Database Info

How do I safely root and unlock bootloader on Marshmallow?

My device is European L04, currently running North Africa release (the earliest Marshmallow build uploaded) - L04_2016_0316_0900 (B820)
I'd like to unlock the bootloader and root my Honor 6. I've never done it (on this particular device), because I've read enough here to know it's slightly more risky than on other devices, especially when you plan to update the stock rom soon, so I preferred to wait until I have the last important update the device is likely to receive - Android 6.0.
What I want to know (some of the answers are in the topics which I listed below):
MultiTool - I've seen reports of bricks when using MultiTool with EMUI4/Marshmallow - why does it happen? My understanding is that MultiTool is a bundle of adb/fastboot and some recovery images for older Android versions, so my theory is that instead of using MultiTool, I should simply get the proper recovery for Marshmallow and flash it manually with fastboot, right?
unlocking bootloader, rooting, flashing recovery - I think I understand the process; in a nutshell: 'fastboot oem unlock X', 'fastboot flash recovery imagename.img', then flash the proper SU.zip in recovery. Where do I find the code, the Marshmallow recovery image, the SU.zip file?
will recovery backup in TWRP work without any problems?
what is the procedure to go back to stock completely after rooting? Unroot, (then wipe if it's needed?) so I am able to safely flash stock firmware again (since, from what I know, flashing stock on a rooted phone makes itself brick permanently, right? or is it just a soft-brick and it can be fixed?)
is there anything else I should know before proceeding?
What I found so far:
http://forum.xda-developers.com/showpost.php?p=66615082&postcount=502 - two recovery images, TWRP and another one (stock?) for the Marshmallow release
http://forum.xda-developers.com/honor-6/general/honor6-multi-tool-t2963060/page50 some rooting instructions for the L02 beta, see posts 494 and 498; no idea whether this is applicable to final Marshmallow or L04 at all
http://forum.xda-developers.com/honor-6/general/huawei-honor-6-plus-unlock-bootloader-id-t3357259 an app to get the unlock code, seems a bit shady to me though on the first glance
http://forum.xda-developers.com/honor-6/development/honor-6-rooting-method-t2962795 alternate methods for bootloader (through a website or by email), in case the app won't work; also, detailed instructions on unlocking and rooting
Basically, I need to know whether my procedure is more or less right before I proceed. I think the information is quite hard to find and the risks are quite high, so I'd like to make a promise - when I'm done rooting it and I know the correct process, I'm going to make a "Update to Marshmallow, unlock, root" how-to thread for all the people that will need it in the future.

Another two questions...
1. Where do I get proper SuperSU for Marshmallow? I get a boot loop (yeah, I know I have to wait and I did, but it's a pretty obvious bootloop from watching the logcat content, and nothing new happens...) after flashing http://download.chainfire.eu/supersu-stable (2.65).
2. I have unlocked my bootloader and installed TWRP, so recovery and fastboot are functional. I didn't make a backup before flashing the zip and now I'm in a bootloop. How do I restore working Marshmallow? I assume I can either beg somebody to upload a TWRP backup for my H60-L04, or somehow flash the stock over what I have now. Can I simply use manual update from SD? Can I somehow flash Marshmallow again with fastboot? I'm too scared of bricking my device right now so I guess I'll brace myself for a few days without a phone until somebody helps me :/

I just flashed the Marshmallow release I had before the bootloop (I used Huawei Update Extractor and flashed boot, cust, system and recovery with fastboot; then open up Huawei recovery and factory reset for good measure, I'm not sure it was even needed) and the device is working. I'll restore my stuff, install TWRP, make a backup then try out your ZIP. Thanks
edit: thanks again - your zip works indeed. So after the initial hurdles, now I've got working root and a reasonable way of restoring in case I screw something up along the way.

Before making a new topic with the tutorial I have a few more questions.
First of all, why exactly we weren't supposed to update the rooted devices? I'm not currently interested in OTAs (it's pretty obvious that it needs a functional Huawei recovery, and you need to unroot cause an update can make a mess in a rooted system, making it bootloop for example), but can we flash extracted images with fastboot on rooted devices? Logically, we should be able to... How about sdcard update method?
Can we flash Marshmallow on Kitkat? (fastboot, sdcard, local update methods?) Or do we need to update to Lollipop along the way?
Can I flash stock roms in general (evenbetween different Android versions) by using fastboot with {boot, cust, recovery, system} images only? There's a lot of images that you can extract with Huawei Update Extractor - why there's so many if they're not needed?

[GUIDE] Upgrade from EMUI 4.1/Android 6.0 to latest firmware

It took me 2 full days to finally successfully upgraded my ancient firmware (L09C16B170) to the updated version (L09C432B397). There are a lot pieces of information that I gathered from this forum and all over the internet that collectively helped me navigate this ordeal. Just want to share it with anyone who is in the same boat, although I know that P9 won't last for too long since P10 has been out for a while. However, if you still want to revive your P9, keep reading.
Requirement
Before reading, you need to understand ways of entering different modes of your P9 phone, which will be used many many times during your upgrade:
Enter recovery mode (also how you enter TWRP) - see this GUIDE
Enter fastboot mode - see this GUIDE
Enter manual upgrade mode (also called dload method; This is NOT TWRP method) - see this GUIDE. Please IGNORE any software or download information in this guide. I want you to refer to this guide for how to do it, NOT what to use or download!
You also need to download and know how to use ADB tool which is quite simple. Search the forum or google and you will find plenty of information and the download links. If you hate command lines, you can even use the GUI version from here.
You will probably also need to use Firmware Finder for Huawei (HWFF) to download firmware of interest for manual update during this process. HWFF is an app that can be installed for free via your phone Google Play Store. The downloaded firmware is saved under the HWFF folder in the internal memory. You might need to unzip these files for upgrade via dload method or directly via TWRP method without unzipping. However TWRP method requires you to unlock the bootloader and install TWRP in the phone (see below for details).
First step - debranding
If you are already on C432xxxx, you might just skip this step. I followed this thread partially (Debranding Guide by Z-Blade), since the whole thing doesn't work for me 100%.
Z-Blade did a fantastic job describing how to debrand his C34 firmware to C342B361. My original version is C16B170 which is a South Africa branded firmware. But I found certain steps in this guide could be omitted and certain steps didn't work in my case. Here is my modified version based on Z-Blade's version:
1. Unlock your bootloader and install TWRP
How to unlock bootloader? Follow this GUIDE. Even though it's for Huawei Ascend XT. It works for P9 as well. You only need to complete Part 1.
After you unlock the bootloader, install TWRP. Depending on which firmware version you're on, the version of TWRP that might work for your device changes. I encountered numerous booting loops due to incorrect version of TWRP. Finally I found that these three versions work for me (3.1.0-0, 3.1.1-0, 3.1.1-1). Always go with the highest version first (3.1.1-1). If you find yourself stuck in the booting screen, long press your power button until you get out of it and install another version of TWRP. Please go to TWRP official website to download TWRP for Huawei P9. Follow this GUIDE to install TWRP recovery on your phone.
2. Flash OEM info file for C432
After you unlock the bootloader and install TWRP recovery, download oeminfo-huawei-p9-eval09-c432.zip from this THREAD and flash it via TWRP method.
3. Flash C432B136 firmware
Download and flash the dload-huawei-p9-eval09-eva-b136.zip via dload method from this thread. After flashing and rebooting your phone, you should be on the L09C432B136 firmware. NOTE: If it boots up to a white screen asking you to enter password, reboot into recovery by holding volume up when you powering up your phone, do a wipe partition and factory reset. You may need to reboot your phone a number times before the phone boots up correctly.
Up to this stage, you have debranded your phone to an european version.
Second step - stepwise firmware upgrade
1. Update from B136 to B166 or B182
As mentioned in Z-Blade's original post, many people will not be able to directly update from B136 to B182. I am one of them. Go into the updater in the phone setting, refresh "check for update". If you can receive B182 update, by all means go for it. If you only receive B166 update, go for it as well. After B166 update and rebooting your phone, check updater again to see if you receive B182 update in the Settings menu. If this method does not work, manually update to B182 by following the steps here via dload method.
2. Update firmware from B182 to B360/361/378 and also upgrade OS from Android 6.0/EMUI 4.1.x to Android 7.0/EMUI 5.0
According to Z-Blade, "After your phone has rebooted and you are on the B182 firmware, you need to now update the firmware to B361 via Huawei Updater 2.0". However, in my case, I tried many times and always failed at this step. I found a workaround by updating to B360 instead of B361. Please follow this GUIDE to update to B360 or B361, whichever works for you. However, please pay attention to following change that I found critical:
- The version of Huawei HiSuite is critical for the success in this step. The GUIDE provided Hisuite download link (version 5.0.0.301_OVE). However, it does not work together with Huawei Updater 2.0 in my hands. This error has wasted me almost half day. Instead, I finally found out the problem and went to HERE to download the version 5.0.1.300 and it finally worked
- However, if even after HiSuite and Updater both work together fine the update does not proceed successfully (the updater might get stuck), you need to update it manually via dload method. Search EVA-L09C432B360 or EVA-L09C432B361 in Firmware Finder for Huawei as mentioned above and download the Full-OTA version (~2G). After download, move the corresponding folder containing firmware zip files under "HWFF" folder in the internal memory to the external SD card. Unzip the firmware file and update your phone using dload method. You may also try TWRP method which can install zip files directly, but at this point, you bootloader will be re-locked and TWRP will be gone. You need to unlock the bootloader and re-install TWRP again as mentioned above.
After you successfully update the firmware to B360 or B361, now you should have Android 7.0 and EMUI 5.0 on your phone. Now go to the updater in your phone setting. You should receive B378 OTA update. Proceed with the update...
You might not need to strictly follow following steps to update your phone to any firmware beyond B378. However, since a lot of new ROMs are based on B380+ or even B390+, if you want to use those, you might need to further update your firmware first.
2. Update firmware from B378 to B383
After updating to B378 and rebooting your phone, check if your phone receives B383 update OTA. If yes, proceed. If not, go to HWFF, download B383 Full-OTA firmware and update via either dload or TWRP method.
3. Update firmware from B383 to whatever later version
After successfully updating your phone to B383, you basically can flash your phone with anything firmware and ROMs built on B380+. I find it unnecessary to update to B386. What I did was that I directly updated from B383 to B394 by following this GUIDE. Since I wanted to try BlueWei 5.7 which is based off B397, I also followed the same guide to update my firmware to B397 before flashing BlueWei ROM.
Now please enjoy all kinds of new ROMs and the fast, revived P9. After this update, my P9 is super smooth (the original firmware and OS was utterly slow and sluggish) and I think I will keep using this phone until it really can't keep up with the hardware requirement of new apps etc.
Hope my guide is helpful!

Nice job to update things and summarize all together. Few comments, though
- Not necessary to go back to c432 b136, to b182 is enough:
https://forum.xda-developers.com/showpost.php?p=75105886&postcount=280
https://forum.xda-developers.com/showpost.php?p=72153575&postcount=2
- For Nougat, please use Huawei P9 Nougat TWRP:
https://forum.xda-developers.com/p9/development/twrp-t3565703
- For DLOAD method, FullOTA-MF-PV versions should be used
- Besides the two methods listed to initiate DLOAD update, there is also a third one:
'Dial': *#*#2846579#*#*
Project Menu will open, select Software Update

[Q]How to change root from phh.superuser to Magisk and upgrade firmware?

Hi Guys, I've been an active user of XDA in the past but didn't have time to follow in the last couple of years so my memory about flashing and tinkering is quite blank.
Here is my situation:
Mate 9 MHA-L29C636B158 (very old ROM)
Bootloader unlocked with paid code from dc-unlocker
Rooted with PHH's Superuser (the only root that was available for our device back in March 2017)
EMUI 5.0 and Android 7.0 (that was obvious from my Build number but I just wanted to state it again)
TWRP 3.0.2-2 is installed with system kept read-only. Internal SD seems to be encrypted
I never took any OTAs as I was afraid that they would break something
In the last month's many of my banking or financial apps have stopped working because I'm rooted so I read that Magisk would be able to circumvent this safetynet thing and would allow me to continue using these apps. Google Pay would be a nice addition also.
At this point I would like to upgrade my firmware and get rid of PHH's Superuser switching to Magisk instead
Could someone please write a detailed guide how to do that? It might be interesting for other users also that are in my same situation. I'm willing to donate a few bucks for a complete and foolproof guide.
Thanks a lot

itenos said:
Hi Guys, I've been an active user of XDA in the past but didn't have time to follow in the last couple of years so my memory about flashing and tinkering is quite blank.
Here is my situation:
Mate 9 MHA-L29C636B158 (very old ROM)
Bootloader unlocked with paid code from dc-unlocker
Rooted with PHH's Superuser (the only root that was available for our device back in March 2017)
EMUI 5.0 and Android 7.0 (that was obvious from my Build number but I just wanted to state it again)
TWRP 3.0.2-2 is installed with system kept read-only. Internal SD seems to be encrypted
I never took any OTAs as I was afraid that they would break something
In the last month's many of my banking or financial apps have stopped working because I'm rooted so I read that Magisk would be able to circumvent this safetynet thing and would allow me to continue using these apps. Google Pay would be a nice addition also.
At this point I would like to upgrade my firmware and get rid of PHH's Superuser switching to Magisk instead
Could someone please write a detailed guide how to do that? It might be interesting for other users also that are in my same situation. I'm willing to donate a few bucks for a complete and foolproof guide.
Thanks a lot
Click to expand...
Click to collapse
Do you still have the unlock code? You'll want it, as the update from EMUI 5 to EMUI 8, on every device I've got, has relocked the bootloader.
With that said:
If you want to keep your data, make a backup using Hisuite.
Download the FullOTA firmware for your current version. Extract system, boot, recovery, recovery2 (as you're on EMUI 5) and flash them either in TWRP or fastboot; that should eliminate PHH SU and TWRP, and ultimately leave the system in a clean state.
If you modified other partitions on the device using TWRP or su in general, it wouldn't be a bad idea to use a nocheck recovery or HuRupdater to flash the entire system, to leave everything in a pristine state, since there are partitions you can't flash with fastboot, even with an unlocked bootloader. The instructions for HuR can be found elsewhere on XDA, as can details about nocheck recoveries, though the latter I'd be careful with - using HWOTA7 on Oreo, for example, WILL cause a brick. You've been warned.
Start the update process - you've already been approved for OTAs and they've been offered, so they should happen automatically. When Oreo is installed, it'll automatically relock your bootloader; you can continue updating here, though if you've got a particular target you want to go to, you might want to unlock and use HuR again to flash that specific one now that you're on Oreo. (The latest firmwares can't be rolled back to Nougat.) If you have no intention of going back to Nougat, you have your unlock code, and you aren't planning to do any other modifications like rebranding, then update away, though you may want to hold off of the Pie update if offered. (Shouldn't be, yet, but it could have been approved for your device already; it changes the boot partitions yet again.)
Now that you're on Oreo and presumably unlocked again, make sure you've got the FullOTA image downloaded for that firmware to your PC. (Always a good idea, anyway.)
Magisk can be installed by:
1) Flashing TWRP with fastboot, then flashing a suitable Magisk zip
2) Using Magisk Manager to patch a boot image and flashing that.
For TWRP:
Get a copy of TWRP from the forum here. When I use one, it's the 3.2.1-0 from @Pretoriano80, you'll find it in the development section. Any 3.2.x for Oreo should work though - a Nougat TWRP will not work.
Flash TWRP to recovery_ramdisk in fastboot. Boot to TWRP, flash Magisk.
For Magisk Manager:
Extract "ramdisk" from your FullOTA firmware. Place it in internal storage on your device. Use Magisk Manager to patch the image (install / patch boot image). Transfer the patched_boot.img created by Magisk back to your PC and flash that to the "ramdisk" partition in fastboot.

Just stumbled over your reply, didn't get an email notification from XDA. Thank you so much. Let's see if I can follow your instructions.
irony_delerium said:
Do you still have the unlock code? You'll want it, as the update from EMUI 5 to EMUI 8, on every device I've got, has relocked the bootloader.
Click to expand...
Click to collapse
Yes, I still have the code
irony_delerium said:
With that said:
If you want to keep your data, make a backup using Hisuite.
Click to expand...
Click to collapse
Done
irony_delerium said:
Download the FullOTA firmware for your current version. Extract system, boot, recovery, recovery2 (as you're on EMUI 5) and flash them either in TWRP or fastboot; that should eliminate PHH SU and TWRP, and ultimately leave the system in a clean state.
Click to expand...
Click to collapse
I downloaded the FullOTA with the FirmwareFinder app on my phone and transferred it to my laptop. Extracted the update.app with WinRAR and extracted system, boot, recovery and recovery2 using the Huawei Update Extractor 0.9.9.3.
Just to make no mistake, could you please confirm the order of flashing these 4 files? And maybe the correct command to use in fastboot?
irony_delerium said:
If you modified other partitions on the device using TWRP or su in general, it wouldn't be a bad idea to use a nocheck recovery or HuRupdater to flash the entire system, to leave everything in a pristine state, since there are partitions you can't flash with fastboot, even with an unlocked bootloader. The instructions for HuR can be found elsewhere on XDA, as can details about nocheck recoveries, though the latter I'd be careful with - using HWOTA7 on Oreo, for example, WILL cause a brick. You've been warned.
Click to expand...
Click to collapse
I don't think that I modified any other partitions, at least not willingly. I even left the system in read-only state. Don't know if phh.su did something by itself?
irony_delerium said:
Start the update process - you've already been approved for OTAs and they've been offered, so they should happen automatically. When Oreo is installed, it'll automatically relock your bootloader; you can continue updating here, though if you've got a particular target you want to go to, you might want to unlock and use HuR again to flash that specific one now that you're on Oreo. (The latest firmwares can't be rolled back to Nougat.) If you have no intention of going back to Nougat, you have your unlock code, and you aren't planning to do any other modifications like rebranding, then update away, though you may want to hold off of the Pie update if offered. (Shouldn't be, yet, but it could have been approved for your device already; it changes the boot partitions yet again.)
Now that you're on Oreo and presumably unlocked again, make sure you've got the FullOTA image downloaded for that firmware to your PC. (Always a good idea, anyway.)
Magisk can be installed by:
1) Flashing TWRP with fastboot, then flashing a suitable Magisk zip
2) Using Magisk Manager to patch a boot image and flashing that.
For TWRP:
Get a copy of TWRP from the forum here. When I use one, it's the 3.2.1-0 from @Pretoriano80, you'll find it in the development section. Any 3.2.x for Oreo should work though - a Nougat TWRP will not work.
Flash TWRP to recovery_ramdisk in fastboot. Boot to TWRP, flash Magisk.
For Magisk Manager:
Extract "ramdisk" from your FullOTA firmware. Place it in internal storage on your device. Use Magisk Manager to patch the image (install / patch boot image). Transfer the patched_boot.img created by Magisk back to your PC and flash that to the "ramdisk" partition in fastboot.
Click to expand...
Click to collapse
Will continue to do the above after your kind confirmation of my last questions. Thanks again

itenos said:
I downloaded the FullOTA with the FirmwareFinder app on my phone and transferred it to my laptop. Extracted the update.app with WinRAR and extracted system, boot, recovery and recovery2 using the Huawei Update Extractor 0.9.9.3.
Just to make no mistake, could you please confirm the order of flashing these 4 files? And maybe the correct command to use in fastboot?
Click to expand...
Click to collapse
The order shouldn't be particularly relevant, just that it's safest to reflash all of them:
- boot because phhsu may have modified the boot image to add su to it
- recovery and recovery2 because you loaded TWRP. recovery2 is specified because it's used to be recommended to flash to erecovery as well as normal recovery.
- system because I'm pretty sure that's the biggest thing modified Hy phhsu, and any other system changes you may have made.
Theoretically, other modified partitions won't matter since the upgrade to 8.0 replaces most (all, I think) of them anyway, but if you have to go through update steps through EMUI 5 first before it'll give you 8, then it's safest that they aren't modified. I mentioned other partitions because, with root & TWRP, you technically could have modified any and all of them.

irony_delerium said:
Download the FullOTA firmware for your current version. Extract system, boot, recovery, recovery2 (as you're on EMUI 5) and flash them either in TWRP or fastboot; that should eliminate PHH SU and TWRP, and ultimately leave the system in a clean state.
Start the update process - you've already been approved for OTAs and they've been offered, so they should happen automatically.
Click to expand...
Click to collapse
Flashing of 158 (original ROM version) went fine. Phone rebooted and titanium reported no root access, so it looks good.
After that I started the OTA update to 172 that waited already long time in my settings and it downloaded it. After downloading it gave me an error during the validation process of the file and asked to download it again.
Unfortunately now both the phone updater and the HiSuite app on my laptop say that 158 is the latest available firmware and no update is available.
I guess that I can download directly the newer firmware but I'm not exactly sure how to flash the whole package and what I should do with the other 2 files that come with it besides the update.zip

itenos said:
Flashing of 158 (original ROM version) went fine. Phone rebooted and titanium reported no root access, so it looks good.
After that I started the OTA update to 172 that waited already long time in my settings and it downloaded it. After downloading it gave me an error during the validation process of the file and asked to download it again.
Unfortunately now both the phone updater and the HiSuite app on my laptop say that 158 is the latest available firmware and no update is available.
I guess that I can download directly the newer firmware but I'm not exactly sure how to flash the whole package and what I should do with the other 2 files that come with it besides the update.zip
Click to expand...
Click to collapse
It might be tweaking out about the fact that you'd previously modified system.
I'd grab the last Nougat release (looks like 191; there are 2 of them, be sure it's not the rollback one you grab) and use hurupdater in TWRP to install it, then let the system try running OTA again.

irony_delerium said:
It might be tweaking out about the fact that you'd previously modified system.
I'd grab the last Nougat release (looks like 191; there are 2 of them, be sure it's not the rollback one you grab) and use hurupdater in TWRP to install it, then let the system try running OTA again.
Click to expand...
Click to collapse
I had to insert the SIM card of the country I bought my phone in to get the OTAs coming. Luckily I still had it with a few $ credit on it. It used just a few cents in data roaming for finding the new firmware, then I downloaded through wifi.
After 4 updates now I'm on 378 and no sign of Pie yet so this afternoon if I find some time I'll continue with rooting.

itenos said:
I had to insert the SIM card of the country I bought my phone in to get the OTAs coming. Luckily I still had it with a few $ credit on it. It used just a few cents in data roaming for finding the new firmware, then I downloaded through wifi.
After 4 updates now I'm on 378 and no sign of Pie yet so this afternoon if I find some time I'll continue with rooting.
Click to expand...
Click to collapse
Easy way:
Unlock phone, if you haven't yet again.
Download and flash TWRP from here: https://forum.xda-developers.com/mate-9/development/recovery-twrp-3-2-1-0-t3783353 (has decryption support) (flash to recovery_ramdisk as Huawei decided to split recovery partition into different parts)
Boot to TWRP, input pin (if you set a pin, else it will decrypt automatically)
Download Magisk: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
Transfer Magisk to phone.
Flash Magisk zip in TWRP.
Reboot and you're done.
You might have to tinker around with Magisk Hide and hide apps if your banking apps still detect root.

As the Huawei Backup took over 4 hours to finish and i can't use Titanium, which is much faster, because I'm not rooted at the moment, I thought it's a good idea to first upgrade to Pie before unlocking my bootloader and losing all data. If I need to stay a few days without root it's ok.
Is there any way to get to Pie without being rooted? I tried the erecovery method on firmware finder. It says that my IMEI is now registered to download the update but when I enter erecovery it starts downloading the 378 oreo package.
I would like to avoid backing up and restoring twice this lengthy process, probably 16 hours all in all

itenos said:
As the Huawei Backup took over 4 hours to finish and i can't use Titanium, which is much faster, because I'm not rooted at the moment, I thought it's a good idea to first upgrade to Pie before unlocking my bootloader and losing all data. If I need to stay a few days without root it's ok.
Is there any way to get to Pie without being rooted? I tried the erecovery method on firmware finder. It says that my IMEI is now registered to download the update but when I enter erecovery it starts downloading the 378 oreo package.
I would like to avoid backing up and restoring twice this lengthy process, probably 16 hours all in all
Click to expand...
Click to collapse
The erecovery method won't work unless you can change the DNS settings on the network being used - it hijacks some of the requests to Huawei's servers to force the update. (And even then it's a bit finicky; I have yet to successfully use it, all things considered.)

Yesterday I finally received 9.0.1.159 with EMUI 9.0.1 by OTA. It installed fine and it's amazing how fast my phone became and how much screen on time I have now with my 2 year old device (8 full hours!). Good job Google and Huawei.
Being on Pie now I suppose that the instructions to root from you and ante0 are not valid anymore as they were meant for Oreo.
Could you please modify the instructions for Pie? And further, as I see that since yesterday in FirmwareFinder a new Pie update 9.0.1.178 popped up, could you please also add instructions how to take this OTA being rooted with Magisk once it arrives?
I've read a bit in the Magisk thread but I did not really understand the part of having to boot to recovery everytime I switch on the phone. Further they are talking there about EMUI 9 but I have already 9.0.1, is there maybe a difference I have to take care about?
Last but not least, I didn't forget my initial promise to donate a few bucks for the detailed instructions so please drop me your email in PM and I'll sent you a few through PayPal or in alternative, if you have some paid apps on the Playstore I could buy them so they might get more visibility.

itenos said:
Yesterday I finally received 9.0.1.159 with EMUI 9.0.1 by OTA. It installed fine and it's amazing how fast my phone became and how much screen on time I have now with my 2 year old device (8 full hours!). Good job Google and Huawei.
Being on Pie now I suppose that the instructions to root from you and ante0 are not valid anymore as they were meant for Oreo.
Could you please modify the instructions for Pie? And further, as I see that since yesterday in FirmwareFinder a new Pie update 9.0.1.178 popped up, could you please also add instructions how to take this OTA being rooted with Magisk once it arrives?
I've read a bit in the Magisk thread but I did not really understand the part of having to boot to recovery everytime I switch on the phone. Further they are talking there about EMUI 9 but I have already 9.0.1, is there maybe a difference I have to take care about?
Last but not least, I didn't forget my initial promise to donate a few bucks for the detailed instructions so please drop me your email in PM and I'll sent you a few through PayPal or in alternative, if you have some paid apps on the Playstore I could buy them so they might get more visibility.
Click to expand...
Click to collapse
The reason recovery boot is needed for Pie is because Huawei removed the ramdisk - in Pie, it's system as root with no way of forcing a ramdisk except by a recovery boot. So as a workaround, Magisk takes over recovery.
The installation instructions for it on Pie are pretty much the same as Oreo, except:
* Patch recovery_ramdisk, not ramdisk. Latest stable Magisk should work (18.1, iirc, has the patches to support recovery boot.)
* When booting, go to recovery. Magisk will start from there and take over the startup process.

irony_delerium said:
The installation instructions for it on Pie are pretty much the same as Oreo, except:
Click to expand...
Click to collapse
Hmm, where do I find the TWRP for Pie in order to flash?
And most importantly how do I have to behave in case of new OTAs coming?

itenos said:
Hmm, where do I find the TWRP for Pie in order to flash?
And most importantly how do I have to behave in case of new OTAs coming?
Click to expand...
Click to collapse
TWRP on this case, don't bother.
Extract your stock recovery from your firmware's update.app file, patch with Magisk Manager, and flash the patched image. When you want to flash an ota, put the stock recovery back.

2023 EMMC_11 Exploit To Root And Flash Custom Boot And Recovery Images Allowing Custom Roms To Be Used

This process will allow flashing custom boot and recovery images on EMMC11 S5
Yes this will allow the EMMC11 S5 to run custom roms like Lineage
Than You ryanbg​Summary Of What This Does
You must be on G900VVRU2DPD1 bootloader for the exploit too work.
The exploit patches the header of the boot or recovery image which forces the phone to skip security check of them and allow them to be used. If on totally stock phone this process flashes combo firmware to your phone which is kitkat based and allows easy rooting. Then I inject safestrap into combo firmware which gives a system based hijack that gives you a custom TWRP like recovery. I then have safestrap recovery flash a minimal QL1 based rom with DPD1 bootloader that updates you back to Marshmallow firmware and a prepatched TWRP recovery. I have to use this method because this prepatched TWRP recovery cannot be flashed in odin because you need unlocked bootloaders to be able too do this. This minimal firmware is also rooted just for good measure but the only thing you will be using this firmware for is to access TWRP so you can flash an actual rom that can be rooted with a magisk root. I have provides some for you to use. If you mess up and loose recovery and dont have a rooted rom you can boot up to. The whole process will have to be done again so take care not too loose your TWRP recovery once using this process.
​What You Can Do
Flash custom boot images that allows you to use magisk
Flash custom recovery
Flash custom roms like Lineage
What You Cannot Do
You can not unlock bootloaders on EMMC_11 so all flashing must be done on a device with custom recovery
You cannot flash custom binaries using odin
Downloads
S5_Root_Tools_2023.7z -- Use If Totally Stock
EMMC_11_Rom.zip -- Stock QL1 6.0 Use If Already On Safestrap
Patch_Boot_Recovery_Image.zip
Boot Images Stock EMMC_11 Or 15
boot_ql1_stock.img
Boot Images Custom EMMC_11 Or 15
PhoeniX.Kernel.V13.0.TW6.0.1.img -- Phoenix Kernel Permissive
PhoeniX.Reborn.Kernel.V1.0.TW6.0.1.img -- Close To Stock Permissive
PhoeniX.Kernel.V1.0.TW6.0.1.G900V.img -- VZW Stock Permissive
TWRP Recovery EMMC 11
recovery_twrp_emmc_11.img -- Pre Patched For EMMC_11
TWRP Features
Backup and flash system images
Green color to distinguish between regular twrp
EMMC_11 TWRP image is prepatched flashing patch zip not needed
EMMC_11 TWRP startup screen labeled to identify its patched
Regualr TWRP can be use if you choose on either model
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Technical Questions And Answers Here
Telegram Channel
Directions If Already Running Safestrap
1. If already running safestrap flash EMMC_11_Rom.zip in safestrap this will install very minimal QL1 rom with proper bootloaders and stuff. From here you can flash rom of your choice just make sure you dont update or change bootloaders.
2. Then root with root of choice.
3. Then flash Patch_Boot_Recovery_Image.zip then your done
4. Then from there on in future flashes follow the EMMC_11 Flashing Custom Roms Boot Images And Recovery Images section
5. I recommend you dont mess with recovery. If you accidently flash an unpatched recovery you may not be able to get it back without starting the whole process over. If a rom you are using flashes a recovery image I recommend you remove it or make sure you flash the patch zip
Directions If Totally Stock
I would recommend Windows defender is turned of before starting
1. Download S5_Root_Tools_2023.7z and unzip
2. Make sure Usb debugging is enabled on your phone
3. Plug in phone and run Safestrap.exe and follow directions on command window
4. This process is pretty much 1 click all automatic except following command window prompts
5. This will detect if your phone is EMMC 11 or 15
6. If it detects EMMC 15 it will automatically unlock your bootloaders.
7. EMMC 11 detection will install Twrp recovery where you can install custom stuff from there.
EMMC_11 Flashing Custom Roms Boot Images And Recovery Images
1. The above tool will give you TWRP Recovery and stock 6.0 rom
2. Flash your rom of choice in TWRP or stay on stock one provide. Do not flash a rom that updates bootloaders.
3. Then flash your root zip like magisk this will patch your boot.img
4. Once a boot.img is no longer stock you will need to flash the Patch_Boot_Recovery_Image.zip after the image is patched with magisk. This zip will be placed on your internal storage from the above tool
5. I recommend you dont change recoveries there is really no need too
6. Anytime you flash a new boot.img it will most likely require you to reflash root zip and then make sure you flash the Patch_Boot_Image.zip very last
Source For Kernel
Source Code For Expolit
Source For TWRP

Instructions For Flashing An AOSP Based Rom
1. Download rom that will work for this device.
2. In twrp wipe data
3. Install rom zip
4. Install gapps that match the rom you are flashing and they must be arm gapps.
5. Install Root zip such as magisk zip
6. Install Patch_Boot_Recovery_Image.zip
7. Reboot
8. Anytime you flash a new boot.img it will most likely require you to reflash root zip and then make sure you flash the Patch_Boot_Image.zip very last
9. If using lineage recovery you will also need to flash the Patch_Boot_Image.zip after you flash lineage recovery
Official Lineage Builds For S5
LineageOS Downloads
download.lineageos.org
Open Gapps
The Open GApps Project
OpenGApps.org offers information and pre-built packages of The Open GApps Project. The Open GApps Project is an open-source effort to script the automatic generation of up-to-date Google Apps packages. All Android versions and platforms supported.
opengapps.org
Regular Magisk
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Magisk Delta
Releases · HuskyDG/magisk-files
Contribute to HuskyDG/magisk-files development by creating an account on GitHub.
github.com
ETFSU
EFTSU Root Solutions
The Largest Database for the Root Solutions on the Internet
eftsu.com
Safteynet Fix Module
Releases · kdrag0n/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix
github.com
Disabling Reactivation Lock
Thanks bbsc
1. Follow above directions too obtain safestrap and root
2. Download and flash EMMC_11_NCG_KK_Safestrap_Full.zip in safestrap then wipe data
This has Samsung Setup Wizard removed so you can get through setup
3. Set up a wireless connection or use your SIM-card and internet connection from your provider.
4. Navigate to Settings - Security, find Reactivation Lock and untick it. The phone will ask you for your existing credentials or to register a new Samsung account. Accept too update app then allow google check when it ask
5. Login to your new account and you will be able to untick Reactivation Lock.
6. When it unticked, Navigate to Settings - Backup Reset - Factory data Reset.
7. Phone will reboot too stock recovery and wipe data and remove current samsung account and you are good too go.
8. Now proceed with flashing of rom of choice or unlocking the bootloader if you have EMMC15 device. On this particular rom you have to enter safestrap from the safestrap splash screen on bootup its not installed as a recovery image because stock recovery is needed
Old Root Methods And Downloads
EMMC_11_S5_Root_Tools_2022_V7.7z​Instructions To Install Safestrap
**If you already have safestrap installed you can skip to Installing Roms Post 2
**If you already have rooted you can skip to Installing Safestrap
**This process uses Kingroot too root but removes all traces of it when done.
Directions
1. Download and unzip EMMC_11_S5_Root_Tools_2022_V7.7z
2. Reboot phone too Download Mode by holding Power+VolDwn+HomeButton as phone starts up
3. Plug phone into computer and open the Odin provided in the above file in the Odin_Folder
4. In Odin Choose BL slot and choose the COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5 Located in the Odin_Folder
5. Flash the file using provided Odin let phone reboot. This will wipe your phone
6. Once phone is rebooted make sure its plugged into computer and phone use recognized by computer
7. Run the Install_One_Click.cmd this should install install safestrap. If this method fails countinue with below methods.
8. If above method fails you can reboot and try again or run the Manual_Install_Root_Apps.cmd and try below methods to root
Towel Root Method
These steps are only needed if above root method failed
1. You need too be connected to a network. Try one of towel root apps and if not successful then try the other one. If it doesn't work go to King root section
2. If towel root succeeds then run the click on the super su app and choose to update su binary and choose normal once successfully updated reboot phone
King Root Method
These steps are only needed if towel root failed
1. You will need to be connected to a network. Click on King root app then click try root
2. Once root is successful don't click on the optimize and close the king root app.
3, Run the Manual_Install_SuperSu.cmd
Installing Safestrap
9. This only needs to be done if 1ckick root bat method failed. Now click on safestrap app and clisk install safestrap click allow in root dialog app once installed click reboot to safestrap
10. Busybox will need to be installed first if you used towel root method to root
Old Safestrap Rom Zips
EMMC_11_NK2_KK_Rooted_Safestrap_Full_V2.zip KIT KAT ROM
EMMC_11_PB1_LL_Rooted_Safestrap_Full_V2.zip LOLLIPOP ROM
EMMC_11_QL1_MM_NonRooted_Safestrap_Full_V2.zip MARSHMALLOW ROM
Entering Safestrap
To Enter Roms From Kit Kat Or Rooted Combo Firmware
1. Reboot phone and click on Recovery Button on safestrap splash screen
To Enter Safestrap On Marshmallow Or Lollipop Roms
2. Reboot to recovery (VolUp+Pwr+Home Buttons) when the bottom navigation lights turn on hold the volume down and power buttons for about 10 seconds until phone boots too Maintenance Boot Mode
Click image for larger version
3. Now use the volume keys to navigate too Factory Reset. Now press the Home button. This will not reset your phone but this is how you enter safestrap. Phone will reboot too safestrap give it about a minute too boot into safestrap it will boot directly too safestrap. Every time you want to enter safestrap you need to follow these steps
4. To leave safestrap simply click reboot system
Installing Roms Using Safestrap
1. If coming from a kitkat rom or the root method above in post 1. You must reboot too stock recovery wipe data and reboot and enter safestrap then Copy Rom Zip To Phone. The data wipe in recovery while on kitkat rom is necessary to partition data correctly too move on too Marshmallow or Lollipop. If on Lollipop or Marshmallow rom skip wiping data in stock recovery because you cannot and copy your rom zip too phone while system is still booted and reboot too safestrap.
2 In safestrap click swipe bar too allow system too be modified
3. Click wipe and swipe to factory reset then click home button then click install and choose EMMC_11_ROM.zip.
4 This will take several minutes too install
5. Once installed click reboot system. If first time in safestrap it will ask you if you want too install TWRP which you cannot. Uncheck the boxes to install twrp and choose Do Not Install and phone will reboot. This is only on first time you enter safestrap after first time it wont ask you this again and simply click reboot system
6. Phone will take several minutes too boot
Features
Stock Deodexed Rom Slightly Debloated
Some Features Added
Safestrap Available On All Roms Root And NonRooted With Ability To Enter Safetrap Without A Computer
Root On Lollipop And KitKat Only
Bugs
1. Lollipop and Marshmallow recovery image is replaced with KitKat boot.img to give ability too boot too safetrap without using a computer. This may cause your sometime to reboot to recovery screen and get stuck when your phone is turned off and you plug in a charger. You can fix by pulling battery with phone unplugged then plug back in if not cycle through a startup then power off
2. There is no recovery image on Lollipop or Marshmallow so you have to wipe cache and data through safestrap
3. If you flash odin files or other roms that flash a recovery image you will loose safestrap ability. There is a safestrap recovery image in files in post 1 that you can flash in odin too get back safestrap abilty.
4. Flashing roms that dont contain safestrap may cause you too loose safestrap so I recommend flashing one of the safestrap zips to add it to roms. This is not necessary on above roms.
5. This is not supported by me anymore. I try and help but I don't check this threads regularly.
6. If you loose safestrap on Marshmallow roms the only way too get it back is to start over from post 1
7. If you find yourself on kitkit rom constantly booting too safestrap flash the KitKat safetrap zip in safestrap
SafeStrap Zips
View attachment Safestrap-4.11-B01-KLTEVZW_MM_LL.zip
View attachment Safestrap-4.11-B01-KLTEVZW-SS-FF-flashable-KK.zip

Bro, you are quite a crack, despite the time that the S5 already has, you keep releasing content to get more out of the s5, I'm still using it and personally I have installed all your roms. Thanks a hug.

Jose_cm001 said:
Bro, you are quite a crack, despite the time that the S5 already has, you keep releasing content to get more out of the s5, I'm still using it and personally I have installed all your roms. Thanks a hug.
Click to expand...
Click to collapse
I just organized stuff better. All this stuff has been around for awhile. I just had it in many different threads so I consolidated it into one thread. I have been cleaning and closing some threads. Im really surprised anyone still uses an s5 but hey im glad someone still gets some use out of this stuff. I made sure all links worked and reuploaded stuff with dead links so should be good now.
Sent from my iPad using Tapatalk

i'm following these instructions but i'm too gumpy to understand:
"7. Run the Install.cmd this should install some apks on your phone then reboot your phone"
i'm connected to a windows 7, i'm supposed to be running a program from the pc then?

chrisco78 said:
i'm following these instructions but i'm too gumpy to understand:
"7. Run the Install.cmd this should install some apks on your phone then reboot your phone"
i'm connected to a windows 7, i'm supposed to be running a program from the pc then?
Click to expand...
Click to collapse
Well yes you have to initially root the phone so you can install safestrap. You have too push the apps to your phone after you install the combination firmware as it has no apk installer so you have too install the apps needed for root and safestrap with adb using the computer. Once that’s done you don’t need computer anymore
Sent from my iPad using Tapatalk

jrkruse said:
Well yes you have to initially root the phone so you can install safestrap. You have too push the apps to your phone after you install the combination firmware as it has no apk installer so you have too install the apps needed for root and safestrap with adb using the computer. Once that’s done you don’t need computer anymore
Sent from my iPad using Tapatalk
Click to expand...
Click to collapse
thank you, i was actually able to figure it out eventually i just forgot to timestamp how long it took me (hours)
appreciate the condensed update, though! most s5ers are still holding on because battery swapability is more important than the app du jour

If I flash the Lollipop ROM will I be able to use the settings factory reset option? Or will that cause a brick without reflashing again?
I want to get the phone in a stock state but maintain safestrap otherwise. Remove all personal data, Disable Reactivation Lock etc (I can't turn it off on my current ROM for some reason). Or I guess getting completely stock even without safestrap is okay too since its still possible to re-get it if needed.

hypermetuljason said:
If I flash the Lollipop ROM will I be able to use the settings factory reset option? Or will that cause a brick without reflashing again?
I want to get the phone in a stock state but maintain safestrap otherwise. Remove all personal data, Disable Reactivation Lock etc (I can't turn it off on my current ROM for some reason). Or I guess getting completely stock even without safestrap is okay too since its still possible to re-get it if needed.
Click to expand...
Click to collapse
The factory reset option in settings will only work if you have stock recovery installed. Format data in safestrap will totally wipe internal storage. wiping just data in safestrap will remove all data except media files. You can flash stock and do it or the combination firmware. All will accomplish the same results.
Sent from my iPhone using Tapatalk

jrkruse said:
This Process Will Install On The EMMC_11 Locked Bootloader Verizon S5
Marshmallow QL1 Stock Rom NonRooted With Safestrap.
Lollipop PB1 Stock Rom Rooted With Safestrap.
KK Rom Rooted With Safestrap​
What This Does
This gives you the ability to boot into safestrap without a computer like the old way was.
You can use safestrap to modify the rom delete apps flash mod zips and even run xposed. Many xposed modules will work without root
You can use safestrap to go back to earlier roms like lolipop or kitkat were you can have root
You can flash some custom Samsung Based Roms. I have a few in the forum
You cannot root Marshmallow roms with a locked bootloader
You cannot flash asop based roms like Lineage as these require a custom boot image
You cannot unlock your bootloader even though you have safestrap
Downloads
EMMC_11_S5_Root_Tools.7z
Instructions To Install Safestrap
**If you already have safestrap installed you can skip to Installing Roms Post 2
**If you already have rooted you can skip to Installing Safestrap
1. Download and unzip files
2. Reboot phone too Download Mode by holding Power+VolDwn+HomeButton as phone starts up
3. Plug phone into computer and open the Odin provided in the above file in the Odin_Folder
4. In Odin Choose BL slot and choose the
COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5
Located in the Odin_Folder
5. Flash the file using provided Odin let phone reboot. This will wipe your phone
6. Once phone is rebooted make sure its plugged into computer and phone use recognized by computer
7. Run the Install.cmd this should install some apks on your phone then reboot your phone
8. When phone reboots choose the Apex launcher which will make it easier to find stuff
9. There are 3 different options installed to root your phone 2 different towel root methods and a KingRoot method
Towel Root Method
10. You need too be connected to a network. Try one of towel root apps and if not successful then try the other one. If it doesn't work go to King root section
11. If towel root succeeds then run the click on the super su app and choose to update su binary and choose normal once successfully updated reboot phone
King Root Method
These steps are only needed if towel root failed
12. You will need to be connected to a network. Click on King root app then click try root
13. Once root is successful don't click on the optimize and close the king root app.
Installing Safestrap
14. Now that you have rooted from one of the above methods click on the BusyBox app and install busybox click allow in the root dialog box
15. Now click on safestrap app and clisk install safestrap click allow in root dialog app once installed click reboot to safestrap
Click to expand...
Click to collapse
Ok, I followed these steps and made it all the way through this time. HUZZAH!!! (Towelroot didn't work since it said it couldn't connect to the internet) King root worked.
Only problem is, how do I know it worked? There isn't a tool for checking if root worked and this version of ROM doesn't seem to have any apps like Google Play Store to grab more apps. How do I install more apps? Thanks!

OreganoPlanter said:
Ok, I followed these steps and made it all the way through this time. HUZZAH!!! (Towelroot didn't work since it said it couldn't connect to the internet) King root worked.
Only problem is, how do I know it worked? There isn't a tool for checking if root worked and this version of ROM doesn't seem to have any apps like Google Play Store to grab more apps. How do I install more apps? Thanks!
Click to expand...
Click to collapse
The whole point is too get safestrap installed if you can boot to safestrap then the process worked
Sent from my iPhone using Tapatalk

JRKRUSE. Thanks so much for this. I've been stuck for a few days with my dad's old S5 trying to get it back to working. I wiped it, and couldn't get past the Samsung Account Reactivation Lock. Tried flashing a few stock firmwares, but nothing worked. I used your method to install the bootloader successfully. Once installed it boated me into a stripped down version of Android, which displayed all sorts of system diagnostic info on the bottom half of the screen. (Not sure what this is called.) I couldn't get the .cmd file to copy the apk's over but it let me copy them over to the downloads folder and install them all one at a time on the phone. Successfully gained root and followed the rest of your steps. Was successfully installing KitKat and finally getting around the Activation Lock. Thank so much!!!

jmc15john said:
JRKRUSE. Thanks so much for this. I've been stuck for a few days with my dad's old S5 trying to get it back to working. I wiped it, and couldn't get past the Samsung Account Reactivation Lock. Tried flashing a few stock firmwares, but nothing worked. I used your method to install the bootloader successfully. Once installed it boated me into a stripped down version of Android, which displayed all sorts of system diagnostic info on the bottom half of the screen. (Not sure what this is called.) I couldn't get the .cmd file to copy the apk's over but it let me copy them over to the downloads folder and install them all one at a time on the phone. Successfully gained root and followed the rest of your steps. Was successfully installing KitKat and finally getting around the Activation Lock. Thank so much!!!
Click to expand...
Click to collapse
Sorry to reply to such an old post, but which KitKat ROM did you end up using? I have a few phones stuck asking me to log into the last used Samsung account and I need a ROM that will bypass that screen.

This thread saved my mysteriously soft bricked, unlocked & rooted S5 VZW device. Thank you jkrruse.
When I try to download EMMC_11_PB1_LL_Rooted_Safestrap_Full.zip I get no mirrors available. Am I SOL?
edit - now one mirror is available which is flaky slow and drops less than 10% into download.
2nd edit- went with Brave browser and used it's download manager to continuously resume dropped download. Hash looks good so here goes...
Final cut: All is well and once I got everything my way I wanted to backup and could not find Safestrap. On boot I get RECOVERY BOOTING..... and nothing else. Had to pull battery. So I'm at a loss. Finally I took the time to make a check list of every step which really doesn't take long and methodically performed each step until success. Have the device where I want it and including a backup. I have many devices and each is unique but this 900V is a workhorse. I think I task overloaded it before so lesson learned.

Updated files to be more compatible with newer computers

JKruse you are awesome man - I just tried to take an old S5 (cid 11) to try and work some magic to get around the YouTube app "not supporting" it, broke my S5 bad, and used your threads to fix myself back to PHX 15. (NOT the first time ive been totaled before) You been dope since I first bought it! Many thanks!

Well with dozens of phones and most far newer than my s5 I finally had to update it to use a certain mission critical app so I went for LL. Followed the above mostly and it's working although I haven't had the chance to wring out everything yet. Thanks jrkruse again for all your great work! Wondering if I'm the last person on the planet to upgrade 4.4.2 to 5

droidzer1 said:
Well with dozens of phones and most far newer than my s5 I finally had to update it to use a certain mission critical app so I went for LL. Followed the above mostly and it's working although I haven't had the chance to wring out everything yet. Thanks jrkruse again for all your great work! Wondering if I'm the last person on the planet to upgrade 4.4.2 to 5
Click to expand...
Click to collapse
I'm still using 4.4.2 but on a T-Mobile S5 instead of the Verizon one.

I wish to thank jrkruse for making this post two years ago, for a phone that is 9 years old.
I paid $45 for the Verizon version of the Galaxy S5. Obviously, I don’t know what I’m doing. Thanks to this post and all the work that went into researching the problems and packaging the solution into a concise solution, I have a working version of an unrooted Marshmallow.
When I got the phone, it started up from a factory reset but as soon as I connected to the internet I got the message
“Device owner policies aren't supported on this phone.”
The menu key, home key and camera were disabled. I was locked out.
I used the Verizon 6.01 upgrade package, hoping it would do a fresh install. It got worse, I got the Knox security violation. I was double locked out.
So I started reading. It was looking bad, there was an embedded kill switch that permanently bricks the phone. After a bit more reading, I discover that I had the Version with cid starting with 11 from a post that said any manufacture date after the year 2014 was a cid 11. I found this thread, so from a locked up phone. my situation worked out to a smoothly running unrooted version of Marshmallow.
I know I didn’t carefully follow the instructions but I’ll layout my journey, for anyone else who is in similar circumstances. I invite comments to tell me what I should’ve done.
Requirements, I used a Windows PC, cable connecting the PC to phone, a micro SD card and an SD adapter that connects to a PC.
The package EMMC_11_S5_Root_Tools_2022_V3.7z is the complete one stop shopping deal and I went to https://www.7-zip.org/download.html to be able to unzip it.
After you unzip it, everything is ready to go.
The procedures are done by scripts, so there is hardly any typing.
The first routine prepares the phone for rooting and safestrap.
The next instruction reads
‘7. Run the Install_One_Click.cmd this should install safestrap.”
When I first read this, it was confusing to me, because I didn’t see a One_Click program. But all you have to do is double click the file named “Install_One_Click”. This is a command file that does all of the typing, both on the PC and phone.
In my case, everything ran as planned and I could skip the instructions for contingency cases.
The script did more work than the instructions in the post required.
The script stops to ask to allow rooting to install safestrap. Tap allow.
The script ends up with the safestrap screen on the phone, asking to install a rooted TWRP. This second time you decline.
On the PC I copied the EMMC_11_QL1_MM_NonRooted_Safestrap_Full_V2.zip file onto a micro SD card, using a USB SD card adapter.
I inserted the card on the phone.
I tapped the install button in safestrap selecting the file on the SD card.
After the install, you end up with Marshmallow. All I did was a few clicks in Odlin, double click on “Install_One_Click” , one tap to allow rooting, one tap to prevent rooting of TWRP and one tap on the install button in safestrap. All in under 15 minutes.
I got a very sleek, clean Marshmallow.
I then got the pop screen “Unfortunately, Google Store has stopped.”
I followed instructions from
https://www.androidpolice.com/install-google-play-store-any-android-device/
I simply downloaded 4 files.
https://www.apkmirror.com/apk/googl...account-manager-6-0-1-2-android-apk-download/
https://www.apkmirror.com/apk/googl...ervices-framework-6-0-1-android-apk-download/
https://www.apkmirror.com/apk/googl...-42-12-040408-481949630-android-apk-download/
https://www.apkmirror.com/apk/googl...-18-21-0-pr-481699564-3-android-apk-download/
installed them and clicked done not open and then rebooted.
The Google Store message was gone, just like the Knox and owner policy messages.
I could download apps from Google Play.
Everyone’s work turned a broken phone into a fully operational one.
I thank everyone.

jrkruse said:
This Process Will Install On The EMMC_11 Locked Bootloader Verizon S5
Marshmallow QL1 Stock Rom NonRooted With Safestrap.
Lollipop PB1 Stock Rom Rooted With Safestrap.
KK Rom Rooted With Safestrap​
What This Does
This gives you the ability to boot into safestrap without a computer like the old way was.
You can use safestrap to modify the rom delete apps flash mod zips and even run xposed. Many xposed modules will work without root
You can use safestrap to go back to earlier roms like lolipop or kitkat were you can have root
You can flash some custom Samsung Based Roms. I have a few in the forum
You cannot root Marshmallow roms with a locked bootloader
You cannot flash asop based roms like Lineage as these require a custom boot image
You cannot unlock your bootloader even though you have safestrap
Click to expand...
Click to collapse
JR - Not as experienced as I'd like to be in this area, but patient and willing to put the time in if I can get the results I'm preferable to - I like the S5 size (one-hand-operable), swappable-battery of course, and several other factors. I've got three Verizon S5 phones still in service and I was hoping to get a little more time with them (prefer to stick with Verizon's network if I can). Was excited to discover Lineage, but it looks like I may not be able to proceed with these specific phones in hand based on finally arriving at your post/thread.
After running your EMMC Check App, it appears they're all version 11 (bootlocked - hence my fail in the Odin steps of Lineage).
Given this, is there NO way to unlock the bootloader or force ANY kind or work-around to proceed with Lineage? Not even if downgrading to the original Lollipop?
From what I understand in your post - other non-Lineage approaches may be able deliver a newer Android OS...but I'd really like to achieve Lineage though if possible (bringing me up to at least Android 11. I even would consider seeking out phone(s) with the 15 EMMC CID if necessary (though I don't know how I'd practically inquire/identify such when asking sellers for that info [decipherable through IMEI/etc?]).
Thanks for all the info assembled here. Hope you might have some advice.
-Jonn

Confused

I have been reading more articles about getting root access on an Android device and am finding the information to be contradictary. It might be the way I am reading it but when it says
"How To Install TWRP Custom Recovery On Any Android Phone (Without Root)"​
I assume it actually means any Android, but it requires a custom recovery image for a particular phone so therefore it can only be for an android device where a custom image is available.
When I was running android 5.1 I installed TWRP so as to backup and restore my phone in case things went wrong, now I am running Android 7 it seems I cannot get a version of TWRP.
Can anyone assist as to what recovery tools I could install on a Ruggex 2 phone running android 7 please
thanks Roy

recovery is "independent" from main android OS. if you already have custom recovery installed on your device, it will even work without any OS installed, so it doesn't care if your phone is running Lollipop or Nougat. you can however check download source for newer version

If that is the case then why does the forum state
How to install TWRP on any Android device​
but then goes on to say
Downloading TWRP for your device​
which implies it is device dependant and not generic?
thanks Roy

Thx, I got it first time. of course custom recovery is device dependant. but that's not what I said. I said recovery mode is independent from android version. (at least till < 11)
btw it's not contradictory to say the Installation is generic for "any" android device (despites the difference device has recovery in partition or in ramdisk) while the Download is device dependant.
also take note that installing custom recovery and rooting android are two different tasks that do not depend on each other.

I think I am just getting more confused the deeper I go, it was fairly easy on my Android 5.1 device but with Android 7 it just seems to fight at every corner. I just cannot install and access TWRP on my device which is important for so many task.

what exactly is the problem?

I am trying to get root access on my Ruggex Rhino device, I had it all working when it was running Android 5.1 but the OS had to be upgraded to Android 6 or above for the new program to work, it is now on Android 7 .
I tryed the original method using King root but that fails to root and having read these forums it appears the way forward is to use Magisk rather than super user but that is another issue. This device on Android 7 does not have any recovery mode, power button and volume up just states no command and not sure if this is anything to do with my problems.
My ideal end goal would be a device running just the one navigation program and all the rest gone including phone module but have been told that is not possible so have to live with the bloated.
Roy

So you are the one who is confusing different things.
King root is so called one-click rooting app that tries to find exploit in its online database and provides root. This method is outdated, you can read more about here
https://android.stackexchange.com/questions/205706
the only one-click rooting app still working I am aware of is mtk-easy-su based on mtk-su exploit and magisk.
the "no command" screen is part of your stock recovery. this indicates your custom recovery has been replaced by stock recovery. read about "no command" screen here
https://android.stackexchange.com/questions/155705
installing custom recovery on android devices will break boot chain of trust. device will boot-loop and deny booting. therefore android will restore stock recovery on each boot, unless you disabled that feature.
read about dm-verity and stock recovery failsafe here
https://android.stackexchange.com/questions/214902
systemless-root is the root method available with SuperSU or Magisk, where system partition no longer is modified (to keep it healthy for updates). instead, the boot partition is modified, that requires bootloader to be unlocked (most devices).
bootloader unlocking will factory reset your device. some older devices allow installing custom recovery on locked bootloader, but you need to find a way to flash it.

Thats good information, move on away from Kingroot due to obsolescence and look into systemless root which from what I have gathered so far is not detected by the system. I will initially look into SuperSu as that was running on Android 5.1, I remember it used to ask for permision to access root and so far Magisk has just taken me round in circles. But first I will look at those articles and see what I can learn.
thanks Roy

actually, rooting with SuperSU is done by flashing SuperSU zip from TWRP. I couldn't find TWRP for your device, but we can help you porting generic TWRP for your device.
rooting with Magisk is done without TWRP
- unlock bootloader (+ factory reset)
- install Magisk apk
- patch boot.img with Magisk app
- flash patched boot.img
(see Installation Instructions)