Has anyone had much experience with the TiVo Stream 4K yet? I have 2 questions really. I would like to accomplish both without rooting the device.
1) Is there a way to skip the initial TiVo activation? I've tried powering off the device once it gets to that screen, but it starts right back up to the activation. I've tried hitting home, back, skip, everything I can think of, but it won't let me move on until the device is activated on a TiVo account. I want to help a buddy out by setting up his device for him, but I don't want the device to be locked to my TiVo account. I may be able to clear data on the TiVo app and remove it from my TiVo account manually (I haven't tried that yet), but I'd like to just skip the whole TiVo activation and let my friend do it all himself (set preferences, services to monitor, etc).
2) Has anyone been able to remove the TiVo Suggestions Channel from the Android TV home screen? When you go into the Channel Customization, you can deselect all channels but the TiVo Suggestions Channel. I can't even get it to move down the list (all other channels you can go left on the channel and move or remove, but that option isn't available for the TiVo suggestions Channel). I've tried clearing data on the TiVo apps. I've even tried disabling the TiVo and Sling apps, but the channel remains (and if you click it when the apps are disabled, it just errors out loading the app).
The important thing with both of those is it must be done without Root. I want Google Play to remain genuine so Netflix and other streaming apps work properly.
From what I can tell, No and No unfortunately. If you disable the Tivo app as well, the block in the launcher remains and won't go away. If you click it, its magically working again and not disabled. I'm fairly certain they modified the launcher and worked the Tivo stuff is permanent as for the price. The hardware is made by another company, same one that makes their AirTV2 tuner for sling. So I would just setup the tivo stuff under your tivo email. If your friend isn't going to use Tivo services in any way, it won't be an issue for you.
https://photos.app.goo.gl/pNcD361dJLsxTxMK9
I went through the original setup and configured it as it expected me to. Then I uninstalled most of the apps it comes bloated with. The ones I couldn't uninstall, I disabled at least visually. Then I installed Wolf Launcher and modified it to my liking. I then moddifed the remote to make the tivo button to open tivimate with a single click and vod apk with double click. I also made the Guide single click to open app history and double to open "Power off, Restart and Screenshot". Sometimes pressing tivo button would bring up the tivo guide and tivimate, so I disabled the tivo app, sling and most other crap entirely I didn't want running in the given app settings.
The only button I could not override was the Netflix button. You cannot uninstall Netflix either, but I believe you can disable it. My device runs incredibly smooth now and my display stays off when I use the power options above. Playback of vod does flicker sometimes, but I feel sure that will get resolved with a future update.
USAMac said:
https://photos.app.goo.gl/pNcD361dJLsxTxMK9
I went through the original setup and configured it as it expected me to. Then I uninstalled most of the apps it comes bloated with. The ones I couldn't uninstall, I disabled at least visually. Then I installed Wolf Launcher and modified it to my liking. I then moddifed the remote to make the tivo button to open tivimate with a single click and vod apk with double click. I also made the Guide single click to open app history and double to open "Power off, Restart and Screenshot". Sometimes pressing tivo button would bring up the tivo guide and tivimate, so I disabled the tivo app, sling and most other crap entirely I didn't want running in the given app settings.
The only button I could not override was the Netflix button. You cannot uninstall Netflix either, but I believe you can disable it. My device runs incredibly smooth now and my display stays off when I use the power options above. Playback of vod does flicker sometimes, but I feel sure that will get resolved with a future update.
Click to expand...
Click to collapse
Which button remapper app did you use? Might want to do something similar.
Also, not sure if it's just the hub I bought, but the Aukey USB type c 4 port hub doesn't work on the stream, but it does on my Huawei. Strangely a generic type c otg with a USB Ethernet adapter works fine.
siralsmooth said:
Which button remapper app did you use? Might want to do something similar.
Also, not sure if it's just the hub I bought, but the Aukey USB type c 4 port hub doesn't work on the stream, but it does on my Huawei. Strangely a generic type c otg with a USB Ethernet adapter works fine.
Click to expand...
Click to collapse
Yea I've had issues with ethernet connection as well. I believe there will be an update soon to resolve alot of the issues. My anker and amazon after ethernet adapters don't work, but I've read ugreen works but some say its unstable.
Anyhow, I used ButtonMapper
siralsmooth said:
Which button remapper app did you use? Might want to do something similar.
Also, not sure if it's just the hub I bought, but the Aukey USB type c 4 port hub doesn't work on the stream, but it does on my Huawei. Strangely a generic type c otg with a USB Ethernet adapter works fine.
Click to expand...
Click to collapse
Hey sorry for the delay! I used ButtonMapper.. and yea, there are alot of externals not working.. hopefully, the pending update will resolve these issues as well!
Is there a way to install the Tivo app on this thing? Kind of ironic it doesn't come with it.
there is a debug version of the firmware
TIVO - Google Drive
drive.google.com
adb shell reboot fastboot
fastboot flashing unlock
fastboot flashing unlock_critical
fastboot reboot
adb disable-verity
adb reboot
adb root
adb remount
relook command is
fastboot flashing lock_critical
fastboot flashing lock
fastboot reboot
ben1226 said:
there is a debug version of the firmware
TIVO - Google Drive
drive.google.com
adb shell reboot fastboot
fastboot flashing unlock
fastboot flashing unlock_critical
fastboot reboot
adb disable-verity
adb reboot
adb root
adb remount
relook command is
fastboot flashing lock_critical
fastboot flashing lock
fastboot reboot
Click to expand...
Click to collapse
what is the point of debug version of the firmware? sorry just asking to clarify
chinkster said:
what is the point of debug version of the firmware? sorry just asking to clarify
Click to expand...
Click to collapse
i'm curious about this too. the new ts4k software is absolute trash, would love to be able to go backwards and keep it from doing updates if possible...but i need more clarity on what exactly this does.
crackers8199 said:
i'm curious about this too. the new ts4k software is absolute trash, would love to be able to go backwards and keep it from doing updates if possible...but i need more clarity on what exactly this does.
Click to expand...
Click to collapse
I see the commands but do you know exactly how to implement them to flash the firmware? Just asking I've been watching this thread for a while
jmanley69 said:
Has anyone been able to remove the TiVo Suggestions Channel from the Android TV home screen?
Click to expand...
Click to collapse
Might be a year late and I'm sure everyone knows this already but.
If you go to apps system apps then disable the app I circled in this picture then restart your system it will let you freely customize everything on the homescreen. (Besides play next but that can be disabled)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ben1226 said:
there is a debug version of the firmware
TIVO - Google Drive
drive.google.com
adb shell reboot fastboot
fastboot flashing unlock
fastboot flashing unlock_critical
fastboot reboot
adb disable-verity
adb reboot
adb root
adb remount
relook command is
fastboot flashing lock_critical
fastboot flashing lock
fastboot reboot
Click to expand...
Click to collapse
So, it is important not to have the erase button checked. I mistakenly had it checked and now the device is stuck in USB download mode showing GX-CHIP (instead of worldcup) that is password protected and the password.bin provided does not seem to unlock it. Any guidance would be helpful.
For others, I have successfully downloaded the ota and have flashable images for anyone interested. If you haven't updated you can flash from fastboot, if you haven't then follow what @ben1226 has in TiVo gdrive remember to uncheck erase and then you should be able to unlock flashing from fastboot. The Rom already has a su binary (in /xbin) which can be enabled (permissions are set off by default) for those interested if one wants root.
EDIT: Attached the unmodified OTA update.
ota-type=BLOCK
post-build=eSTREAM4K/SEI400TV/SEI400TV:9/PI/5614:user/release-keys
post-build-incremental=5614
post-sdk-level=28
post-security-patch-level=2021-04-05
post-timestamp=1622542764
pre-device=SEI400TV
jahrule said:
So, it is important not to have the erase button checked. I mistakenly had it checked and now the device is stuck in USB download mode showing GX-CHIP (instead of worldcup) that is password protected and the password.bin provided does not seem to unlock it. Any guidance would be helpful.
For others, I have successfully downloaded the ota and have flashable images for anyone interested. If you haven't updated you can flash from fastboot, if you haven't then follow what @ben1226 has in TiVo gdrive remember to uncheck erase and then you should be able to unlock flashing from fastboot. The Rom already has a su binary (in /xbin) which can be enabled (permissions are set off by default) for those interested if one wants root.
EDIT: Attached the unmodified OTA update.
ota-type=BLOCK
post-build=eSTREAM4K/SEI400TV/SEI400TV:9/PI/5614:user/release-keys
post-build-incremental=5614
post-sdk-level=28
post-security-patch-level=2021-04-05
post-timestamp=1622542764
pre-device=SEI400TV
Click to expand...
Click to collapse
Is there a guide to do this the links you gave me dont show anything . I'm about to buy one and attempt this but I need instructions I mainly want root .
@tokoam The tools etc are found here https://drive.google.com/drive/folders/18PWax4UPUBAdgAz1R9KnmCNFlt6a3fjA?usp=sharing where @ben1226 linked.
basically don't update it when you first get it. In a few days I will have more as m currently working on something for it.
If you are inpatient and have some know how then: flash the update I provided above, but NOT the bootloader from there (the updated bootloader enables oem lock and so far have not found a way to expose the option in dev options). Then chmod the `su` binary located in /xbin/ and you should have root and be good to go.
flash the update I provided above ... Then chmod the `su` binary located in /xbin/ and you should have root and be good to go
Click to expand...
Click to collapse
I installed the update that you attached above (in post #13) but there is not any su binary located in /xbin/, or anywhere else.
This seems to make sense, because you say in post #13:
EDIT: Attached the unmodified OTA update.
But I'm not sure why you suggested that the 'su' binary would be there, if the update attached to post #13 was installed.
flash the update I provided above, but NOT the bootloader from there (the updated bootloader enables oem lock and so far have not found a way to expose the option in dev options)
Click to expand...
Click to collapse
I didn't flash the bootloader from the update (in post #13), but still the bootloader was locked after I installed the rest of the update. Even if I didn't update bootloader.img or boot.img, the bootloader still gets locked when installing the rest of the update attached to post #13. So, the update is locking the bootloader by other means, probably via system.
I could unlock the bootloader again only by re-flashing the userdebug verson via usb burning mode. But then, of course, I no longer have 5614.
Right the bootloader lock happens only when you flash a system.IMG which is not a user debug version. The su binary is in the debug system img. I think if we can expose the allow OEM unlock option in Dev settings then we would be good to ho. My device bricked in gx-chip mode that apparently uses a different password then the one provided by Ben so im stuck there for now
goapy said:
I installed the update that you attached above (in post #13) but there is not any su binary located in /xbin/, or anywhere else.
This seems to make sense, because you say in post #13:
EDIT: Attached the unmodified OTA update.
But I'm not sure why you suggested that the 'su' binary would be there, if the update attached to post #13 was installed.
I didn't flash the bootloader from the update (in post #13), but still the bootloader was locked after I installed the rest of the update. Even if I didn't update bootloader.img or boot.img, the bootloader still gets locked when installing the rest of the update attached to post #13. So, the update is locking the bootloader by other means, probably via system.
I could unlock the bootloader again only by re-flashing the userdebug verson via usb burning mode. But then, of course, I no longer have 5614.
Click to expand...
Click to collapse
jahrule said:
Right the bootloader lock happens only when you flash a system.IMG which is not a user debug version. The su binary is in the debug system img. I think if we can expose the allow OEM unlock option in Dev settings then we would be good to ho. My device bricked in gx-chip mode that apparently uses a different password then the one provided by Ben so im stuck there for now
Click to expand...
Click to collapse
Here is something that can be done:
if (!showEnableOemUnlockPreference()) {
removePreference(this.mEnableOemUnlock);
this.mEnableOemUnlock = null;
That needs to he removed from tvsettings.apk
doing that is the easy part.. but installing the custom apk is the hard part.
need bootloader unlocked so we make changes to system.
the above is decompiled from the userdebug build.
also:
private static boolean showEnableOemUnlockPreference() {
return !SystemProperties.get("ro.frp.pst").equals("");
}
private boolean isOemUnlockAllowed() {
return !this.mUm.hasUserRestriction("no_oem_unlock");
}
pretty much: ro.frp.pst = 1 or true should turn on OEM unlock in developer options.
BTW: user restrictions only means, you must be logged into box with correct username and all..
bypassing settings and logging on as guest or whatever will not show any developer options..
that is what it means about user restrictions..
The circuit board used in the tivo stream 4k has a place for a micro sd card socket. I'm going to install a socket and check if it works.
I read on reddit this morning that the android 10 update started on 3/17. No sign of it on my hardware yet.
Related
I installed the OTA update last night and it's just looping through the "alcatel one touch" and "smart move" screens. It's been like that for hours.
I need assistance in getting into recovery mode, and hopefully getting my files off the device.
I have downloaded android-studio and am about to install it to get adb and fastboot, and have downloaded the drivers for the idol 3. At this point when it's plugged in, my computer doesn't recognize the device.
If you did not have usb debugging enabled BEFORE the boot loop installing adb and fastboot now won't do you any good. Are you still able to get into recovery and is it twrp or the factory recovery? Without a direct way to get the phone into bootloader regretfully the only solution is to send it in for warranty repair (or replacement via your credit card if you paid that way under purchase protection)
Are you trying to remove the data to prevent access by others or because you need the data? Did you make any backups to external sd or copied to the pc?
I as well am stuck in bootloop. Was able to get into factory recovery and reset phone several times. Still no luck. I have a TWRP backup, but how to I do a temporary boot into it? Only option available in factory recovery was to sideload via ADB, but no luck using fastboot commands there. Phoned Alcatel and they have referred me back to Amazon. Amazon only wants to refund me, won't exchange! Of course I bought at the pre-order price. Any help would be greatly appreciated.
wrench588 said:
I as well am stuck in bootloop. Was able to get into factory recovery and reset phone several times. Still no luck. I have a TWRP backup, but how to I do a temporary boot into it? Only option available in factory recovery was to sideload via ADB, but no luck using fastboot commands there. Phoned Alcatel and they have referred me back to Amazon. Amazon only wants to refund me, won't exchange! Of course I bought at the pre-order price. Any help would be greatly appreciated.
Click to expand...
Click to collapse
The factory reset killed you....if you had usb debugging enabled prior and had not done a factory reset (which kills /data) you could have possibly gotten to an adb shell long enough to do an adb reboot bootloader. The problem is there's no way now to get you into bootloader....you can't get to it from recovery (factory).
If you purchased it by credit card you might see if their purchase protection (typically 60-90 days) allows a claim submission for a replacement....in this case they would cut you a check for the cost of a replacement after mailing in your old one. That's the only solution I see to remain at the $199 price.
You could also see if amazon will issue a $50 credit to your account in addition to return to allow for repurchase. Unlikely but possible.
Ok thanks for the input and advice. As a last ditch effort, is there a way to create or modify the twrp file as a "signed" zip file so that I could boot into it via stock recovery. This was how I rooted my old Galaxy S2, although it was a CWM recovery.
wrench588 said:
Ok thanks for the input and advice. As a last ditch effort, is there a way to create or modify the twrp file as a "signed" zip file so that I could boot into it via stock recovery. This was how I rooted my old Galaxy S2, although it was a CWM recovery.
Click to expand...
Click to collapse
Nothing so far has worked in that regard...in fact I created a update.zip using "zipme" to replace the build.prop that another user says the factory recovery refused to process.
Without a full factory rom to pull needed info in or the source code to compile one we can't do some of the things which would "save" the device.
wrench588 said:
...Only option available in factory recovery was to sideload via ADB, but no luck using fastboot commands there.
Click to expand...
Click to collapse
Strange ... the stock recovery of 6039y has an option for reboot to the bootloader.
petrov.0 said:
Strange ... the stock recovery of 6039y has an option for reboot to the bootloader.
Click to expand...
Click to collapse
Can you post a screenshot where the option is? I'm not doubting your word but perhaps he's looking in the wrong place? I'm back on TWRP so can't look in the stock recovery myself.
famewolf said:
Can you post a screenshot where the option is? I'm not doubting your word but perhaps he's looking in the wrong place? I'm back on TWRP so can't look in the stock recovery myself.
Click to expand...
Click to collapse
There is no option for screenshot while the phone is in the stock recovery. I need a camera to take a picture of the menu. I can do this later. The menu however looks like this:
Code:
reboot system now
apply update from ADB
apply update from sdcard
apply update from phone storage
wipe data/factory reset
wipe cache partition
reboot to bootloader
power down
view recovery log
petrov.0 said:
There is no option for screenshot while the phone is in the stock recovery. I need a camera to take a picture of the menu. I can do this later. The menu however looks like this:
Code:
reboot system now
apply update from ADB
apply update from sdcard
apply update from phone storage
wipe data/factory reset
wipe cache partition
reboot to bootloader
power down
view recovery log
Click to expand...
Click to collapse
If it's right off the main page like that then I can confirm it's not on the 6045. It's been one of the main issues with folks bricking their devices...if their rom gets messed up and they have factory recovery they have no way to get into bootloader to do anything to repair the device. Seems alcatel needs to add the reboot to bootloader to our recovery. I wonder where we could report that.
Is there a way to "lock" recovery so the updates cannot replace twrp? TWRP allows adb access and reboot to bootloader.
famewolf said:
If it's right off the main page like that then I can confirm it's not on the 6045. It's been one of the main issues with folks bricking their devices...if their rom gets messed up and they have factory recovery they have no way to get into bootloader to do anything to repair the device. Seems alcatel needs to add the reboot to bootloader to our recovery. I wonder where we could report that.
Is there a way to "lock" recovery so the updates cannot replace twrp? TWRP allows adb access and reboot to bootloader.
Click to expand...
Click to collapse
This is a snapshot from the recovery menu of 6039y.
The short answer of your question regarding the "lock" is ... no. If a longer explanation is needed ... this is from the update file, a link to which was provided by you:
Code:
if ! applypatch -c EMMC:/dev/block/bootdevice/by-name/recovery:18393344:f9062580503eb61b315a5d12c5c6b3bb133aa4b2; then
....etc.
what it does is to check the sha1 sum of the recovery partition and if the sha1 sum doesn't match to f9062580503eb61b315a5d12c5c6b3bb133aa4b2 will continue with an overwriting of the recovery partition and then will apply a patch. It can't be changed because the whole update will fail.
yep no bootloader
I've got reboot to boatloader on main page from stock recovery on my 6045k
Sent from hell
famewolf said:
Is there a way to "lock" recovery so the updates cannot replace twrp? TWRP allows adb access and reboot to bootloader.
Click to expand...
Click to collapse
Back to the "lock" question. Probably it is possible the OTA update to be slightly modified and then to be flashed through the TWRP recovery (there is an option in TWRP to skip the signature verification ... the verification will fail if the zip file is modified). But I prefer to wait for the OTA update of the 6039y, as I want to perform some tests with the upgrade.
ractar28 said:
I installed the OTA update last night and it's just looping through the "alcatel one touch" and "smart move" screens. It's been like that for hours.
I need assistance in getting into recovery mode, and hopefully getting my files off the device.
I have downloaded android-studio and am about to install it to get adb and fastboot, and have downloaded the drivers for the idol 3. At this point when it's plugged in, my computer doesn't recognize the device.
Click to expand...
Click to collapse
I am in the same boat as OP re the state my Idol 3 (6045i) is currently in. I also unchecked superuser but did not unroot completely before installing the update. I have not yet done a data wipe through recovery though. Unfortunately, back when I rooted the phone I did NOT check the box telling the phone to remember the computer/RSA key for future use. As a result, now when the phone is stuck at the white/animated Alcatel boot logo I can see the phone under adb devices, but it shows as unauthorized.
One thing that did seem odd, was browsing through stock recovery when trying to browse to apply an update from either phone storage or the SD card, no files are showing up at all. All it is showing is the folder root ( /.. ) in both instances and nothing else. Even after I attempted loading several system update and twrp images (in .zip and .img formats) on the SD card from my computer, once loaded in the phone none of the files show up through stock recovery. Is this SD card not compatible/formatted wrong or is something else going on?
Is there any current method to gaining access to the phone via adb manupulating the adbkey files in the $User$/Home/.android folder? I do currently have the adbkey files on my Mac from connecting the phone previously. I'm assuming these files are uniquely generated hashes?
That is ridiculous if the 6045k has bootloader access from recovery and 6045i does not. What would be the reasoning for this?
Nikola Jovanovic said:
I've got reboot to boatloader on main page from stock recovery on my 6045k
Sent from hell
Click to expand...
Click to collapse
Does the sha1 sum of your recovery happen to match f9062580503eb61b315a5d12c5c6b3bb133aa4b2 ? If so it could solve some issues but why do I suddenly think all 3 models have their own recovery?
---------- Post added at 08:47 AM ---------- Previous post was at 08:43 AM ----------
n3tnut said:
I am in the same boat as OP re the state my Idol 3 (6045i) is currently in. I also unchecked superuser but did not unroot completely before installing the update. I have not yet done a data wipe through recovery though. Unfortunately, back when I rooted the phone I did NOT check the box telling the phone to remember the computer/RSA key for future use. As a result, now when the phone is stuck at the white/animated Alcatel boot logo I can see the phone under adb devices, but it shows as unauthorized.
One thing that did seem odd, was browsing through stock recovery when trying to browse to apply an update from either phone storage or the SD card, no files are showing up at all. All it is showing is the folder root ( /.. ) in both instances and nothing else. Even after I attempted loading several system update and twrp images (in .zip and .img formats) on the SD card from my computer, once loaded in the phone none of the files show up through stock recovery. Is this SD card not compatible/formatted wrong or is something else going on?
Is there any current method to gaining access to the phone via adb manupulating the adbkey files in the $User$/Home/.android folder? I do currently have the adbkey files on my Mac from connecting the phone previously. I'm assuming these files are uniquely generated hashes?
That is ridiculous if the 6045k has bootloader access from recovery and 6045i does not. What would be the reasoning for this?
Click to expand...
Click to collapse
adb reboot bootloader won't work even with it showing unauthorized? If you can get into bootloader you can fix /system without messing up your /data (don't wipe data or you lose adb entirely...you may figure out how to add the correct hash if we can find how it's generated)
Here's some info on the hashes you might find useful taken from: http://nelenkov.blogspot.com/2013/02/secure-usb-debugging-in-android-422.html
Secure ADB implementation
The ADB host authentication functionality is enabled by default when the ro.adb.secure system property is set to 1, and there is no way to disable it via the system settings interface (which is a good thing). The device is initially in the OFFLINE state and only goes into the ONLINE state once the host has authenticated. As you may already know, hosts use RSA keys in order to authenticate to the ADB daemon on the device. Authentication is typically a three step process:
After a host tries to connect, the device sends and AUTH message of type TOKEN that includes a 20 byte random value (read from /dev/urandom).
The host responds with a SIGNATURE packet that includes a SHA1withRSA signature of the random token with one of its private keys.
The device tries to verify the received signature, and if signature verification succeeds, it responds with a CONNECT message and goes into the ONLINE state. If verification fails, either because the signature value doesn't match or because there is no corresponding public key to verify with, the device sends another AUTH TOKEN with a new random value, so that the host can try authenticating again (slowing down if the number of failures goes over a certain threshold).
Signature verification typically fails the first time you connect the device to a new host because it doesn't yet have the host key. In that case the host sends its public key in an AUTH RSAPUBLICKEY message. The device takes the MD5 hash of that key and displays it in the 'Allow USB debugging' confirmation dialog. Since adbd is a native daemon, the key needs to be passed to the main Android OS. This is accomplished by simply writing the key to a local socket (aptly named, 'adbd'). When you enable ADB debugging from the developer settings screen, a thread that listens to the 'adbd' socket is started. When it receives a message starting with "PK" it treats it as a public key, parses it, calculates the MD5 hash and displays the confirmation dialog (an activity actually, part of the SystemUI package). If you tap 'OK', it sends a simple simple "OK" response and adbd uses the key to verify the authentication message (otherwise it just stays offline). In case you check the 'Always allow from this computer' checkbox, the public key is written to disk and automatically used for signature verification the next time you connect to the same host. The allow/deny debugging functionality, along with starting/stopping the adbd daemon, is exposed as public methods of the UsbDeviceManager system service.
We've described the ADB authentication protocol in some detail, but haven't said much about the actual keys used in the process. Those are 2048-bit RSA keys and are generated by the local ADB server. They are typically stored in $HOME/.android as adbkey and adbkey.pub. On Windows that usually translates to %USERPOFILE%\.android, but keys might end up in C:\Windows\System32\config\systemprofile\.android in some cases (see issue 49465). The default key directory can be overridden by setting the ANDROID_SDK_HOME environment variable. If the ADB_VENDOR_KEYS environment variable is set, the directory it points to is also searched for keys. If no keys are found in any of the above locations, a new key pair is generated and saved. On the device, keys are stored in the /data/misc/adb/adb_keys file, and new authorized keys are appended to the same file as you accept them. Read-only 'vendor keys' are stored in the /adb_keys file, but it doesn't seem to exist on current Nexus devices. The private key is in standard OpenSSL PEM format, while the public one consists of the Base 64 encoded key followed by a `[email protected]` user identifier, separated by space. The user identifier doesn't seem to be used at the moment and is only meaningful on Unix-based OS'es, on Windows it is always '[email protected]'.
While the USB debugging confirmation dialog helpfully displays a key fingerprint to let you verify you are connected to the expected host, the adb client doesn't have a handy command to print the fingerprint of the host key. You might think that there is little room for confusion: after all there is only one cable plugged to a single machine, but if you are running a couple of VMs, thing can get a little fuzzy. Here's one of way of displaying the host key's fingerprint in the same format the confirmation dialog uses (run in $HOME/.android or specify the full path to the public key file):
awk '{print $1}' < adbkey.pub|openssl base64 -A -d -a \
|openssl md5 -c|awk '{print $2}'|tr '[:lower:]' '[:upper:]'
We've reviewed how secure ADB debugging is implemented and have shown why it is needed, but just to show that all of this solves a real problem, we'll finish off with a screenshot of what a failed ADB attack against an 4.2.2 device from another Android device looks like:
famewolf said:
adb reboot bootloader won't work even with it showing unauthorized? If you can get into bootloader you can fix /system without messing up your /data (don't wipe data or you lose adb entirely...you may figure out how to add the correct hash if we can find how it's generated)
Click to expand...
Click to collapse
Just tested using adb reboot bootloader again and this is the result: error: device unauthorized. Please check the confirmation dialog on your device.
Something else I tried was running fastboot commands in the narrow window that the phone initially boots (black screen with Android logo) but that didn't seem to work either. I tried:
fastboot reboot-bootloader
fastboot -i 0x1bbb reboot-bootloader
fastboot -i 0x1bbb devices
I noticed if you plug the phone into the computer via USB while the phone is off, it will briefly power on to the Android logo/black screen before flashing the battery status once and turning off. Is this an opportunity to send fastboot or adb commands to the phone?
I'll try messing with the adbkey stuff later when I have time to dig into it.
There is a tool from Alcatel (TCL) which can perform upgrades of the device from a Windows PC. You can try it if nothing else helps. There are two COM ports available under Windows when the device is powered off and the USB cable is connected to the phone. This tool use them to perform some checks on the device and probably will continue with an upgrade (it says that all of your data will be wiped after the upgrade etc. so there is a possibility to overwrite everything with a stock image) ... there are instructions how to work with it. The link is from the French support section of Alcatel. Despite that the program has support for 6039 and 6045 is not clear for which of their versions.
petrov.0 said:
There is a tool from Alcatel (TCL) which can perform upgrades of the device from a Windows PC. You can try it if nothing else helps. There are two COM ports available under Windows when the device is powered off and the USB cable is connected to the phone. This tool use them to perform some checks on the device and probably will continue with an upgrade (it says that all of your data will be wiped after the upgrade etc. so there is a possibility to overwrite everything with a stock image) ... there are instructions how to work with it. The link is from the French support section of Alcatel. Despite that the program has support for 6039 and 6045 is not clear for which of their versions.
Click to expand...
Click to collapse
The problem is we currently have no stock images in the format it requires to flash to restore the device. I would think those have to be available first?
---------- Post added at 02:56 AM ---------- Previous post was at 02:55 AM ----------
n3tnut said:
Just tested using adb reboot bootloader again and this is the result: error: device unauthorized. Please check the confirmation dialog on your device.
Something else I tried was running fastboot commands in the narrow window that the phone initially boots (black screen with Android logo) but that didn't seem to work either. I tried:
fastboot reboot-bootloader
fastboot -i 0x1bbb reboot-bootloader
fastboot -i 0x1bbb devices
I noticed if you plug the phone into the computer via USB while the phone is off, it will briefly power on to the Android logo/black screen before flashing the battery status once and turning off. Is this an opportunity to send fastboot or adb commands to the phone?
I'll try messing with the adbkey stuff later when I have time to dig into it.
Click to expand...
Click to collapse
You can't do fastboot commands until the phone is IN bootloader....so you'd have to do adb reboot bootloader
adb devices
etc....
famewolf said:
The problem is we currently have no stock images in the format it requires to flash to restore the device. I would think those have to be available first?
Click to expand...
Click to collapse
It is possible the program to download these images from a server.
I found another interesting thing. The device has a download mode. It is activated when the phone is powered off and connected to a PC. You must wait the display to turn off after the charging battery symbol and then to press and hold both volume keys, after which to press and hold the power button (without releasing these for the volume). But still don't know what to do in this mode. No device is detected on my Linux box when the phone is in this state. Probably I should try in Windows.
Also when the Alcatel upgrade tool was trying to detect the phone I'm almost sure that one of the COM ports was
Qualcomm HS-USB Diagnostics 9006
there is a lot information for other devices how this can be used to unbrick your phone, so this is a some start. The images which the people flash through it are in raw format.
Root Guide for the T-Mobile LG V10
Read Post #2 - Great Info
Before we start, I like to mention that I did not create any of these files and I do not take credit for the work done. All I am doing is putting everything in one place and some helpful things that I had to google. This effort is mainly to make the process easier and more efficient as opposed to having to have several tabs or windows open to do it. I will make sure the proper thanks are given at the bottom
Click to expand...
Click to collapse
Instructions Start Here:
Warning - This will erase user data so you will have to set everything back up again! Always BACK UP YOUR DEVICE!!
1. Download the following tools for this process: adb-setup-1.4.3.exe, & twrp-2.8.7.1-h901.img, & UPDATE-SuperSU-v2.46.zip
Alternative ADB and Fastboot Option - (I Prefer) [GUIDE] Install Android SDK Standalone [ADB][30 Dec 2015] for Android SDK Standalone if you are interested
2. Install adb-set-up-1.4.3.exe to install the universal adb driver (Creates adb folder in C:\ if you don't already have adb setup)
3. Go to settings, about phone, software info and tap build number 5x to enable Developer Options
4. Check the Enable OEM unlock box to enable OEM Unlock
5. Enable USB debugging
6. Plug phone into the computer
7. Click on USB options on the phone and change it to PTP (USB Debugging will connect - Authorize Your Computer when prompted from phone)
Screenshots of Enabling USB Debugging and OEM Unlock
1.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2.
3.
4.
5.
6.
7. Open a Command Window and change directory to
Code:
[B]C:\adb[/B]
or if you have Android SDK type this below
Code:
[B]C:\Android\platform-tools[/B]
and type
Code:
[B][SIZE="3"]adb devices[/SIZE][/B]
8. You will Get Prompted after adb runs - Allow USB Debugging
8. From the Command Prompt, verify adb sees the device connected -
Open Command Prompt
Code:
cd C:\adb
Code:
adb devices
9. Reboot into the bootloader in command prompt by typing: adb reboot bootloader
10. You will now unlock the bootloader, verify, and Install TWRP
Note* - Make sure you copied twrp-2.8.7.1-h901.img into the C:\adb Folder already
Code:
[SIZE="3"]fastboot oem unlock
fastboot getvar unlocked
fastboot reboot-bootloader
fastboot flash recovery twrp-2.8.7.1-h901.img
fastboot boot twrp-2.8.7.1-h901.img[/SIZE]
11. You should be in TWRP Currently.
12. Reboot the device, it will delete user settings, so you need to repeat steps 3-8 to get adb set-up again
13. Now place UPDATE-SuperSU-v2.46.zip om your phone
14. Reboot into recovery
15. Back up YOUR EFS PARTITION
16. Wipe Cache and Dalvick Cache 3x
17. Flash UPDATE-SuperSU-v2.46.zip
18. You have successfully Unlocked the bootloader and Rooted your Device!!
19. SuperSU will prompt you to give tmobile.pr.adapt root privlidges, DENY
20. Navigate with Root Explorer to /system/priv-app/AdaptClient and rename AdaptClient.apk to AdaptClient.apk.bak and reboot
21. Finally, All done
Click to expand...
Click to collapse
USEFUL ROOTING LG V10 - by: Glenn Silvasy
Give Thanks To:
@KAsp3rd - http://forum.xda-developers.com/tmobile-lg-v10/development/recovery-unofficial-twrp-t3239740
@Chainfire - For Super User
@mikeyinid - Flashable Stock Image
@TheJesus - Providing img files for stock ROM, and OEM unlock Guide
@Snoop05 - ADB Drivers and Fastboot
And Anyone else that was missed!
Updated [31 Dec 2015]
References, Guides and Great Information - Please Read
LG-H901 Stock .img Files (Boot, System, and Recovery)
Go Here
LG-H901 Stock Flashable ZIP in TWRP
Go Herehttp://forum.xda-developers.com/lg-v10/development/lg-h901-stock-images-device-restore-t3241170http://forum.xda-developers.com/lg-v10/development/lg-h901-stock-images-device-restore-t3241170
TWRP
Go Here
ADB and Fastboot
Go Here #1
Go Here #2 - This can be reached from Go Here #1, but I posted it for a direct link to the tool just in case you miss it!
Android SDK Standalone Tools for ADB and Fastboot Devlopment Setup Guide
Go Here
Can't Get Into the Bootloader - Enter Fastboot Mode
Go Here
These links will have all the files you need in case you encounter any issues and I will also try to answer any questions within the scope of my knowledge. I been doing this for a while and there are tons of smart people on XDA. Please search for the question you want to ask to avoid issues, however, I do not believe in biting someones head off either. Researching is how you learn!! :good:
16. Wipe Cache and Dalvick Cache 3x
Click to expand...
Click to collapse
You seriously do not need to do that, this isn't 2010. In fact, if you ever do that when Xposed is installed, you'll cause a bootloop.
siraltus said:
You seriously do not need to do that, this isn't 2010. In fact, if you ever do that when Xposed is installed, you'll cause a bootloop.
Click to expand...
Click to collapse
Actually never caused a bootloop period...at worse it optimized all the apps installed which takes time, but hey thanks for the uneeded criticism
Edit: Also good thing xposed is not even a factor anyway. Sometimes you can not help being ignorant
Sent from my LG-H901 using Tapatalk
bdorr1105 said:
Actually never caused a bootloop period...at worse it optimized all the apps installed which takes time, but hey thanks for the uneeded criticism
Edit: Also good thing xposed is not even a factor anyway. Sometimes you can not help being ignorant
Sent from my LG-H901 using Tapatalk
Click to expand...
Click to collapse
I'm opening my prompt within the folder adb installed to (C:\adb), adb devices command isn't finding anything. I have the necessary things ticked in developer options. Driver issue maybe? thanks
I never did numbers 15, 16 & 20. Not even sure what number 20 is for. Care to explain?
baySF said:
I never did numbers 15, 16 & 20. Not even sure what number 20 is for. Care to explain?
Click to expand...
Click to collapse
Your EFS partition contains your IMEI number and modem partition that allows you to connect to LTE and data services. This happens on Samsung devices, although rare, it does happen. It is good to just back it up just in case you flash and something happens to that partition, your phone essentially becomes a paper weight. I have always wiped cache and dalvick before flashing anything, feel free to do it if you like, not required.. Lastly, when you have root, that app is a T-Mobile app trying to request root permissions, do not allow it. It is an uneeded app. The only useful T-Mobile apps are the Visual Voicemail, Mobile Hot Spot and T-Mobile My Account.
sleekgreek said:
I'm opening my prompt within the folder adb installed to (C:\adb), adb devices command isn't finding anything. I have the necessary things ticked in developer options. Driver issue maybe? thanks
Click to expand...
Click to collapse
After you unlocked developer settings and checked USB Debugging, did you remember to change your connection from MTP to PTP, once you do that it should prompt you on the phone to allow the connection
bdorr1105 said:
After you unlocked developer settings and checked USB Debugging, did you remember to change your connection from MTP to PTP, once you do that it should prompt you on the phone to allow the connection
Click to expand...
Click to collapse
Yes all checked, I never get the prompt though. Also in the device manager I'm seeing The yellow exclamation for "abd interface". This is such a simple process And I've been jacking with it for awhile. I've run the 15 sec ADB several times already. On windows 10 btw
edit: changing to PTP also
sleekgreek said:
Yes all checked, I never get the prompt though. Also in the device manager I'm seeing The yellow exclamation for "abd interface". This is such a simple process And I've been jacking with it for awhile. I've run the 15 sec ADB several times already. On windows 10 btw
edit: changing to PTP also
Click to expand...
Click to collapse
I am on windows 10, so the adb driver is not installed. Did you run the universal adb driver I have posted in the OP. Run that, then ensure your phone is on PTP. If you still have that yellow exclamation point, right click, uninstall driver, then scan for hardware changes and once the driver is installed correctly, you will be good to go
bdorr1105 said:
I am on windows 10, so the adb driver is not installed. Did you run the universal adb driver I have posted in the OP. Run that, then ensure your phone is on PTP. If you still have that yellow exclamation point, right click, uninstall driver, then scan for hardware changes and once the driver is installed correctly, you will be good to go
Click to expand...
Click to collapse
adb-set-up-1.4.3.exe , yes I've installed that several times. I go to that installed folder (C:abd) and open my command prompt from within it. Maybe I'll just get the sdk again, seems like a real simple issue I can't get sorted. Freaking aggravating
sleekgreek said:
adb-set-up-1.4.3.exe , yes I've installed that several times. I go to that installed folder (C:abd) and open my command prompt from within it. Maybe I'll just get the sdk again, seems like a real simple issue I can't get sorted. Freaking aggravating
Click to expand...
Click to collapse
Well adb wont work unless the driver is working, in device manager, if you have the yellow exclamation point, it wont work. You should have seen the Google ADB driver installer come up like a normal windows program installation. Your driver is giving you problems
Try the attached drivers, just extract the zip and point the computer to look in the location of the extracted folder. See if it makes the exclamation go away
bdorr1105 said:
Well adb wont work unless the driver is working, in device manager, if you have the yellow exclamation point, it wont work. You should have seen the Google ADB driver installer come up like a normal windows program installation. Your driver is giving you problems
Try the attached drivers, just extract the zip and point the computer to look in the location of the extracted folder. See if it makes the exclamation go away
Click to expand...
Click to collapse
Thats a no go also, it's saying windows was unable to install. Thanks for the help, I have to crash though, down to 4 hours sleep before work because of this phone lol. I've never had this issue before, maybe tomorrow I can get it sorted out. thanks again
Running fastboot oem unlock will always wipe your user data
KAsp3rd said:
Running fastboot oem unlock will always wipe your user data
Click to expand...
Click to collapse
Thanks for that info, I am surprised it wipes your data or even touches the user partition. Never would have guessed it was from oem unlock
Sent from my LG-H901 using Tapatalk
bdorr1105 said:
Your EFS partition contains your IMEI number and modem partition that allows you to connect to LTE and data services. This happens on Samsung devices, although rare, it does happen. It is good to just back it up just in case you flash and something happens to that partition, your phone essentially becomes a paper weight. I have always wiped cache and dalvick before flashing anything, feel free to do it if you like, not required.. Lastly, when you have root, that app is a T-Mobile app trying to request root permissions, do not allow it. It is an uneeded app. The only useful T-Mobile apps are the Visual Voicemail, Mobile Hot Spot and T-Mobile My Account.
Click to expand...
Click to collapse
Is there a way to check if your IMEI was wiped? I still have data and can still send messages and makes calls but whenever I'm at work, I'll always get "voice access restricted" and I never got that on my nexus 5. I also lose connection to my Wi-Fi at work and at home randomly because it says "avoided poor connection". Granted all I have to do is turn Wi-Fi off then back on but it's very annoying. Again, never happened on my nexus 5.
baySF said:
Is there a way to check if your IMEI was wiped? I still have data and can still send messages and makes calls but whenever I'm at work, I'll always get "voice access restricted" and I never got that on my nexus 5. I also lose connection to my Wi-Fi at work and at home randomly because it says "avoided poor connection". Granted all I have to do is turn Wi-Fi off then back on but it's very annoying. Again, never happened on my nexus 5.
Click to expand...
Click to collapse
If you can access LTE than you are solid.. Trust me you will know, you will get rejected from the network.. It is in settings>about>status it will say 0 or be blank if it missing... Rather be safe than sorry
Sent from my LG-H901 using Tapatalk
bdorr1105 said:
Actually never caused a bootloop period...at worse it optimized all the apps installed which takes time, but hey thanks for the uneeded criticism
Edit: Also good thing xposed is not even a factor anyway. Sometimes you can not help being ignorant
Click to expand...
Click to collapse
Clearing Dalvik bootlooped both my G4 and my V10 as well as others with Xposed installed, so I'm passing the warning, no need to be butthurt. Thanks for calling me ignorant, stay classy!
siraltus said:
Clearing Dalvik bootlooped both my G4 and my V10 as well as others with Xposed installed, so I'm passing the warning, no need to be butthurt. Thanks for calling me ignorant, stay classy!
Click to expand...
Click to collapse
I cleared cache and dalvick 3 times after installing xposed, but xposed was updated... Look at how you decided to tell me, in a condescending manner so maybe when I explained my side in the aggressive manner you did which was unnecessary, but anyway, learn to be classy before you ask someone else to be classy. Have a great week and merry Christmas bud
Sent from my LG-H901 using Tapatalk
bdorr1105 said:
I cleared cache and dalvick 3 times after installing xposed, but xposed was updated... Look at how you decided to tell me, in a condescending manner so maybe when I explained my side in the aggressive manner you did which was unnecessary, but anyway, learn to be classy before you ask someone else to be classy. Have a great week and merry Christmas bud
Sent from my LG-H901 using Tapatalk
Click to expand...
Click to collapse
Aggressive? Condescending? Wow. You need to check your ego at the door, buddy, it gets bruised way too easily.
Goal has been successfully achieved by a little bit of research and careful experimentation. Got to the middle of this post to find the complete solution.
I have a 4g Router Model: R660 also called 4g Wingle. The manufacturer is unknown as there is no branding on the device. But some say it is a GadgetIT product. I have scoured the internet and I cannot find the vendor named GadgetIT. But that is a separate discussion.
Main Goal: My main goal is to enable Virtual Server/Port forwarding in the device. The UI available when the device is connected is available at 192.168.1.1 with credentials admin/admin and Looks like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This device is marketed by ISP PTCL as CHARJI EVO . The users of PTCL charji on this forum might say that port forwarding is not possible in this device but I disagree. and I have evidence to support otherwise but again that is a separate discussion.
What I have found so far?
I am able to telnet to this device at 192.168.1.1 via admin/admin credentials. Here is what I get.:
Version
LNX.LE.4.1-41009-9x35
But admin is not root. There is a separate user called root which obviously has a different password. I have tried all common router password (not sure what all will constitute...but i have tried many).
The goal here is to root this device so that I can perform the necessary changes such as the following:
As you might have guessed by now, that i cannot unless I am root which I am not.
So I need your help guys. Here are other interesting things to look at:
I could edit mobileap_cfg.xml but I cannot because the file is readonly and I was unable to chmod it to 777 with an error message "Operation not permitted" indicating that I am not root and I can not make that happen.
The second thing i would like to do is to enable SNMP monitoring which I cannot do from the main interface because the vendor hid the option.
Lastly, enable firewall.
Interestingly, all these options are available in a tab called "Security" which the vendor has hidden from the configuration interface available at 192.168.1.1
So I am inviting the expert comments of all hackers that can help me make get it sorted out. Ideally, it would be awesome to have these options enabled from the UI (I am willing to hack, root this device and modify firmware if needed) to get this done.
This can potentially help millions of PTCL Charji Users who cannot run any kind of server using this device (including game servers) and any kind of listening services (sockets or WEB or FTP) r those who would like use torrents but suffer from terrible low download speeds on torrents because of not being able to open ports for incoming connections that significantly raise download speeds for torrent.
More details:
mobileap_cfg.xml ownership and permissions:
Appreciate your help. Waiting to hear helpful responses soon. Successfully rooted without any busy box.
Solution Achieved successfully- See Steps & detail as follows:
I was able to switch device to bootloader mode and was able to change root password and now I am able to switch to root mode when logged in via admin using telnet. I have successfully change the DMZ but i have yet to observe its effects. If it works, I will work on changing other values as well.
Detail:
The device closely resembles D-Link DWR 901 But mind you, it is NOT DWR 901. Even thought the radio matches, if you flash the firmware from DWR 901 (which will be successful), the device will NOT work. Since there is no available source of the original firmware of the device, the device will be of no use anymore. So do not do it.
Similary D-Link's DWM 222 is also similar to this device (only that DWM 222) is a 3G modem. I downloaded both firmwares and found out upon extraction of these firmwares, that it contains the following files.
Files that you actually need are present in this archive -
WARNING
Use at your own RISK!!. Flashing this directly to your Charji will brick you Charji device. So just follow the procedure I described and do not try to flash it directly otherwise it will render your device unable to connect even though everything will look all right in the software. The device will never connect again...ever!
https://www.dropbox.com/s/hqa2m4499pyrj3z/R660A-Donot-Flash-it-On-Charji-It-Will-Brick-Your-device.7z?dl=0
There is a file called dl.exe which can turn the device into download mode assumung you have the PTCL Charji Wingle R660 plugged into the USB port.
After that running adb devices command will list all the devices.
After that you need to run the following commands
Code:
adb shell
passwd
The adb shell command will take you to the shell.
The passwd command executed from shell will tell you to enter a new password for root user
You will have to provide a secure password for it to be accepted.
After that, it will update the root password.
exit the shell using the exit or quit command or simply close the command prompt.
Now, you can telnet to the device using the command
Code:
telnet 192.168.1.1
Login with username admin and password admin (if these are your credentials to access the router page, Use your credentials. Mine were admin/admin)
The issue the following command to switch to root mode
Code:
su
It will ask for root password. Enter the password you set using the adb shell you had used before. and viola. You will turn to root mode.
You you have two ways to fix the NAT/DMZ problem.
Either you can directly use the vi editor (my OpenEmbedded Linux OS installed on the device has only vi support) to edit the file mobileap_cfg.xml and update DMZ value and port forwarding values.
or you can enable the security tab by editing the menu.js file which is located in /WEBSERVER/www/ directory. Now I had a PTCL Charji R660. If you have a different device, your files will be located elsewhere with different sets of issues.
You can do whatever you want!
Older Updates
Update# 02:
DMZ is now working !!
Update# 03
Successfuly unlocked the hidden security tab but still untested. Will test it shortly.
Update # 04
Successfully unlocked Wizard
Update# 05
NAT Rules persisting and working, tested by download torrents and using CanYouSeeMe.ORG
Torrents Downloads working on max available speeds
Reserved 1
Reserved for additional instructions etc
Reserved 2
Good find but instructions are really ambiguous and unclear. What are you supposed to do with dl.exe? run it, stare at it, run it and press enter????
You are just trapping people into bricking their devices with this instruction.
Yes I am bad at providing instructions.
dl.exe once run, turns the charji into bootloader mode and then it is possible to run adb shell and adb commands.
Hope this helps. I will update the article to be more descriptive in future sometime. Don't have time right now.
Regards.
timematcher said:
dl.exe once run, turns the charji into bootloader mode and then it is possible to run adb shell and adb commands.
Click to expand...
Click to collapse
Ok you are still not being clear. What do you mean by run once? currently dl.exe shows
Code:
Welcome to use OnekeyUpdate Tool.
The Software to be updated:Desktop
Press 'Enter' to update or 'Q' to quit.
on opening. Should I press Enter?
Sorry about being rude in first comment. I am really angry right now over this device right now, what kind of stupidity is not allowing user to port forward.
raza1080p said:
Ok you are still not being clear. What do you mean by run once? currently dl.exe shows
Code:
Welcome to use OnekeyUpdate Tool.
The Software to be updated:Desktop
Press 'Enter' to update or 'Q' to quit.
on opening. Should I press Enter?
Sorry about being rude in first comment. I am really angry right now over this device right now, what kind of stupidity is not allowing user to port forward.
Click to expand...
Click to collapse
When you click Enter, it will say "Waiting for device...." and then "found"
That is the point the device will appear in device manager (on windows) as well. and Now is the time to run adb shell and corresponding commands in my first article.
Important thing to note is that if you have never rooted any android (or linux) based device/phone/tablet, I suggest you read more about running adb.
The goal of my article was the following:
1. reset root password on the OpenEmbedded Linux variant on teh charji wingle device
2. Login via Telnet to 192.168.1.1 (Charji web console) using admin/admin (default credentials of Charji)
3. change to root mode using su command
4. Be able to change the xml files ( i mentioned in the first post) that allow the user to create the firewall rules and virtual server entries.
Now at this point I did not know that the person who whitelabelled Charji wingle for PTCL simply had disabled the relevant code in menu.js that enabled the Virtual server entries and firewall entries and DMZ fields (that allow pot forwarding, open firewall or simply set an ip address for DMZ that opens everything to a single IP on charji local network).
Once I found out, I was really happy and now I created the virtual server entries for torrent which was my main problem.
Thanks to Dr.hack who created a proper tutorial on his blog based on information in this article in a more streamlined manner.
Dr. Hack's Blog, Root-hack-ptcl-charji-evo-nat/
thank you for the tutorial.I am trying it on a charji cloud R500A. when dl.exe finds the device it goes to "6% Downloading hex image" .Am i suppose to wait at this point?
And will i be able to use other sim on the the device after the root?
Tarar said:
thank you for the tutorial.I am trying it on a charji cloud R500A. when dl.exe finds the device it goes to "6% Downloading hex image" .Am i suppose to wait at this point?
And will i be able to use other sim on the the device after the root?
Click to expand...
Click to collapse
First things first!, Are you trying to flash the image from the firmware link I gave? You should really not do that!
The link i gave is only provided for firmware modding experts. It is not the firmware of Charji. So if you flash it, it will brick your device and it will become useless.
What you really need to use is th dl.exe file , copy it into a separate folder with no other stuff in it.
If you run it from the same folder, it will brick your device by flashing a firmware which will not work for your Charji. CHarji will never connect after that!
dl.exe must be run to turn the device into booloader mode, After that you have to run adb shell commands and make the necessary changes to reset the root user password.
I don't know if it will allow you to use another SIM or not. PTCL devices are usually NOT network locked. But again, this is not a tutorial for allowing the users to use another sim. It merely allows the user unlock Virtual Server, Firewall, DMZ settings and similar features which are hidden by PTCL.
And there is no such thing as "Telenet". Telnet is a client application in windows which is not installed by default. You will have to install Telnet Client from "Add Remove programs" in Windows. It is needed to access the device using the telnet protocol. Do some research on Telnet.
timematcher said:
First things first!, Are you trying to flash the image from the firmware link I gave? You should really not do that!
The link i gave is only provided for firmware modding experts. It is not the firmware of Charji. So if you flash it, it will brick your device and it will become useless.
What you really need to use is th dl.exe file , copy it into a separate folder with no other stuff in it.
If you run it from the same folder, it will brick your device by flashing a firmware which will not work for your Charji. CHarji will never connect after that!
dl.exe must be run to turn the device into booloader mode, After that you have to run adb shell commands and make the necessary changes to reset the root user password.
I don't know if it will allow you to use another SIM or not. PTCL devices are usually NOT network locked. But again, this is not a tutorial for allowing the users to use another sim. It merely allows the user unlock Virtual Server, Firewall, DMZ settings and similar features which are hidden by PTCL.
And there is no such thing as "Telenet". Telnet is a client application in windows which is not installed by default. You will have to install Telnet Client from "Add Remove programs" in Windows. It is needed to access the device using the telnet protocol. Do some research on Telnet.
Click to expand...
Click to collapse
Thank you so very much for the details.
Yeah i found out about telnet commands.but i was using the dl.exe in the same folder.i guess that's why adb devices wasn't able to find my device.
Luckily it didn't install that firmware.
I have bricked my device by accidentally runing the gui.exe and i was dont know that it will flash new firmware. is there any way to get back ?:crying:
If you are able to switch to fastboot mode and you have the original software in the right format, then you should be able to flash the new firmaware using the utilities provided in the original post. The only way I think. I will try to see if I can create an image for my Charji R660 but I can not promise anything.
Note that I bricked first of mine and I took it to the people who upgrade firmware of the device and they were unable to fix it. and I got a new one by being sneaky (and playing dubm) about it.
Or if you want to learn, maybe start experimenting a little bit but I think you will need the original firmware.
timematcher said:
When you click Enter, it will say "Waiting for device...." and then "found"
That is the point the device will appear in device manager (on windows) as well. and Now is the time to run adb shell and corresponding commands in my first article.
Important thing to note is that if you have never rooted any android (or linux) based device/phone/tablet, I suggest you read more about running adb.
The goal of my article was the following:
1. reset root password on the OpenEmbedded Linux variant on teh charji wingle device
2. Login via Telnet to 192.168.1.1 (Charji web console) using admin/admin (default credentials of Charji)
3. change to root mode using su command
4. Be able to change the xml files ( i mentioned in the first post) that allow the user to create the firewall rules and virtual server entries.
Now at this point I did not know that the person who whitelabelled Charji wingle for PTCL simply had disabled the relevant code in menu.js that enabled the Virtual server entries and firewall entries and DMZ fields (that allow pot forwarding, open firewall or simply set an ip address for DMZ that opens everything to a single IP on charji local network).
Once I found out, I was really happy and now I created the virtual server entries for torrent which was my main problem.
Thanks to Dr.hack who created a proper tutorial on his blog based on information in this article in a more streamlined manner.
Dr. Hack's Blog, Root-hack-ptcl-charji-evo-nat/
Click to expand...
Click to collapse
Hi dear friend how are you? I need original webui of PTCL Charji device For Huawei Ec8372u-876 device please can you share the link or any guidance for this
saqi755 said:
Hi dear friend how are you? I need original webui of PTCL Charji device For Huawei Ec8372u-876 device please can you share the link or any guidance for this
Click to expand...
Click to collapse
Or any other links of non modified original Loced Huawei firmware and Webui
Huawei Ec8372u-876 is a very good device compared to sh!t devices offered by PTCL before.
Here is what I have found on the web.
Its probably an unlocking solution and not a locked file.
I am in no way responsible for the quality of the file or the steps as I dont have this device and I can not test it before posting.
Please use these are your own risk. I at least downloaded the file and executed on local PC.
but that is pretty much it. Please use at your own risk.
PTCL Evo Charji Cloud
E5377u-872
How to Unlock Evo Charji E5377u-872
1: Battery Should be 100% Charged
2: Data Cable
3: A Pin
4. Unlocked file
Click to expand...
Click to collapse
Code:
www.mediafire.com/file/6td2bh12b4l6g9o/PTCL_charji_E5377u-872-www.hispeedsolution.com.exe/file
Process>>
1. Remove the battery from the device
2. Press & Hold Power Button + Reset Button on the same time after 5 seconds device will boot into download mode.
3. Connect to PC
4. Wait for drivers
5. After the drivers installed go to device manager & note down the port # namely appplication UI interface.
6. Run the *.exe file & enter the port # (E.g 19 or 20 or etc etc)
7. Let it flash the device, it will take about 5 minutes, after the flashing let the device reboot. Your device will stuck on the Huawei screen, Don't worry wait for 3 minutes then remove the battery insert any Sim card & turn on the device.
8. Your device is successfully unlocked on all network Sim.
9. Connect the device to PC & set up accordingly.
Click to expand...
Click to collapse
timematcher said:
Huawei Ec8372u-876 is a very good device compared to sh!t devices offered by PTCL before.
Here is what I have found on the web.
Its probably an unlocking solution and not a locked file.
I am in no way responsible for the quality of the file or the steps as I dont have this device and I can not test it before posting.
Please use these are your own risk. I at least downloaded the file and executed on local PC.
View attachment 5369881
but that is pretty much it. Please use at your own risk.
Code:
www.mediafire.com/file/6td2bh12b4l6g9o/PTCL_charji_E5377u-872-www.hispeedsolution.com.exe/file
Click to expand...
Click to collapse
Thanks for your cooperation but I need file for Ec8372u-876 this file is not working on this please check this again this is not a device with battery
Let me look into it.
timematcher said:
timematcher said:
Can we use other networks 4G in this device?
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Please reply if possible
sparking111 said:
Please reply if possible
Click to expand...
Click to collapse
Huawei 4G wingle should support other networks/SIMs once rooted.
I had a E8372h-608 4G wingle which was network locked to Telenor. After flashing it with network-neutral, universal firmware from huawei, it works for Ufone, Telenor, Warid/Jazz after appropriate AP configuration within the device UI.
Does that answer your query?
First of all, Thanks to @johndaniel, @htcmage, @gorEisberg @Forbesii @morphvale @arjun_m4 for sharing all the information and files required for this guide.
FIRST THING FIRST: Data is priceless. Always backup before you modify your phone software.
Disclaimer: Not every carrier in the world support VoLTE or VoWiFi. Please ask your carrier first to get more info if you don't know if they provide support to VoLTE and 5G. Tested on a Xperia 5 III (XQ-BQ72).
Prerequisites:
* Xperia 1 III or Xperia 5 III (This guide works on Android 12 and 13)
* Windows Computer
* Firmware for your device
* USB Cable
Downloading Firmware
Download XperiFirm from https://xperifirm.com/download/xperifirm-v4-6-0/ and Install
Open the XperiFirm and Download the firmware for your device ( check your model number and download the firmware)
Preparing the Device for Rooting
* Back up all the data from your device.
Make sure the device is supported for Bootloader unlock by opening the dialer and enter the code *#*#7378423#*#* and then press Service Info -> Configuration.
If the Bootloader unlock status is Yes, then you’re lucky and continue the rest of the guide.
Visit https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/ and Select your device and enter IMEI and get the code.
Enable Developer Options and then Enable OEM Unlocking and USB debugging on your device.
Download Platform tools for Windows using this link
https://dl.google.com/android/repository/platform-tools-latest-windows.zip
Open CMD and go to the Platform-tools directory and enter the below command:
adb reboot bootloader
Once it’s in bootloader mode or fastboot mode you will see blue light then type this command on CMD:
fastboot oem unlock 0xYOURKEY
Wait for the reply on cmd and then type
fastboot reboot
Now your device is Unlocked.
After reboot, configure your phone without entering Google Account's, we don't need this now, just connect your phone with a Wifi Network
Rooting
Download and Install Magisk in your phone from here
In your computer, open the firmware folder you have downloaded and look for boot.sin file it looks something like boot_X-FLASH-ALL-4BA8.sin with around 96MB size (might look different for other versions and regions)
Download UnSin Exe from https://forum.xda-developers.com/t/tool-unsin-sin-v3-v4-v5-unpacker-v1-13.3128106/ and then drag and drop the boot.sin this will give you boot.img
Rename the boot_X-FLASH-ALL-4BA8.img into boot.img (easier to flash) and then using Magisk Manager to patch it.
Just don’t delete the original boot.img we need that for the re-locking bootloader.
Now copy the magisk_patched.img into the Platform-tools folder and rename it into boot_magisk.img
Open CMD and go to the Platform-tools directory and enter the below command:
adb reboot bootloader
Once in fastboot mode type this command
fastboot flash boot boot_magisk.img
Wait for it and then type
fastboot reboot
After restarting your phone, open magisk and verify it's rooted.
How to extract your MBN files from your device's firmware
After rooting your phone, you can use a file explorer (in my case I use Solid Explorer, you can download it from here if you want).
Select the folder root inside the app and then look for your .mbn files searching in this path:
Code:
root/vendor/firmware_mnt/modem_pr/mcfg/configs/mcfg_sw/generic/(area)/(operator)/Commercial/mcfg_sw.mbn
Copy your mbn file to a normal folder in your phone, like "downloads" and then copy that file again to your computer.
Enabling 5G and Volte
Open CMD and go to the Platform-tools directory and enter the below command:
adb shell
su
setprop persist.usb.eng 1
Allow the access in Magisk after entering the su command.
If the phone, asks for Allow access press Deny.
Download QPST from https://qpsttool.com/ and install, also, you can find the Qualcomm Drivers inside the zip, install them.
After that, it should show up 3 Xperia on the device manager and install one by one manually using Qualcomm driver just youtube this part. Use Qualcomm USB diagnostic 9091 or 9081.
REMEMBER: To configure modem files in Efs explorer or flash the MBN file it is required to enter the following commands in adb:
adb devices (to start the usb debugging, allow your computer if is neccesary)
adb shell
su
setprop persist.usb.eng 1
Open QPST Configurator, check the list and find which COM port corresponds to "LAHAINA". Go to the device manager and disable the rest, ONLY KEEP THE PORT FOR LAHAINA. Quit any QPST tools after this.
Open command line in the EfsTools folder, type
Code:
./EfsTools.exe efsInfo
and press enter. No error should occur if you configured correctly, and the COM port in step 3 should be shown.
I attached some mbn files on this post, check if some of them are compatible with your carrier.
Select the mbn file from the mbn folder. Find the mbn file for your carrier. If you're using a secondary operator, please use the mbn file for the main operator (e.g. Telcel -> use ATT mbn). Copy the mcfg_sw.mbn to the root of the EfsTools folder, open a terminal inside this folder (shift + right click = open a new Powershell Window) then type.
Code:
./EfsTools.exe uploadDirectory -i mcfg_sw.mbn -o / -v
and press enter.
The program will overwrite your modem information updating it to the mbn file you flashed.
Open EFS Explorer and select LAHAINA if the name is there otherwise try one by one until you see a bunch of folders.
Once all the folders are showing up go to Policyman folder and copy carrier_policy.xml attached in this post and paste it there.
Restart the device.
You should now have the Speed of 5G or 4G+ and Volte enabled.
Don’t stop here.
Time to go back to Stock (Unroot)
Open CMD and go to the Platform-tools directory and enter the below command:
adb reboot bootloader
Remember the original boot.img we have before patching copy that file into platform tools and replace it with the patched boot_magisk.img
Then type this command:
fastboot flash boot boot.img
Once that’s done then type this command:
fastboot oem lock
Wait for the response and then type this command:
fastboot reboot
Once that’s done your device should format and bootloader locked and back to stock ROM with 5G and Volte enabled.
Enabling VOLTE Options after re-lock bootloader and unroot.
Go to Playstore and install Shizuku app.
With the app opened, open up a terminal and write
Code:
Code:
adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh
to start it
Check the app. It should say Shizuku is running.
Download and install this apk
In your app drawer find Pixel IMS app, open it and click on allow all the time for "Allow Pixel IMS to access Shizuku"
Hit the enable VoLTE button at the lower left.
Go to settings, mobile data settings and you will find the enable Volte Option or 4G Call.
Also, it kept working after uninstalling Pixel IMS and Shizuku apps.
You can restart the device and the Volte/5G will remain active.
Type
Code:
*#*#4636#*#*
in the phone original dialler. Select Phone Information, press the dots at the upper-right corner and select IMS Status, you can check if the IMS status is registered.
Now, you can enjoy VoLTE, VoWiFi, and even 5G (depends on your carrier's support).
How to Update your phone keeping your flashed mbn and carrier policy files.
Thanks to @bentree for the great idea, I just updated my phone with the firmware released today using newflasher and removing the modem files from the folder.
DON'T UPDATE USING OTA, download your most recent firmware with XperiFirm.
Download Newflasher (I'll attach the file on this post)
Extract the Newflasher files from the .rar file and copy them to the firmware's folder.
Remove the modem files from the folder, personally I removed these ones:
modem_X-FLASH-ALL-XXXX.sin
modemst1_X-FLASH-ALL-XXXX.sin
modemst2_X-FLASH-ALL-XXXX.sin
Open the NewFlasher.exe file and follow the steps in the command prompt.
Flash keeping your data.
After rebooting, your phone will boot as normal, but your will notice the Volte and VoWifi options are missed.
Repeat this step (Enabling VOLTE Options after re-lock bootloader and unroot).
Enjoy!
Amazing detailed guide. Thanks for sharing.
Quick question, can all of this be done on Android 13 now? And does it support 45/5G VoLTE/VoWifi on both SIMs?
I haven't upgraded for almost a year now coz everything was working fine on A12 with 4G VoLTE and VoWifi.
anmolkakkar said:
Amazing detailed guide. Thanks for sharing.
Quick question, can all of this be done on Android 13 now? And does it support 45/5G VoLTE/VoWifi on both SIMs?
I haven't upgraded for almost a year now coz everything was working fine on A12 with 4G VoLTE and VoWifi.
Click to expand...
Click to collapse
Of course I forgot to tell you that I achieve this on Android 13, last security patch. Firmware version 61.2.A.0.388.
My carrier doesn't support VoWifi, but remember the last step only provides to enable Volte option and no VoWifi, so you probably won't get VoWifi anyways.
My carrier (Jio (India)) supports both but just wanted to know if this on A13 now. Good to know.
Will risk upgrading tonight and see if I get successful. I will update here based on how it goes.
Yeme said:
You can't restart the device and the Volte/5G will remain active.
Click to expand...
Click to collapse
You can or can't restart the device? Will the settings stay after restarts?
anmolkakkar said:
You can or can't restart the device? Will the settings stay after restarts?
Click to expand...
Click to collapse
Yes, the settings stay after restarting, sorry the post was corrected.
Does unlocking bootloader loses drm keys ? If yes the how to backup drm keys and after relocking bootloader will drm keys restored ? And also will jio and Airtel 4g volte, 5g both work after this method? I have Sony xperia 5 iii xqbq 62 us variant. Looking forward to follow your method. Is this is same procedure for xq bq62 and xqbq72.
anmolkakkar said:
My carrier (Jio (India)) supports both but just wanted to know if this on A13 now. Good to know.
Will risk upgrading tonight and see if I get successful. I will update here based on how it goes.
Click to expand...
Click to collapse
Were you able to upgrade, Anmol? How did it go? (fingers crossed)
Updated to A13. Did all the process (i have my own process similar to this in a notepad). Airtel mbn files just DON'T work. Vowifi shows up but no calls can be placed coz the phone doesn't even show VoLTE on top if Wifi is off (even though IMS service status shows available). Some issue with the bands maybe. Mobile data works fine on 4G/5G for Airtel.
Jio works fine though all through.
Historically, Airtel didnt work for me in A12 too.
anmolkakkar said:
Updated to A13. Did all the process (i have my own process similar to this in a notepad). Airtel mbn files just DON'T work. Vowifi shows up but no calls can be placed coz the phone doesn't even show VoLTE on top if Wifi is off (even though IMS service status shows available). Some issue with the bands maybe. Mobile data works fine on 4G/5G for Airtel.
Jio works fine though all through.
Historically, Airtel didnt work for me in A12 too.
Click to expand...
Click to collapse
Thanks for the update, Anmol!
xperiafirm kam nhi krra
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So this might be an extremely stupid question, but once I restart my phone into bootloader via adb, the device is no longer in the list. adb devices will not display anything, reconnect doesn't care and fastboot obviously doesn't do anything either. Unplugging will shut down the phone normally and allow me to restart without changes.
I'm suspecting a driver problem, did anyone here have that same issue and knows how to quickly fix it?
Google USB Drivers are installed via Android studio (v13) and Xperia 5 III drivers are installed manually (by installing sa0200adb.inf).
Retenor said:
So this might be an extremely stupid question, but once I restart my phone into bootloader via adb, the device is no longer in the list. adb devices will not display anything, reconnect doesn't care and fastboot obviously doesn't do anything either. Unplugging will shut down the phone normally and allow me to restart without changes.
I'm suspecting a driver problem, did anyone here have that same issue and knows how to quickly fix it?
Google USB Drivers are installed via Android studio (v13) and Xperia 5 III drivers are installed manually (by installing sa0200adb.inf).
Click to expand...
Click to collapse
Check this video bro
I had the same issue, tell me if you could fix it.
Can you post a tutorial video?
For me and beginner
Yeme said:
Check this video bro
I had the same issue, tell me if you could fix it.
Click to expand...
Click to collapse
Wow, thanks for the quick reply, and yes, this worked flawlessly, thanks!
Is there also a list somewhere about which Magisk installation settings one has to check or leave unchecked for patching the boot.img?
Mmm I don't remember checking settings while patching the file. Leave everything as it is.
Retenor said:
Wow, thanks for the quick reply, and yes, this worked flawlessly, thanks!
Is there also a list somewhere about which Magisk installation settings one has to check or leave unchecked for patching the boot.img?
Click to expand...
Click to collapse
Yeme said:
Mmm I don't remember checking settings while patching the file. Leave everything as it is.
Click to expand...
Click to collapse
Turns out that is not even needed and just me reading too many guides and confusing things.
Anyways, I am rooted now, which was the plan from the start! VoLTE and VoWIFI was enabled for my provider from the getgo so I am done with low-level tinkering for now. Thanks for the assistance!
shoaib130088 said:
Can you post a tutorial video?
For me and beginner
Click to expand...
Click to collapse
Since I am now at the point where I did everything I can't record it anymore, but the guide is actually very straight-forward and specific about things. I suggest just following step-by-step and asking here if something is not clear.
If you run into the driver issue, you will have to do the same thing as done in the video above TWICE: once for when you unlock the bootloader and the second time when flashing the patched img.
Keep in mind the commands above only work (at least in powershell) without further ado when platform tools etc. is installed with PATH variable set (At least seems to be the issue for me, correct me if I'm wrong here). If you don't know what PATH is or don't want to set it, you can navigate to your platform-tools folder and then hold shift and right click to any blank area to bring up "open powershell here" in the context menu. This way you get an input shell right where you need it.
Then, don't enter "adb reboot bootloader" or similar, type in
Code:
.\adb.exe reboot
or whatever you want to input. This will call the exe from your current directory.
Same goes for flashing, typing
Code:
.\fastboot.exe flash boot .\boot_magisk.img
is equivalent to the one in the guide, provided you moved the boot_magisk.img file to the platform-tools folder.
I also encourage you to input
Code:
.\adb.exe devices
after each command step to make sure your device is still properly recognized. If it is not, you may need to go for the steps in the video.
So quick question. I know that the Samsung S21 5g uses same chipset. I need the mbn files from the samsung firmware but everytime I try to open the modem.bin file from the samsung firmware I get an unable to open as archive error. Every other Bin file I can open but not the modem file. Does anyone have a copy of the S21 5G modem files? Cheers, Bentree.
Any one help me to anydesk
Thanks @Yeme for support for successful xperia 1 iii volte wifi calling enable in India jio sim
QLink Serrano 3
Model No. HPP-L55B
By Hot Pepper Mobile
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Bootloader Unlocking
And Rooting Guide
OVERVIEW:
This guide provides step-by-step instructions for unlocking the bootloader and achieving root access on the QLink Serrano 3. Please note that this guide is specifically for the QLink variant of the Serrano 3 (HPP-H55L), as I have not verified the applicability of this guide on other carrier variants of this smartphone. To simplify the rooting procedure, and to cater this guide to new and inexperienced members, I have provided a boot image pre-patched for Magisk systemless root support below, in the downloads section.
IMPORTANT NOTE: The pre-patched boot image in the downloads section below corresponds with firmware build HPP-L55B-J-9.0.0. If your Serrano is running a different build, flashing the pre-patched boot image provided may or may not result in compatibility issues. In short, the best rule of thumb when achieving systemless root is to always patch an image that matches the firmware build installed on your device, otherwise you may encounter issues such as broken WiFi, broken Bluetooth, or your device may not boot at all. Should any members encounter issues of this sort, you may flash your device with the HPP-L55B-J-9.0.0 firmware by following my firmware restoration guide for the Serrano here: QLink Serrano 3 Firmware Restoration Guide
PREREQUISITES:
You will need a Windows PC or laptop with the ADB & fastboot tools installed. I have provided a link below for the latest Minimal ADB & Fastboot tools. You will need the factory supplied, or a quality equivalent micro USB to USB-A data syncing/charging cable. And, you will need your QLink Serrano 3 smartphone. I again emphasize that this guide has only been tested on the QLink variant of the Serrano (HPP-L55B).
DISCLAIMER:
The tasks outlined in this guide encompass inherent risks to the integrity and operability of your smartphone. Moreover, unlocking the bootloader/rooting the device will void any active manufacturer's warranty you may have on your Serrano. By proceeding further, you are assuming full responsibility for the state and health of your smartphone. As such, you are hereby absolving me of any responsibility or civil liability in the unfortunate event things go badly. This guide has been fully and thoroughly tested. Follow the instructions carefully, employ some patience, and pay attention to detail and I'm confident things will go smoothly. It should also be noted that the tasks outlined herein can be carried out using a Mac or Linux computer as well. This particular guide, however, will focus solely on a Windows -based setup.
I.. INSTALLING ADB & FASTBOOT
Because both tasks outlined in this guide require ADB/Fastboot communication between your phone and PC/laptop, this first section will focus on proper installation of the ADB & Fastboot utilities on your Windows computer. If you already have a working ADB/Fastboot environment, skip down to the next section on unlocking the bootloader. Otherwise, follow these steps:
Download the Minimal ADB & Fastboot tools installer from the link below. Right click the .exe file and opt to run it as an administrator. Follow the on-screen prompts and complete the installation;
Open the Windows File Explorer, go to This PC and open your C: drive directory. Open Program Files x86 and locate the Minimal ADB & Fastboot folder. Copy the folder and then paste it on your desktop (this step merely configures the ADB & Fastboot directory to a more convenient location from which to work);
Open the Minimal ADB & Fastboot folder and double click the file named cmd-here. A command prompt will open. Next, connect your Serrano to your Windows computer using a suitable micro USB to USB-A data syncing cable. Ensure that USB Debugging is enabled in your Developer Options menu.
In the command window you opened in the previous step, execute this command:
Code:
adb devices
Watch your device display for a USB Debugging authorization prompt. Grant the request. If properly connected, the command window will output an alphanumeric string consistent with your device serial number;
If the command window does not display your serial number, or if you get a WAITING notification, your smartphone isn't communicating properly with your PC or laptop. Try another data syncing cable,; change USB ports; and/or reinstall the Minimal ADB & Fastboot tools on your computer;
Once you have established proper device communication, we will now test fastboot mode communication. Execute this command:
Code:
adb reboot bootloader
Your device should now boot into fastboot mode, which will be illustrated by a darkly backlit display with the words => FASTBOOT mode.... displayed in a white font at the bottom-left of the screen;
Next, execute this command:
Code:
fastboot devices
Similar to before, if properly connected, the command window will display your device S/N. If you don't see your S/N, or if the command window says WAITING, you are not properly connected. Again, try changing USB ports, try another data syncing cable, and/or reinstall the Minimal ADb & Fastboot tools on your computer.
II. UNLOCKING THE BOOTLOADER
WARNING: Unlocking the bootloader triggers a native Android security mechanism that forces the device into a factory data reset. This will erase all saved userdata on your phone. Before proceeding further, make a backup of all saved userdata you wish to keep.
Open device Settings>System>Developer Options, and enable the OEM Unlock option;
Boot into fastboot mode by executing:
Code:
adb reboot bootloader
Once in fastboot mode, it's time to initiate bootloader unlocking. Execute this command:
Code:
fastboot flashing unlock
Your smartphone display will now prompt you to tap Volume + to proceed with unlocking, or Volume - to cancel;
After pressing Volume +, the unlock sequence will finish in just a few seconds. Now reboot to complete the process: Execute:
Code:
fastboot reboot
As mentioned previously, your phone will now initiate a mandatory factory data reset, after which your device will boot into the initial setup phase of the Android OS. Your bootloader is now officially unlocked.
III. ROOTING THE SMARTPHONE
Now that the bootloader is unlocked, attaining root access is very straightforward.
Download the patched boot image and vbmeta image files from the links below and save the files in your Minimal ADB & Fastboot folder;
Double click the cmd-here.exe file to open a command window. Execute this command to flash the patched boot image:
Code:
fastboot flash boot patched_boot.img
Now we will disable dm-verity by executing this command:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Now, execute this command to reboot your phone:
Code:
fastboot reboot
Upon reboot into the Android OS, locate the Magisk app or its stub placeholder in your app drawer. Open Magisk, grant any requested permissions, and follow any prompts to finish setting up the root environment. Magisk may initiate a reboot to complete root setup. If the Magisk app or its stub placeholder is not in your app drawer, download the Magisk v25.2 APK from the link below and install it on your phone. That's it. You are rooted with the Magisk v25.2 systemless root solution.
DOWNLOADS:
• Minimal ADB & Fastboot v1.4.3
• Patched boot.img
• vbmeta.img
• Official Magisk Releases (GitHub)
Thank you for this I'm going to try this. Here are some of the issues I have been having. When I plug it in to charge it. It keeps trying to boot and will not stop. I have to press the power button to buy bypass an error message that says this device is corrupted. I just got this phone from qulink (Amazon) and it was doing this since I opened it. It will not update the system. I believe the boot issue may have something to do with it. I'm not sure what kind of bloat wear it has but I do know something is running rapidly in the back ground I have practically no battery life and charging it is a night near. Another important question is can I use a chrome book to do the procedure? Any input would be greatly appreciated.
Thanks
John Bridges
John Bridges said:
Thank you for this I'm going to try this. Here are some of the issues I have been having. When I plug it in to charge it. It keeps trying to boot and will not stop. I have to press the power button to buy bypass an error message that says this device is corrupted. I just got this phone from qulink (Amazon) and it was doing this since I opened it. It will not update the system. I believe the boot issue may have something to do with it. I'm not sure what kind of bloat wear it has but I do know something is running rapidly in the back ground I have practically no battery life and charging it is a night near. Another important question is can I use a chrome book to do the procedure? Any input would be greatly appreciated.
Thanks
John Bridges
Click to expand...
Click to collapse
Greetings @John Bridges. You have come to the right place. Sounds like you're stuck in a classic boot loop. Flashing the factory firmware offered in my guide should certainly restore your device to its stock factory state.
The firmware, unfortunately, does include the typical bloatware specific to QLink devices. Of course,, once you get your phone restored via firmware flashing, you can always opt to unlock your bootloader, achieve root and debloat tie stock OS. So, your best option may be to first restore your device by installing firmware, and then rooting.
Serrano Firmware Restoration Guide
Greetings Viva,
Thanks for the great response. I will try your great advice and respect you for dedicating you're time to help the Android epidemic.
John Bridges said:
Greetings Viva,
Thanks for the great response. I will try your great advice and respect you for dedicating you're time to help the Android epidemic.
Click to expand...
Click to collapse
Thank you for the kind words. The type of boot loop you are experiencing is caused from data corruption that occurs when Android decrypts the /userdata partition during the boot sequence. By default, Android encrypts all data on this partition for user security; as such, whenever your device boots up, Android decrypts the data to make it accessible. If any errors or data corruption are incurred during this process, you will be promoted to either try again or perform a factory data reset.
Sorry I just saw your reference to the Chromebook. I'm afraid it won't be much help on this. My guide focuses on a Windows setup; however, Linux or Max can also be used. Out of curiosity, have you first tried factory resetting the phone?
Yes I did still didn't help When I'd tried to start it a message would appear saying the device is court press power button to continue and it came out of the box with this problem. I tried to update it and several different errors would show up,one was something about OTA, Would it be possible to do the procedure with a chrome book?
John Bridges said:
Yes I did still didn't help When I'd tried to start it a message would appear saying the device is court press power button to continue and it came out of the box with this problem. I tried to update it and several different errors would show up,one was something about OTA, Would it be possible to do the procedure with a chrome book?
Click to expand...
Click to collapse
The device is court I mean.
Corrupt I mean
John Bridges said:
Corrupt I mean
Click to expand...
Click to collapse
I understand on the device being data corrupted. Firmware restoration is definitely your best option. I know of no way to flash firmware using a Chromebook. I'll research it and see if it can be done.
Okay I did find an XDA guide on utilizing ADB & fastboot on Chromebook. https://forum.xda-developers.com/t/...-chromeos-adb-fastboot.2157230/#post-38232908
However, even the developers who posted in that thread refer to the procedure as extremely complex.
@John Bridges have you had any luck with restoring your firmware via Chromebook?
For those members who detest the abundance of bloatware included in the factory firmware package, I have unpacked the super.img, removed a considerable amount of the QLink apps, services and other bloatware, and then repacked the super.img. I have removed the annoying QLink lock screen, the QLink "free WiFi" service, a number of the preinstalled Google apps, and some other RAM demanding apps & services. I've noticed a remarkable improvement in performance on my own device as a result of debloating the stock OS in this manner.
I will post a new thread this weekend with this debloated stock OS, and instructions for fastboot installation. You will need an unlocked bootloader to install it.
VivaI
I just haven't had time to do it yet I am anxious to do it however and I will let you know how it went for sure.
VivaI and others,
It is a shame that people like myself that have to get these government phones to have one or hacked and it's a great thing you all are doing to give us a phone that will be actually uncorrupted. I don't know if this matters but the phone I got was from Amazon and it is supposed to be unlocked I don't know if that means the bootlegger is unlocked or anything else but I thought it may be helpful to you to know this.
John Bridges said:
VivaI and others,
It is a shame that people like myself that have to get these government phones to have one or hacked and it's a great thing you all are doing to give us a phone that will be actually uncorrupted. I don't know if this matters but the phone I got was from Amazon and it is supposed to be unlocked I don't know if that means the bootlegger is unlocked or anything else but I thought it may be helpful to you to know this.
Click to expand...
Click to collapse
And I'm talking about the phone or the replacement phone you get from q Link it is supposed to be unlocked and it comes from Amazon I checked on it online.
John Bridges said:
And I'm talking about the phone or the replacement phone you get from q Link it is supposed to be unlocked and it comes from Amazon I checked on it online.
Click to expand...
Click to collapse
To the best of my knowledge -- but not confirmed 100% -- all variants of the Serrano are GSM unlocked. Mine originally came from Amazon as well. By unlocked, I am referring to network unlocked and not the bootloader.
Very nice to know! I'm going to try and get it done tomorrow.
John Bridges said:
Very nice to know! I'm going to try and get it done tomorrow.
Click to expand...
Click to collapse
If you have any questions, or if you encounter any obstacles during the procedure, just let me know.
Viva La Android said:
For those members who detest the abundance of bloatware included in the factory firmware package, I have unpacked the super.img, removed a considerable amount of the QLink apps, services and other bloatware, and then repacked the super.img. I have removed the annoying QLink lock screen, the QLink "free WiFi" service, a number of the preinstalled Google apps, and some other RAM demanding apps & services. I've noticed a remarkable improvement in performance on my own device as a result of debloating the stock OS in this manner.
I will post a new thread this weekend with this debloated stock OS, and instructions for fastboot installation. You will need an unlocked bootloader to install it.
Click to expand...
Click to collapse
Could you share the link to this thread please? The search function on this forum is frustrating and not turning up any relevant results and with your profile set to private I coludn't search for your threads either.
Crap nevermind, I just noticed I could pull up threads you created using the search function and looks like it hasnt been posted yet. Could you update this thread when it is?
GIutton said:
Could you share the link to this thread please? The search function on this forum is frustrating and not turning up any relevant results and with your profile set to private I coludn't search for your threads either.
Crap nevermind, I just noticed I could pull up threads you created using the search function and looks like it hasnt been posted yet. Could you update this thread when it is?
Click to expand...
Click to collapse
Not finalized. There are bugs to work out.
Anyone know why we can't modify, add, or remove files from the system partition using an app like root explorer? I wanted to change my bootanimation on my hot pepper serrano 3 and remove unwanted apps and files since i now have it rooted with magisk 25.2 but system partition seems to be read only at the moment. You can delete stuff from the system partition but they come back after a reboot. Same goes with modifying or adding anything in /system. You need to mention in the OP that we only have partial root not full root. Can anyone confirm this and is there a solution to this problem? Is it just me that is having this issue?