Database Info

[ROOT][OUDHS][LUCID2] Spirited Away: RCT Nerfer :: 5/7/13 :: FULL NOTES ON RCT INSIDE

I thought I'd crosspost this here for once, as I don't think RCT, the Root Checker Tool, is going away. Please note that the original Spirited Away is not my work and is used with permission. This post pertains to the Verizon-sold LG Lucid 2 (VS870). -k0
--
k0nane and the Official Unloved Devices Hit Squad present...
Spirited Away: RCT Nerfer Edition
With thanks to Dan Rosenberg and the original Spirited Away he created!
​
Root! Root, root root, root.
Verizon doesn't want you to have it. The OUDHS does! At the behest of everyone's favorite giant, oligopolist, anti-consumer, borderline-evil carrier, LG stuck what they call the Root Checker Tool (RCT) into the guts of the Lucid 2. Not present on the international model, the RCT checks for - and perhaps prevents the execution of - certain root tools. It also leaves logs of the presence or running of said tools. See the second post for more details.
This package cuts off RCT's head and gives you - not your carrier or the OEM - a bit more control over your phone. This does not unlock the bootloader, unfortunately. It's just root.
Code:
#include <external/cyanogenmod/std_disclaimer.h>
/*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
Instructions​
Download the package.
Extract the contents of the zip.
Ensure you have installed the drivers for your phone.
Connect it to USB, wait for it to be detected.
Double-click run.bat, follow on-screen instructions. Mac and Linux users, open the file and follow along, it's just a set of ADB commands.
Let it finish, continuing to follow instructions.
That's it! Your device will autoreboot. You will be rooted.
FAQ​
Q: What does this install?
A: Your device will have Superuser (ChainsDD's variant, the original), the su binary, and BusyBox 1.20.2 on it.
Q: Can I use this on a device that isn't the Verizon-model LG Lucid 2?
A: That's a bad idea. Don't do that. Don't whine to us if you break stuff by doing so.
Q: Will this survive OTAs?
A: Probably not, and it's almost guaranteed that RCT will come back with a vengeance! Be very careful with updates!
Q: I've tried to root already, can LG/Verizon tell?
A: Unless you reset what's already been written, they sure can. See the next post.
Downloads​
Download Root Package
Download Root Package (Mirror)
​
Credits:​
Shabbypenguin: making me aware of the issues on this device, initial testing, general awesomesauce
SICFreak: remote access to two devices, time, taking the risk, patience
Dan Rosenberg (@djrbliss): Spirited Away exploit, reverse engineering of rctd post-root
The OUD Hit Squad: for being made of either unstable isotopes of uranium, or pure greatness, one of the two
LG and Verizon: just kidding, f*ck you both
Donations
This is not, and will never be donationware. Your generosity - if you feel like showing it - is highly appreciated! Thank you!
Donate to Dan Rosenberg:
​

Technical Details​
Just what do we know about RCT? RCT, the Root Checker Tool, has one primary purpose: to make persistent note of any presence of rooting-related tools, the running of su, or the remounting of the system partition as read-write. The main "meat" of the tool - if not all of it - is in /system/bin/rctd. Mr. Rosenberg was kind enough to decompile and analyze the tool, and state that it checks for the following files:
/system/[bin,sbin,xbin]/su
/sbin/su
/data/local/tmp/su
/system/app/[s,S]uper[u,U]ser.apk,
/data/data/com.noshufou.android.su
/data/local/tmp/[s,S]uper[u,U]ser.apk
/system/[bin,xbin]/busybox
/data/local/tmp/busybox
The tool writes a hexadecimal number to /persist/rct and /data/system/lgmdm_root_flags.txt (these files are identical in contents) that represents the "root status". Mr. Rosenberg confirms that "[the] number is an encoded representation of whether su, Superuser, busybox, etc. are installed". The tool writes a human-readable representation of what it's found to /persist/rct.cfg. An example from a rooted system (if used on a previously-virgin system, this package will prevent this from being written):
Code:
Rooted
Not allowed command had been executed.
> su
Mount option had been changed.
> /system
Rooting related file had been installed.
> su
> superuser
> busybox
[LG RCT v1.0.1220]
A "clean" system will display "not rooted" and nothing else except the bottom line.
RCT also writes copies of ls -l /, portions of /dev/log/main and /dev/log/system, ls -l /system/app, ls -l /persist/LostFound, df -h, and basic system information (see below) to files named after asteroids and stored in /persist/LostFound.
Code:
VS870 4G
Model name : L1v
Manufacture : LGE
OS Version : 4.1.2
Secure : 1
Operator : Verizon Wireless
Country : US
Product version : M8960A-AAAANAZM-3.0.0743
Build date : Wed Mar 6 21:51:54 KST 2013
RCT may have other functions. rctd only does what's described above - it's a logger and nothing more, according to Mr. Rosenberg. There may be other portions of the system, but I have not found them.
I do have "clean" copies of the entire /persist and lgmdm_root_flags.txt, but due to the sensitive nature of some of the logs, and to protect the privacy of my tester, I prefer not to publicly distribute them. If anyone needs them, please contact me here, on XDA, Twitter, or chat.freenode.net #oudhitsquad.
How RCT Starts/Is Triggered
rctd, the main daemon that makes up RCT, is started as a system service in init.l1v.rc. I seem to have misplaced my copy of this file/the kernel, but it's a very standard service start. As the bootloader is currently locked, there's not much that can be done about this.
Inside com.lge.systemservice.core, BootCompletedReceiver waits for the BOOT_COMPLETED signal to be thrown, then executes the following:
Code:
const-string v1, "ro.build.target_operator"
const-string v2, ""
invoke-static {v1, v2}, Landroid/os/SystemProperties;->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
move-result-object v1
const-string v2, "VZW"
invoke-virtual-quick {v1, v2}, [email protected]
move-result v1
if-eqz v1, :cond_1d
.line 12
new-instance v0, Landroid/content/Intent;
invoke-direct {v0}, Landroid/content/Intent;-><init>()V
.line 13
.local v0, mServiceIntent:Landroid/content/Intent;
const-string v1, "com.lge.action.ROOTINGCHECKER"
invoke-virtual-quick {v0, v1}, [email protected]
.line 14
invoke-virtual-quick {p1, v0}, [email protected]
.line 16
.end local v0 #mServiceIntent:Landroid/content/Intent;
:cond_1d
return-void
For those of you who don't speak smali, the real juicy bit of that appears as the following, when run through dex2jar:
Code:
[SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2][SIZE=2]
[/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE][/SIZE]if (SystemProperties.get("ro.build.target_operator", "").equalsIgnoreCase("VZW"))
{
Intent localIntent = new Intent();
localIntent.setAction("com.lge.action.ROOTINGCHECKER");
paramContext.startService(localIntent);
}
Yes, it really is just checking an item in build.prop to see whether it should run or not. That's an alternate way to stop rctd, but not one that I like. It is safe to remove the entirety of BootCompletedReceiver.smali, and for anyone working on modifications in the future, I would do so.
As you can see, an intent is thrown, and caught by rctd, which does its thing. It (rctd's main function) seems to run once per boot, but I cannot guarantee that.
Other Framework/System Finds
com.lge.mdm contains one item of interest. The rest of the framework, and /system/app, is largely clean. LGMDMGeneralController is the file of interest, and for the sake of readability in this post, I've run it through dex2jar. Here it is: Pastie This class contains a lot more than just RCT-related items, many potentially worth investigating.
Other things of note:
Viewing strings of other binaries, including those pertaining to FOTA, indicate the presence of "rooting history tables". Where these are, I don't know, and it could be as simple as what's already outlined here. Do proceed with caution, particularly around updates, as the updater system is rife with checks and logging for modifications.
There's an "ATS Agent" of some type hanging out in the framework. Its purpose is to take logs, and it may be responsible for the asteroid-namesake files. It is not present on the international model, thus can be assumed to be specific to VZW. Proceed with caution. I am automatically suspicious of these "diagnostic" tools after CIQ.
There's a GUI for RCT's output. See below.
Finally, I found some dialer codes. There's fun to be had here - proceed with caution, but enjoy Verizon/LG's hidden menu, and see what's to be seen in the Rooting Check entry (RootingCheck class inside the hidden menu apps/JARs).
A Message for Verizon and LG
Teehee, you guys are funny. This wasn't hard, no more than Samsung's silly attempt to block package installation back on the Galaxy Indulge 4G (on MetroPCS). Go ahead and keep trying to prevent your users from controlling their devices... it's a losing battle.
Oh, and suck me. (And Dan.)
Credits/Donations
Please see the previous post for these notes. This was a good number of hours' worth of research - if I have helped you, please consider giving a small token. This system isn't going away any time soon.​

I'll take one more just in case.
--
P-O-S-T :: R-E-S-E-R-V-E-D
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Original artwork by Pendulum via Gasolin3.
...for future use.
Follow me on Twitter @k0nane and @publik0!
Join the OUDHS and I on IRC at irc.freenode.net #oudhitsquad, or via the webchat link in my signature.​

Doesn't seem to work on an LG Lucid 2 with firmware VS87011A.
Someone on another forum mentioned having the same problem with the same firmware version. Any ideas?

GnatGoSplat said:
Doesn't seem to work on an LG Lucid 2 with firmware VS87011A.
Someone on another forum mentioned having the same problem with the same firmware version. Any ideas?
Click to expand...
Click to collapse
I'm curious too. I've yet to see anything.

hkbladelawhk said:
I'm curious too. I've yet to see anything.
Click to expand...
Click to collapse
I did manage to root it. I downgraded to old FW, rooted, installed Voodoo OTA Rootkeeper, then took the OTA update back to current and managed to stay rooted. Had to reinstall a Superuser app, I used SuperSU.
I have heard all that can be avoided by using Motochopper which supposedly will root the current FW, but I didn't try that method.

GnatGoSplat said:
I did manage to root it. I downgraded to old FW, rooted, installed Voodoo OTA Rootkeeper, then took the OTA update back to current and managed to stay rooted. Had to reinstall a Superuser app, I used SuperSU.
I have heard all that can be avoided by using Motochopper which supposedly will root the current FW, but I didn't try that method.
Click to expand...
Click to collapse
I just now used motochopper to root after enabling USB Debugging and clicking "skip" on the message "Checking for PC Drivers". if you do not, adb will NOT work. also, its best to use Charge Only when rooting unless you must have the SD Card mounted

Hello,
I have to send my D802 in service due to yellow display spots and i want to remove the "rooted" from download mode
i've tried flashing few stock firmware and it didn't worked
now i found this http://forum.xda-developers.com/showthread.php?t=2715114
but it seems that i don't hace the rct and rct.cfg file that it requires
can you give me those files ? do they have same content for each phone ?
or do you know any other way?
Thanks.

EMUI8.0 - Hidden settings & tweaks [Root needed]

Here is a list of hidden settings & tweaks for EMUI8.0 .
They were tested on oreo STF-L09C432B360 but should work on others EMUI8.0 devices.
Other version than European C432 should switch "/eu/" part in original filename with region codename of their firmware.
Root access is needed to be able to edit these file ; Keep files' permissions & owner's rights as they were.
For rooting EMUI8.0, I'll suggest magisk 15.4 until a better solution appears.
Show 4G/LTE switch in network settings
In :
Code:
/cust/hw/eu/prop/local.prop
Look for :
Code:
ro.config.hw_hide_lte=true
Edit it to :
Code:
ro.config.hw_hide_lte=false
Reboot
Show 4G/LTE switch in quick settings
In :
Code:
/cust/hw/eu/xml/hw_default.xml
Look for :
Code:
<integer settings.global.hw_4g_show="0" reset="true"/>
Edit it to :
Code:
<integer settings.global.hw_4g_show="1" reset="true"/>
Reboot
Change icons' title fontsize
In :
Code:
/product/etc/xml/hw_launcher_default_config.xml
Look for :
Code:
<item name="config_IconTitleSize">12</item>
Edit with the number of your choice beetween ? & ? :
Code:
<item name="config_IconTitleSize">10</item>
Reboot
Show icons' titles on 2 lines
In :
Code:
/cust/hw/eu/xml/hw_default.xml
Look for :
Code:
<string app_name_two_lines="false"/>
Edit it to :
Code:
<string app_name_two_lines="true"/>
Reboot
Huawei Call Recorder
Follow this link
Huawei Face Unlock
Follow this link
Testing in progress :
Add '4G/LTE only' mode to prefered carrier modes list in network settings
In :
Code:
/cust/hw/eu/xml/hw_default.xml
Look for :
Code:
<string hw_add_4g_only="250"/>
Change or add your carrier's mcc number.
Note : [adding mcc numbers with ';' or ',' ?] [need testing with 'all' , '-1' , 'ALL' or nothing for mcc parameter)
Testing in progress :
Replace '4G' by '4,5G' in both settings and status bar
In :
Code:
/cust/hw/eu/xml/hw_default.xml
Look for :
Code:
<string hw_show_4_5G_for_mcc="286"/>
Change or add your carrier's mcc number.
Note : [adding mcc numbers with ';' or ',' ?] [need testing with 'all' , '-1' , 'ALL' or nothing for mcc parameter)
Testing in progress :
Add 6x5, 5x6, 6x4 & 4x6 icons layout to homescreen settings
In :
Code:
/product/etc/xml/hw_launcher_default_config.xml
Look for :
Code:
<item name="config_desktopCellsOptionItems" reset="true">4x5,4x4,5x4,5x5</item>
-WIP-
Layout 6x6 not working
Testing in progress :
Change begin date of monthly data usage cycle
In :
Code:
/data/user_de/0/com.huawei.systemmanager/databases/netassistant.db
With a sqlite editor change this value :
Code:
settinginfo / begin_date
Change it from null to the day's number your monthly data plan starts.
After editing : Double check UID & GID ownerships are still set to 1000 (system).
Show 4G+/CA switch in settings
In :
Code:
/version/special_cust/STF-L09/hw/eu/prop/local.prop
Look for :
Code:
ro.config.support_ca=false
Edit it to :
Code:
ro.config.support_ca=true
Reboot
Show data roaming options in settings (options available are: disabled/domestic/international)
In :
Code:
/cust/hw/eu/xml/hw_default.xml
Look for :
Code:
<string hw_data_roam_option="26006,27211"/>
Change or add your carrier's mcc&mnc number.
Note : [need testing with 'all' , '-1' , 'ALL' or nothing for mcc parameter)
Reboot
Wifi bridge enabler
Follow this link
PS: I use TotalCommander on android but others files explorer with root access should work too.
MAKE BACKUPS BEFORE YOU EDIT ANY FILES !!!
0. Check file's permission & file's owner and remember it.
1. First backup the original file in a backup directory.
2. Copy again the original file in a custom directory with user's rights.
3. Edit file on this custom folder.
4. Delete original file on original location, then hurry to step 5.
5. Copy previously edited file from custom folder to original location and accept when TotalCommander ask about re-mounting partition.
6. Verify file's permission & file's owner in original location.
I'll update this OP with new tweaks & settings as they are uncovered.
Reasons for editing:
-typos, visual work-over, added file's ownership (UID) infos
-added 'Change begin date of monthly data usage cycle'
-added Wifi bridge, CA settings (4G+) & Roaming options

-reserved-

for have call recorder whit twrp
EDIT:
sorry if you use it in oreo, recorder call work, but there isnt link for listen in phone dialer. it is full 100% working only in nougat

angelobiz said:
for have call recorder whit twrp
Click to expand...
Click to collapse
Any differences, beside twrp compatible, with the one provided on OP's link ?

oslo83 said:
Any differences, beside twrp compatible, with the one provided on OP's link ?
Click to expand...
Click to collapse
i dont know, but i think it is same same. whit twrp it is more simple install.
i have test it in nougat work so good,
EDIT:
i wrong sorry, in oreo work, but for listen the record have to go hit recorder app... there isnt a link for listen in dialer.

link for Face unlock added !

angelobiz said:
i have test it in nougat work so good,
EDIT:
i wrong sorry, in oreo work, but for listen the record have to go hit recorder app... there isnt a link for listen in dialer.
Click to expand...
Click to collapse
You meant it's partialy working on nougat ?
Because here on oreo it's fully working with a link for listen recordings in dialer.

Added 'Change begin date of monthly data usage cycle' in OP.

oslo83 said:
You meant it's partialy working on nougat ?
Because here on oreo it's fully working with a link for listen recordings in dialer.
Click to expand...
Click to collapse
i mean TWRP file that i posted.
your files and guide is ok!

I Found:
Show 4G+/CA switch in settings
&
Show data roaming options in settings (disabled/domestic/international)
I'll add them soon.
+ I'll test vowifi (some tweaks and edits already done) once my volte would be *finally* enabled carrier side.
As i think you need volte function enabled for enabling vowifi.

Quick update:
Volte finally enabled carrier side, so now volte is working on stock as it should for me.
Vowifi not working, but maybe almost :
- vowifi carrier settings line added in volte/vowifi carrier's file.
- one of the two hiddens wificalling settings screen is shown and seems to works: It keeps the settings set once close. It's com.android.settings.Settings$WifiCallingSettingsActivity
- the others don't and this should be a problem, it's com.android.settings.Settings$HwWifiCallingSettingsActivity
For now when wificall should occurs it complains about no wifi connected to when there is one already connected to. I saw some wlan settings still set to 0 in config files - need to fiddle with it...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

About call recorder, I installed app and gave permissions like said but each time I try to start a record or set for automatic record, I get a pop up bubble reading "open device error". Any idea?
I'm on Oreo B360 rooted with Magisk. Solid explorer for all operations.

FlyingMachete said:
About call recorder, I installed app and gave permissions like said but each time I try to start a record or set for automatic record, I get a pop up bubble reading "open device error". Any idea?
Solid explorer for all operations.
Click to expand...
Click to collapse
1) I don't use sdcard, do you use one ? Formated to ? External shared memory ?
Or
2) Solid Explorer didn't set rights &/or owners for you the same way Total Commander did for me
OR
3) Did you mess with rights of /storage/emulated/0/Sounds/CallRecord ?
Could you record your voice with stock record apps ?

I can tell you my HwCallRecorder FOLDER and subFOLDERS are uid & gid 0 (root) with 755 set as rights.
All FILES included in folders and subfolders are uid & gid 0 (root) with 644 set as rights.

oslo83 said:
1) I don't use sdcard, do you use one ? Formated to ? External shared memory ?
Or
2) Solid Explorer didn't set rights &/or owners for you the same way Total Commander did for me
OR
3) Did you mess with rights of /storage/emulated/0/Sounds/CallRecord ?
Could you record your voice with stock record apps ?
Click to expand...
Click to collapse
oslo83 said:
I can tell you my HwCallRecorder FOLDER and subFOLDERS are uid & gid 0 (root) with 755 set as rights.
All FILES included in folders and subfolders are uid & gid 0 (root) with 644 set as rights.
Click to expand...
Click to collapse
Weird, I have exact same set permissions to folders and files, I do have an sd card but default storage is internal, I made sure nothing tried to record to it, even tried after having ejected it, to no avail. Then I formatted it for the sake of it but still same. And I can make a voice record with stock record app... No clue what's happening there. Thanks for your help though.

Magisk 16.0 confirmed as fully working.

Call recorder from the OP.
I can confirm working on Honor 9 STF C432 360 Oreo,
BUT
the recording app requires strict access to the microphone. You need to disable OK google detection on any screen and lockscreen. Then the recording finally works on both incoming and outgoing calls.
Hooray.

Added CA settings (4G+) & Roaming options to OP.
Added original link to working magisk module for Wifi bridge to OP.

AR Lens enabler
Follow this link

qwert8988 said:
Hi oslo83, saw your hidden settings post and I have a huawei honor 8 pro phone with Android Oreo. But I cannot find the entries in those file. How can I find the correct database or XML files in my phone to tweak those settings? And is there a setting to add seconds to status bar clock? Thanks
Click to expand...
Click to collapse
Hi,
What's your region ? Not C432 ?
You could start by searching all files from your root directory which:
- are named "*.xml" or "*.prop"
- are containing some terms like "settings.global.hw_4g_show="
About an inbuilt setting to add seconds to status bar clock, i'm sure there is but i don't know how it's called ans where it is.

[PORT] Fortnite for Android with device check disabled (v5.21.2-4296531)

Fortnite for Android with device check disabled
Notes and warnings - READ THESE FIRST!:
This is an APK with only the device check disabled. It spoofs a Samsung Galaxy Note 9, so edit the settings accordingly for your device in game. You may experience optimisation issues. It still requires an ARM64 device (arm64-v8a), as that's all the code included supports.
THIS APK HAS A DIFFERENT SIGNATURE TO THE OFFICIAL GAME (MY SIGNATURE) - THIS IS A REQUIREMENT OF MODDING APKS - IT MAY BE VISIBLE TO EPIC. I AM NOT RESPONSIBLE FOR ACCOUNT BANS OR KICKS FROM THE GAME. YOU ARE RECOMMENDED TO USE A BACKUP OR THROWAWAY ACCOUNT IF YOU DO NOT WANT TO RISK YOUR ACCOUNT
This game uses Safety Net, and also looks for ADB being enabled. You must pass safety net and disable ADB to play the game. Whilst it is likely possible to mod that out, it would also enable cheaters to play the game more easily, and make Epic more likely to retaliate against this mod. For that reason, this release is as close to the official build as possible, with only the device spoofed. There is an experimental APK with the Safety Net test skipped - this may mean your account gets banned so be careful!
This APK does not grant access to the exclusive in-game skin
This APK will not install over the top of the official APK. Uninstall that first, then install this one.
FAQ
Got the "You were removed from the match due to internet lag, your IP or machine, VPN usage, or cheating. We recommend not utilizing VPN or proxy services while attempting to play Fortnite" error? Read this (don't post that you have it in this thread either)
Got "App not installed"? If you have another Fortnite build (a leak or release build, both count), uninstall it first then install this. Otherwise, your device does not meet the compatibility requirements
Got an error involving Safety Net, ADB or root? Make sure your device passes Safety Net, you have enabled Magisk Hide for the game (not just overall) and have disabled ADB/USB debugging. You can also try using the less-safe, Safety Net disabled APK
Got the 3GB RAM issue even with the RAM patched APK? The error your are seeing appears to be in native code, and is caused by a genuine lack of RAM, so it can't be solved
Got an error where it says "Fortnite encountered an error indicating an incompatibility with your mobile device's graphics driver"? Read this
Got an error where it says your device doesn't have OpenGL ES 3.1 support or floating point render target support? Your device isn't compatible
Game crashing during optimisation? Your device isn't compatible
Got GPU compatibility issues? Read this
Download
Version 5.21.2-4296531 (newest):
APK with the device/GPU/RAM check disabled, but does not spoof the Note 9 to the game. This will only work if you have an invite, like the official build, but is less laggy. Use the third APK if you don't mind lag and want to skip the invite system
Dead Link
APK with the device/GPU/RAM check disabled, as well as the Safety Net check disabled (warning: This may cause account bans):
Dead Link
APK with the device/GPU/RAM check disabled, fully spoofing the Note 9 (may cause lag/overheating):
Dead Link
Checksums:
Fortnite_com.epicgames.fortnite-5.21.2-4296531-Normal.apk:
MD5: 0E1CE4ADEEA4F2134E370F014EEB67B9
SHA1: BBE50D447EB120506E22DAD0522973D47CF9C095
Size: 90.3MB
Fortnite_com.epicgames.fortnite-5.21.2-4296531-NS.apk:
MD5: 30F683A6340535DB42BE4F2185AB4D85
SHA1: 5B4970EA07DD4216D46AEAED312158842F990169
Size: 90.3MB
Fortnite_com.epicgames.fortnite-5.21.2-4296531-Note9.apk:
MD5: C8C31820B275D84E31A6DAD977A44579
SHA1: 52380A0CFCA0245B5C785099F38B1746C3D52BDB
Size: 90.3MB
The APK is signed with my certificate, you can validate this in any mirrors by checking the MD5 and SHA1 of the APK file. You are free (and recommended to, if you wish) to mirror this file elsewhere and share it on for free (no charging or having people follow your social media or anything in return for the download), but please give credit if you do.
Old APKs:
Version 5.2.1-4288479:
APK with the device/GPU/RAM check disabled, but does not spoof the Note 9 to the game. This will only work if you have an invite, like the official build, but is less laggy. Use the third APK if you don't mind lag and want to skip the invite system
Dead Link
APK with the device/GPU/RAM check disabled, as well as the Safety Net check disabled (warning: This may cause account bans):
Dead Link
APK with the device/GPU/RAM check disabled, fully spoofing the Note 9 (may cause lag/overheating):
Dead Link
Checksums:
Fortnite_com.epicgames.fortnite-5.2.1-4288479-Normal.apk:
MD5: 0E1CE4ADEEA4F2134E370F014EEB67B9
SHA1: BBE50D447EB120506E22DAD0522973D47CF9C095
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.1-4288479-NS.apk:
MD5: 4B0FB3774F3889453315E9B61B10D970
SHA1: 14349F5ADE14FCF86B908D61E6A3FBABD53114D2
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.1-4288479-Note9.apk:
MD5: D3498C9308F7C0D05321F1B24AEFB5F4
SHA1: 554AD0B5AA31EA0937B1E4215CBD998D32F751E3
Size: 90.4MB
Version 5.2.1-4284747:
APK with the device/GPU/RAM check disabled, but does not spoof the Note 9 to the game. This will only work if you have an invite, like the official build, but is less laggy. Use the third APK if you don't mind lag and want to skip the invite system
Dead Link
APK with the device/GPU/RAM check disabled, as well as the Safety Net check disabled (warning: This may cause account bans):
Dead Link
APK with the device/GPU/RAM check disabled, fully spoofing the Note 9 (may cause lag/overheating):
Dead Link
Checksums:
Fortnite_com.epicgames.fortnite-5.2.1-4284747-Normal.apk:
MD5: A97810E01746328119434A3F72984F28
SHA1: BCA5038A0687E77E9CE1F834BCDB652CFB6F399A
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.1-4284747-NS.apk:
MD5: 566B0BB19E1E5BB66A3352FD6C67A934
SHA1: 8CDD0E69353730B35ABBDD0BEF5FECDF443DBE46
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.1-4284747-Note9.apk:
MD5: 24AC0E1F0F168973ACD0516B6E1E0206
SHA1: 7B283B8A989F6A9E54BCDB53EF0BCC20B5ADA8CD
Size: 90.4MB
Version 5.2.0-4276112
APK with the device/GPU/RAM check disabled, fully spoofing the Note 9 (may cause lag/overheating):
Dead Link
APK with the device/GPU/RAM check disabled, fully spoofing the Note 9 (may cause lag/overheating), as well as the Safety Net check disabled (warning: This may cause account bans):
Dead Link
APK with the device/GPU/RAM check disabled, but does not spoof the Note 9 to the game. This will not work until the 12th August when Epic open the beta fully, but should be better on the lag front (as it doesn't give the game the wrong info) - EXPERIMENTAL:
Dead Link
Checksums:
Fortnite_com.epicgames.fortnite-5.2.0-4276112.apk:
MD5: 3A298A730708B9F51B8D60F39FF15157
SHA1: 47744AEAC2A099DB7AD420A88D9D5A48231181E1
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.0-4276112-NS.apk:
MD5: C92AE326BF9051FAE97F338B259B978F
SHA1: 8C77135D119133EFAC7348BAF6C10F66B0DCF548
Size: 90.4MB
Fortnite_com.epicgames.fortnite-5.2.0-4276112-EXP.apk:
MD5: 86287E8538C286F0D752115057450AD1
SHA1: 5AEDFE7D09443A8E4D210468B605A88E27B0AC5C
Size: 90.4MB
This APK skips the Safety Net check and GPU/RAM check - Be extremely careful with this as it may crash or overheat your device, and your account may get banned
Dead Link
This APK doesn't skip the Safety Net check or GPU/RAM check, so may be safer:
Dead LInk - Thanks bluedragon02
APK with Safety Net skip:
MD5: 446C82441025FA08D707BB9BFE4C5A44
SHA1: 3DB935E8D6E7EDD6EB1C7A533972DD04CF4772BD
Size: 90.3MB
APK without Safety Net skip:
MD5: F51702713287B2222FFA1C05F2CC4BEE
SHA1: C3A549E583D4E6AD77FBE5FD46FDA99FBFA035EC
Size: 90.3MB
How to mod it yourself
Got a tinfoil hat? Don't trust my APK? Well, you can mod the original, official APK yourself with my instructions.
Porting Guide
Step 1: Download the APK
The best way to do this is via APKmirror, as the official installer also checks the device requirements. You can find the latest APK here
Step 2: Decompile it with APKtool
Install APKtool if you have not already, then run the decompile command:
Code:
apktool d <path-to-apk>
This will produce a folder containing the Java code (in Smali) and resources
Step 3: Editing the Smali
There are multiple options to edit the code here, but only one file is edited. You can find that at smali/com/epicgames/ue4/GameActivity.smali
Open it in a decent text editor, such as Notepad++, Sublime Text or Visual Studio Code
The following options are just that - optional. You can mix and match how you like, depending on what you want the mod to do
Disabling the device check (CPU/GPU/RAM)
Search for the following line:
Code:
.method private processSystemInfo(Ljava/lang/String;Ljava/lang/String;)Z
Paste the following code after the ".locals" line:
Code:
const/4 v0, 0x1
return v0
Result should look like this: https://i.imgur.com/4UdwVui.png
Save the file
How this works: The "processSystemInfo" method gets device information and checks it, displaying a message if the device is not compatible. The code we pasted in simply returns that the device is compatible so the code moves on
Enabling the Note 9 features
Search for the following line:
Code:
.method public AndroidThunkJava_Fortnite_CheckLocalizationA()Z
Paste the following code after the ".locals" line:
Code:
const/4 v0, 0x1
return v0
Result should look like this: https://i.imgur.com/WZxJlSm.png
Save the file
How this works: The "AndroidThunkJava_Fortnite_CheckLocalizationA" method checks if the device is a Note 9 by checking its brand and device properties from the build.prop. It also checks if the device supports the BLE S-Pen using a Samsung class. The code we pasted in simply returns that the device is a Note 9 and supports the pen, so the code moves on
Enabling the Tab S4 features
Search for the following line:
Code:
.method public AndroidThunkJava_Fortnite_CheckLocalizationB()Z
Paste the following code after the ".locals" line:
Code:
const/4 v0, 0x1
return v0
Result should look like this: https://i.imgur.com/V6EtEKk.png
Save the file
How this works: The "AndroidThunkJava_Fortnite_CheckLocalizationB" method checks if the device is a Tab S4 by checking its brand and device properties from the build.prop. It also checks if the device supports the S-Pen using a Samsung class. The code we pasted in simply returns that the device is a Tab S4 and supports the pen, so the code moves on
Disabling the Safety Net check
Warning: This may cause account bans
Search for the following line:
Code:
.method public AndroidThunkJava_GetCurrentConnectionState()Z
Paste the following code after the ".locals" line:
Code:
const/4 v0, 0x0
return v0
(This is not a typo, it should return "false" [0x0])
Result should look like this: https://i.imgur.com/eZjt9Zc.png
Save the file
How this works: The "AndroidThunkJava_GetCurrentConnectionState" runs the Safety Net check, but only does so if the device has Google Play Services installed. For some reason, if we return that Play Services isn't installed, the game doesn't care that we skipped the Safety Net check
Fully spoofing the Note 9 to the game
Warning: This may cause lagging and overheating
Search for the following line:
Code:
invoke-virtual/range {v0 .. v5}, Lcom/epicgames/ue4/GameActivity;->nativeSetAndroidVersionInformation(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V
It should be preceded by these lines: https://i.imgur.com/rZ9iWZ8.png
Replace the lines shown in the image above with the following:
Code:
sget-object v1, Landroid/os/Build$VERSION;->RELEASE:Ljava/lang/String;
sget-object v2, Landroid/os/Build;->MANUFACTURER:Ljava/lang/String;
const-string v2, "samsung"
sget-object v3, Landroid/os/Build;->MODEL:Ljava/lang/String;
const-string v3, "SM-N960U"
sget-object v4, Landroid/os/Build;->DISPLAY:Ljava/lang/String;
Result should look like this: https://i.imgur.com/gY93PZy.png
Save the file
How this works: The "nativeSetAndroidVersionInformation" method sets the device information in native code, ie. the game itself. The code we added overwrites the information got from the device's build.prop, spoofing the Note 9's model number and manufacturer to the game
Step 4: Recompiling the APK
In your APKtool directory, run the following command:
Code:
apktool b <name-of-apk-without-.apk>
This will produce an unsigned APK in the decompilation folder\dist
Step 5: Signing the APK
The easiest option here is to copy the APK in the "dist" folder to your device, then use the ZipSigner app on your device to sign it.
This will produce a signed APK in the same directory as the unsigned APK, but with "-signed.apk" rather than ".apk"
Step 6: Installing the APK
If you currently have a version of the APK that was not signed using ZipSigner (INCLUDING a modded APK downloaded from this thread, and the official APK), you must uninstall that first
You can then install the "-signed.apk" APK ZipSigner produced in Step 5.

Now we need the APK with checks disabled. I'm running the official APK on a rooted S9. I disabled ADB, enabled Magisk Hide but it's still kicking me out.

Awesome!!! Thanks
https://www.youtube.com/watch?v=6cqr7v3TQQI

Lukyczk said:
Now we need the APK with checks disabled. I'm running the official APK on a rooted S9. I disabled ADB, enabled Magisk Hide but it's still kicking me out.
Click to expand...
Click to collapse
As I mentioned in the first post, that would enable cheaters to use cheat apps more easily when the game is running, making the port a bigger target for Epic. If they DMCA it anyway, then I suppose it might be called for?

Quinny899 said:
As I mentioned in the first post, that would enable cheaters to use cheat apps more easily when the game is running, making the port a bigger target for Epic. If they DMCA it anyway, then I suppose it might be called for?
Click to expand...
Click to collapse
I get that, but there are also tons of people with rooted devices that want to play legit.

May you try to remove RAM and GPU checks for people with potato phones, @Quinny899? ?

DodoGTA said:
May you try to remove RAM and GPU checks for people with potato phones, @Quinny899?
---------- Post added at 08:11 PM ---------- Previous post was at 08:09 PM ----------
May you try to remove RAM and GPU checks for people with potato phones, Quinny899?
Click to expand...
Click to collapse
Considering how it lagged on my Pixel 2 XL, that probably isn't a good idea.

Quinny899 said:
Considering how it lagged on my Pixel 2 XL, that probably isn't a good idea.
Click to expand...
Click to collapse
How about lowest settings? ?

I have adreno 505 but fortnite ask minimum for adreno 530 , how to bypass the gpu detection ?

DarioKJ said:
I have adreno 505 but fortnite ask minimum for adreno 530 , how to bypass the gpu detection ?
Click to expand...
Click to collapse
Buy a better smartphone :fingers-crossed:

Quinny899 said:
Fortnite for Android with device check disabled
Notes and warnings:
This is an APK with only the device check disabled. It spoofs a Samsung Galaxy Note 9, so edit the settings accordingly for your device in game. You may experience optimisation issues. It still requires an ARM64 device (arm64-v8a), as that's all the code included supports.
THIS APK HAS A DIFFERENT SIGNATURE TO THE OFFICIAL GAME (MY SIGNATURE) - THIS IS A REQUIREMENT OF MODDING APKS - IT MAY BE VISIBLE TO EPIC. I AM NOT RESPONSIBLE FOR ACCOUNT BANS OR KICKS FROM THE GAME. YOU ARE RECOMMENDED TO USE A BACKUP OR THROWAWAY ACCOUNT IF YOU DO NOT WANT TO RISK YOUR ACCOUNT
This game uses Safety Net, and also looks for ADB being enabled. You must pass safety net and disable ADB to play the game. Whilst it is likely possible to mod that out, it would also enable cheaters to play the game more easily, and make Epic more likely to retaliate against this mod. For that reason, this release is as close to the official build as possible, with only the device spoofed.
This APK does not grant access to the exclusive in-game skin
This APK will not install over the top of the official APK. Uninstall that first, then install this one.
Download
Fortnite_com.epicgames.fortnite-5.2.0.apk
MD5: F51702713287B2222FFA1C05F2CC4BEE
SHA1: C3A549E583D4E6AD77FBE5FD46FDA99FBFA035EC
Size: 90.3MB
The APK is signed with my certificate, you can validate this in any mirrors by checking the MD5 and SHA1 of the APK file. You are free (and recommended to, if you wish) to mirror this file elsewhere and share it on, but please give credit if you do.
How to mod it yourself
Got a tinfoil hat? Don't trust my APK? Well, you can mod the original, official APK yourself with my instructions.
Coming soon.
Click to expand...
Click to collapse
Wahoux said:
Buy a better smartphone :fingers-crossed:
Click to expand...
Click to collapse
Wahoux , give me a rog phone ??
(Just kidding)

I hope it works on my Potter, because it has only 2GB of RAM

well, now let's wait for gpu check bypass and root check bypass.
Really surprised by your work anyways, that was extremely quick, thank you!

DarioKJ said:
I have adreno 505 but fortnite ask minimum for adreno 530 , how to bypass the gpu detection ?
Click to expand...
Click to collapse
Just use GLTools

can't login

Is there a way to hide unlocked bootloader? Cuz now it detects that my bootloader is unlocked

It does work! However I'm thrown out of every match seconds after I land. In the lobby I get a notification that says I'm removed due to crappy internet, VPN, proxy or cheating. I guess it does some kind of a check when you're actually going in-game.

Thanks for your work @Quinny899 Will this give you the galaxy skin since its spoofed as a Note 9?

jesper801 said:
Is there a way to hide unlocked bootloader? Cuz now it detects that my bootloader is unlocked
Click to expand...
Click to collapse
kyan31 said:
Thanks for your work @Quinny899 Will this give you the galaxy skin since its spoofed as a Note 9?
Click to expand...
Click to collapse
Read the first post.

Quinny899 said:
Read the first post.
Click to expand...
Click to collapse
Missed that, my bad, thanks for clarifying.

[TOOL] Advance Tool for Android™ - ADB and fastboot commands

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ATA Tool Only for Windows and Linux
Code:
/*
* I'm not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed (like it did for me...).
*/
This tool include adb.exe and fastboot.exe and Scrcpy. This tool currently only supports Windows and Linux, in future updates I might add support for macOS.
Windows Versions:
Windows ATA Tool v0.9.3.10072020:
if the botton doesn't work click this link: https://github.com/MassimilianoSart...W/ATA-v0.9.3.10072020-for-Windows-By-Sway.zip
Linux Versions:
Linux ATA Tool v0.0.2.280920200:
if the botton doesn't work click this link: https://github.com/MassimilianoSart...20L/ATA-v0.0.2.28092020-for-Linux-By-Sway.zip
Windows Features:
UNLOCK BOOTLOADER
FORMAT DATA PARTITION (EXT4)
FORMAT DATA PARTITION (F2FS)
FLASH BOOT (only .img file)
FLASH BOOTLOADER (only .img file)
FLASH RADIO (only .img file)
FLASH RECOVERY (only .img file)
FLASH SYSTEM (only .img file)
FLASH VENDOR (only .img file)
FLASH CACHE (only .img file)
FLASH ROM (You must know what you are doing)
Check connected devices
Boot into ROM
Boot into recovery
REBOOT SMARTPHONE
REBOOT INTO THE RECOVERY
REBOOT INTO THE Fastboot/Bootloader
Check connected devices
Automate Apks installer
Check devices version connected
Install an app
Unistall an app (No System App)
Emulate device (Resize Screen)
Emulate device (Change Density)
Reset (Emulate device)
Screen Recording
Smarthphone Status
Change system info
Grant WRITE_SECURE_SETTINGS permission
Grant DUMP permission
Check for granted permissions
Create and run a program: keyevent Istruction https://developer.android.com/reference/android/view/KeyEvent.html
Scrcpy - Screen mirror
ADB over network working
Logcat and Display On Screen Only
Logcat and Record Text File Locally
"getevent" and Display On Screen Only
"getevent" and Record Text File Locally
View System Info (Data From build.prop, g.prop, and others)
Wireless debugging (only on Android 11)
adb backup and restore
input from keyboard to smartphone
Linux Features:
Check connected devices
REBOOT SMARTPHONE
REBOOT INTO THE RECOVERY
REBOOT INTO THE Fastboot/Bootloader
Check devices version
Enable/Disable Dark Mode in Q
Device serial number
Liked my work? Give me a beer
Requirements
1. To run Scrcpy the Android device requires at least API 21 (Android 5.0).
2. Make sure you enabled adb debugging on your device(s). On some devices, you also need to enable an additional option
Issues:
Strange outputs?
if you find strange outputs from commands, it's a know issue, you have to start again the command and it will work!
Licence:
ATA:
Copyright (C) 2019-2020 SwayWasTaken
Scrcpy:
Copyright (C) 2018 Genymobile
Copyright (C) 2018-2020 Romain Vimont
SDK Platform Tools:
Copyright (C) 2016-2019 Google LLC https://developer.android.com/license
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Links:
ATA Tool source Download link: https://github.com/MassimilianoSartore/Advance-Tool-for-Android/archive/master.zip
Scrcpy repository: https://github.com/Genymobile/scrcpy
SDK Platform Tools link: https://developer.android.com/studio/releases/platform-tools.html
Github page: https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-
Donate link: https://www.paypal.me/SWayGaming
Icon in the download botton: https://icons8.it
PS : I am not responsible for bricked devices use ATA at your own risks!
Android is a trademark of Google LLC.

This program was made with an Unlicensed compiler.
Please buy the PRO version to distribute your EXE.
Press any key to continue . . .
Click to expand...
Click to collapse
Always these lame bat2exe converters.
Why not people just distribute these as plain batch files I wonder...

CXZa said:
Always these lame bat2exe converters.
Why not people just distribute these as plain batch files I wonder...
Click to expand...
Click to collapse
O Sorry I will publish the source on GitHub.
I will try to resolve the problem

CXZa said:
Always these lame bat2exe converters.
Why not people just distribute these as plain batch files I wonder...
Click to expand...
Click to collapse
Now you can download the batch file from the link in the first post, sorry again

Sorry if I was a bit - well - a bit too me. I have just stumbled into these batexes maybe too many times. All sort of "kitchens" (what the heck, isn't there still a better word, really) use them, ASSAYYED, TOAD (open source? okay, maybe so***), Uppercut (several batexes inside each other, just plain weird..).
Maybe they have their use but I haven't figured it out yet really.
Great, now it's much smaller too... :good:
(*** the bat files can usually found from the temp folder when one runs these exes)

CXZa said:
Sorry if I was a bit - well - a bit too me. I have just stumbled into these batexes maybe too many times. All sort of "kitchens" (what the heck, isn't there still a better word, really) use them, ASSAYYED, TOAD (open source? okay, maybe so***), Uppercut (several batexes inside each other, just plain weird..).
Maybe they have their use but I haven't figured it out yet really.
Great, now it's much smaller too... :good:
(*** the bat files can usually found from the temp folder when one runs these exes)
Click to expand...
Click to collapse
Oh I didn't know that, hope you will appreciate that. If you will find something wrong, please report to me. I will make some changes in the batch this week.

V 0.3
Changelog:
- Added device info on the home
Download:
https://github.com/SwayWasTaken/Advance-Tool-for-Android/archive/master.zip

V 0.4
Changelog:
- some improvement under the hood
Download:
https://github.com/SwayWasTaken/Advance-Tool-for-Android/archive/master.zip

V 0.5
Changelog:
- some improvement under the hood, now the program will check if the device is connected
Download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android/archive/master.zip

V0.5.1
Changelog:
- Added more options to unlock and lock the bootloader
Download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-/archive/master.zip

SwayWasTaken said:
Changelog:
- Added more options to unlock and lock the bootloader
Download:
https://github.com/MassimilianoSarto...ive/master.zip
Click to expand...
Click to collapse
The link doesn't work, but it's the same as before.
Nice batch project, helps those that don't want to type everything by themselves.
That :devicecheck you could make less strict. Just check that the value isn't empty...

CXZa said:
The link doesn't work, but it's the same as before.
Nice batch project, helps those that don't want to type everything by themselves.
That :devicecheck you could make less strict. Just check that the value isn't empty...
Click to expand...
Click to collapse
Thanks for the suggestion, change made!!

V0.5.2
Changelog:
-V 0.5.2: some improvement under the hood (Thanks to @CXZa for the suggestion)
Download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-/archive/master.zip

V 0.5.7 Changelog:
-New information about your smathphone
-New loading screen
-New integration with more batch files
Now the main script must stay in the same folder as Scripts folder
Download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-/archive/master.zip

V0.5.8
Changelog:
- Change system info
- New window size

V0.5.9
Changelog:
- Now you can uninstall system app without root access on your smartphone!!
Pay attention you can damage your phone!
Enjoy!
download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-/archive/V0.5.9.zip

Hi. I tried to run this and it only gives me a yes or no option then shuts off. I'm not sure if I have my path set up at all as there really aren't any set up instructions. Could you give a quick set up tutorial?

0.6.0
Changelog:
- Grant WRITE_SECURE_SETTINGS permission
- Grant DUMP permission
- Check for granted permissions
- Changed window size
Download:
https://github.com/MassimilianoSartore/Advance-Tool-for-Android-ADB-Tool-/archive/0.6.0.zip

Supermatt01 said:
Hi. I tried to run this and it only gives me a yes or no option then shuts off. I'm not sure if I have my path set up at all as there really aren't any set up instructions. Could you give a quick set up tutorial?
Click to expand...
Click to collapse
the problem is that you dont have adb set as environment variable, follow this link to set it https://www.xda-developers.com/adb-fastboot-any-directory-windows-linux/.

SwayWasTaken said:
the problem is that you dont have adb set as environment variable, follow this link to set it https://www.xda-developers.com/adb-fastboot-any-directory-windows-linux/.
Click to expand...
Click to collapse
Okay. I'm giving it a look.

Question [J706F][FIXED] Update from 10 to 11 not working after switching from ROW to ZUI

EDIT: FIXED. I flashed persist.img from version "S250260_210804..." (unzip, flash via `fastboot flash persist persist.img`) https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
Hello dear community,
I am in need of some help. So here is what I did:
* Coming from latest Android 11 ROW, flashed ZUI using QFIL from here: https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
* tried upgrading to ZUI 12.5, 12.6 and 13 but didn't work
* used fastboot to unlock and unlock_critical (i know, i know...)
* used payload_dumper (from some github repo) to extract zui 13 update.zip
* flashed every image I extracted manually using fastboot (I know, I'm stupid)
* Got ZUI 12.0 working, didn't like it and wanted ROW android 11 back
* flashed latest ROW rom using QFIL from lolinet url -> bootloop
* flashed oldest ROW rom using QFIL, updated 3x via OTA to latest version -> few bootloops, then device booted back to android 10 and created notification "failed to install ota"
So I can install any version between TB-J706F_S210002_201015_ROW and TB-J706F_S250260_210804_ROW from lolinet url, but nothing above that. Neither through QFIL, nor using lenovo smart rescue assistent, nor using OTA update from android 10 (which is working fine).
I tried following things to fix this:
* ####6030# -> change to CN and change the NV value to 00
* ####6030# -> change to DE and change the NV value to 02 or 00
* flash latest ROW using QFIL, then change NV value from 02 to 00
nothing of that worked and I'm starting to believe, that I ****ed up some partitions using fastboot. Because I flashed images from ZUI android 11 and I can't install ROW android 11 now.
Could I possibly try restoring a TWRP backup from some other user?
What else could I do to install android 11?
PS: I used QFIL backup and restore tool to change the NV value. Because the nv reader/writer tool didn't seem to work.

It might help, if someone would be kind enough to provide me with the following images (by backing them up with twrp):
* abl
* xbl_a
* xbl_b

Hi there, I also got into this trouble that can't flash any global ROM including TB-J706F_S250260_210804_ROW. What I did is change the NV value to 02 and not 00 using QFIL. After that I was able to update via OTA and currently on the latest global ROM.
Thanks to this thread: https://forum.xda-developers.com/t/check-region-unlock-p11-tb-j606f-l-n.4356451/

MateUserHHTT​I have similar problem before, can not flash to Android 11, even ROW or ZUI, bootloop~
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
If not functional, I'm following below post instruction to flash presist.img, and can upgrade to Android 11, both of ROW & ZUI are available.
<TB-J706F> Auto-rotation & Auto Brightness Broken.​But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.

auston said:
But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
Click to expand...
Click to collapse
I may found a fix for Bluetooth MAC by generating a file for the "NV-items_reader_writer.exe" and wrote it to NV item 447 (some one sait this is BT). Problem was that this item (447) was NOT present at this time inn QCN.
WARNING! May my guess of "Items size" 128 is wrong, I don't know. Use at your own risk and change the file to your MAC.
After that I flashed "persist.img" (matching the actual ROM), some one wrote that this fixed the autorotate. I can confirm this.
But still not found solution for serial, the correct serial is still in NV item 2497.

Okay, Serial number restore can be done the same way.
See here https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/
Best would be to have the full original QCN file (or an editor for this files)

MateUserHHTT said:
* abl
* xbl_a
* xbl_b
Click to expand...
Click to collapse
abl (_a and _b) = abl.elf
xbl (_a and _b) = xbl.elf
You will find both in the ROM Zip's at lolinet.
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.

auston said:
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
Click to expand...
Click to collapse
Firstly, let me thank you for your reply! It's interesting, I indeed noticed just a few days ago, that auto rotation isn't working!
I will follow the guide you linked and update my post accordingly.
Edit: THANK you very much indeed! My problem was solved instantly by this!
Flashed persist.img via fastboot, flashed the latest ROM from lolinet using QFIL and had no issues whatsoever.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
Click to expand...
Click to collapse
as I said in my post, I did tried both 00 and 02. I read the thread about the second region code checking.

CryptMan said:
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Click to expand...
Click to collapse
I don't have any problem but just in case...
I guess PN is Product Number where did you change it and where do you get the correct value? I only found a code before the SN that looks unique per tablet but it's not in the box.

MrCrayon said:
I guess PN is Product Number where did you change it and where do you get the correct value?
Click to expand...
Click to collapse
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.

One issue persists though, which is that my widewine level is set to L3.
1. I flashed persist.img from TB-J706F_S250260_210804_ROW
2. I then installed the TB-J706F_S620150_211226_ROW via QFIL and
3. updated to TB-J706F_S630185_220128_ROW via OTA in system settings.
My serial number is also 1-9A-F. My device is locked. I'm unlocking my device and flashing the persist.img of the latest ROM. If that doesn't work, what are my options to restore L1?

CryptMan said:
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
Click to expand...
Click to collapse
Ah ok, so the number before SN is the PN.
I have two J706F and they have different PN, The last 8-9 digits are different and the other ones are the same.
I could not find that code anywhere else.

MateUserHHTT said:
One issue persists though, which is that my widewine level is set to L3.
Click to expand...
Click to collapse
If you check in play store settings does it say your device is certified?

On my J706F, the one on which I have lost QCN with SN MAC etc. , I have the same problem as MateUserHHTT.
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
My guess it that there is a file or partition holding this certifications, but I don' t know which.
And of course I don't have a backup ...

If you check in play store settings does it say your device is certified?
Click to expand...
Click to collapse
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

CryptMan said:
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
Click to expand...
Click to collapse
Is your bootloader unlocked or did you unlock it previously and relocked?
MateUserHHTT said:
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
Click to expand...
Click to collapse
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.

MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
Click to expand...
Click to collapse
I previousl, unlocked and afterwards relocked it (both flashing lock and flashing lock_critical)
Yes, I once said "erase all before download" and accidentally deleted my original qcn file so some NV fields seem to be missing. Maybe that caused the app to default back to 4.4 it was Lenovo Feature Updater by the way, not the settings - system - update.
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/

MateUserHHTT said:
It was Lenovo Feature Updater by the way, not the settings - system - update.
Click to expand...
Click to collapse
I disabled that as soon as I saw it
MateUserHHTT said:
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
Click to expand...
Click to collapse
Not much really, I'm not at my desk now but I extracted LenovoOTA from stock ROM and decompiled it with apktools, but even with online tools is probably ok.
Then I see two options:
Recompile that package changing package name and adding a log with full address and parameters or get the code that construct the URL and put it in a new app.
For you probably the last one is easier.
I went for a third I was trying to understand if i could get the data with adb or in files but I did not find documentation.
MateUserHHTT said:
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
Click to expand...
Click to collapse
I don't think there is a way to force it, this widevine a thing is a pain.

MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Click to expand...
Click to collapse
Locked, and was never unlocked before.
I tried to unlock now, but does not succeed with flashing sn.img.
Because I'm not interested on Custum ROM, I will leave it locked.
Do you know where the device certification is stored?

I unlocked without flashing sn.img. Does that make a difference?
Did you try monitoring the network traffic with wireshark?