Database Info

[Guide] BQ Aquaris M10 (freezerhd) twrp & root

Hi,
as I did not find an English guide for rooting a BQ Aquaris M10 tablet and had some problems when trying to root my tablet, I want to post an guide how to root this tablet.
First of all:
- This guide is just from my experience and is not thoroughly tested. It's on your own if you risk bricking your device.
- If you get stuck in the process, in nearly all cases you can revert to stock with the MTK flash tool (can be found on mibqyyo.com) and the images provided by BQ on their website.
- I could not unlock the bootloader with the 1.X-Images (Lollipop), as the VolumeUp-Button didn't work in fastboot-mode and you need this button to confirm the unlock.
- Booting into recovery from start with VolumeUp and Power-Button. This doesn't work with the 1.X-images, too.
- This guide is not intended for users without experience in unlocking/rooting a device. If you don't know how to use adb, fastboot, recovery and things like that, don't try it!
- You will loose all your data during this process!!
Guide:
Modify boot.img, flash new firmware
SuperSU in systemless mode doesn't work on stock image, as the SuperSU installer can't extract boot.img. You have to repack boot.img.
I tried a SuperSU installer without systemless-mode, but device didn't even boot anymore afterwards.
This guide is derived from a Spanish tutorial on the HTCmania-forum ("Root M10 HD Marshmallow") by yquepongo. Thanks to him!
Get a firmware for your device from the BQ-website (should be Marshmallow, see above) and unzip it to a directory.
Extract the boot-verified.img in the firmware directory with a bootimg-extractor. There are various tools available.
I used bootimg.exe, because this was explained in the mentioned thread and I even used it with wine on Linux and it went well.
Search for cpiolist.txt in your extracted boot-verified.img and delete the first two lines:
mode:mtk
mtk_header_name:ROOTFS
Repack boot-verified.img and put it back in the firmware directory.
Flash the modified firmware with the MTK flash tool according to the tutorial on .mibqyyo.com (Title "Hard Reset for the smartphone range Aquaris and Aquaris E"). In short: Disconnect device, start Tool, load scatter file from firmware directory, choose firmware upgrade, start download, connect the device in power off state, download will start automatically.
This will delete all your data and put the device back to factory rom (hard reset)!!!
If you don't want to flash the complete firmware, you can flash only the boot-verified.img with "Download only" in the flash tool. I didn't try this and don't know if this is working.
Start your device, don't activate any security settings to prevent encryption of data partition.
Unlock bootloader, flash TWRP, install SuperSU
Enable developer settings on device and activate "OEM unlock" in developer settings.
Reboot into fastboot (adb reboot bootloader) and unlock bootloader (fastboot oem-unlock).
This will delete all your data!!! Reboot your system afterwards to make sure everything is still ok.
Do not activate any security settings and make sure your data partition is not encrypted!
The existing TWRP-image can't handle an encrypted data partition, you will end in a boot loop and have to start the whole process again!
Double check, your data partition isn't encrypted. (Settings - Security)
Reboot into fastboot (adb reboot bootloader) and flash the TWRP-image from the TWRP-site (fastboot flash recovery twrpxxx.img)
After reboot TWRP should start.
If you have checked that everything is ok (I would recommend a reboot into normal mode), you can install SuperSU with the standard-installer-zip in TWRP.
If you didn't modify your boot.img, the installer will give a warning that it cannot extract boot.img and you will not find any SuperSU on your system.
If you get stuck in bootloop afterwards you can start anew and try it with another image flashed with MTK flash tool. (Firmware 2.2.0 from December 2016 for freezerhd worked in my case)
Maybe some steps could be shortened, but I haven't tried it.

hi zrfl,
i have a bq aquarius m8 with mm os.
the m8 has the same resolution (1280x800)
can i try the twrp recovery from the m10?
i will also root my m8 but i cant extract the boot-sign.img.
all tools fails.
have you any ideas?
update:
yesterday i opened the bootloader. the volume button works in fastboot-mode.
also i can unlock the boot image with the tools from: https://forum.xda-developers.com/showthread.php?t=2073775
but the unpack fails:
Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers
Supplied image: unlokied-new.img
Setting up work folders . . .
Splitting image to "/split_img/" . . .
Android boot magic not found.
Error!. . .
Click to expand...
Click to collapse
i think this bq boot image use non-standard header. any ideas how to root this bq aquarius m8?
i buyed this tablet only to can use xposed.
i think, any android without root or xposed is useless

i opened a separate theme for this : https://forum.xda-developers.com/android/general/root-help-to-root-twrp-recovery-bq-t3536170

dreas74 said:
hi zrfl,
i have a bq aquarius m8 with mm os.
the m8 has the same resolution (1280x800)
can i try the twrp recovery from the m10?
i will also root my m8 but i cant extract the boot-sign.img.
all tools fails.
have you any ideas?
update:
yesterday i opened the bootloader. the volume button works in fastboot-mode.
also i can unlock the boot image with the tools from: https://forum.xda-developers.com/showthread.php?t=2073775
but the unpack fails:
i think this bq boot image use non-standard header. any ideas how to root this bq aquarius m8?
i buyed this tablet only to can use xposed.
i think, any android without root or xposed is useless
Click to expand...
Click to collapse
Sorry, but I can't help you there, as the M8 seems to be too different to the M10: I didn't have to unlock the boot.img, it was easy to unpack.

hi zrfl,
thanks for your reply. i contacted the developer osmOsis from the android image kitchen.
he will implement the bq specials in his tools.
more in the AIK thread: https://forum.xda-developers.com/showthread.php?t=2073775&page=108

this is the only way to root this device !!
thanks a lot ...

Thanks for this tutorial.
I've followed all the step, I'm able to flash the new recovery from the TWRP website but then I do a
Code:
fastboot reboot-bootloader
but the device reboot normally, just with a warning message during boot saying something like "This device is unlock and can't be trusted, it will boot in 5 seconds".
So I'm unable to access TWRP recovery, I guess when the device reboot it override the recovery partition because if I do a
Code:
adb reboot recovery
I end up in the Android recovery not TWRP.
Any idea ?
Thanks

ZazOufUmI said:
Thanks for this tutorial.
I've followed all the step, I'm able to flash the new recovery from the TWRP website but then I do a
Code:
fastboot reboot-bootloader
but the device reboot normally, just with a warning message during boot saying something like "This device is unlock and can't be trusted, it will boot in 5 seconds".
So I'm unable to access TWRP recovery, I guess when the device reboot it override the recovery partition because if I do a
Code:
adb reboot recovery
I end up in the Android recovery not TWRP.
Any idea ?
Thanks
Click to expand...
Click to collapse
Sorry, I have done this a long time ago and don't know what could be wrong:
You have the correct message, so unlock was successfull
You try to reboot in fastboot, so you flashed TWRP correctly in fastboot-mode
And I don't have the device at hand to try it myself. But I do have a few suggestions, what you could try:
Don't try to shorten procedure with unlock and flashing of TWRP at once. I'm not sure, but I think I had problems when I tried this. So do a normal reboot after unlock, before booting again into fastboot and flashing TWRP. (Now you have done this already )
I don't remember the proper boot command after flashing of TWRP. But
Code:
fastboot reboot-bootloader
doesn't make sense: You are already in bootloader.
Is there a boot-option in the bootloader where you could choose recovery?
Otherwise better power off and use the key-combination for booting into recovery: VolumeUp+Power.
I think, you have to repeat the procedure, as recovery seems to be overwritten: Boot into fastboot, flash TWRP, reboot into recovery. And avoid normal booting before first boot into TWRP!
Did you use the newest TWRP 3.1.0 from March 8th? I haven't tried this yet, so there could be the problem. You could try the previous one: 3.0.2 from last year.

Thanks, I succeed with the combo key (power + vol up) directly after the reboot process

Perfect it's working great now !

I did exactly what you wrote but SuperSU won't install because it cannot extract the ramdisk...

Hi @zrfl
Thanks for your posting!
I did as you suggested and successfully unlocked bootloader and installed TWRP 3.1.1. Your hint to modify the boot-verified was extremely helpful, as I wouldn't be able to unlock the bootloader otherwise.
However, I did not manage to install super su. And boy, I tried many different versions od regular/system/systemless supersu, each flashed according to the respective how-to.
I ended up either in a bootloop, or get stuck on the Android logo at boot.
Flashing goes well until this step:
"Decompressing ramdisk
--- Failure, aborting"
I checked ramdisk compression of boot with Carliv image Kitchen and it tells me that it already is set to "gz" and not another compression TWRP can't handle.
Please help me on how to flash SuperSu.
Thanks and best
Tom

There is something wrong: TWRP does not need a modified boot.img.
Maybe newer ROM-versions are different.

Solution for geting root on BQ M10 FHD on stock rom 2.6.2: Start with a fresh system and install magisk beta (not stable), reboot and root is granted!
tanks a lot to @scafroglia93!

Are there any Custom ROM's
For this Tablet like CM/LineageOS AOSP etc?
Googling reveals nothing and Considering all the kernel mods like hardcore and Ubuntu touch I find it hard to believe that nobody has built one of the later.

I've been searching for custom ROMs too. Apparently, there are none available at present. However, I'd highly appreciate lineage rom.

[Guide]How to Root OnePlus 6 Guide! [Video Tutorial][Windows/Mac/Linux]

For those of you who want to root your OnePlus 6, here is the easiest root method even a 10-year old can follow that works on all Windows, Mac, and Linux. Now, before I begin, you will have to unlock the bootloader. If you have not unlocked your bootloader or don’t know what that is, please follow How to Unlock Bootloader on OnePlus 6 first!
Here's a full step-by-step video tutorial:
First, I want to thank those who made root tutorials but I found an easier way to root that does not involve switching any slots, took me a quite awhile to figure this out but well worth the effort. You only have to flash TWRP image to boot, then with TWRP flash boot.img, TWRP installer, and Magisk with this tutorial. You can do it easily on all Windows, Mac, Linux, or even Chromebook(just install Chrome ADB on Chrome Web store)
Special thanks to magnamentis, his method didn't work for me as I lost my Wifi but after few hours of tinkering, found you can just reflash boot.img then the TWRP installer zip file he provided, and voila! Flawless root everytime, I've tested this about 10 times now, thanks again for the post here:
https://forum.xda-developers.com/showpost.php?p=76687704&postcount=212
Step 1. Once you have unlocked your bootloader, make sure to SIGN IN as if you do not sign into your phone, you will end up in a nasty bootloop.
Step 2. Check your Android version in Settings->About Phone just in case you are reading this in the future when Android 9.0 comes out but this tutorial is future-proof and will work on future Android versions so long as you use the correct boot image file.
Step 3. Power off your phone and hold down Volume Up and Power buttons for about 3 seconds until you enter the Fastboot mode. When doing this, make sure your USB cable is disconnected otherwise you may enter another special mode for unbricking. If you mess up and get into that special mode, simply reboot your device by holding down Volume Down and Power buttons for about 20 seconds.
Step 4. Once in fastboot mode, connect a USB cable from your OnePlus 6 to your computer. You can use Windows, Mac, or Linux. For my video tutorial, I will be using Windows 10 but you can go ahead and use the substitute code for Mac or Linux as most of the steps are nearly identical.
Step 5. You will need to download:
NOTE: All the download links are at the BOTTOM OF THE PAGE, wait 5 secs and click on "CLICK HERE TO DOWNLOAD", don't click on the ads!!!
Download fastboot.zip:
https://download.highonandroid.com/file/Tools/fastboot.zip
Android USB Drivers for Windows:
https://download.highonandroid.com/file/Drivers/UniversalAdbDriverSetup.msi
Download Magisk:
https://download.highonandroid.com/file/Tools/Magisk/Magisk-v16.4.zip
Download TWRP image:
https://download.highonandroid.com/file/TWRP/OnePlus6/twrp-3.2.1-oneplus6.img
Download TWRP installer zip:
https://download.highonandroid.com/file/TWRP/OnePlus6/twrp-installer-oneplus6-3.2.1.zip
Download and boot.img for OnePlus 6T Android 8.1:
https://download.highonandroid.com/file/TWRP/OnePlus6/boot/8.1/boot.img
Step 6. If you have followed my bootloader unlock tutorial and installed drivers for Windows, you can skip that step. If not, you can go head and run the Android USB Driver program and install drivers. For Mac or Linux, no drivers are needed!
Step 7. Unzip fastboot.zip and move over the TWRP image file you downloaded earlier to the fastboot folder.
Step 8. Open a command prompt for Windows by typing “cmd” in the search bar. For Mac or Linux, open a terminal, if you don’t know how, please Google it.
Step 9. Type the following.
For Windows:
cd Downloads
cd fastboot
fastboot flash boot twrp twrp-3.2.1-oneplus6.img
For Mac:
cd Downloads
cd fastboot
chmod 755 *
./fastboot-mac flash boot twrp twrp-3.2.1-oneplus6.img
Note: CHMOD command basically changes file permissions so you can run the files.
For Linux:
cd Downloads
cd fastboot
chmod 755 *
sudo ./fastboot-linux flash boot twrp twrp-3.2.1-oneplus6.img
Note: CHMOD command basically changes file permissions so you can run the files.
This will flash the TWRP image to your boot partition. Normally, we can simply boot TWRP image but since we don’t have official TWRP recovery(as of writing this), you will have to flash TWRP image to the boot partition, which allows us to boot TWRP recovery.
Step 10. Choose “Recovery” using the Volume keys and hit Power button to enter TWRP recovery.
Step 11. Recovery will probably be in Chinese, hit the “Read Only” button, top button on left middle.
Step 12. You can change the language back to English by hitting the second box from bottom right then hit the globe icon on top right.
Step 13. Go back to your computer and copy over the TWRP install zip file, Magisk zip file, and boot.img file.
Step 14. You don’t need the USB cable connected anymore. Go ahead and install the boot.img file using the image option in Install menu. This will flash back your regular boot image to the boot partition.
Step 15. Next, install the TWRP install zip and Magisk zip file. This will give you permanent TWRP recovery and full root.
Step 16. Reboot and you should see everything working including WiFi, 4G LTE, yadayadayada. Open Magisk Manager app and find you have full root with SafetyNet pass also so you can hide root.
Verify you have full root by installing Titanium Backup app(free app) on the Play Store, you should see a Superuser request window.
That’s it! Enjoy folks!

OnePlus 6T? How is this supposed to be easier? You have sixteen steps here. The other method from wuxianlin is very simple I did it in five minutes with no issues at all including WiFi still working. And how can you say you don't have to switch slots. It is required to flag TWRP to both a and b for it to work properly. You don't even mention that in this tutorial.

se7ensde said:
OnePlus 6T? How is this supposed to be easier? You have sixteen steps here. The other method from wuxianlin is very simple I did it in five minutes with no issues at all including WiFi still working. And how can you say you don't have to switch slots. It is required to flag TWRP to both a and b for it to work properly. You don't even mention that in this tutorial.
Click to expand...
Click to collapse
I got lost trying to do that root method, I was following this one here:
https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-unlock-bootloader-flash-twrp-t3792643
But yeah you don't have to switch slots for my root tutorial, which can cause havoc if you flash to the wrong one. If you don't believe me just watch the video. It doesn't hurt to have multiple root methods so long as they work. But my Wifi kept dying everytime I used the slot switch method until I found this way to do it.
I am only trying to make a tutorial that even a kid follow but I've broken down a few steps into maybe 10+ steps, probably helpful for noobs who are trying to root. If you are advanced XDA user, great job though, took me a few hours myself to get a flawless root method. Believe me, I love shortcuts and any method that works the first time out but sucks if people don't explain every little detail as not everyone is an expert. I've been rooting phones for awhile now and it was not easy task with OP6.

Can i use this method over patched boot image? I now rooted from https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-magisk-root-oos-5-1-5-t3794440 this guide…i wonder

galza said:
Can i use this method over patched boot image? I now rooted from https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-magisk-root-oos-5-1-5-t3794440 this guide…i wonder
Click to expand...
Click to collapse
Yes, since this root method flashes a stock boot image after installing TWRP, you can follow it fine. But make a backup of everything just in case.
Basically, this root method, you flash TWRP to boot partition, then flash stock boot image in TWRP, flash TWRP installer for permanent TWRP, then flash Magisk, and reboot. It's actually just 4 steps, I had to make it much longer for noobs because they will mess up.

zedomax said:
Yes, since this root method flashes a stock boot image after installing TWRP, you can follow it fine. But make a backup of everything just in case.
Basically, this root method, you flash TWRP to boot partition, then flash stock boot image in TWRP, flash TWRP installer for permanent TWRP, then flash Magisk, and reboot. It's actually just 4 steps, I had to make it much longer for noobs because they will mess up.
Click to expand...
Click to collapse
I didn't have to switch slots to root at all and I used the very first method to gain root that was posted here on op6 forums.
https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-magisk-root-oos-5-1-5-t3794440

se7ensde said:
I didn't have to switch slots to root at all and I used the very first method to gain root that was posted here on op6 forums.
https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-magisk-root-oos-5-1-5-t3794440
Click to expand...
Click to collapse
Yes, that root method is great but it does not give you TWRP recovery, meaning you can't install custom ROMs with it. But if you need TWRP recovery, you will need to install TWRP recovery thru one of the tutorials here.

zedomax said:
Yes, that root method is great but it does not give you TWRP recovery, meaning you can't install custom ROMs with it. But if you need TWRP recovery, you will need to install TWRP recovery thru one of the tutorials here.
Click to expand...
Click to collapse
The current method of installing TWRP is not noob friendly. Nor is yours in fact after reading yours or seems not complicated than it needs to be. You also need to give credit to the creators of our TWRP and there guides.

galza said:
Can i use this method over patched boot image? I now rooted from https://forum.xda-developers.com/oneplus-6/how-to/oneplus-6-magisk-root-oos-5-1-5-t3794440 this guide…i wonder
Click to expand...
Click to collapse
Did it work for you?

Thanks @zedomax!! Never hurts to have different methods, opinions, or guides! Jeep rockin! #neversettle

@zedomax Thank you for these amazing tutorials. I watched both your videos. In that you mentioned that OnePlus ota updates are twrp compatible but then if I root will I have to unroot the phone or flash the stock rom first then install that ota update and then root again or there's some other method to install OTA on a rooted device?

Aashay said:
@zedomax Thank you for these amazing tutorials. I watched both your videos. In that you mentioned that OnePlus ota updates are twrp compatible but then if I root will I have to unroot the phone or flash the stock rom first then install that ota update and then root again or there's some other method to install OTA on a rooted device?
Click to expand...
Click to collapse
You can accept OTA, but you will have to reflash Magisk.img. Most OTAs do not overwrite boot.img I think unless they are major updates(like to Android P 9.0 when available). So, just flash OTA and if you lose root, reboot into TWRP and flash Magisk.

HI, thanks for the guide but my phone just blocked at recovery launch. Ho can i do?

Same
Edit: It's ok, probably a bug

Thank you zedomax for taking the time to create this guide. I'm gonna try it!
I assume this will work for both A6000 and A6003 right?

Hi Admin,
I lost my Wifi as soon as i rooted my device, please help?

Prabhjeet Bagga said:
Hi Admin,
I lost my Wifi as soon as i rooted my device, please help?
Click to expand...
Click to collapse
Me too. How can this be fixed?

I think I bricked my phone.
This is what I did:
- Bought OnePlus 6 (I think it was A6000)
- Installed OTA, so I was on Android 8.1.0 and OOS 5.1.8
- Followed this tutorial, which broke wifi
- I followed mixtapes02's advice on the video and reflashed OOS 5.1.8
- Now I cannot boot into Android anymore, I can only get to TWRP
EDIT: I managed to install OOS 5.1.5 successfully

aximili said:
I think I bricked my phone.
This is what I did:
- Bought OnePlus 6 (I think it was A6000)
- Installed OTA, so I was on Android 8.1.0 and OOS 5.1.8
- Followed this tutorial, which broke wifi
- I followed mixtapes02's advice on the video and reflashed OOS 5.1.8
- Now I cannot boot into Android anymore, I can only get to TWRP
EDIT: I managed to install OOS 5.1.5 successfully
Click to expand...
Click to collapse
I had the same issues and went through the same process. Took a whole day to get it back to stock.

I am sorry to ask such a noob question, but i am very confused by the command you say to use in Step 9:
>fastboot flash boot twrp twrp-3.2.1-oneplus6.img
what is the meaning of the first "twrp" in that command?
shouldn't it be simply:
fastboot flash boot twrp-3.2.1-oneplus6.img
Thank you in advance for the explanation

Moto G7 root and TWRP

This thread contains known working root and custom recovery, along with any other verified working mods for this device
Thanks to anyone who is willing to help out in advance. You are awesome
Code:
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards, fires, rigged elections,
* thermonuclear war, or you getting fired because the alarms failed and you
* could not call in.
*
* Please ensure you have an advanced understanding of this device before
* flashing it! YOU are choosing to make these modifications of your own free will
THIS REQUIRES AN UNLOCKED BOOTLOADER!!! DO NOT ATTEMPT ON A LOCKED BOOTLOADER. YOU ALSO NEED APPROPRIATE DRIVERS AND ADB TOOLS. THIS GUIDE IS ONLY FOR THE MOTO G7 SERIES, DO NOT ATTEMPT ON ANY OTHER DEVICE
Also check under developer options USB debugging and OEM unlock is checked. Tap build number 7x under settings -> about phone to enable developer options. Please note that some carrier locked variants do not permit OEM unlocking and as such currently have no method to unlock the bootloader
Follow the instructions here to unlock your bootloader
Confirmed Magisk working with boot image, patched through Magisk app.
TWRP needs some work but basic functionality is up
Magisk
Download the appropriate firmware from here, making sure to match build number and variant, found under Settings -> System -> About Phone. Even if you use boot images given to you, I recommend you do this just in case something messed up
Extract the boot.img file
Copy it to the internal storage of your device
Install magisk manager app, found here and open it.
Make sure under advance setting both keep dm-verity and keep force encryption are checked, otherwise you may get stuck in a bootloop
Tap install beside "Magisk is not installed" on the first card
Tap patch boot image
Select your boot image
Once magisk creates the image, copy it to the folder that contains the adb tools
The output can be flashed via fastboot on an unlocked bootloader via
Code:
adb reboot bootloader
fastboot flash boot boot.img
After initial setup/first boot, reboot your device again. Magisk Manager stub should now show up under apps. If you have previously installed it, you'll still need to reboot after the initial boot with magisk for the app to recognize you have it
The stub will download the actual app (if necessary). Once that's installed, open it and tap yes when it asks you to set up environment. If that failed, just close the app and reopen, tapping yes on the prompt. Do that until it says setup done
We now have twrp so theoretically the magisk zip can be flashed. I personally have experienced a lot of problems with this method so I'd recommend against it, but if you want to here's how:
See below instructions to flash twrp if you haven't already
Download the latest magisk zip here and save it to your SD card if you have one
Reboot to TWRP via volume down + power, which will get you to bootloader. In bootloader, use the volume keys to scroll to recovery mode, then press power to select. I personally prefer adb via
Code:
adb reboot recovery
Type in you screen lock if prompted, then hit the check mark on keyboard when done
Tap install
Navigate to where you saved the zip and select it
Swipe to install
Follow the last two steps of the other method
TWRP
A beta version of TWRP is now available here. Credit to @Alberto97
Download the file and copy to your adb tools folder
Reboot to bootloader
Code:
adb reboot bootloader
Boot it with
Code:
fastboot boot twrp-version-build-river.img
Put the TWRP image in your external SD Card or, in case you don't have one, push it to /data with adb this way:
Code:
adb push twrp-version-build-river.img
Tap Advanced -> Install Recovery Ramdisk -> Navigate to /data or /external_sd and select TWRP -> Swipe to Install
Select Fix Recovery Bootloop from Advanced tab, and swipe to fix
In case of emergency (eg, soft brick), follow these instructions to get back to stock before reattempting. They may say for updating, but they work to get back to stock

I Have two G7 rooted with Magisk indeed

if you look at the full firmware there seems to be no stock recovery included in it. we definitely need twrp to even flash a custom gsi rom. id help but i have no time or idea how to build twrp.

mingkee said:
I Have two G7 rooted with Magisk indeed
Click to expand...
Click to collapse
Can you please provide evidence? A screenshot of the main page of Magisk app and a screenshot of root checker will do

fix-this! said:
if you look at the full firmware there seems to be no stock recovery included in it. we definitely need twrp to even flash a custom gsi rom. id help but i have no time or idea how to build twrp.
Click to expand...
Click to collapse
I know how, but I'd need the stock recovery

clcombs262 said:
Can you please provide evidence? A screenshot of the main page of Magisk app and a screenshot of root checker will do
Click to expand...
Click to collapse
OK
You asked for it

clcombs262 said:
I know how, but I'd need the stock recovery
Click to expand...
Click to collapse
There's a possibility recovery is merged into boot.img
I found patched boot is significantly smaller than original
I will look more into original boot.img to find required parameters for boardconfig.mk, but probably you can only boot with TWRP not flashing it.

mingkee said:
OK
You asked for it
Click to expand...
Click to collapse
Can you share step by step how you did it?
Like patch boot img with magisk, flash magisk zip, use TWRP, etc?

mingkee said:
There's a possibility recovery is merged into boot.img
I found patched boot is significantly smaller than original
I will look more into original boot.img to find required parameters for boardconfig.mk, but probably you can only boot with TWRP not flashing it.
Click to expand...
Click to collapse
Thanks for the effort!

clcombs262 said:
Can you share step by step how you did it?
Like patch boot img with magisk, flash magisk zip, use TWRP, etc?
Click to expand...
Click to collapse
He described it in
https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084/page4
I'm trying to gather enough courage to root my G7. Scary. But I need it for things like titanium backup, AfWall, etc.
Besides I believe twrp is not yet available. Need it for the nandroid backup to restore if things go bad.

maybeme2 said:
He described it in
https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084/page4
I'm trying to gather enough courage to root my G7. Scary. But I need it for things like titanium backup, AfWall, etc.
Besides I believe twrp is not yet available. Need it for the nandroid backup to restore if things go bad.
Click to expand...
Click to collapse
That's a generic set of instructions, with no links or evidence provided that it works
I could literally use those instructions to root any device with magisk. (Excluding device that can't unlock bootloader and such)
I'm looking for confirmation, instructions tailored to our device, links to appropriate files, what's working on what model/firmware/variant, etc
Also we should figure out TWRP. Very handy in rooting and unrooting

clcombs262 said:
That's a generic set of instructions, with no links or evidence provided that it works
I could literally use those instructions to root any device with magisk. (Excluding device that can't unlock bootloader and such)
I'm looking for confirmation, instructions tailored to our device, links to appropriate files, what's working on what model/firmware/variant, etc
Also we should figure out TWRP. Very handy in rooting and unrooting
Click to expand...
Click to collapse
I have my Moto G7 xt1962-1 US Retail rooted with magisk. It works. You can use my patched boot image if your're running the same on ppo29.114-16-5 and don't want to do it yourself. Flash with:
Code:
fastboot flash boot patched_boot.img

mingkee said:
There's a possibility recovery is merged into boot.img
I found patched boot is significantly smaller than original
I will look more into original boot.img to find required parameters for boardconfig.mk, but probably you can only boot with TWRP not flashing it.
Click to expand...
Click to collapse
Of course its merged. I did not realize this, but it is a arm64 A/B partition device. that means that recovery is merged into boot

clcombs262 said:
That's a generic set of instructions, with no links or evidence provided that it works
I could literally use those instructions to root any device with magisk. (Excluding device that can't unlock bootloader and such)
I'm looking for confirmation, instructions tailored to our device, links to appropriate files, what's working on what model/firmware/variant, etc
Also we should figure out TWRP. Very handy in rooting and unrooting
Click to expand...
Click to collapse
I can work on providing the steps I take with river_amz later today and document each step. Will edit this reply when I do so.

Ni
clcombs262 said:
That's a generic set of instructions, with no links or evidence provided that it works
I could literally use those instructions to root any device with magisk. (Excluding device that can't unlock bootloader and such)
I'm looking for confirmation, instructions tailored to our device, links to appropriate files, what's working on what model/firmware/variant, etc
Also we should figure out TWRP. Very handy in rooting and unrooting
Click to expand...
Click to collapse
cclombs, you are correct. ANY device that can be bootloader unlocked can be rooted with Magisk in this way. Magisk works by inserting itself into the boot image so you just need access to the boot image. However, this method requires you to have access to the Stock ROM. Luckily, Moto seems to be very good about supplying this.
EDIT: Section removed. Access to read boot.img requires root. I was wrong!
And yes, I have successfully achieved root using the above methods. I used it on my Moto G7 Power, and on my Nexus E4 plus before TWRP was available.

zerogun said:
cclombs, you are correct. ANY device that can be bootloader unlocked can be rooted with Magisk in this way. Magisk works by inserting itself into the bootloader so you just need access to the bootloader image. However, this method requires you to have access to the Stock ROM. Luckily, Moto seems to be very good about supplying this.
Theoretically, even if you did not have access to the stock ROM, you can enable ADB debug in Developer Options, go into an ADB shell, and then do this:
dd if=/dev/block/[boot location] of=/data/downloads/boot.img
This would do a full image backup of your boot.img and put into your downloads folder. And yes, I have successfully achieved root using the above methods. I used it on my Moto G7 Power, and on my Nexus E4 plus before TWRP was available.
Click to expand...
Click to collapse
I thought dd required root?
And I think you mean boot image, not bootloader. Bootloader is very different, and should NEVER be modified

You are correct. I meant to say boot image. I'll edit to not confuse people.
I'll have to check later on if dd requires root. I thought it only needed adb debig access.

Thank you zerogun. I'm trying to learn.
zerogun said:
However, this method requires you to have access to the Stock ROM. Luckily, Moto seems to be very good about supplying this.
Click to expand...
Click to collapse
Where do they supply these stock ROMs?
zerogun said:
Theoretically, even if you did not have access to the stock ROM, you can enable ADB debug in Developer Options, go into an ADB shell, and then do this:
dd if=/dev/block/[boot location] of=/data/downloads/boot.img
This would do a full image backup of your boot.img and put into your downloads folder. And yes, I have successfully achieved root using the above methods. I used it on my Moto G7 Power, and on my Nexus E4 plus before TWRP was available.
Click to expand...
Click to collapse
When you 'go into an adb shell' do you mean use adb from a connected PC or is there an adb shell app on the phone itself?

Anybody interested in partially working TWRP? My plan was to release it once fully working but I'm stuck on decryption since days (I can't understand what keymaster 4 is still missing since it wants to upgrade the key) and I might change idea.
With broken decryption you can't use your internal storage but you will be still able to flash things from sdcard or usb otg.

Alberto97 said:
Anybody interested in partially working TWRP? My plan was to release it once fully working but I'm stuck on decryption since days (I can't understand what keymaster 4 is still missing since it wants to upgrade the key) and I might change idea.
With broken decryption you can't use your internal storage but you will be still able to flash things from sdcard or usb otg.
Click to expand...
Click to collapse
You can wipe with TWRP to remove encryption once, but you have to reboot in TWRP

[UNOFFICIAL][DECRYPTION WORKS] TWRP 3.3.1 for UMIDIGI F1 [20191103]

Introduction
This is an UNOFFICIAL TWRP port for UMIDIGI F1 that works properly with encrypted /data partition in official ROM. I am aware that the UMIDIGI F1 already has TWRP built for it, but none of them seem to have decryption working properly. In fact, every single TWRP, even official ones, for any MT6771 device, seem to have non-functional decryption support. Through some digging I managed to fix decryption at least for UMIDIGI F1, so here is my version of TWRP for the device.
Known Bugs
- Screen may flash on the password-input UI. Anything else is fine though.
This TWRP has been tested with official ROM and my LineageOS 17 port (https://forum.xda-developers.com/android/development/unofficial-lineageos-17-0-umidigi-f1-t3997827) and it works fine.
This is UNTESTED on the F1 Play. ONLY TESTED on regular F1.
Why Bother
Because security matters. Using a cheap device should not mean giving up security, and more importantly, privacy.
Instructions
1. Unlock bootloader
2. Enable ADB debugging in system
3. Execute "adb reboot bootloader" while having your phone connected to PC
4. Execute "fastboot flash recovery <your_downloaded_recovery>.img"
5. Reboot phone while holding Volume Up + Power buttons
Note: The official ROM may overwrite the recovery, so you may need to re-flash the recovery if this behavior isn't prevented either by TWRP or manually.
Downlaods & Sources
20191103: https://github.com/PeterCxy/android_device_umidigi_F1/releases/tag/20191103-twrp
- Fixed issues with Magisk and OpenGAPPS
20191102: https://github.com/PeterCxy/android_device_umidigi_F1/releases/tag/20191102-twrp
Device Tree: https://github.com/PeterCxy/android_device_umidigi_F1/tree/twrp-9.0
Modified TWRP (Required for decryption to work): https://github.com/PeterCxy/android_bootable_recovery

Updated to 20191103

I appreciate your sharing this. I have added "system_image emmc" to the fstab file, so I can flash and backup the system.img
This works good on my F1,
But I tried to make this decrypt work for my other phone with 6771(Bold N1), but couldn't find all same files added to recovery/root from stock firmware.

mrmazak said:
I appreciate your sharing this. I have added "system_image emmc" to the fstab file, so I can flash and backup the system.img
This works good on my F1,
But I tried to make this decrypt work for my other phone with 6771(Bold N1), but couldn't find all same files added to recovery/root from stock firmware.
Click to expand...
Click to collapse
Those files are extracted from vendor.img, but it can be different on different devices, e.g. keymaster version might be different. Also you will need to patch them using `patchelf` to make them use `/sbin/linker64` instead of `/system/bin/linker64`

hello
im willing to port your amazing twrp to our phone UMIDIGI F1 Play and i need permission to do it ???
thanks

Shadow Of Leaf said:
hello
im willing to port your amazing twrp to our phone UMIDIGI F1 Play and i need permission to do it ???
thanks
Click to expand...
Click to collapse
on other releases, no change was needed to boot on both. I would try as is first.
as long as you have working sp flash tool in case of issue.

mrmazak said:
on other releases, no change was needed to boot on both. I would try as is first.
as long as you have working sp flash tool in case of issue.
Click to expand...
Click to collapse
Cause i test it without changes , it reboot to system
I think because they have different kernels

I am unable to install twrp.
When I run the "fasthboot flash recovery" command, cmd aparace "waiting for de ice" and nothing happens on my phone ...
Am I doing something wrong?

no fastboot response
for some reason (most likely pilot error, lol) the phone doesn't show when I do "fastboot devices" - even though the F1's screen shows "fastboot mode" in very tiny letters on the bottom-left.
probably something stupid I'm doing wrong, will keep trying...

tarvoke said:
for some reason (most likely pilot error, lol) the phone doesn't show when I do "fastboot devices" - even though the F1's screen shows "fastboot mode" in very tiny letters on the bottom-left.
probably something stupid I'm doing wrong, will keep trying...
Click to expand...
Click to collapse
You can operate from adb/fastboot folder and device can stay on fastboot mode but if drivers were not properly installed then no connection with pc.
Try installing:
- https://androidmtk.com/download-15-seconds-adb-installer
- https://androidmtk.com/download-mtk-usb-all-drivers
- https://www.androidweblog.com/download-mediatek-usb-vcom-drivers/
Start the process from device on using adb commands to always allow access to the pc. I mean:
Code:
adb devices
and then if device is detected you will see a screen warning to "always allow...." then tap on yes; this suppress future conflicts, then
Code:
adb reboot bootloader
while on fastboot follow with
Code:
fastboot devices

SubwayChamp said:
You can operate from adb/fastboot folder and device can stay on fastboot mode but if drivers were not properly installed then no connection with pc.
Click to expand...
Click to collapse
thanks!
adb was already working (is how I made the thing reboot to bootloader, and yes I did tell it to permanently accept the computer I'm using.
this is on linux, so the drivers shouldn't be a problem... although SMH I never put USB IDs into the udev rules. which is interesting, because regular adb already worked fine without it - I have had phones in the past that some did, some did not, require the computer to know about vendor/hardware ID.
(and I know that the adb USB IDs are usually different than the ID for fastboot, as well.)
like I said, pilot error lol. but thank you again for the reply!

I have done the following:
Enabled Developer Options
Enabled USB Debugging
Enabled OEM Unlocking
Unlocked the bootloader with:
Code:
adb reboot bootloader
fastboot flashing unlock
Rebooted and Enabled USB Debugging again.
Then after downloading your recovery
Code:
adb reboot bootloader
fastboot boot ~/Downloads/recovery.img
But nothing happened.
I rebooted and thought I would try flashing
Code:
adb reboot bootloader
fastboot flash recovery ~/Downloads/recovery.img
It just paused on the boot screen saying "Your device has been unlocked and can't be trusted".
If I reboot then try to go direct to recovery:
Code:
adb reboot recovery
I end up with the broken android screen and "No command"
What am I missing?

opticyclic said:
I have done the following:
Enabled Developer Options
Enabled USB Debugging
Enabled OEM Unlocking
Unlocked the bootloader with:
Code:
adb reboot bootloader
fastboot flashing unlock
Rebooted and Enabled USB Debugging again.
Then after downloading your recovery
Code:
adb reboot bootloader
fastboot boot ~/Downloads/recovery.img
But nothing happened.
I rebooted and thought I would try flashing
Code:
adb reboot bootloader
fastboot flash recovery ~/Downloads/recovery.img
It just paused on the boot screen saying "Your device has been unlocked and can't be trusted".
If I reboot then try to go direct to recovery:
Code:
adb reboot recovery
I end up with the broken android screen and "No command"
What am I missing?
Click to expand...
Click to collapse
While in fastboot the first you should do is see if device is detected by pc with
Code:
fastboot devices
It looks like something is wrong with your path, I ever avoid path copying or moving the file/image to the adb/fastboot directory but anyway if you don´t want to do it you can copy the path from the bar where your recovery file is allocated, for example, if the file is in Downloads directory like it seems actually is, no matter what unit/drive you are in you can set an absolute value to avoid errors, look at this example: C:\Users\your_user\Downloads
If your device is detected then you can flash the recovery as you were trying to do it with
Code:
fastboot flash recovery recovery.img
and then you can reboot directly to it without need to reboot to system previously and this will prevent TWRP from being overwritten, with
Code:
fastboot boot recovery.img

hmm, so when I checked the udev rules, it already had one for MTK/mediatek - and the USB vendor is '08ed' in fastboot as well as in regular adb, so it wasn't a problem with udev/plugdev.
which I guess may mean the lunix generic android drivers for fastboot might be... "lacking" - I'll have to scrounge up a win7 laptop and try the recommended windows drivers.

SubwayChamp said:
...
It looks like something is wrong with your path, I ever avoid path copying or moving the file/image to the adb/fastboot directory but anyway if you don´t want to do it you can copy the path from the bar where your recovery file is allocated, for example, if the file is in Downloads directory like it seems actually is, no matter what unit/drive you are in you can set an absolute value to avoid errors, look at this example: C:\Users\your_user\Downloads
...
Click to expand...
Click to collapse
I don't think it was anything to do with the path as it output the file transfer size.
I think it was a combination of the following:
I wasn't pressing the right combinations of buttons after flashing.
i.e. holding VOL UP and pressing POWER on the screen saying "Your device has been unlocked and can't be trusted".
Rebooting might (?) have been reverting the recovery.
I was originally trying this on the firmware that was shipped 2019012414 but after flashing 2019090418 with SPFlashTool I had more success.
I also able to reboot to recovery directly after flashing with fastboot with the following:
Code:
fastboot oem reboot-recovery
Whichever was the key I can now reboot to recovery from adb too.
:good:

Your twrp eliminates fingerprint authentication.
I discovered something interesting, your twrp only works on my device, no other twrp works, but when I install it, I lose my fingerprint, it doesn't work at all.
Simply put, I must choose between the fingerprint or the root.

LyrielAlk said:
No other twrp works, but when I install it, I lose my fingerprint, it doesn't work at all.
Simply put, I must choose between the fingerprint or the root.
Click to expand...
Click to collapse
Try to clean flash last vendor build with spflash tool. First boot need stock recovery.
You don't need custom recovery to achieve root.
Maybe give a try to SNwriter (I never needed it though and can't help here).

Both of those twrp are not sticking. I have flashed with spoken flash tool v5 1944 win and I fastboot cmd with the same results.

Thanks
Gracias for this master ?

good
Shadow Of Leaf said:
hello
im willing to port your amazing twrp to our phone UMIDIGI F1 Play and i need permission to do it ???
thanks
Click to expand...
Click to collapse
good idea

Help with Installing TWRP for Moto E6

Greetings All,
I recently purchased a Motorola E6 (Model XT2005-5).
Expecting to be able to install the TWRP recovery, I unlocked the bootloader.
Based on the TWRP site, there appears to be a recovery image for just about every phone on the planet, EXCEPT the E6 :-(
After scouring the net, I found about 4 or 5 possible recovery images, as well as a LOT of dead links.
None of these images appear to work.
They either just boot the phone to the existing system, or bring up a message about 'corrupt data'.
As per recommendations ,these images were booted using the Linux command:
'fastboot boot '
rather than flashed.
I HAVE managed to flash a stock ROM image. Although it boots OK, I get a 'bad key' message when it starts.
Donno if this is significant or not.
There also seems to be some data that was NOT cleared by the stock rom installation commands.
The phone was packaged for US Cellular, and I still get the US Cellular splash screen when the phone starts.
The source for updates also seems to be from US Cellular...
There is no problem using the SIM from my phone provider.
Does anyone have a valid link to a functional TWRP for this phone?
Are there additional commands needed (other than 'boot') to possibly get the images that I have found to work?
Is there some additional ROM that needs to be erased to clear out the US Cellular data/logo?
Any other advice or suggestions are GREATLY appreciated.
Thanx.
Richard Rosa

richardrosa said:
Greetings All,
I recently purchased a Motorola E6 (Model XT2005-5).
Expecting to be able to install the TWRP recovery, I unlocked the bootloader.
Based on the TWRP site, there appears to be a recovery image for just about every phone on the planet, EXCEPT the E6 :-(
After scouring the net, I found about 4 or 5 possible recovery images, as well as a LOT of dead links.
None of these images appear to work.
They either just boot the phone to the existing system, or bring up a message about 'corrupt data'.
As per recommendations ,these images were booted using the Linux command:
'fastboot boot '
rather than flashed.
I HAVE managed to flash a stock ROM image. Although it boots OK, I get a 'bad key' message when it starts.
Donno if this is significant or not.
There also seems to be some data that was NOT cleared by the stock rom installation commands.
The phone was packaged for US Cellular, and I still get the US Cellular splash screen when the phone starts.
The source for updates also seems to be from US Cellular...
There is no problem using the SIM from my phone provider.
Does anyone have a valid link to a functional TWRP for this phone?
Are there additional commands needed (other than 'boot') to possibly get the images that I have found to work?
Is there some additional ROM that needs to be erased to clear out the US Cellular data/logo?
Any other advice or suggestions are GREATLY appreciated.
Thanx.
Richard Rosa
Click to expand...
Click to collapse
There doesn't seem to be a working custom recovery for this device.
Moto devices are often referred to by development name or codename.
Your device should be SURFNA, look for that name on the bootloader screen
or
Code:
fastboot getvar product
I suggest following this thread for twrp
[ABANDONED] TWRP Dirty Port for Moto E6
https://www.getdroidtips.com/twrp-recovery-motorola-moto-e6/ None of my recoveries have worked for the E6, but I'm being linked as a developer for a working TWRP recovery. if you came from this link, DO NOT use my builds. I've deleted the...
forum.xda-developers.com
The bad key warning is pretty common with Moto devices after the bootloader is unlocked.
I have a general moto stock firmware thread here
[Guide] Using Fastboot.exe with Motorola devices
Guide: Using Fastboot.exe with Motorola Devices If your device has its own section please post in that section. You can ping me with @sd_shadow MediaTek or Qualcomm Chip? Do I have a MediaTek Device? see post #26 Info: If you have a MediaTek...
forum.xda-developers.com

sd_shadow said:
There doesn't seem to be a working custom recovery for this device.
Moto devices are often referred to by development name or codename.
Your device should be SURFNA, look for that name on the bootloader screen
or
Code:
fastboot getvar product
I suggest following this thread for twrp
[ABANDONED] TWRP Dirty Port for Moto E6
https://www.getdroidtips.com/twrp-recovery-motorola-moto-e6/ None of my recoveries have worked for the E6, but I'm being linked as a developer for a working TWRP recovery. if you came from this link, DO NOT use my builds. I've deleted the...
forum.xda-developers.com
The bad key warning is pretty common with Moto devices after the bootloader is unlocked.
I have a general moto stock firmware thread here
[Guide] Using Fastboot.exe with Motorola devices
Guide: Using Fastboot.exe with Motorola Devices If your device has its own section please post in that section. You can ping me with @sd_shadow MediaTek or Qualcomm Chip? Do I have a MediaTek Device? see post #26 Info: If you have a MediaTek...
forum.xda-developers.com
Click to expand...
Click to collapse
I was afraid that was the answer.
Of all the cellphones in all the world, I had to buy this one :-(
I HAVE managed to get root access by flashing a Magisk modified recovery. However, this method is good for one boot per flash. It appears that once the boot completes, the modified recovery is gone from memory.
I DO get an error on flash about the image not signed or corrupt, and a similar message on the phone when booting, but once powered this way, I can 'su' in a shell.
How many times can the ROM be flashed before it starts to wear out?
And I STILL cannot find where USC hides it's bootanimation file. I removed the one in /system/media and a couple in /vendor, and that #$%^* 'Hello Moto' greeting and the USC logo screen still appear...
Thanx again for your help
Richard Rosa

richardrosa said:
I was afraid that was the answer.
Of all the cellphones in all the world, I had to buy this one :-(
I HAVE managed to get root access by flashing a Magisk modified recovery. However, this method is good for one boot per flash. It appears that once the boot completes, the modified recovery is gone from memory.
I DO get an error on flash about the image not signed or corrupt, and a similar message on the phone when booting, but once powered this way, I can 'su' in a shell.
How many times can the ROM be flashed before it starts to wear out?
And I STILL cannot find where USC hides it's bootanimation file. I removed the one in /system/media and a couple in /vendor, and that #$%^* 'Hello Moto' greeting and the USC logo screen still appear...
Thanx again for your help
Richard Rosa
Click to expand...
Click to collapse
Try patching both the recovery.img and the boot.img
[Guide] Root Motorola with Magisk (UnLocked Bootloader)(Non-TWRP method)
Root Motorola Devices with Magisk Note: This method has been working with most Moto Devices that the Bootloader can be UnLocked. If the Bootloader cannot be Unlocked this method will not work. Please only use this as a reference. If you require...
forum.xda-developers.com

sd_shadow said:
Try patching both the recovery.img and the boot.img
[Guide] Root Motorola with Magisk (UnLocked Bootloader)(Non-TWRP method)
Root Motorola Devices with Magisk Note: This method has been working with most Moto Devices that the Bootloader can be UnLocked. If the Bootloader cannot be Unlocked this method will not work. Please only use this as a reference. If you require...
forum.xda-developers.com
Click to expand...
Click to collapse
Thank you! That was the magic. It even got rid of the 'bad key' message on a normal boot!
Now if I can only find where that bootanimation file is hidden....
Thanx again.
Richard Rosa