying to get Magisk on there via ADB. The only way to do that was to patch the boot-sign .img and since I got the new Magisk, I let it patch, flashed, and now voila, nothing but a bootloop. Off to DM Verity my way out of it lol.
Click to expand...
Click to collapse
If it is close enough to 450, and you can get into fastboot, you can try and boot the linked boot.img
fastboot boot m19_ST16C7BNv205.img
Same modifications I had to use to get the first boot image I found to work with BNTV450.
avb, mtk type and signature removed.
Also patched with Magisk 19 (canary release)
For good measure.
https://drive.google.com/open?id=1LgtB2JKCKwLJ64mUlij5Cb_cJrBi8Av1
PS.
Tested above modified v2.0.5 boot.img on BNTV450 running v1.0.2, so it should work on BN v1.0.2 and up.
Good Luck.
Cheers.
PPS.
Just ordered one. (Should show up in 2-3 days.)
Hey @ipdev make sure you get the insurance for 2 years. Shouldn't be more than 6-8 bucks. You're going to need it.
I went ahead and tried all the versions that you posted on your OP for flashing; only one was successful - the rest softbricked on the flash. When I went back and flashed the 460 stock on it, it was a different stock and never did run back right - kept getting the blinking red border ring and unfortunately lost the serial #, flash, and every possible entry on the "About Nook" tab - essentially glitching it out. Since I''d only had it for 12 hours, I took it back and swapped it out for a fresh one
So the issues I'm seeing so far are:
1. It's encrypted and says as such - this is what is causing the probs later in flashing and you can't deactivate it from what I see so far without a custom recovery.
2. Patching the boo img via MagiskManager will softbrick it, and I tried with both 18 & 19 inase there were issues with one over another.
3. The device will try to auto update ASAP OTA so make sure you don't connect it to the internet before you disable that function.
4. There is no "official firmware" you can download - B&N will only let you direct download the firmware through notifications. Granted, if you want the only one I was able to find I can post it (it says its Oreo 8.1.0 but it looks different than what comes on the device and its running a crappy Android Go)
5. Its easy to unlock the bootloader per your instructions but after you get the Orange State it takes an awful long time for basic boot (which is more of a personal irritant than a problem, lol)
6. If you patch and flash the boot img with Magisk, you will completely lose the screen. Keep in mind though, if you plug it into the computer you will keep hearing the connect/disconnect chimes. It will keep doing that and neither adb or fastboot will function (even though you can fastboot devices command and it will show a Daemon output).
7. Booting into recovery becomes harder and harder from adb and fastboot once you unlock the bootloader - pressing volume rocker and power does not do it at all.
I'll try your new files and see what happens...I think the guy got a hell of a lot of potential and needs a nice streamlined rom or at the very least root to get the bloat off so its faster. But I think it says something on its crippled nature when the guys at B&N say it ain't worth it in the long run - apparently they aren't as great as even the nook HD line.
Articul8Madness said:
Hey @ipdev make sure you get the insurance for 2 years. Shouldn't be more than 6-8 bucks. You're going to need it.
I went ahead and tried all the versions that you posted on your OP for flashing; only one was successful - the rest softbricked on the flash. When I went back and flashed the 460 stock on it, it was a different stock and never did run back right - kept getting the blinking red border ring and unfortunately lost the serial #, flash, and every possible entry on the "About Nook" tab - essentially glitching it out. Since I''d only had it for 12 hours, I took it back and swapped it out for a fresh one
So the issues I'm seeing so far are:
1. It's encrypted and says as such - this is what is causing the probs later in flashing and you can't deactivate it from what I see so far without a custom recovery.
2. Patching the boo img via MagiskManager will softbrick it, and I tried with both 18 & 19 inase there were issues with one over another.
3. The device will try to auto update ASAP OTA so make sure you don't connect it to the internet before you disable that function.
4. There is no "official firmware" you can download - B&N will only let you direct download the firmware through notifications. Granted, if you want the only one I was able to find I can post it (it says its Oreo 8.1.0 but it looks different than what comes on the device and its running a crappy Android Go)
5. Its easy to unlock the bootloader per your instructions but after you get the Orange State it takes an awful long time for basic boot (which is more of a personal irritant than a problem, lol)
6. If you patch and flash the boot img with Magisk, you will completely lose the screen. Keep in mind though, if you plug it into the computer you will keep hearing the connect/disconnect chimes. It will keep doing that and neither adb or fastboot will function (even though you can fastboot devices command and it will show a Daemon output).
7. Booting into recovery becomes harder and harder from adb and fastboot once you unlock the bootloader - pressing volume rocker and power does not do it at all.
I'll try your new files and see what happens...I think the guy got a hell of a lot of potential and needs a nice streamlined rom or at the very least root to get the bloat off so its faster. But I think it says something on its crippled nature when the guys at B&N say it ain't worth it in the long run - apparently they aren't as great as even the nook HD line.
Click to expand...
Click to collapse
If you just need a temporary root, I put up this guide a few minutes ago since there was no definite resource about rooting this device. https://forum.xda-developers.com/nook-7/how-to/how-to-temporary-root-bntv460-t3963304
turtleletortue said:
If you just need a temporary root, I put up this guide a few minutes ago since there was no definite resource about rooting this device. https://forum.xda-developers.com/nook-7/how-to/how-to-temporary-root-bntv460-t3963304
Click to expand...
Click to collapse
I appreciate it, but I've since taken it back. Tell you what though, maybe I'll pick up a used one on ebay and try it

stuck in fastboot mode: error boot prepare

stock rooted pixel4a (from google directly) running root.boot.sunfish-qd4a.200805.003.img iirc.
just hit the upgrade magisk button as i always do (yes, i unhid the app back to normal) but it failed. directly following this, it rebooted and i am now stuck inside fastboot mode without access to ADB. fastboot commands work but ADB do not. is there a way to upload a boot image to get me back to where i was? OR at the least, backup my phone before a full wipe. thanks in advance!
xxTECRAxx said:
stock rooted pixel4a (from google directly) running root.boot.sunfish-qd4a.200805.003.img iirc.
just hit the upgrade magisk button as i always do (yes, i unhid the app back to normal) but it failed. directly following this, it rebooted and i am now stuck inside fastboot mode without access to ADB. fastboot commands work but ADB do not. is there a way to upload a boot image to get me back to where i was? OR at the least, backup my phone before a full wipe. thanks in advance!
Click to expand...
Click to collapse
adb commands don't run on fastboot.
You must flash stock boot.img or magisk patched boot.img using fastboot flash boot "the_boot.img_file_you_want_to_flash"
should i flash this image "root.boot.sunfish-qd4a.200805.003.img"? or do you know where i get a patched magisk boot image? i've looked through magisk github as well as here but i may not be looking for the right stuff. i get the idea of what needs to be done. how i do it exactly is a little stretch, outside the obvious command "fastboot flash boot.img"
little more push in the right direction, please?
EDIT:
reviewing this https://forum.xda-developers.com/t/guide-unlock-root-safetynet-for-pixel-4a.4153773/
and this https://forum.xda-developers.com/t/help-access-internal-storage-from-fastboot.4221223/#post-84332187
the fastboot mode screen displays the following for the bootloader version: s5-0.2-6281315 and i do have a bootloader that matches that. going to give that a whirl
making headway but not booting still
xxTECRAxx said:
making headway but not booting still
Click to expand...
Click to collapse
Judging by the screens you've shared, you've just tried to flash bootloader into boot partition. DON'T DO THAT.
If I were you I would just download the complete fastboot ROM and would run flash-all.bat.
In order to retain your data, before running the bat, open it and remove the "-w" you'll see on the update command line.
This will flash the hole ROM and firmware, thus making your device to achieve boot.
Afterwards you may try to root it again.
THANK YOU!
hey @Typhus_ wanted to say thank you again! i was not only able to get back to norm, i was also able to root back to where i was, with the exception of not passing SafetyNet. been reading about it and what all is available to use with HidePropCconfig module. the pixel4a was passing prior to this riggamaroll but not really concerned about that issue at this time.
i just noticed i am not seeing the full 128gb disk. about 6 months ago i had an issue with root and went full retard, re-formatting the phone and throwing commands at it with ADB. i really couldn't tell you exactly what i did as i don't remember but i can confirm i messed with the partitions and this has obviously effected me adversely.
being that you had efficiently helped me with my bootloader and your experience here at XDA, i thought maybe you had some thoughts on the disk not being 128gb and how i might repair that. i have since backed up and in a position to go full retard
please see attached screenshots of disk analyzer, sdmaid, and a windows shared drive mount
xxTECRAxx said:
hey @Typhus_ wanted to say thank you again! i was not only able to get back to norm, i was also able to root back to where i was, with the exception of not passing SafetyNet. been reading about it and what all is available to use with HidePropCconfig module. the pixel4a was passing prior to this riggamaroll but not really concerned about that issue at this time.
i just noticed i am not seeing the full 128gb disk. about 6 months ago i had an issue with root and went full retard, re-formatting the phone and throwing commands at it with ADB. i really couldn't tell you exactly what i did as i don't remember but i can confirm i messed with the partitions and this has obviously effected me adversely.
being that you had efficiently helped me with my bootloader and your experience here at XDA, i thought maybe you had some thoughts on the disk not being 128gb and how i might repair that. i have since backed up and in a position to go full retard
please see attached screenshots of disk analyzer, sdmaid, and a windows shared drive mount
Click to expand...
Click to collapse
That storage space values are just... weird. Can't quite find another word for it.
If I ran into that kind of problem I would completely clean flash the stock ROM again, this time keeping the "-w" flag. You see, that flag completely cleans the user data partition and creates it again as soon as the flashing procedure ends. Most likely, and by doing so, your storage space values will be correct again. Obviously this will wipe everything so, if you decide to do so, please backup manually all your important stuff.
As for SafetyNet fix, you may use kdrag0n module (he made and shared one universal mod that fixes it) or you may flash my addon features module (link on my signature) that, not only, fixes SafetyNet, but also, adds several cool mods.
Cheers!

[CLOSED] Delete Thread.

Due to the disrespect of certain members I will no longer share the tutorials.
Wait does this mean you finally got my script to work?
lebigmac said:
Wait does this mean you finally got my script to work?
How about a little feedback in my project thread? Is that too much to ask for?
Did the latest fix work for you or not? Hello?
Click to expand...
Click to collapse
I said you were working on it. LOL. If it worked I'd be writing a Guide for that!
Make sure boot.img matched with the phone build number, or the phone may get bootloop.
Moto One Ace is one of the easiest phone to root
mingkee said:
Make sure boot.img matched with the phone build number, or the phone may get bootloop.
Moto One Ace is one of the easiest phone to root
Click to expand...
Click to collapse
Exactly. Definitely made a note of that in the guide since that is why the frozen touchscreen issue happens.
Articul8Madness said:
.This tutorial is for people like me than ran into problems rooting the Moto One 5G Ace XT2113 (MetroPCS Qualcomm Variant) running on stock Android 10. I got this phone literally last week brand new in the box. This is a hand holding guide for the Noobs that really are intimidated by rooting their device.
Follow the following at your own risk! I am not responsible for any mishaps with your devices.
I want to thank @mingkee and @sd_shadow for pointing me in the right direction. And for the rest of the contributors that I took bits and pieces from that helped me figure out rooting this; I did achieve root out the starting gate but initially lost touchscreen functionality. The issue was that you have to use the boot.img of your firmware to patch into Magisk; if you do this with your phone out the box you really don't know which firmware was used and that is where the bungle happens. This will clear up all those potential freakout moments.
Thanks to Android 10 being System As Root with all these new super partitions running amuck, you cannot get Write access in the actual system files. So even when you achieve root, you can't do much. @lebigmac is working on that as we speak. Drop by his thread on R/W access and beta test his script so he can get more knowledge about how our phone works.
Introduction/Preparation
First, go and prepare by READING EVERYTHING. Very important. This is the Qualcomm variant and NOT the Mediatek variant. Flashing does make a difference between the two. Last thing you want to do is brick the device because you flashed the wrong firmware to the wrong processor, or you flashed other software for the other similiar Moto One 5G and it bricked.
Second, unlock the bootloader. All T-Mobile and their subsidiary variants can be unlocked by Motorola as well as International and Motorola factory variants; go to their bootloader official unlock site and follow their instructions, it's easy peasy. If you do it in firefox it may not go to the third step page and hang on the page where you put the long code in (follow instructions on page to get the unlock code you'll see what I'm talking about). It is HIGHLY ADVISABLE to do this in Waterfox or Chrome (I used Waterfox). And yes, you may have to request the code 3x to get it to send to your email depending on their server traffic. When you get it, follow Motorola's instructions for unlocking the bootloader in fastboot. It will show you that the bootloader is unlocked.
Verizon and ATT Variants CANNOT BE BOOTLOADER UNLOADER UNLOCKED.
***NOTES SO YOU DON'T FREAK OUT***
1. I did NOT see the motorola post screen telling me it was unlocked. I had to find this in fastboot's menu.
2. The only way to restore the phone if something goes wrong is by flashing it via fastboot. The way to get to fastboot is turn the phone off and press Volume Down and Power. The Motorola tool will NOT work. That's normal.
3. You will see a cute message that you've unlocked the bootloader and that the phone software integrity is compromised when you boot the phone up every single time after the bootloader unlock. It will also say press the power button to pause. This is normal. Give it a minute, you havent broke it.
4. OEM Unlocking should already be activated and greyed out in the Developer Options once the bootloader is unlocked; you can't access it anymore.
Files
You will need an SD card for root. You will also need other apks to successfully help you pull off root ready to install. Pull ALL the necessary files you will need.
1. Get Minimal ADB and Fastboot (it's easier).
2. Download the Motorola Drivers from their site if yo don't already have them (if you run into problems you will have to uninstall and reinstall them through their utility which is found on PC here: C:\Program Files\Common Files\Motorola Shared\Mobile Drivers
3. Cpu-Z.apk (Very important, its hard to know your hardware without this).
4. Magisk v22.0.apk (They no longer have a separate Magisk Manager)
5. Root Explorer.apk (This software helps navigation better but you can use any Explorer of your choice).
6. Root Checker.apk
7. Stock Firmware XT2113-3_KIEV_RETEU_10_QZK30.Q4-40-62_subsidy-DEFAULT_regulatory-XT2113-3-EU-SAR_CFC.xml (This is important if you mess up the boot image trying to root). You can get the firmware of your choice at Motorola Official Firmware For Kiev.
8. Patience (and a good movie keeping you going).
As of now this device as no TWRP, so you have to do this the old fashioned way to root. And just so you know, I used Windows 7 for all of this.
Pre-Rooting
1. Make sure the phone is fully charged.
2. Make sure your sim card is REMOVED from the phone. Everytime you wipe the phone or do anything messing with the boot image the phone resets itself to factory settings, and tries to push an update. Just take the silver key thing and pop it out. You will have to push it back in and out in a second, but start with it out.
3. Make sure your wifi is OFF.
4. Make sure your SD is in and mountable and all files you need are on the card.
5. Make sure you Save boot.img to your SD Card from your firmware files. This is very important for root.
6. Make sure your developer options are activated.
7. Make sure your USB debugging is enabled AND you've given permissions for your computer to have administrative access with it enabled (more on this below).
8. Make sure to check CPU-Z for your hardware specs so you download the right files for the phone and avoid potential problems.
9. Make sure you manually set USB to Transfer files (no other option will work and by default its set to Charge this Device).
10. Make sure you have the STOCK CABLE that comes with the phone. Like most Motorolas this model is funky about using other cables.
11. Make sure you back up all your calls, texts, pics, etc. Flashing the firmware is the ultimate factory reset and you will lose all your files on the phone. SMS Restore is a good software to backup Calls and Text logs and it supports keeping MMS.
12. Make sure you have the internet. It is necessary for some steps.
Rooting
1. Make sure all the firmware files are extracted into your Minimal ADB and Fastboot folder (or whatever ADB folder you're using for this).
2. Open FlashFile.xml in Notepad. This is located among the firmware files you put in the Minimal ADB and Fastboot folder.
3. Cut, copy, and paste everything from the FlashFile that is shown and then paste it in an online Flash file Converter. I used Online Flash File Converter here.
4. Convert the text by pressing the bar below where you pasted the text. It may be in Spanish or Portuguese but is should say something like Cerar Commandos.
5. Copy the text by hitting the two pieces of paper icon in the corner after it's converted. Or just cut copy and paste manually.
6. Turn the phone completely OFF.
7. Plug your phone via USB cable into the computer.
8. Press Volume Down and Power to boot into fastboot mode. Do not use "adb reboot bootloader" as that command may or may not work and hang at "waiting for device" (it was iffy for me and it knocked off USB permissions BADLY).
9. Open up Minimal ADB and Fastboot (Make sure you don't have it set to open this as an administrator, it messes with permissions) Make sure your firmware files are in the Minimal ADB directory or it won't work.
10. Paste the contents of the flashfile converter into Minimal ADB and Fastboot. This should start the process of the flashing.
11. When the entire flash is complete, boot the phone and disconnect phone from the computer. Ignore the bootloader unlock error.
12. Wait. Sometimes this takes up to 3-5 minutes on a new flash. You should see the boot animation of Motorola.
13. Push your Sim Card back into the phone.
14. Start setting up your device on the screen. Sim Card must be in or it will give you a message your phone is Network Locked.
15. Once you make it to the Wifi Setup screen take the Sim back OUT the phone. Do not connect to Wifi.
16. Once you are done with setup, go to Settings>About phone.
17. Go all the way down to Build Number and press it until you unlock Developer Options.
18. Go to Settings>System>Advanced>Developer Options. Advanced is a pull down tab that will reveal Developer Options.
19. Disable Automatic System Updates. I know this is hard for some people, but a forced OTA update may cause problems and prohibit root.
20. Enable USB Debugging. Disable Verify bytecode of debuggable apps. Disable Verify apps over USB if it is highlighted. Exit.
21. Put your SD/Sim card back into the phone.
22. Go to the Files folder and install Magisk first, then Root Explorer and Root Checker.
23. Open Magisk. You will see Magisk and App. Hit Install by Magisk (a fingerprint looking icon is to its left).
24. Allow Magisk to access photos, media, and files if it asks.
25. Select option "Select and Patch A File."
26. It will take you to a screen where you can select your explorer to navigate to your SD card where you saved the boot.img. Go there and select it.
27. Magisk will save it as magisk_patched.img. Once you get it patched, find where it saved, make sure it's on your SD card and then turn off the phone.
28. Plug your phone via USB cable into the computer.
29. Press Volume Down and Power to boot into fastboot mode.
30. Open up a fresh Minimal ADB and Fastboot (Make sure you don't have it set to open this as an administrator, it messes with permissions) Make sure you transfer the magisk_patched.img that Magisk patched off your SD card into this folder.
31. Rename your original boot.img to "boot.img original" or whatever distinct name you want to give it in your Minimal ADB and Fastboot folder.
32. Rename your magisk_patched.img to boot.img.
33. In Minimal ADB and Fastboot type "fastboot flash boot boot.img" and hit enter.
34. If all goes well it should flash to the partition before it says done and in how many seconds.
35. When it is done, reboot phone by selecting START (keep pressing volume rockers until you see it, then press the power button).
36. Wait for the bootloader cannot be trusted screen to pass (may take a minute) and wait for the Hello Moto opening.
37. Open Root Checker and confirm root. You can uninstall it after confirmation if you like.
38. Open Root Explorer. A prompt asking you to grant permission should pop up.
Congrats. You should be rooted now.
***NOTES SO YOU DON'T FREAK OUT***
1. Do NOT flash someone else's patched boot image. It WILL NOT WORK. Do the work, find your firmware, and patch the boot image yourself. You're asking for bootloop hell if you do as your boot.img that Magisk patches needs to match that particular firmware you used.
2. While it hasn't happened to me, You may have followed everything perfect and it still bootlooped. Save yourself the frustration and just flash it over. See the next section on the proper way to flash so you don't lose your baseband, IMEI, or any other important stuff.
3. While you won't lose anything just flashing boot.img, you will lose everything having to flash ALL the firmware over. Keep backups of all your important stuff.
****Notes on Flashing The Stock Firmware if you have to****
In the event you bootloop and have to start from scratch, follow my guide on restoring the firmware on the phone. And don't worry - it won't relock the bootloader. You can find my guide here: The Complete Noob Guide to Flashing via Fastboot MetroPCS Moto One 5G Ace XT2113 [Qualcomm Version]
Hope this helps my fellow TMobile and subdiary acolytes and othoers. I have flashed and reflashed my phone with different variant roms trying to force Write status and beta testing scripts for @lebigmac on our device so it's pretty straightforward now.
I will try and answer questions if I can or point you in the right direction.
Click to expand...
Click to collapse
Question I keep seeing you have to use adb to fix if messed up, sorry not a question yet but that's wrong. When I did it I think I mixed up my moto g stylus boot.img and got a boot loop. I flashed stock boot.img and it came up with a screen saying Android os was corrupted try to reboot if didn't work factory reset is needed. Rebooted popped up again hit factory reset and the phone did it for me. Not sure if you knew that, question tho lol sorry, can I patch boot img with magisk and flash to a phone that's not fresh from a factory reset
bobbyp1086 said:
Question I keep seeing you have to use adb to fix if messed up, sorry not a question yet but that's wrong. When I did it I think I mixed up my moto g stylus boot.img and got a boot loop. I flashed stock boot.img and it came up with a screen saying Android os was corrupted try to reboot if didn't work factory reset is needed. Rebooted popped up again hit factory reset and the phone did it for me. Not sure if you knew that, question tho lol sorry, can I patch boot img with magisk and flash to a phone that's not fresh from a factory reset
Click to expand...
Click to collapse
Well, when I rooted the 1st time I got a frozen touchscreen as I didn't have the correct Firmware (as the phone's firmware out of the box auto updated and the firmware that was available did not match its peripherals). So my phone lost ALL TOUCH ability. The way I explain in this guide is what worked for me, as the LHSA tool doesn't help at that stage. And honestly, I think adb is better and more familiar to most Moto folks that have had several devices and got root on them.
If you mixed up your Moto G Stylus boot.img, all you have to do is try and reflash your firmware boot.img and flash it (or if you have root your patched boot.img). I've flashed this phone almost 70 times in 9 days and I normally do not reflash my boot.img as its already patched to the firmware and I'm just starting from scratch. However, I wouldn't advise that on recovery.img that went wrong, just saying. The phone will force a factory reset.
I don't recommend a factory reset for flashing if you're trying to get root. It's best to compile all the files in ADB to make sure they're taking together, and not going after the fact. There is no shutting off DM-Verity at this time, especially without TWRP and a patch for it, and this model is a bit funky about added flashing with this new Dynamic Partition crap.
Articul8Madness said:
Well, when I rooted the 1st time I got a frozen touchscreen as I didn't have the correct Firmware (as the phone's firmware out of the box auto updated and the firmware that was available did not match its peripherals). So my phone lost ALL TOUCH ability. The way I explain in this guide is what worked for me, as the LHSA tool doesn't help at that stage. And honestly, I think adb is better and more familiar to most Moto folks that have had several devices and got root on them.
If you mixed up your Moto G Stylus boot.img, all you have to do is try and reflash your firmware boot.img and flash it (or if you have root your patched boot.img). I've flashed this phone almost 70 times in 9 days and I normally do not reflash my boot.img as its already patched to the firmware and I'm just starting from scratch. However, I wouldn't advise that on recovery.img that went wrong, just saying. The phone will force a factory reset.
I don't recommend a factory reset for flashing if you're trying to get root. It's best to compile all the files in ADB to make sure they're taking together, and not going after the fact. There is no shutting off DM-Verity at this time, especially without TWRP and a patch for it, and this model is a bit funky about added flashing with this new Dynamic Partition crap.
Click to expand...
Click to collapse
That's what mine did, I flashed stock boot, is corrupted my phone says and forced reset, I'm newish to moto, Samsung for many years, had to ditch them tho lol.
I appreciate the help and hope I didn't come across as arguing, more like clarifying. I too prefer adb over anything, only get the rom from tool. Again thanks for info.
bobbyp1086 said:
That's what mine did, I flashed stock boot, is corrupted my phone says and forced reset, I'm newish to moto, Samsung for many years, had to ditch them tho lol.
I appreciate the help and hope I didn't come across as arguing, more like clarifying. I too prefer adb over anything, only get the rom from tool. Again thanks for info.
Click to expand...
Click to collapse
If your bootloader is unlocked the only way you should have gotten the corruption is if you flashed an incompatible firmware. Mine came with MetroPCS but I've flashed RETUS and RETEU well. I'd stray from any VZW or ATT software just because you can't trust their firmware won't lock down the bootloader.
Or maybe the software just didn't download well. Try re-downloading it . I've had a bad download mess up a flash before.
I think it's cause 1 magisk wasn't installed and 2i used a different phone to patch
bobbyp1086 said:
I think it's cause 1 magisk wasn't installed and 2i used a different phone to patch
Click to expand...
Click to collapse
You have to install Magisk and patch on the phone in question since it's looking for that firmware and that phone's peripherals. You can't use another phone - that's a no no. This ain't Gingerbread, lol.
Articul8Madness said:
You have to install Magisk and patch on the phone in question since it's looking for that firmware and that phone's peripherals. You can't use another phone - that's a no no. This ain't Gingerbread, lol.
Click to expand...
Click to collapse
I'm fairly new to magisk, just recently in past year or so stopped using supersu. Not by choice lol but upgraded my note 4 lmao. So as far as the script for read and write, never flashed and after I got magisk, no modules only su permissions, fx did mount /
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
and fix file permissions, it's in settings
bobbyp1086 said:
I'm fairly new to magisk, just recently in past year or so stopped using supersu. Not by choice lol but upgraded my note 4 lmao. So as far as the script for read and write, never flashed and after I got magisk, no modules only su permissions, fx did mount /View attachment 5279427View attachment 5279429View attachment 5279431View attachment 5279433 and fix file permissions, it's in settings
Click to expand...
Click to collapse
Having Root on this device is not going to magically fix the fact that Android 10 on ALL DEVICES is READ ONLY. You will have to go to @lebigmac or @munjeni and try their R/W mount scripts to get true root access. Munjeni's V2 worked for me. He's on V7 now. LeBigMac has been hard at work trying to get us up and running with his script, but we have Super partitions AND A/B. So it's taking some time.
Articul8Madness said:
Having Root on this device is not going to magically fix the fact that Android 10 on ALL DEVICES is READ ONLY. You will have to go to @lebigmac or @munjeni and try their R/W mount scripts to get true root access. Munjeni's V2 worked for me. He's on V7 now. LeBigMac has been hard at work trying to get us up and running with his script, but we have Super partitions AND A/B. So it's taking some time.
Click to expand...
Click to collapse
I am not familiar with either but take it that's it's not an easy task. Should I run v2 or v7 then? Moto one g ace metro.
I was fooled by the trickery, I thought something seemed off with the root on modern phone's.
I just bought a new Moto One 5G ace and was wondering where I can find the stock T-Mobile Firmware variants to prevent bricking?
I successfully rooted it with Magisk patched and ready to go. Unfortunately for the time being the phone won't bypass safety net even with MagiskHide. It just won't work but I'm really happy this phone can be unlocked
bobbyp1086 said:
I am not familiar with either but take it that's it's not an easy task. Should I run v2 or v7 then? Moto one g ace metro.
I was fooled by the trickery, I thought something seemed off with the root on modern phone's.
Click to expand...
Click to collapse
Android 10 is very challenging. It is easy to root but it is a trickable root with a false sense of root since Google locked all Android 10 and newer as Read Only on the System with this super partition crap trying to be Apple.
Skel40 said:
I just bought a new Moto One 5G ace and was wondering where I can find the stock T-Mobile Firmware variants to prevent bricking?
Click to expand...
Click to collapse
Check my guide. I posted link to where the repository is.
Skel40 said:
I successfully rooted it with Magisk patched and ready to go. Unfortunately for the time being the phone won't bypass safety net even with MagiskHide. It just won't work but I'm really happy this phone can be unlocked
Click to expand...
Click to collapse
You will not pass safety net because you've rooted it and Android 10 will block it. It isn't necessary, especially if you delete all Google stuff and their tracking Covid crap.
Articul8Madness said:
Having Root on this device is not going to magically fix the fact that Android 10 on ALL DEVICES is READ ONLY. You will have to go to @lebigmac or @munjeni and try their R/W mount scripts to get true root access. Munjeni's V2 worked for me. He's on V7 now. LeBigMac has been hard at work trying to get us up and running with his script, but we have Super partitions AND A/B. So it's taking some time.
Click to expand...
Click to collapse
Hi @Articul8Madness. Thanks for mentioning me
There's a Motorola user who recently got my script to work using the troubleshooting repair script that I posted here
It turns out the lpmake arguments that are auto-generated by the original script were flawless and were not the root cause of the unidentified lpmake error that some Motorola users were experiencing at the end of the original script. According to @Xiaoleng the error was most likely caused by some kind of new Motorola security feature that prevents the terminal command from executing if the arguments are too long. Go figure.
And he was even able to fastboot flash the super_fixed.bin in one piece without having to first split it up into chunks. That's a huge surprise to me. I always thought Motorola users can only fastboot flash super sparsechunks?!
Please feel free to give it a try and report back your results. Thanks. Good luck!

Categories

Resources