Database Info

[ROOT][TWRP][OUTDATED] Oppo R9S (China edition) exploit and TWRP flasher

This tool is out of date. See the main R9S thread for an updated tool by Wu Xianlin which gives you an improved TWRP recovery and access to more ROMs.
Original post is below for historical purposes only.
Oppo R9S (Chinese version) TWRP installation tool
Only works on Chinese OS release 005 which can be downloaded here and flashed in stock recovery.
Earlier versions will not work, nor will later versions. It has to be this specific version.
P̶r̶o̶b̶a̶b̶l̶y̶ doesn't work on international editions either.
DOWNLOAD - R9S_TWRP.zip - V1.01
DOWNLOAD - R9S_TWRP.zip - V1.0
Changelog
1.01 - Tweaked timings to try and improve success rate
1.01 - Changed how text is output to hopefully improve appearance on Windows 7
This script uses an exploit by Chinese developer Wu Xianlin to gain temp root, then it flashes his TWRP build that works on the R9S despite the locked bootloader.
From there you can attempt to perma-root your phone, install a custom ROM etc. etc.
Thanks to the following XDA members, without whom this would not have been possible:
jacksmack
celoxocis
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Antivirus issues
Some AV's may complain about this file containing a Trojan. They are technically correct. It's called "dirtycow" and is being used in the wild to hack into Linux systems. It cannot affect Windows systems, but I use it to hack a linux-based system (your phone)
If your AV refuses to let my script run you will have to disable it temporarily. Feel free to read through my script (root1.bat) to check what it is doing.

Useful things to flash in TWRP
CyanogenMod13 - by Wu Xianlin
Stock Recovery - by Wu Xianlin
GApps (ARM64) - by opengapps.org
Updated basebands, ripped from ColorOS
Use these only if you have issues with phone/GPS/etc. after installing CM. Otherwise leave alone.
[2017-01-11 v0180] - released ROM (China) - by me!
[2017-01-24 v1470] - ALPHA ROM (China) - by me!
Note: The version number on basebands stays the same, but the MD5s are different. No idea what has changed, but they work!

Unbrick instructions:
Does not work in Windows 10. Tested working in Windows 7
Download this unbrick package
Install the quallcommmtkdriver package
Run daanav-enabler as administrator
Run msmdownloadtool as administrator
Click through any timeout error you get
Click on the titlebar of MSMDownloadTool and press F6 to enable the options
Fully power down your phone by holding vol-, vol+ and power for 10 seconds
Hold vol- and vol+ while connecting the USB cable (use the stock Oppo cable)
MSM should now show your phone.
Press F5 to decide what to flash. For the first attempt choose "All except userdata".
Click the start button.
After 5 minutes your phone should reboot into ColorOS.
If ColorOS hangs on boot, then repeat the above staps and this time flash all, including userdata. This will wipe your photos etc. sorry!
This will leave you on V004 of the OS. You will need to upgrade to 005 before attempting to root again.

Can I request a version of this that stops at permanent rooting? Unless you think there would be a problem with the fact that I intend on using it on a r9s plus.
Or a link to what I maybe overlooked, in case it already exists.

Unfortunately this program doesn't perma-root. It gains a temp root and uses that to flash TWRP. TWRP can then be used to flash a custom ROM or a rooting tool.
It also doesn't unlock the bootloader. Wu Xianlin somehow managed to make a version of TWRP that the locked bootloader is happy with!
however if you edit root1.bat and scroll down to line 181. Change it from:
Code:
type root3.txt | adb shell /data/local/tmp/root2.sh
to:
Code:
adb shell /data/local/tmp/root2.sh
Then the script will just drop you to a root shell. Unfortunately you are then on your own as to how you get perma-root.
I have no idea whether this method will work on the R9SPlus. In theory it should do but I've not tried it. I won't be held responsible if you brick your phone and probably won't be able to help, though you should be able to do a three-finger reboot and then boot into recovery and reflash ColorOS.
Optional modifications you can make that will make the script neater:
You can also remove lines 178 and 179
Code:
echo Copying TWRP
adb push r9s-twrp-3.0.2.0-20170107.img /sdcard/twrp.img
and change line 184 from
Code:
pause
REM ---- CHINESE TWRP HELP ----
to
Code:
pause
exit
REM ---- CHINESE TWRP HELP ----

I will take your "I have no idea if this will work fo r9s+" at face value and try to be patient for something more certain, thanks for your contribution nonetheless
I saw the translation you posted and am a bit depressed Wu recommended to return the phone...

Oppo make amazing hardware but terrible software that is never updated. I used to be ok with this because they actively encouraged rooting and custom ROMs but this change in attitude from them makes it very hard to recommend the phone.
I would be interested to know if this exploit does gain root on the Plus. In theory it should work, and there's also a decent chance that TWRP will too as the hardware is very similar, but will require someone very brave/stupid to try it

BTW. Anyone who is going to try this on the Plus. Ensure you have a flashable .ozip of a working ColorOS (full install, not OTA) saved to internal storage as the stock Oppo recovery is a POS that doesn't provide ADB, MTP or USB.
If you end up wrecking your OS and don't have that image in place ready to flash from recovery you are screwed.
Likewise do not flash TWRP until you are sure that your OS is still bootable, and also take a dump of the stock recovery first! (and post it in the other thread as it's bloody useful to have!)
Sent from my OPPO R9s using XDA Labs

Hi the Unbrick pack RAR is corrupted and can not unzip.
Also there is Trojan in DOWNLOAD - R9S_TWRP.zip - V1.0 - Dirtycow file and the NOD Antivirus is deleting this file.
Please advice how to proceed ?

NOD is correctly detecting that this is a hacking tool using a well known exploit (dirtycow).
Since you actually want to do that, you're going to have to disable NOD until you're done.
Sent from my OPPO R9s using XDA Labs

Lum_UK said:
NOD is correctly detecting that this is a hacking tool using a well known exploit (dirtycow).
Since you actually want to do that, you're going to have to disable NOD until you're done.
Sent from my OPPO R9s using XDA Labs
Click to expand...
Click to collapse
Hi I got to somewhere but I am stuck now...
Please check the pic and advice how to install the CyangenMode. (I have uploaded the pic in your thread in Oppo Community forum please check it there because I am new here and can not post with external links..)
Sorry for the inconvenience. Looks like I am few steps away to finish the job but something is missing...

Goro1234’s image: http://s27.postimg.org/8usudi9g3/IMG_20170207_133854.jpg
You need to do a wipe data/cache/dalvik as CM won't install on top of incompatible data.
Note that this will wipe your installed apps, settings, app data, saved games etc. but will not wipe your photos, music, downloads or anything else saved to internal storage.
You may wish to take a backup from within TWRP first. Apps like Titanium Backup and Nandroid Manager are reasonably good at restoring apps and data from a TWRP backup.
Also don't forget to install GApps
Sent from my OPPO R9s using XDA Labs

For the unbrick package you need 7-Zip to extract it.

Lum_UK said:
`Also don't forget to install GAaps`
Hi I am on Cyanogen now !!! Thanks for the help. Can you please tell me now which is the correct gapps version for our device. I have installed random one which does not make connection with google. I have tried to install ARM 64, but cant flash because systems says that is incompatible... Thanks
Click to expand...
Click to collapse

Select ARM64, android 6.0 and whichever variant you like (I recommend the Pico version)
Sent from my OPPO R9s using XDA Labs

Sorry for the English, I made a mess with the phone, after unlocking everything, and held the phone for several days with CM13, I saw that GPS was not working, so vovelo return to the origin, but now I can not installing Stock Recovery more to put the stock rom, I tried to do unbrick, but when I press start of msmdownloadtool, the program stops and closes. If some kind soul gives me some advice. Done everything under win 7 reset. Thank you so much Gianfranco.

GPS should be working. I'm using it all the time on CM13 as my phone is my satnav.
Maybe wipe and reflash, or try one of the baseband updates?
Sent from my OPPO R9s using XDA Labs

Now, the problem is more to do so that I can not leave,
I installed through the files Stock TWRP Recovery as a boot, and I hand the boot source and installing the original rom, after the reboot remains on oppo screen. what can I do. Thank you so much Gianfranco.

hold all three buttons for 10 seconds to forceibly power off the phone and then try to boot to recovery.
If you get the Oppo recovery then try to do a factory reset and then flash the stock ROM,
if you get TWRP then try to flash Cyanogen.
If you can't do either then you're going to have to run the unbrick tool. Do you have another PC you can try it on?

Thanks, but I have tried various solutions, when I install the boot ROM from stock, is successful, the reboot hangs installation applications. I wanted to know if you can other software for unlocking. Thank you very much for giving me some advice, thanks ancora.Gianfranco.

Twrp 3.3.1. UmiDIGI Power 4G

TWRP 331 Porting Thread for New UMIDIGI Power 4G
New thread for the new model UMIDIGI Power 4G Helio P35 Octa core Mtk 6765
Umidigi Power 4G MT6765 Octa Core 4G 4GB 64GB Android 9 Smartphone 6,3 inches
Everybody are Welcome!:good:
MANY THANKS TO OUR MODERATORS TO OPEN AGAIN THIS THREAD !
More attention to the Xda-developers Rules:
http://forum.xda-developers.com/announcement.php?f=256
Many thanks to "SUPER ADMIN" MR. MIKE​

New twrp 331-test 1 for this device is builded!
Now need period of tests...
http://www.mediafire.com/file/cnqw8d2qkjqtp6k/Twrp_331_test1_Umi_Power.rar/file

reserved 1

Reserved 2

TWRP Not Working for Me
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!

SeekerofLight.iz said:
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
I confirm the first part of this, same issue here... i'd like to flash a twrp for gsi purposes, but for now no luck

SeekerofLight.iz said:
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
Can you write how you got the root of the law? Instructions for inexperienced users.
Thank you in advance.

Root UMIDIGI Power with Magisk
mr A V said:
Can you write how you got the root of the law? Instructions for inexperienced users.
Thank you in advance.
Click to expand...
Click to collapse
Sure thing! Here's a Magisk root guide for anyone just getting started that I wrote up just now. (All mentioned files are provided in the zip.)
Step 0 - Download the Attached Zip File Below
Google Drive Mirror
Mediafire Mirror
MEGA Mirror
Step 1 - Drivers
Install the MediaTek drivers by running "DriverInstaller.exe". These are the drivers that worked for me. But if you have issues with them in Step 5, Google "Mediatek MT65xx USB VCOM Drivers" (or some variation of that) and try some others you can find.
-----------------------------------
Step 2 - Install ADB Interface
Install the Android SDK (ADB Interface). To do this drop the platform-tools folder (from the Step 2 folder) into your C:\ directory. Press the windows start button and search for "Environment Variables" and click on "Edit environment variables" from the results. Under SYSTEM VARIABLES on the bottom (not User variables above it) click on the "Path" variable, and click edit. In the new window that appears, hit "Browse..." and click on the "platform-tools" folder that you placed in your C:\ directory.
All this does is allows you to easily input adb commands into command prompt with no issues. This will be used to verify that the device is appearing properly and issue commands in case of emergency.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
-----------------------------------
Step 3 - Install Magisk
Copy the Magisk.apk to your phone and install it.
(This is where you can then copy the boot.img to your device and patch it via the Magisk app to create the "magisk_patched_boot.img" file, however I have included the already patched file in Step 6 for the UMIDIGI Power so you don't need to.)
Also, this is the Magisk v19.3 Beta, but you can install another version.
-----------------------------------
Step 4 - OEM Unlocking/USB Debugging Mode
On your phone, go to Settings >> System >> Developer Options. (If you haven't activated Developer Options yet, do that by going to About Phone >> Build number, and tap it a bunch of times, but I'm sure you already know this lol)
In Developer Options, turn on "OEM Unlocking" to unlock the bootloader, and USB Debugging.
-----------------------------------
Step 5 - Verify That Your Phone is Detected with ADB
Connect your phone to your PC. Make sure you click "Allow USB debugging" on your phone. Then open up Command Prompt. (Protip: Type "color a" and press Enter if you want to feel like a REAL HACKERMAN.) Now, type in "adb devices" and verify that your phone is detected by your computer. If it's detected, then that's perfect you can move on to Step 6. If not, then uh... you may have to try and find some other MediaTek drivers mentioned in Step 1.
-----------------------------------
Step 6 - Set up SP Flash Tool
Open up SP Flash Tool on your computer by running "flash_tool.exe" in the SP Flash Tool Folder. (If at any time it shows a "Processing" window for some reason, just close and reopen the program if it doesn't go away on its own.)
On the first line choose "MTK_AllInOne_DA.bin". And the third line "Authentication File" can be left blank.
On the second line where it shows "Scatter-loading File", hit "choose" and find the "MT6765_Android_scatter.txt" file in the Step 6 folder. It'll load up and show a bunch of green/white rows in the space below.
Now this looked intimidating to me at first, but it's actually quite simple. As far as I understand (and I could be wrong but), the scatter file just tells the program where to place certain files, like a map for the program to follow. The scatter file I provided is for the UMIDIGI Power. The only thing we'll worry about for now is the boot.img file (but in the future, this is where you could also install a TWRP recovery once we get one that is confirmed to work.)
So in the white/green list, scroll down to where it says "boot" in the "Name" column, and click on the blank area in the "Location" column. It will bring up a window where you can browse to the "magisk_patched_boot.img" that I provided.
-----------------------------------
Step 7 - The Big Huzzah (Rooting)
Power off your phone and make sure it's UNPLUGGED. On SP Flash Tool, click "Download". This prepares the program to begin flashing your phone as soon as it is connected. Grab your phone with one hand, and with your other hand plug in the USB cable (if you only have one hand, use your mouth I guess). Your screen should not turn on at all throughout this process, but if it's successful, you should see that the program begins to flash your device after a second or two. Now just wait until it reaches 100% and says "Download Ok" with a green checkmark. And you're pretty much done!
You can then boot up your phone and check the Magisk app, as well as download a root checker from the Play Store to confirm that your phone has root access! Have fun!

Thank you, far-away friend from me, that you are such a sympathetic person! Thank you for writing everything so quickly and in detail. As soon as I receive my phone, I will definitely try to do everything as you wrote.
Tell me, do you plan to install any firmware on this device? For example, Miui. Or are you satisfied with the stock?

mr A V said:
Thank you, far-away friend from me, that you are such a sympathetic person! Thank you for writing everything so quickly and in detail. As soon as I receive my phone, I will definitely try to do everything as you wrote.
Tell me, do you plan to install any firmware on this device? For example, Miui. Or are you satisfied with the stock?
Click to expand...
Click to collapse
No problem! Unfortunately I don't see many custom ROMs coming to this phone, considering it's not a very popular device. I'd guess our best bet is to hope that the UMIDIGI F1 gets some support, and that anything on there can hopefully be ported over to this phone, but even that device isn't very popular either. For me though, that's not a huge issue because I'm actually quite satisfied with the stock firmware it has on board. It's basically stock Android Pie, and I've been able to add all the extra goodies I want into the phone through Magisk Manager and EdXposed with very minor issues. Most notably Viper4Android to fix the slightly tinny speakers and pump up the overall headphone experience too, and Gravity Box for some extra minor software customization.
Overall, I'd say the biggest downside to this device is the limited camera capabilities, and its somewhat limited performance for heavier tasks like 3D games / game streaming. But other than that, this feels like a very premium device. :good:

I thought about the fact that it is you who can transfer other firmware to this device. As a developer, let's say.
On the F1 already installing the firmware AOSP, LOS and other projects. But need to flash these firmware through TVRP recovery. For our device, there is no such recovery yet.
I have little understanding of the intricacies of the android. Sorry if my questions seem silly.
If we take the firmware for F1, for example AOSP, will it have to be somehow changed for our UD Power? Or can just take the archive, as it is, and flash it?
The processor of our smartphone is not very strong, so it is not for games. It is also not clear what RAM is installed. It looks like the manufacturer has installed a cheap part. Put single-channel LDDR 3. So he made a low price. At the expense of device performance.

mr A V said:
I thought about the fact that it is you who can transfer other firmware to this device. As a developer, let's say.
On the F1 already installing the firmware AOSP, LOS and other projects. But need to flash these firmware through TVRP recovery. For our device, there is no such recovery yet.
I have little understanding of the intricacies of the android. Sorry if my questions seem silly.
If we take the firmware for F1, for example AOSP, will it have to be somehow changed for our UD Power? Or can just take the archive, as it is, and flash it?
The processor of our smartphone is not very strong, so it is not for games. It is also not clear what RAM is installed. It looks like the manufacturer has installed a cheap part. Put single-channel LDDR 3. So he made a low price. At the expense of device performance.
Click to expand...
Click to collapse
I definitely consider myself to be a major noob with the more advanced Android development stuff. I only know enough to find my way around the internet and flash compatible software, haha. I've never looked into creating ports myself, but it's certainly something I think might be worth learning, especially with the limited device support on these phones.
And yeah, in terms of performance I don't expect much out of a phone at this price point, but for all the essentials - music, 1080p YouTube, web browsing, and mid to light gaming, it's surprisingly great considering the price. I haven't had any issues with the memory as of yet, so I wouldn't be too concerned, although you're definitely right in that they probably source some pretty cheap parts for these kind of phones.

SeekerofLight.iz said:
Sure thing! Here's a Magisk root guide for anyone just getting started that I wrote up just now. (All mentioned files are provided in the zip.)
"stubbed guide"
Click to expand...
Click to collapse
It works like a charm, thank you! by the way, were you able to boot that twrp or still nothing? and if you made it, were you able to flash a gsi over that too? i'm unable even to boot that twrp
---------- Post added at 09:30 AM ---------- Previous post was at 09:29 AM ----------
ghost45 said:
TWRP 331 Porting Thread for New UMIDIGI Power 4G
New thread for the new model UMIDIGI Power 4G Helio P35 Octa core Mtk 6765
Umidigi Power 4G MT6765 Octa Core 4G 4GB 64GB Android 9 Smartphone 6,3 inches
Everybody are Welcome!:good:
MANY THANKS TO OUR MODERATORS TO OPEN AGAIN THIS THREAD !
More attention to the Xda-developers Rules:
http://forum.xda-developers.com/announcement.php?f=256
Many thanks to "SUPER ADMIN" MR. MIKE​
Click to expand...
Click to collapse
Can i ask you a guide on how were you able to boot it? i'm only getting a bootloop after flashing that from SPFlash

I will build one other version of recovery soon...

mg95tux said:
It works like a charm, thank you! by the way, were you able to boot that twrp or still nothing? and if you made it, were you able to flash a gsi over that too? i'm unable even to boot that twrp
Click to expand...
Click to collapse
Glad to hear it worked for you!
Still nothing. Unfortunately I haven't had any luck with booting into TWRP since I last tried it. Hoping ghost45 will be able to help us out with that when he gets the chance.

Bootloop - Secureboot
Nevermind, bootloader locked.
just type on CMD:
adb reboot bootloader
then
fastboot flashing unlock

Andre_Filho said:
Nevermind, bootloader locked.
just type on CMD:
adb reboot bootloader
then
fastboot flashing unlock
Click to expand...
Click to collapse
remember to allow oem unlock from developer settings in stock rom, otherwise it will fail!

SeekerofLight.iz said:
Finally received the phone today. Spent a few hours trying to get your TWRP port installed with no luck unfortunately. After flashing it via SP Flash Tool, I ran into an "Orange State" unlock warning (which I assume is normal). However it's followed by a bootloop. I can only get the phone to boot using the stock recovery.img. Any modifications to the recovery causes a loop.
On the other hand though, I was able to get root through Magisk (I'm using the latest 19.3 version), and patching the stock boot.img through the app, then flashing the patched boot.img to the phone with SP Flash Tool. I have Viper4Android working, which was my main reason for wanting root, so I'm satisfied for the most part. Can't wait to try this phone out as my daily driver!
Click to expand...
Click to collapse
How do you manage to work Viper.
Cause i'm having some problems, tested all versions and my Driver always stays on "Active: NO Format: Unsuported.... Abnormal"
BusyBox also don't seens to work.
:/
Some help?

Andre_Filho said:
How do you manage to work Viper.
Cause i'm having some problems, tested all versions and my Driver always stays on "Active: NO Format: Unsuported.... Abnormal"
BusyBox also don't seens to work.
:/
Some help?
Click to expand...
Click to collapse
The trick to getting Viper4Android to work is to make sure you have SELinux set to "PERMISSIVE" rather than "ENFORCING" on your phone. Here's a handy little app designed to automatically set it to permissive on boot!
https://forum.xda-developers.com/devdb/project/?id=1561#downloads
And for BusyBox, I was having issues too at first because I think with systemless root, BusyBox can only be installed in /sbin, which gets wiped after each boot. So I searched for "BusyBox" in the Magisk app and found a module called "BusyBox for Android NDK" which has worked perfectly for me.
One thing to note...
Sometimes SELinux doesn't always get changed automatically everytime you boot up. It's pretty consistent, but every once in awhile you may need to manually set it to permissive mode again if things don't seem to be working. But it's literally just pressing a single button, so not a big deal.
The other thing is with Viper itself- At times when I launch the app, the driver status says "abnormal" even after I've toggled SELinux to permissive. If you go into settings and toggle "compatibility mode" or "attach audio effects" on and then off that seems to refresh the driver status. Not sure why, but it works.
Let me know if you have any issues.

TWRP for UMIDIGI POWER
I ask for help in creating TWRP for UMIDIGI POWER firmaware ROM v1.5
Please make for this model TWRP
I am very grateful to you - I unlocked the phone and got the rights Root rights.
It remains only to create a TWRP for UMIDIGI POWER
At this forum, competent specialists and for other models everything is already done.
Maybe there is a website where you can make an order to create a TWRP?
Unfortunately, I do not know English and I do not know how to apply.
I would be very grateful and ready to test your work.

[Release] Root the Palm phone

Here is a rooting method for the Plam Phone either the US variant or the Vodafone variant this has not been tested or confirmed working on any other device. This root method may break in the future because it is using a tool that isn't designed for the public i tried getting the firehose packaged with the tool to work in other edl flashing tools but was not able to get it working. So this is all we have for now. There is minimal risk in doing this it just has a lot of steps and it requires a pc running windows.
Note: This will wipe your device so anything stored on it will be lost please backup anything important like photos/contacts/etc
Download and install Sugar QCT from here (Be sure to install the usb drivers as well)
Included in the zip is the username and password that you will need to use to run the program please do not post it here.
Boot the device into recovery by turning the device off and then holding the power button until it restarts 3-4 times and boots to recovery
Select the option to go into emergency download mode
Now plug the device into your computer and open Sugar QCT
From the list select pepito/PVG100 (US) or pepito_vdf (Vodafone)
Now select Upgrade this will download the palms firmware package and flash it to the device
When it finishes do not close sugar
Unplug your device and hold the power button for a few minutes so it will restart out of EDL mode, use a rubber band or something to apply pressure to it so you don't have to hold it
Go to where Sugar QCT is installed (C:\Program Files (x86)\SUGAR QCT_SP_Gotu2\bin\)
In there you should see a folder called PVG100-xxxx (The x's are your serial number)
Copy that to your desktop or anywhere else that you like
In the folder, there should be some random looking mbn files these are actually the firmware files just names are randomized to make using them harder.
There should be a file called B1AMD0D0CV00.mbn if not look for a file that starts with a B it will be the boot.img
You will need to push that to an android device and patch it with magisk manager.
Once that is done replace the B1AMD0D0CV00.mbn in your copy of the firmware with the patched boot.img
Boot it back into emergency download mode as previously stated
Close and reopen sugar
Copy your firmware copy back into C:\Program Files (x86)\SUGAR QCT_SP_Gotu2\bin\ be sure it is the same folder structure
Now select your model again and then press the upgrade button in sugar this will now flash your modified firmware to the device.
Once it finishes hold the power button for a few minutes so it will restart out of EDL mode, use a rubber band or something to apply pressure to it so you don't have to hold it
When it restarts and powers up then go through setting the phone up and install magisk manager and you're rooted.
Thanks to @StormSeeker1 for telling me about holding the power button for a few minutes to get out of EDL previously you had to let the phone die to get out of it which is a pain.

Interesting, shall do it tomorrow.
Curious, this doesn't use the root exploit discussed in other threads? Where is (7) downloading from?

snoopy20 said:
Interesting, shall do it tomorrow.
Curious, this doesn't use the root exploit discussed in other threads? Where is (7) downloading from?
Click to expand...
Click to collapse
It doesn't use any root exploit, it's downloading the firmware directly from TCL servers, the tool used is designed for service centers.

If they are the same hardware, it should be possible to flash Vodaphone over the top?

snoopy20 said:
If they are the same hardware, it should be possible to flash Vodaphone over the top?
Click to expand...
Click to collapse
They are signed with different keys, so it will probably cause the device to boot loop and or not startup. I would not recommend trying it.

Is it possible to dump the radio files from an network unlocked device, and use these files to unlock Verizon network.
Any other ideas to unlock network?
Current findings:
1. Remove the Verizon sim warning.
Simply edit the /vendor/build.prop and modify line "ro.product.vzw=true" to false. However, it has a side effect, causing the contacts in dailer FC while browsering.
2. Enable diag, serial and QMI
One method is dialing "###2324#", another approach is launching "EngineerMode" through apps like quickshortcutmaker, then navigate to Connectivity - DiagProtector.
3. Boot animation path
/Vendor/JRD_custres/media/
4. Most garbage apps path
/Vendor /priv-app/

Every time I try to replace the MBN files after being patched the utility keeps redownloading the originals. Any advice?

xswxm said:
Is it possible to dump the radio files from an network unlocked device, and use these files to unlock Verizon network.
Any other ideas to unlock network?
Current findings:
1. Remove the Verizon sim warning.
Simply edit the /vendor/build.prop and modify line "ro.product.vzw=true" to false. However, it has a side effect, causing the contacts in dailer FC while browsering.
2. Enable diag, serial and QMI
One method is dialing "###2324#", another approach is launching "EngineerMode" through apps like quickshortcutmaker, then navigate to Connectivity - DiagProtector.
3. Boot animation path
/Vendor/JRD_custres/media/
4. Most garbage apps path
/Vendor /priv-app/
Click to expand...
Click to collapse
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
kotaKat said:
Every time I try to replace the MBN files after being patched the utility keeps redownloading the originals. Any advice?
Click to expand...
Click to collapse
Are you postive that the folder structure is the same?

deadman96385 said:
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
Are you postive that the folder structure is the same?
Click to expand...
Click to collapse
I am using another carrier, not USA ones, and it has problems with 4G network.

it works, thanks

Just began mind. So far it's stuck on 2%.
Regarding flashing Vodaphone over Verizon, if the ROM files are signed with different keys then modifying the boot.img will surely break the signage?

snoopy20 said:
Just began mind. So far it's stuck on 2%.
Regarding flashing Vodaphone over Verizon, if the ROM files are signed with different keys then modifying the boot.img will surely break the signage?
Click to expand...
Click to collapse
Are you still stuck at 2%? Of downloading, or of flashing?

deadman96385 said:
I put my t-mobile sim into mine and it worked fine no edits needed and mine is officially locked to verizon.
Are you postive that the folder structure is the same?
Click to expand...
Click to collapse
tapa_t said:
Are you still stuck at 2%? Of downloading, or of flashing?
Click to expand...
Click to collapse
Tried flash pvg100e over pvg100, it will stuck at the beginning and the program won't flash.

xswxm said:
Tried flash pvg100e over pvg100, it will stuck at the beginning and the program won't flash.
Click to expand...
Click to collapse
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Is pvg100e for Vodafone? Where did you get the ROM if your device is pvg100?
Does it finish flashing if you do pvg100 over pvg100?

tapa_t said:
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Is pvg100e for Vodafone? Where did you get the ROM if your device is pvg100?
Does it finish flashing if you do pvg100 over pvg100?
Click to expand...
Click to collapse
The tool deadman provided definitely works if u follow the instruction and choose the right version.
For the signature issue, maybe u can find the answer in another thread about temporary root.
As to the version problems, pvg100 is for Verizon.
To my knowledge, the pvg100e is for many other vendors, such as Vodafone, and the UK version maybe share the same model name. There is another version pvg100eu, for European. U can find more evidence in the temporary root thread.

So far the following:
Windows 10 64 - goes to 2% then after a few seconds a 5002 error.
Windows 7 64 inside Virtualbox - goes to 2% and then doesn't move.
I've tried the drivers and others on the web although the latest is around 2014/15.

xswxm said:
The tool deadman provided definitely works if u follow the instruction and choose the right version.
For the signature issue, maybe u can find the answer in another thread about temporary root.
As to the version problems, pvg100 is for Verizon.
To my knowledge, the pvg100e is for many other vendors, such as Vodafone, and the UK version maybe share the same model name. There is another version pvg100eu, for European. U can find more evidence in the temporary root thread.
Click to expand...
Click to collapse
Checked last night, mine, pvg100, is snapdragon 430, and the China mainland version is pvg100c with snapdragon 435.

deadman96385 said:
It doesn't use any root exploit, it's downloading the firmware directly from TCL servers, the tool used is designed for service centers.
Click to expand...
Click to collapse
I'm not looking to root right now, but if I'm understanding this correctly this should mean that I can use SugarQCT to pull the latest version (1AMD) firmware for my Palm that doesn't show any OTA's available and is still on the original 1AGL firmware. Is that correct?
Thanks for making this happen, deadman96385!

tapa_t said:
Doesn't that empirically prove that different versions have different signatures, or at least ROM's are different enough to prevent switching over? Maybe we are just so lucky that boot.img is not checked as rigorously.
Click to expand...
Click to collapse
No need for empirical proof, I did the analysis here.
The difference is: the early part of boot is Qualcomm code using Qualcomm security. These are the "pbl", "sbl/edl" and "aboot/fastboot" programs (and also "modem", "tz" and other bits). These were the parts that I was looking at in the link above.
When "aboot" completes, it hands over to the late part of boot, which is Android code using Google security. These are the "boot.img/Linux kernel" programs, "recovery", "system", "vendor", "data", etc. They use a different security model. That's what this root method targets. You are correct when you say "Maybe we are just so lucky that boot.img is not checked as rigorously".
It does imply that you can mix the PVG100 Qualcomm partitions for "early boot" with the PVG100E Android partitions for "late boot" and vice-versa. But someone with motivation needs to test this... (No, you can't unlock cellular bands this way; the "modem" partition is from Qualcomm and must match your hardware.)
A good diagram is below; Source (and explanation): https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html -- I recommend studying this article.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ssuds said:
I'm not looking to root right now, but if I'm understanding this correctly this should mean that I can use SugarQCT to pull the latest version (1AMD) firmware for my Palm that doesn't show any OTA's available and is still on the original 1AGL firmware. Is that correct?
Click to expand...
Click to collapse
This should work. Keep in mind that whilst 1AMD seems to be fine, future versions may (permanently) close the vulnerabilities that allow you to get root, modify system partitions or use the current version of SugarQCT. I don't think this will happen but we should all keep the possibility in mind.

Which Windows version are people using? I've tried W10 and also W7 through a virtualbox but with the above errors.

[GUIDE/ODIN/FW/BL] SM-P610 USA/XAR WIFI ONLY: Stock Firmwares + Modded BL WarningText

THIS IS YOUR FIRST WARNING (WILL BE REITERATED PLENTY OF TIMES!) IN BIG RED BOLD LETTERS - THESE FILES ARE FROM/FOR THE USA ("XAR") REGION, SM-P610 WIFI MODEL ONLY!
(with the exception of the Odin utility, as well as possibly the modified boot splash screen, which may work on other variants, though untested and done solely at your own risk - read all the notes!!)​
I already went through the work, so I figured I would share these files for those who also own the same exact tablet. Again, it's for the USA/XAR region Samsung Galaxy Tab S6 Lite WiFi Model ONLY - "SM-P610" / "gta4xlwifi". LTE model is a different variant; do NOT flash the stock firmware files to that device! Also, sorry, I will not support or answer questions for other variants (other than what I will mention in this OP). Downloading firmwares for other variants will be a huge PITA, and I don't have / pay for any "premium" accounts which would allow me to quickly download the huge firmware files. I'm only sharing these I'm posting because I already took the time to acquire and archive them for personal usage, and might as well share them for those who own the same device / variant.
Use these files at your own risk, and only flash if you know what you're doing!! I'm not responsible for any problems user may incur from usage of these files, the usual warnings apply, etc. This device is just a backup / playaround device for me, and so it doesn't get daily usage out of me, nor will I likely be very active on this subforum (sorry! just being honest). Also, I immediately installed LOS on my device anyway, so I don't run stock ROM myself and therefore won't be sharing pre-patched Magisk boot images either. Sorry to those who are used to that from me =)
So anyway... what's in this post?
Odin3 v3.14.4 (version I've been using on this device, and working perfectly fine as of this initial posting)
Stock firmware zips for USA/"XAR" Region SM-P610, WiFi Only
Modified BL file (Odin-flashable), to remove the warning boot text
Odin3 v3.14.4:
I posted this in another thread, but figured I would also link to it here so it's easy to find in one place. This worked perfectly fine for me to root / install TWRP / flash BL files, etc.
Download Link: https://www.androidfilehost.com/?fid=10763459528675582443
Stock Firmware Files:
USA/XAR WIFI ONLY! October 2020 Update - Firmware Version P610XXU2BTJ5
Download Link: https://www.androidfilehost.com/?fid=10763459528675592742
USA/XAR WIFI ONLY! September 2020 Update - Firmware Version P610XXU2BTI3
Download Link: https://www.androidfilehost.com/?fid=10763459528675592159
Firmware files for other variants, see this post. Follow the links, use the resources, consider the context for other variants: https://forum.xda-developers.com/showpost.php?p=83083249&postcount=2
Modified [BL-slot] Odin-Flashable File To Remove Warning Splash Screen Text:
My Thoughts On This...After unlocking the bootloader and flashing non-stock images, we all know we end up with that annoying, ugly splash screen screaming that the device is modified. Most of us modifying our devices understand the security implications involved, and ironically choose to modify our devices to increase security in other ways. Yet, these warning splash screens, in the unfortunate event of possible theft, may very well end up being the reason a more tech-savvy thief is able to break into the device, or find someone who can. So, thanks to users' posts Awesomeslayerg's hint and blascogm's guide, I quickly came up with an Odin-flashable file to change the splash screen, as seen below:
(if the pic doesn't show, probably the imgur link I used is dead, but I also attached it to this post)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I know some people may be thinking "why not just remove the PRESS POWER KEY TO CONTINUE line completely and have it stay at the normal boot screen seamlessly the whole time", and the reason I decided not to do this is because it generally wouldn't make the average person suspect the device is modified, and it's still good for us to know that it's at the boot stage where we can hit the power key to skip the ~10 second timeout. It's exactly the same image, so it's still very seamless and stock-like. I even took the time to center the power key text exactly, by the pixel, from left to right and from top bottom relative to the knox and android logos.. ; )
And if it really bothers you that much, follow the guide I linked above and do it yourself. =)
I should also mention that, for our devices, the .bin.lz4 file that needs to be decrypted is actually "up_param.bin.lz4" and not "param.bin.lz4" as suggested in the guide, as it's for a different device. You will need the lz4 utility (check Awesomeslayerg's thread, or google lz4 github) to decrypt the lz4 file to a regular bin file, and then you can extract and/or replace the .jpg files using an archiver program (I recommend 7-zip for this).
The hash checksums for every single file/jpg in each up_param.bin were identical between the September and October firmwares. Therefore, at least as of this posting, the same modified Odin-flashable file will work on either firmware version, and likely future versions until they make any significant changes. I did test this myself too btw. Also, if you look at the structure and contents of the up_param.bin file for yourself, you'll see that they are simply .jpg files containing the screens, backgrounds, and text you're all familiar with when going into bootloader / download mode. Assuming they follow the same file naming structure, I suspect you can probably flash this to other variants, although it will change the text language to English (assuming they localize the bootloader / download mode text per every region; I have no idea about this as I only own US variants). To see what I'm talking about, here's a quick screenshot (better resolution pic, and just in case imgur link dies, also attached to this post):
Now that I (hopefully) tricked you into reading this entire section so that you now have some basic understanding of how it works before proceeding to flashing the warning text removal mod, here are the instructions / link for install:
- Download the .tar file provided below.
- Boot device into Download mode.
- Place .tar file into bootloader [BL] slot in Odin and flash.
Download Link: https://www.androidfilehost.com/?fid=10763459528675592179
To revert back to stock splash screen with warning text, for whatever reason:
Pull the stock up_param.bin.lz4 from the stock firmware file (from the BL****.md5 file within the firmware zip).
- Convert it to up_param.bin uzing lz4 utility.
- Add up_param.bin to an archive as .tar file, uncompressed (recommend using 7-zip).
- Flash the .tar file, which should contain only the stock decrypted up_param.bin file, in Download mode using Odin in the BL slot.
I uploaded my custom jpg's, as well as the stock untouched jpg's, for those that are curious or want to edit them further. Feel free to snag them here: https://www.androidfilehost.com/?w=files&flid=320350
* As we can see, we're only modifying the .jpg files provided by up_param.bin, so it's a relatively harmless process (unlike modifying aboot files in the old days of HTC devices, which if done improperly could literally result in an unrecoverable brick). But even so, please only flash if you know what you're doing and can recover from any potential mistakes or errors.

Not sure if there were any changes since the September / October 2020 firmwares, but here's a new one directly modified from the March 2021 (Android 11) firmware base:
NEWEST DOWNLOAD, BASED ON 2021-03 FIRMWARE:
https://www.androidfilehost.com/?fid=14943124697586346609

And another

Hi,
Thanks for these resources. I'm actually not at these steps yet. I'm having trouble gaining access to the OEM Bootloader Unlock option in developer options. Here are things I've tried already based on what I researched before my attempt.
Android 10 is the current OS installed after unboxing.
1. Disable Automatic Date and time
2. Select a date more than 7 days prior to current date of attempt.
3. Under Settings > About Phone > Software Information. Select/Tap Build Number 7-8 times to unlock Developer Option.
4. Disable Auto Update System (Apply Updates When Device Restarts) - *This was somehow already disabled the first time I entered Developer options*
5. Under Software Updates > Disable Automatic Updates -*This was also already disabled on unboxing and it says Automatically download updates over Wifi. It does not say Automatic Updates*
6. Reboot device and return to Developer Options after booting to OS.
7. The OEM Bootloader Unlock option should appear greyed out at this point. Toggle it to unlock bootloader with consideration that it will wipe the device data.
These are the steps I've found and tried with no success in gaining access to the Bootloader unlock option. I am also certain that my device is the international model SM-P610 with Exynos chipset and Mali-G72 GPU. Something else to note, I did uncheck many default options tied to improving privacy on the device before attempting the steps to gain access to the bootloader unlock option. I do not know if that would make a difference. If you recognize anything wrong with the steps I've tried already, please let me know where I'm going wrong or where I can find the correct way to unlock the bootloader. I've been posting in other threads, but nobody seems to be replying to me. Any help will be appreciated.

Hi
I've flashed your modded file on my PHN (Netherlands), no problems at all working ootb!

Hi. I used blascogm's guide for my P615 with latest firmware for SEC UI 3.1and all are OK! Thanks for all.
Add. I add link . Flash via Odin(BL).
https://androidfilehost.com/?fid=14943124697586347282

i5lee8bit said:
Not sure if there were any changes since the September / October 2020 firmwares, but here's a new one directly modified from the March 2021 (Android 11) firmware base:
NEWEST DOWNLOAD, BASED ON 2021-03 FIRMWARE:
https://www.androidfilehost.com/?fid=14943124697586346609
Click to expand...
Click to collapse
I flashed ths when I'm running lineageos 18.1 annd this is the only mod that worked for me

Thanks for posting your images and linking to the guide, worked perfectly and the images just fit to the pixel <3

Confirmed working as of March 2022. Device is running base P610XXU2DUL9. Thanks for the hard work.

can you make one for SM-P613 model plz?

[UMX U696CL- RELEASE THREAD]

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Proudly Presents
Another Exclusive Release
Supported Model
UMX U696CL
Recoveries
TWRP_11 Recovery
Roms
GSI Roms - Arm32 Binder64 Required
AssuranceRom Custom Stock * WIP *
-AIO ToolKit Prerequisites-
1- Linux: Linux Mint Cinnamon Suggested
2- Python 3
Rom Notes/Disclaimer/Warning
* WIP *
Contributors
@gregeerg / BVK - for using his device as a ginuea pig to make this happen
@AndyYan - for his GSI knowledge and wisdom
@deadman96385 - for uploading dumped files to github
@Jet! - for flashing twrp and dumping stock super image
Big Thanks To The Folks In My A-Team Telegram Group
Big Thanks To The Folks Who Have Come To The A-Team Telegram Group To Help Test
Device Downloads
UMX U696CL Downloads
Recovery Device Trees
Device Source
A-Team Website
A-Team Supported Devices
TeleGram Live Support
A-Team Digital Solutions​

-Updates-
5-18-2022- Initial AIO ToolKit v0.01 Release

I don't have telegram, is there anywhere else I can download some of this stuff from?
Thanks..

karl615 said:
I don't have telegram, is there anywhere else I can download some of this stuff from?
Thanks..
Click to expand...
Click to collapse
No sir, I don't put out untested stuff. I've gotten 0 feedback on the toolkit

How do we get feedback if no one can download here? we are not forcing anyone to install tiktok whatsapp instagram facebook telegram or any other crappy pipapo, keep development on xda-developers. Think about it

aIecxs said:
How do we get feedback if no one can download here? we are not forcing anyone to install tiktok whatsapp instagram facebook telegram or any other crappy pipapo, keep development on xda-developers. Think about it
Click to expand...
Click to collapse
I left a download link, unsure what you mean. If XDA would allow me to upload a 1.7gb 7zip file I would but that's not reality. I need stuff tested and chat to be fluid and prompt. That's not possible on a forum. In reality, If I had the device, I could test in 1 day what it would take a week to do on Telegram or 3 months to do on XDA forum. So for getting things done in a timely fashion, Telegram is my go to. I've been a member of XDA since 2012, I've done my time. If people don't want the toolkit or if joining telegram is too much, that's fine, not the people I want to help me test my software then anyways. The people who just want to grab a download and go can wait for the rest of the backend process. Again, I don't even have this device. So why am I even doing this is what i'm now wondering. I guess next time someone comes to me with a untouched device I won't help and use my resources to get something going....
it's alright though, you can consider this project shelved as I have a different hands on device I've already moved on to. Enjoy the twrp I built for you guys!.....

PizzaG said:
I left a download link, unsure what you mean. If XDA would allow me to upload a 1.7gb 7zip file I would but that's not reality. I need stuff tested and chat to be fluid and prompt. That's not possible on a forum. In reality, If I had the device, I could test in 1 day what it would take a week to do on Telegram or 3 months to do on XDA forum. So for getting things done in a timely fashion, Telegram is my go to. I've been a member of XDA since 2012, I've done my time. If people don't want the toolkit or if joining telegram is too much, that's fine, not the people I want to help me test my software then anyways. The people who just want to grab a download and go can wait for the rest of the backend process. Again, I don't even have this device. So why am I even doing this is what i'm now wondering. I guess next time someone comes to me with a untouched device I won't help and use my resources to get something going....
it's alright though, you can consider this project shelved as I have a different hands on device I've already moved on to. Enjoy the twrp I built for you guys!.....
Click to expand...
Click to collapse
Appreciated..
Update: flashed the recovery using 'fastboot flash recovery /path-to-.img' and the recovery works fine as far as I can tell, but the system is gone. Or something is up anyway, I can't get it to boot normally.. only to recovery. What did I do wrong?

Sorry Pizza i havent had the time to give feedback on it but i have the same issues booting. please dont let one person ruin it for everyone. i will hyu on telegram later today

PsYk0n4uT said:
Sorry Pizza i havent had the time to give feedback on it but i have the same issues booting. please dont let one person ruin it for everyone. i will hyu on telegram later today
Click to expand...
Click to collapse
Actually i havent had the time to get my linux machine setup correctly because of a memory leak issue that kept crashing my system but i finally got it running stable. i tried using relive on virtualbox but couldnt get it working properly due to driver issues in the host OS on this windows machine and for some reason i had more than one python version installed causing me conflicts. i ended up just using adb to flash the images and the phone no longer boots. i want to test it on a native linux os first

Well, folks...I'm about to give this a go....I still have a BLU View 3 to root today. Much gracias for all the effort

Cinephile 74 said:
Well, folks...I'm about to give this a go....I still have a BLU View 3 to root today. Much gracias for all the effort
Click to expand...
Click to collapse
Well I seem to have faux pas along the way.... bootloader unlocked easy-peasey. But I can't get fastboot to flash TWRP no matter what directory I use....RELP!

Is this the ROM or the bootable zip?

I'm back and about to try this again with an actual thumb drive with the ReLiveDVD on a thumb drive now that I have one

I downloaded A-Team-UMX_U696CL_AIO_ToolKit-v0.01.7z from the tg group and here's my feedback. I don't mean to sound ungrateful but:
Root does not work. I opened Main_Menu.sh and the root option literally does nothing. The lines are commented out and the image it was supposed to flash doesn't exist. Bootloader unlocking works (seems to literally be a single fastboot command i.e. "fastboot flashing unlock", seems like the new "oem unlock") and TWRP does work, but only once. If I flash it in fastboot and immediately reboot to recovery from there, I can get in. If I try to go to recovery after restarting, I get the dead android with the red ! triangle saying "no command". TWRP won't mount data (I think it said it couldn't decrypt, but I don't even have a lock code on it) so you need a micro sd to store the boot.img in order to patch it in Magisk. It would've been nice if you included it, though it seems you intended to but haven't gotten around to it since it's only v0.01. Still, it's not much of an all-in-one if it can't do the primary thing most people will want from it. I do fortunately have micro sd cards so I was able to save (manually in TWRP terminal using dd, annoying as hell on a touchscreen, can't even type "=" without going through 2 keyboard menus) and patch it in Magisk and now do have root working.
I don't understand why this requires Linux. The AIO doesn't do anything you can't do in Windows. The Python file is just an ASCII logo that makes you wait 10 seconds for no reason. It would have more user friendly as just a bunch of separate partition IMG uploads and instructions. I wish I had actually looked at the shell scripts beforehand instead of downloading a Linux distro and booting it as a live cd. If you make a new version, consider just including a portable adb/fastboot with it and skipping Linux/Python since it's not necessary.
After googling the "no command" screen, I held down power and pressed volume up and got into the regular Android recovery. So despite the bootloader being unlocked, it appears TWRP got overwritten by the default recovery. I flashed TWRP at least 3 times, immediately entering TWRP each time afterward, but it never stuck.
I'm attaching my Magisk'd boot.img in case anyone else gets stuck at that part. If anyone chooses to use it, MAKE YOUR OWN BACKUP FIRST, obviously. I'm not responsible for anything that happens using that file.

Eric janaika said:
TWRP does work, but only once.
Click to expand...
Click to collapse
proof that TWRP works for you, anything beyond is usage problem.

aIecxs said:
proof that TWRP works for you, anything beyond is usage problem.
Click to expand...
Click to collapse
I got twrp to stick but could not do anything with it since I didn't have an SD card before I misplaced the phone. Yes the scripts unfinished but as stated above somewhere, the dev did not have a device to test on.
If you wanna help, and it's probably the only way anyone else who isnt so knowledgable as many visiting xda seeking a way to root their device is gonna get this finished as well, please consider joining the telegram chat and contribute to this forum whatever you learn. Maybe Pizza will still be interested in helping. I tried but somehow misplaced the phone in the middle of filling in my huge gaps of knowledge on the subject.
I could not mount or wipe /data in twrp and even flashing the super.imgwould not allow me to boot because I was unable to do anything with the data partition. Had to flash the stock recovery to get it to boot period.
Maybe twrp will get you root if you patch your boot image with Magisk and flash it in twrp.
I'm not sure what else could be done. And not even sure that would work without being able to mount /data.
It's really hard for anyone working on a device they don't have to finish the work without some feedback from people who have enough knowledge to give them useful feedback.

The unlock bootloader option and the flash twrp recovery options work.
Script could be finished but I doubt there's much motivation for them since th3y don't own the device.
But the script is there. Most of the work on that part is done.
would only take some contributions by interested people.
PsYk0n4uT said:
I got twrp to stick but could not do anything with it since I didn't have an SD card before I misplaced the phone. Yes the scripts unfinished but as stated above somewhere, the dev did not have a device to test on.
If you wanna help, and it's probably the only way anyone else who isnt so knowledgable as many visiting xda seeking a way to root their device is gonna get this finished as well, please consider joining the telegram chat and contribute to this forum whatever you learn. Maybe Pizza will still be interested in helping. I tried but somehow misplaced the phone in the middle of filling in my huge gaps of knowledge on the subject.
I could not mount or wipe /data in twrp and even flashing the super.imgwould not allow me to boot because I was unable to do anything with the data partition. Had to flash the stock recovery to get it to boot period.
Maybe twrp will get you root if you patch your boot image with Magisk and flash it in twrp.
I'm not sure what else could be done. And not even sure that would work without being able to mount /data.
It's really hard for anyone working on a device they don't have to finish the work without some feedback from people who have enough knowledge to give them useful feedback.
Click to expand...
Click to collapse

what do you need a script for? read any random TWRP install guide steps are more or less same
- unlock bootloader
- patch avb/dm-verity/vbmeta
- install TWRP
- makesysrw super.img (optional)
- disable encryption (optional)

PsYk0n4uT said:
The unlock bootloader option and the flash twrp recovery options work.
Script could be finished but I doubt there's much motivation for them since th3y don't own the device.
But the script is there. Most of the work on that part is done.
would only take some contributions by interested people.
Click to expand...
Click to collapse
Agreed. PizzaG has done a bang up job with his UMX U696CL offerings, and his knowledge is extensive regarding custom ROMs and recoveries.

Eric janaika said:
I downloaded A-Team-UMX_U696CL_AIO_ToolKit-v0.01.7z from the tg group and here's my feedback. I don't mean to sound ungrateful but:
Root does not work. I opened Main_Menu.sh and the root option literally does nothing. The lines are commented out and the image it was supposed to flash doesn't exist. Bootloader unlocking works (seems to literally be a single fastboot command i.e. "fastboot flashing unlock", seems like the new "oem unlock") and TWRP does work, but only once. If I flash it in fastboot and immediately reboot to recovery from there, I can get in. If I try to go to recovery after restarting, I get the dead android with the red ! triangle saying "no command". TWRP won't mount data (I think it said it couldn't decrypt, but I don't even have a lock code on it) so you need a micro sd to store the boot.img in order to patch it in Magisk. It would've been nice if you included it, though it seems you intended to but haven't gotten around to it since it's only v0.01. Still, it's not much of an all-in-one if it can't do the primary thing most people will want from it. I do fortunately have micro sd cards so I was able to save (manually in TWRP terminal using dd, annoying as hell on a touchscreen, can't even type "=" without going through 2 keyboard menus) and patch it in Magisk and now do have root working.
I don't understand why this requires Linux. The AIO doesn't do anything you can't do in Windows. The Python file is just an ASCII logo that makes you wait 10 seconds for no reason. It would have more user friendly as just a bunch of separate partition IMG uploads and instructions. I wish I had actually looked at the shell scripts beforehand instead of downloading a Linux distro and booting it as a live cd. If you make a new version, consider just including a portable adb/fastboot with it and skipping Linux/Python since it's not necessary.
After googling the "no command" screen, I held down power and pressed volume up and got into the regular Android recovery. So despite the bootloader being unlocked, it appears TWRP got overwritten by the default recovery. I flashed TWRP at least 3 times, immediately entering TWRP each time afterward, but it never stuck.
I'm attaching my Magisk'd boot.img in case anyone else gets stuck at that part. If anyone chooses to use it, MAKE YOUR OWN BACKUP FIRST, obviously. I'm not responsible for anything that happens using that file.
Click to expand...
Click to collapse
Did you flash this from fastboot or from twrp?