Related
There's been a lot of changes since I posted this thread!
We've now got a rom for LineageOS 14.X based on Nougat which can be found in its own thread here!
This thread is still useful because it provides links to the history of how the tablet was rooted and how we were able to get a custom recovery but all discussion on the LineageOS rom should take place in that thread from now on. When new roms are created I will add them to this first post for posterity so everyone can find them. Does anyone know how to best request our own forum? I think we're starting to get big enough one would be of use...
bornagainpenguin said:
Here's what we have so far....
First we unlock the bootloader, explained here. Thanks for the easy to follow summary, 20tibby_gt06!
Extracted stock recovery here. Thanks jmo!
Stock image with root and updates. Can be fastboot flashed here. Another debt of gratitude to jmo!
Working TWRP recovery image here. Thank you bbelos for getting this working for us!
A listing of items you might wish to freeze upon rooting here. Thanks Pegasus Epsilon for posting this!
Another list of apps you might wish to freeze or remove here. This time courtesy of GartimusPrime
Lineage ROM, Build one Current Build: lineage-13.0-20170219-UNOFFICIAL-x103f.zip All hail bbelos for hacking away at this and sharing the results!
As per usual all things related to rooting and installing roms is at the users' own risk. You also assume the responsibilities of administering your own hardware when you seize administrative rights and control. Be careful and responsible when undertaking any actions. These links are intended to help find discussed items in the thread, not act as an HOWTO. You must do your reading before acting on anything or the brick you create will be yours to hold.
PS: What else do we need to petition for an official section for our tablet? We've got root, unlocked the bootloader, and a mostly functional rom created via Lineage by that wonderful individual known as bbelos. What else do we need?
Original post quoted below:
Click to expand...
Click to collapse
bornagainpenguin said:
I've searched and searched the site and Google for answers before giving up and posting this thread.
I picked up the new Walmart Black Friday tablet, which is known as Lenovo TB-X103F or model ZA1U0000US depending on where you look. I'm mostly satisfied with it as is, but I desperately miss my adblocker and my xposed framework features, as well as the ability to move updated apks to the system partition so as to not have redundant apps wasting space.
Unfortunately there is very little information available about this tablet.
Walmart.com listing
Energy Star page.
Lenovo's own website doesn't seem to have much mention of it beyond the source code dump listed here. I run Ubuntu on my laptop and my TV box for Kodi but I couldn't tell you if the code has everything and it would be possible for someone to build something or if it's missing critical information making hopes of a new community rom or cyanogenmod rom impossible. Does anyone else have this model tablet and know how to root it, put in a recovery? The one that comes with the device is in Chinese so I powered it off because I wasn't sure how else to get out of there.
Thanks in advance for all help given.
Click to expand...
Click to collapse
re:
yes i am trying to figure out how to root this tablet but i am having no luck. i hope their are some solutions
volkstony said:
yes i am trying to figure out how to root this tablet but i am having no luck. i hope their are some solutions
Click to expand...
Click to collapse
Do you have a Windows machine? Have you given Kingoroot a try from Windows yet?
I don't have a Windows box so I haven't tried it yet.
I did notice there's an option in Developer Options to allow OEM unlocking, which allows the bootloader to be unlocked but am not sure if it actually does anything or not.
Sent from my Lenovo TB-X103F using Tapatalk
re:
yes i have a windows laptop. i have had no luck with either versions of kingo root on this tablet. all my android items have been rooted and upgraded with no issues but this tablet has not been cooperating at all lol. i hope someone will have a solution for this tablet soon.
I also bought one of these "Lenovo TAB 10 (TB-X103X)" tablets from WallyMart for $100. It is an apparently excellent tablet, perfect for my intended purpose. Great screen albeit only 800 lines but rich colors and bright. And it is speedy.
I tried the following to root it with no success:
Towelroot: tr.apkKingroot: KingoRoot.apkKingroot: via ADB
Booting the tab into it's stock "Recovery(?)" (power + volume down) confronts the user with a Chinese language "Recovery" (in quotes because I don't read Chinese so it actually could be saying anything like "ROOT? HAHAHA"):
Here's a link to a picture of the recovery screen: tinyurl.com/jhfwgt7
Anyone care to translate into English? Please? Is one of these options for the purpose of installing a .zip file (like SuperSU)?
Another thing to try is installing a custom Recovery like TWRP and from that installing SuperSU. I have little confidence that TWRP will install on this device so using the stock recovery may be a better option, if it is an option at all.
I did manage to unlock the bootloader on mine (I think). I have not tried any root options without a firmware backup method in fear of a bootloop. Especially since it is my wife's haha!
XX
I was able to get the bootloader unlocked as well and have since confirmed that it is unlocked. However, I believe that is just the first step. We need a custom recovery made for it and then we should have no problem getting root. I don't know what is required to make a custom recovery but since the source code is available, it seems like this is something that someone smarter than I might be able to accomplish. Anyone know anything about custom recoveries?
Jonathan
Hm, same issue here, would love a way to root.
Also, I can't seem to enable multi-window mode, even in Developer mode. Any suggestions?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This is an image of what I see when I boot from a shut down tablet with the volume down button and the power button held down. Does anyone read enough Chinese to tell us what it says?
Doing the boot from a shut down tablet and volume up and power button held gives a different screen, which is in English and resembles Clockwise recovery.
Sent from my 0PM92 using Tapatalk
Rough translation
bornagainpenguin said:
This is an image of what I see when I boot from a shut down tablet with the volume down button and the power button held down. Does anyone read enough Chinese to tell us what it says?
Doing the boot from a shut down tablet and volume up and power button held gives a different screen, which is in English and resembles Clockwise recovery.
----------------------
Good find. However, it seems to just be a diagnostic app.
1) Display backlight
2) Button
3) Motor
4) Display
5) After the camera (I am guessing back camera)
6) Front Camera
7) Speaker
8) Headset
etc...
I just used an app that would translate the text. Good to know but probably not helpful in obtaining root.
Click to expand...
Click to collapse
Root/Recovery Bounty?
I could really use these tablet for a project that I am working on. However, I need root and custom recovery. It is a pretty nice tablet, especially for the price. I picked it up at my local Wal-mart for $79. They still have a stack of them. I have heard of people putting out "bounties" for rooting, etc. I am not rich, but I would be willing to put up some money. I could even provide a device to a qualified person to experiment on. Any other interest in adding to the bounty?
Well a good place for you guys to start would be finding out if the device bootloader is locked. If you have windows (don't know if you can do this on MAC or Ubuntu) you can download the Android SDK and when connected to the device with debugging enabled type in CMD in the adb and fastboot folder "fastboot oem status" to possibly find out if its locked and "fastboot oem unlock" to unlock it if you're willing to take the risk.
Get back to me with your thoughts on this and if this works and unlocks it/its already unlocked, check if the device has an MTK Chipset. If it does there's a tool to make custom CWM Recovery's for MTK devices and you could flash a SuperSU zip from there.
Best of luck guys!
Rooted Droid said:
Well a good place for you guys to start would be finding out if the device bootloader is locked. If you have windows (don't know if you can do this on MAC or Ubuntu) you can download the Android SDK and when connected to the device with debugging enabled type in CMD in the adb and fastboot folder "fastboot oem status" to possibly find out if its locked and "fastboot oem unlock" to unlock it if you're willing to take the risk.
Click to expand...
Click to collapse
Don't currently have access to a Windows machine at moment. My stuff is all Linux or my MacBook (which I'm increasingly developing a loathing for). I take it that the 'unlock bootloader' option in Developer Options is not really something that does anything then?
Rooted Droid said:
Get back to me with your thoughts on this and if this works and unlocks it/its already unlocked, check if the device has an MTK Chipset. If it does there's a tool to make custom CWM Recovery's for MTK devices and you could flash a SuperSU zip from there.
Best of luck guys!
Click to expand...
Click to collapse
OK, this I can answer. It has a Snapdragon 210 not an MTK. People were ragging down the tablet before Black Friday because of that so it stuck in my memory.
Sent from my 0PM92 using Tapatalk
bornagainpenguin said:
. I take it that the 'unlock bootloader' option in Developer Options is not really something that does anything then?.
Click to expand...
Click to collapse
I really couldn't tell you if the unlock bootloader in developer options would really unlock it (though it defiantly would make sense to!) without checking the status in CMD.
If the "device status" CMD doesn't work then I'm pretty sure it means there isn't a bootloader lock/its always unlocked. There is an alternative for Mac and Linux os's to do this I think but I can't remember how its done. (Worst case scenario use a virtual machine to run these tests in windows).
After we figure this out, since you said you can't find anything on this tablet, there probably isn't a custom recovery. (There is a tool to make Recovery's but its for MTK chipsets, although there may be a tool or something now for snapdragon chips to make them).
If you are able to look into checking the lock status using Mac/Linux and you find it's unlocked/unlockable, then there is also a way for Mac and Linux (or a virtual machine) to push a superuser zip with the CMD.
Let me know if what I wrote wasn't straightforward enough because I confused myself a bit even writing it lol.
Best of luck!
Bootloader can be unlocked - Confirmed
Rooted Droid said:
I really couldn't tell you if the unlock bootloader in developer options would really unlock it (though it defiantly would make sense to!) without checking the status in CMD.
If the "device status" CMD doesn't work then I'm pretty sure it means there isn't a bootloader lock/its always unlocked. There is an alternative for Mac and Linux os's to do this I think but I can't remember how its done. (Worst case scenario use a virtual machine to run these tests in windows).
After we figure this out, since you said you can't find anything on this tablet, there probably isn't a custom recovery. (There is a tool to make Recovery's but its for MTK chipsets, although there may be a tool or something now for snapdragon chips to make them).
If you are able to look into checking the lock status using Mac/Linux and you find it's unlocked/unlockable, then there is also a way for Mac and Linux (or a virtual machine) to push a superuser zip with the CMD.
Let me know if what I wrote wasn't straightforward enough because I confused myself a bit even writing it lol.
Best of luck!
Click to expand...
Click to collapse
I can confirm that the bootload can be easily unlocked. I have done this with my device and verified the status.
---------- Post added at 12:53 PM ---------- Previous post was at 12:49 PM ----------
Rooted Droid said:
I really couldn't tell you if the unlock bootloader in developer options would really unlock it (though it defiantly would make sense to!) without checking the status in CMD.
If the "device status" CMD doesn't work then I'm pretty sure it means there isn't a bootloader lock/its always unlocked. There is an alternative for Mac and Linux os's to do this I think but I can't remember how its done. (Worst case scenario use a virtual machine to run these tests in windows).
After we figure this out, since you said you can't find anything on this tablet, there probably isn't a custom recovery. (There is a tool to make Recovery's but its for MTK chipsets, although there may be a tool or something now for snapdragon chips to make them).
If you are able to look into checking the lock status using Mac/Linux and you find it's unlocked/unlockable, then there is also a way for Mac and Linux (or a virtual machine) to push a superuser zip with the CMD.
Let me know if what I wrote wasn't straightforward enough because I confused myself a bit even writing it lol.
Best of luck!
Click to expand...
Click to collapse
I have tried flashing SuperSU on my device both before and after bootloader unlock. The factory recovery will only flash ZIP that are signed with their signature, so despite having the bootloader unlocked, I think we need a custom recovery to gain root access. Does anyone know of a recovery for the same chip? I am willing to put mine at risk, I just haven't found an option.
jmo said:
I can confirm that the bootload can be easily unlocked. I have done this with my device and verified the status.
I have tried flashing SuperSU on my device both before and after bootloader unlock. The factory recovery will only flash ZIP that are signed with their signature, so despite having the bootloader unlocked, I think we need a custom recovery to gain root access. Does anyone know of a recovery for the same chip? I am willing to put mine at risk, I just haven't found an option.
Click to expand...
Click to collapse
That's good news to hear its unlocked, nothing will ever flash in a stock recovery unfortunately unless developed by the OEM, so now its the more difficult part.. I did a quick look around and I can't seem to find a recovery. I found out though, if you can find a recovery with the same chipset and the same resolution, it's able to be ported. (Pretty sure I read somewhere that twrp can't be ported so it'd have to be cwm, phillz or another one. Not entirely sure though).
A lot of the ones I came across while looking for a portable recovery were all guides for MTK devices and I haven't found a snapdragon one yet :/.
Also I appreciate you willing to put your device at risk, but I want to be damn sure its right first otherwise its not worth messing up your tablet!
We're making good progress here now
Any recoveries?
Rooted Droid said:
That's good news to hear its unlocked, nothing will ever flash in a stock recovery unfortunately unless developed by the OEM, so now its the more difficult part.. I did a quick look around and I can't seem to find a recovery. I found out though, if you can find a recovery with the same chipset and the same resolution, it's able to be ported. (Pretty sure I read somewhere that twrp can't be ported so it'd have to be cwm, phillz or another one. Not entirely sure though).
A lot of the ones I came across while looking for a portable recovery were all guides for MTK devices and I haven't found a snapdragon one yet :/.
Also I appreciate you willing to put your device at risk, but I want to be damn sure its right first otherwise its not worth messing up your tablet!
We're making good progress here now
Click to expand...
Click to collapse
Anyone who finds any recoveries that are similar in hardware, please let me know.
jmo said:
I could really use these tablet for a project that I am working on. However, I need root and custom recovery. It is a pretty nice tablet, especially for the price. I picked it up at my local Wal-mart for $79. They still have a stack of them. I have heard of people putting out "bounties" for rooting, etc. I am not rich, but I would be willing to put up some money. I could even provide a device to a qualified person to experiment on. Any other interest in adding to the bounty?
Click to expand...
Click to collapse
I went by WallyMart to buy (another)one for my wife. Was the $79. you paid a day sale or something? They're $99 in TX.
Local Wal-mart
pwillikers said:
I went by WallyMart to buy (another)one for my wife. Was the $79. you paid a day sale or something? They're $99 in TX.
Click to expand...
Click to collapse
My local Wal-mart just has a stack of them out on the counter (approx 20) with the $79 price on them. They aren't going very fast but they don't have any display models out and you would have to look for them to find them.
Hi Everyone,
Living in Japan, we have no official channel to purchase a OnePlus handset here.
Really wanted to get a OnePlus 7 Pro as I felt it is the best model on the market as of today.
Knowing that, I got mine on Amazon Japan from a HK online shop which had very good reputation.
Now, the problem is these phones always come already opened as they say they need to confirm operation before sending it.
I have been reading news and article about this where we see more third party companies flash their roms with malware/ransomeware already built in...
In these situation, the best way to clean the phone is to do a full re-install of the OS.
I did review a bunch of article on XDA and it seems that now, due to the A/B partition setup, we can't just use official OnePlus image to load from the fastboot easily.
We have to rely on community provided too and stock rom to be able to do so....
When I raised the question to OnePlus and Oneplus forums, they mentioned to me that installed the updated like here (Page: support.oneplus.com/app/answers/detail/a_id/4312/~/oxygen-os-for-oneplus-7-pro)would do the trick using the local update function.
What I was directed to do is use the recovery boot to delete system settings/cache and everything data user and then, run the local update. Doing so, that would do it while not using community tools.
Here are my questions and which I would hope to get your experience:
1 Is the process I did really does use a brand new clean OS and do not rely/integrate part of the OS that came with the handset originally (that was the target).
2 Is there a way for me using OnePlus only provided tools and image to fully delete the phone and install the OS (maybe I am thinking this too much like a PC which I have more experience with...)
3 The OS looks fine and no strange apps shows up at all but how can I be sure nothing dodgy is running? Is there tools I could use to confirm this?
Sorry if I sound paranoid. Ideally, I understand the best thing to do was to buy directly from Oneplus and work a way to have it shipped to Japan but thought it would be interesting for me to learn more about android.
With previous Oneplus, it was easier as they were provided this type of official file for recovery but they stopped...
Thank you again for your time and hopping to learn more about how new android setup works.
Is the bootloader locked? Is Widevine (Netflix HD) certification still there? You can check these things to see if the phone has been tampered with.
brissoukun said:
Hi Everyone,
When I raised the question to OnePlus and Oneplus forums, they mentioned to me that installed the updated like here (Page: support.oneplus.com/app/answers/detail/a_id/4312/~/oxygen-os-for-oneplus-7-pro)would do the trick using the local update function.
What I was directed to do is use the recovery boot to delete system settings/cache and everything data user and then, run the local update. Doing so, that would do it while not using community tools.
Here are my questions and which I would hope to get your experience:
1 Is the process I did really does use a brand new clean OS and do not rely/integrate part of the OS that came with the handset originally (that was the target).
2 Is there a way for me using OnePlus only provided tools and image to fully delete the phone and install the OS (maybe I am thinking this too much like a PC which I have more experience with...)
3 The OS looks fine and no strange apps shows up at all but how can I be sure nothing dodgy is running? Is there tools I could use to confirm this?
Thank you again for your time and hopping to learn more about how new android setup works.
Click to expand...
Click to collapse
Good questions. Before you start, check the model number of your device through Settings > About. I'm assuming it's the international/global/unlocked version (GM1917).
With regard to question 1, a full build downloaded from the link you provided should contain every part of the OS, and flashing it through local update should overwrite anything that was there before. Before flashing, I would perform a full data wipe through recovery like you mentioned.
Q2: There is an MSM tool that will completely flash a system image for the OP7 Pro. I don't think they're generally intended for public use but they always get leaked anyways. They write an image (in the case of OnePlus, a .ops file) to the phone using a PC and USB connection. Here is a link to a thread which contains the MSM tool:
https://forum.xda-developers.com/oneplus-7-pro/how-to/guide-mega-unbrick-guide-hard-bricked-t3934659
Download the tool for the model of your phone (probably the international, firmware GM21AA), and extract its contents into a directory. In order for the tool to work, you need the OnePlus USB drivers installed on your PC. Plug the phone into your PC with it on, and enable USB file transfer. Open File Explorer and you should see a drive labeled "OnePlus drivers" or similar. Open it and run the driver setup executable file. You'll also need ADB to make your phone reboot into a mode that will allow the tool to perform its tasks. Here is a guide to installing ADB:
https://www.xda-developers.com/what-is-adb/
Once you've set that up, make sure the phone is plugged into the PC and the MSM tool is open. Make the phone boot into edl mode by typing
Code:
adb reboot edl
and once it says Connected next to a COM port in the tool, press start. Don't interrupt the process until it completes the download and the status message turns green. The phone should automatically reboot. This method is arguably more risky than using the local upgrade option, so do it at your own risk.
Q3: Make sure that OEM unlocking is turned off in developer settings and that the bootloader is locked (if the bootloader is unlocked, you'll see a yellow warning message after you power on the device from a power off state). Without an unlocked bootloader it would be pretty difficult to make any deep modifications to the device.
Hi @Zocker1304 and @TManchu,
Please let me thank you very much first for your kind and detailed reply, this is really welcome.
@Zocker1304:
I checked using the ADB/Fastboot connection that indeed, the Bootloader is locked so, that looks good.
Also installed (using a separate Google account) DRM Info app to confirm that the Widevine is properly installed and at L1 level which indeed again, looks good.
@TManchu
Thank you again for your very detailed reply! This was exactly what I needed as information.
I did already exactly as mentioned for the #1 so, it looks I should be good now with a proper rom from OnePlus (and did a full wipe in the Recovery boot mode)
For #2, I think I will skip that since as you rightly said, with #1, it should be fine so, prefer to keep with the recommended step.
For #3, we are covering what Zocker1304 mentioned too and I could confirm it.
My only concern about #3 was that you can actually relock the bootloader but (and please correct me If I am wrong), you can only do so if you are using stock OnePlus images (to date...seems like dev teams are working to have this changed? Bootloader locked with custom firmware?) which then means the image is safe.
I suppose the last item was my only open query for your thoughts but so far, the handset looks fine.
Thanks to you and the community, I have learned about the A/B partition scheme, msm tool, Fastboot/Recovery mode and Bootloader and ADB tools.
It is always good to learn more about the tech we use (especially phones, we have so many sensitive information stored into them today).
Not being careful could potentially means quite a lot of troubles down the road with Ransomeware/data leak tools.
Of course again, I could have simply purchased a JP phone from a brick and mortar shop next to my place and be fine with it. :silly:
brissoukun said:
.
For #3, we are covering what Zocker1304 mentioned too and I could confirm it.
My only concern about #3 was that you can actually relock the bootloader but (and please correct me If I am wrong), you can only do so if you are using stock OnePlus images (to date...seems like dev teams are working to have this changed? Bootloader locked with custom firmware?) which then means the image is safe.
I suppose the last item was my only open query for your thoughts but so far, the handset looks fine.
Thanks to you and the community, I have learned about the A/B partition scheme, msm tool, Fastboot/Recovery mode and Bootloader and ADB tools.
It is always good to learn more about the tech we use (especially phones, we have so many sensitive information stored into them today).
Not being careful could potentially means quite a lot of troubles down the road with Ransomeware/data leak tools.
Of course again, I could have simply purchased a JP phone from a brick and mortar shop next to my place and be fine with it. :silly:
Click to expand...
Click to collapse
No problem! I’ve just done some reading and from what I understand, re-locking the bootloader on anything other than a completely stock ROM will result in a bricked phone. I believe this is due to the way Android handles data encryption. If what you’ve heard is true, being able to lock your bootloader on a custom ROM would be great for device security. However, should something go wrong with the ROM having a locked bootloader might make it more difficult to fix.
I know that there are ways to sign system and boot images so that you can lock the bootloader with them installed, but I think that would still show a warning though I'm not sure.
Anyways, if all the build dates and numbers in the system info are correct, the firmware should be stock and as long as the bootloader is locked too, I don't believe you can tamper with that.
Hi Gents,
Thank you very much for the answer to the thread and much appreciated.
Apologies for not getting back to you all earlier as yesterday was family day...haha!
Well, since things looked good on the OS and the build, I went ahead and started to use the phone properly setting up my accounts. It did give me some incentive to get all my sensitive accounts setup with 2FA so that in case I get hacked with my passwords in the future...they would still need the 2fa (using Google Authenticator).
I did check also all system apps/running process and didn't see anything shady.
Just for reference, here were the type of articles I was refering too for the OS being plagued with malware even out of the box:
Page_theverge.com/2019/6/6/18655755/google-android-malware-triada-ota-rom-ads-spam-oem (sorry gents, new account, cannot put links yet)
However here, it seems it is due to lax review from the maker to third party tools which were including malware...
To have the same level on the oneplus I bought from the HK shop, they would have needed access to OnePlus Dev team to inject the malware in official image (knowing anyway I have re-installed a new image from the local update).
Otherwise, I was reading on the web about the fact to relock the bootloader with a custom roam and there seems to have a lot of messages but not concrete steps. It seems it depends a lot on phone model and brand.
When you are checking
Page_gizmochina.com/2019/06/10/relock-bootloader-oneplus-7-pro/
This is where you can read at the end:
"The above method only works if OnePlus 7 Pro is running on stock recovery and stock firmware. The ability to relock devices running custom recovery is expected in the next few weeks. "
That was published last month so, not sure if they got this to work on the OnePlus 7 pro yet.
So that's it, I am now using my new device which looks to work great and hopefully, won't get any bugs down the road.
I appreciate you taking the time to get back to me and will continue to learn about android.:good:
Picked up an AT&T Radiant Core for cheap at a store around me. I don't intend to use it with AT&T, it was just such a low price that I figured I'd get it and see if I can break into it just for fun. It's an MTK6739 chipset phone, so in theory it should be easy to pull partitions from this thing with something like SPFT (or Miracle Box, if you paid for it) and do a dirty port of TWRP to get root privileges on it. But this is harder than it seems.
I need an auth file to do anything with SPFT. Apparently this has to do with some kind of "secure boot" mechanism that MediaTeks sometimes have now. There's no stock firmware for this device online from what I can find, nor for the generic version of the device, the Tinno U304AA (AT&T just rebranded it). If I had a stock firmware image, maybe I could risk wiping the partitions and reflashing the stock firmware to get rid of the secure boot stuff.
I saw a guide for how to access the bootloader on the Tinno U304AA generic version, but on the AT&T version of the phone there's no option in the boot select menu (Vol. UP + Power) to get to the bootloader to run a fastboot oem unlock. All the AT&T version has is recovery and normal boot. I'm not sure what I can do to maybe reset this to get the other options. Maybe if I had the stock firmware for the generic version of the phone I could overwrite it and get access to those other options.
Either way, just posting this up for anyone else that got one of these and wants to collaborate/contribute. Maybe with enough collective brainpower we can make something happen.
UPDATE: found a stock system image dump, thank you to @lopestom for directing me to this. This guy's been the MediaTek king for as long as I can remember.
It appears to be a dtbo and system partition dump. It also has the vendor partition and a (partial?) boot image dump. Not sure if things like the full boot and recovery images are stored somewhere in here, I didn't look too deeply into it yet. I have no idea how whoever this is managed to pull these partitions... they either got root access somehow, or they found a proper Download Agent and Auth file to pull it all. Either one of these would be awesome. I reached out to the user to ask them how they did it, we will see what they say if they want to share how they did it.
https://git.rip/dumps/att/u304aa
jasonmerc said:
Picked up an AT&T Radiant Core for cheap at a store around me. I don't intend to use it with AT&T, it was just such a low price that I figured I'd get it and see if I can break into it just for fun. It's an MTK6739 chipset phone, so in theory it should be easy to pull partitions from this thing with something like SPFT (or Miracle Box, if you paid for it) and do a dirty port of TWRP to get root privileges on it. But this is harder than it seems.
I need an auth file to do anything with SPFT. Apparently this has to do with some kind of "secure boot" mechanism that MediaTeks sometimes have now. There's no stock firmware for this device online from what I can find, nor for the generic version of the device, the Tinno U304AA (AT&T just rebranded it). If I had a stock firmware image, maybe I could risk wiping the partitions and reflashing the stock firmware to get rid of the secure boot stuff.
I saw a guide for how to access the bootloader on the Tinno U304AA generic version, but on the AT&T version of the phone there's no option in the boot select menu (Vol. UP + Power) to get to the bootloader to run a fastboot oem unlock. All the AT&T version has is recovery and normal boot. I'm not sure what I can do to maybe reset this to get the other options. Maybe if I had the stock firmware for the generic version of the phone I could overwrite it and get access to those other options.
Either way, just posting this up for anyone else that got one of these and wants to collaborate/contribute. Maybe with enough collective brainpower we can make something happen.
Click to expand...
Click to collapse
OMG! So excited to see this here! My Mom gave my nephew this phone and niece has one. So I've been trying my best to get the thing to at least be a decent phone! I installed a launcher on it, changed the icons and wallpaper and made it look good at least. It will be nice to have someone to talk to about this. The thing has been beyond frustrating! First off though how did you get the computer to recognize it? I can't get Windows or Linux to recognize it and couldn't find any drivers. If you managed that much you got further than I did. I haven't tried with my nieces though. It might just be his phone. She's 13 so it took awhile to pry it from her long enough to find out what kind it was, but I'm willing to try to get it from her once again if the phone can be improved.
sjjtnj said:
OMG! So excited to see this here! My Mom gave my nephew this phone and niece has one. So I've been trying my best to get the thing to at least be a decent phone! I installed a launcher on it, changed the icons and wallpaper and made it look good at least. It will be nice to have someone to talk to about this. The thing has been beyond frustrating! First off though how did you get the computer to recognize it? I can't get Windows or Linux to recognize it and couldn't find any drivers. If you managed that much you got further than I did. I haven't tried with my nieces though. It might just be his phone. She's 13 so it took awhile to pry it from her long enough to find out what kind it was, but I'm willing to try to get it from her once again if the phone can be improved.
Click to expand...
Click to collapse
Linux should just work, plug in the thing and the "drivers" if you will should be there already. Check the phone's settings for USB Debugging in the Developer Options if there's further trouble.
Don't get me wrong too, this phone is, was, and will always be a piece of junk. There's no getting around a screen this bad and 1GB of RAM. I'm actively trying to find a Download Agent and Auth File combo to get this thing to work with SPFT so I can try to port a custom recovery to get us Magisk root permissions at least. Root will make the phone slightly better, but it will still be junk. Unless we can get kernel source for it as well to mess with things like clock speeds and CPU governors (which LEGALLY we are supposed to be guaranteed, but good luck convincing a Chinese company to give it to you) everything we do, if we CAN do anything, will be like deodorant on a turd. It'll smell a little better, but it's still a turd.
jasonmerc said:
Linux should just work, plug in the thing and the "drivers" if you will should be there already. Check the phone's settings for USB Debugging in the Developer Options if there's further trouble.
Don't get me wrong too, this phone is, was, and will always be a piece of junk. There's no getting around a screen this bad and 1GB of RAM. I'm actively trying to find a Download Agent and Auth File combo to get this thing to work with SPFT so I can try to port a custom recovery to get us Magisk root permissions at least. Root will make the phone slightly better, but it will still be junk. Unless we can get kernel source for it as well to mess with things like clock speeds and CPU governors (which LEGALLY we are supposed to be guaranteed, but good luck convincing a Chinese company to give it to you) everything we do, if we CAN do anything, will be like deodorant on a turd. It'll smell a little better, but it's still a turd.
Click to expand...
Click to collapse
Right, I'm considering giving him my current phone when I get a new one. It doesn't seem like I'm going to be able to unlock and root it so I want a phone I can. Mainly for space personally. He's young so he doesn't need it rooted, but I'm thinking if I can root it then I might be able to use it to root my phone. Speaking of rooting I think I found a way to root this phone. It took me a couple days to get the phone since he said he couldn't find it, but I have it now. It just needs to charge, but the battery sucks so it takes forever. I did find out that it does have a decent recovery. I had booted it into recovery and then I was messing around with the keys after the little passed out green guy popped up and suddenly it loaded stock recovery. It had an option to mount the system and flash with adb and everything. The only problem is I kept booting it by messing with keys. So I honestly don't know which ones worked. I kept booting into it last night by messing with them, but now I can't seem to get it to boot into the right recovery now that I'm trying to figure out the right key combination. I will figure it out though (eventually) and let you know what you have to click, but if you get the chance just mess with it and hopefully you'll find it like I did.
Also I was looking up the phones variants and downloaded a couple stock roms that I felt had all the right specs I'm going to try to flash one if I can get it plugged in. I downloaded custom twrp image's for them as well, and even found one twrp that I was able to download in the app. If you used it then you know that it takes you to a download page if you are downloading the wrong twrp.img. So the fact it let me download it in the app meant it tricked twrp into thinking it was that phone. So I'm going to try that stock rom first. Maybe we'll be able to change it to another model. It really needs something flashed, because it's a mess. I thought he messed it up, but after reading what you said maybe it's just the phone. He's young so it doesn't matter as much to him, but I feel bad for my niece. I really need to look into at least getting her another phone. I'm going to work on it later today and see what I can do. First I got to get it to work on the computer, but I may be able to root it without the computer. I'll keep you updated with my progress.
any luck with this?
Yeh, is there a status update?
Sorry, I got a concussion and haven't been able to do much, but really I'm stuck because I can't get it to connect to the computer at all. Not in Windows or Linux. I think he's messed it up beyond repair at this point. The offline root gave me an error around the mounting of the system, but that can be done if you can get the recovery to show up. It's one of the options. I was trying this method. HERE see if you can get it plugged in and to work. Also, Kingoroot gets to 90% on the apk alone. So the computer app might do the trick. Then you can switch it to su. Really a rooted phone can get a lot done with apps like flashify and flashfire that we can't do right now. If you can get even a temp root let me know and I'll tell you what I found out about the apps to unlock the bootloader, flash TWRP, Flash Magisk, then flash ROMs. If you want to try the variant route I was trying then just do a search on google. Some sound just as bad, but other similar phones seem better. You can pick which one you want to try. The phone I have got to a point that it kept deleting applications and stuff on the phone and has trouble with the sd card. So I don't have the stuff I had saved on it anymore. I'm giving him my current phone when I get a new one. It's too messed up to salvage. I hope you have more luck.
sjjtnj said:
Sorry, I got a concussion and haven't been able to do much, but really I'm stuck because I can't get it to connect to the computer at all. Not in Windows or Linux. I think he's messed it up beyond repair at this point. The offline root gave me an error around the mounting of the system, but that can be done if you can get the recovery to show up. It's one of the options. I was trying this method. HERE see if you can get it plugged in and to work. Also, Kingoroot gets to 90% on the apk alone. So the computer app might do the trick. Then you can switch it to su. Really a rooted phone can get a lot done with apps like flashify and flashfire that we can't do right now. If you can get even a temp root let me know and I'll tell you what I found out about the apps to unlock the bootloader, flash TWRP, Flash Magisk, then flash ROMs. If you want to try the variant route I was trying then just do a search on google. Some sound just as bad, but other similar phones seem better. You can pick which one you want to try. The phone I have got to a point that it kept deleting applications and stuff on the phone and has trouble with the sd card. So I don't have the stuff I had saved on it anymore. I'm giving him my current phone when I get a new one. It's too messed up to salvage. I hope you have more luck.
Click to expand...
Click to collapse
I need to unlock my phone U304AA
Ok boys and girls, in case anyone is still wondering here is how to root this sucker.
https://drive.google.com/file/d/1--Ul1ae73zcejNuJ1a7ftq5sTo2VP8Ya/view?usp=drivesdk
Comes with two files. Mtksu amd magisk be sure to use the magisk version included in the zip. Install mtksu then wmagisk, open mtksu and install the top magisk option. Reboot then open magisk hit install when it asks. Now open mtksu scroll to the bottom and hit activate and reboot again. Should be good too go at this point. Oh yeah be sure to click apply at boot in mtksu. Not sure if this had been posted before or not. Now, to find a way to unlock bootloader and install twrp.
Thank you, I tried Mtksu on mine and it didn't work, but it might've been the phone. I don't have one of these anymore, but I hope you all the best of luck. For the bootloader and Twrp try Flashfire or flashify.
MTK bypass method released by some smart dudes out there. I will test if we can use SPFT on this phone now. Stay tuned. This could mean root & recovery in a matter of minutes.
EDIT: It ALMOST works. Technically it bypassed the auth file as advertised. The only thing left now is finding a compatible preloader/scatter file to use.
Used a modified Moto E6 Play scatter file to pull images from the device. Tried flashing over stuff and got an error. Long story short my U304AA is now permanently bricked, so I'm tapping out of this project here
I do have recovery and boot images that (supposedly) work if anyone else wants to try and take over Keep in mind these were pulled with a scatter file from a DIFFERENT phone that's of the same chipset, so not everything is guaranteed to work. For example, the preloader was pulled with the specified parameters but I do NOT know if it's functional
Because I'm tapping out, and because nobody else seems to have anything on this, I'm uploading everything I can. Some pulls are too big to upload and some just won't work for some reason, but use whatever you'd like for anything you can. Hope I did something helpful
I have searched in Google Search and the tutorials forum but not found a tutorial
_____________
Sent from my website: https://topsanphamhay.com/kem-chong-nang-danh-cho-da-dau-mun.html - https://topsanphamhay.com/kem-chong-nang-innisfree-perfect-uv-protection-cream-co-tot-khong.html - https://topsanphamhay.com/kem-chong...ifying-face-fluid-dry-touch-co-tot-khong.html using Iphone X
Well AT&T is giving away lots of Radiant Core devices because of their 3G shutdown: https://www.xda-developers.com/att-3g-shutdown-free-phone/
My wife and I just got one, so now I have two of these but I'm not sure I trust AT&T enough to use the "free" phone that they sent.
It would be great if someone can pickup this project, especially since so many phones are now flooding the market.
I just got 3 of these "free" from AT&T. In fact I don't really need them, I just happen to have phones with an IMEI number that AT&T cannot decipher, so they sent me new phones just in case I can't use 4G.
Anyway, I'm trying to use mine as spare Google assistants scattered around the house, but because they run that crappy Android Go, the Go version of Assistant won't listen to me until I long-press the home button. I would also like to use them when I travel as a spare.
These things are essentially throw-away, so I'm OK to risk bricking one of them.
What I really want to do is install a real version of Android on here, has anyone managed to crack this yet?
I personally have been writing and reading using this tool https://github.com/bkerler/mtkclient, which is much simpler than the others
Its a little rough around the edges, but it certainly works
My final problem is disabling secure boot (I already have a boot.img patched with magisk)
It appears that fastboot is simply not a mode for booting on this model, so I was wondering if anyone knows how to disable AVB by hand with just partition images
kayshinonome said:
I personally have been writing and reading using this tool https://github.com/bkerler/mtkclient, which is much simpler than the others
Its a little rough around the edges, but it certainly works
My final problem is disabling secure boot (I already have a boot.img patched with magisk)
It appears that fastboot is simply not a mode for booting on this model, so I was wondering if anyone knows how to disable AVB by hand with just partition images
Click to expand...
Click to collapse
if it's possible to downgrade the firmware to before the october 2019 patch, it might be possible to mtk-su the device: https://www.att.com/device-support/article/wireless/KM1376142/ATT/ATTU304AA
might be another alternative to trying to disable avb on a locked bootloader
luridphantom said:
if it's possible to downgrade the firmware to before the october 2019 patch, it might be possible to mtk-su the device: https://www.att.com/device-support/article/wireless/KM1376142/ATT/ATTU304AA
might be another alternative to trying to disable avb on a locked bootloader
Click to expand...
Click to collapse
Not possible to do, already tried before when I didn't brick it
KJ7LNW said:
Well AT&T is giving away lots of Radiant Core devices because of their 3G shutdown: https://www.xda-developers.com/att-3g-shutdown-free-phone/
Click to expand...
Click to collapse
Just got mine from this. I'd like to install something like NixOS mobile, but I've never used an android phone before. Will that be possible on this phone? If so, is there a good guide for newbs like myself?
Hello everyone!
So today something that could potentially let users flash/unbrick their phones using the current MSM Download tool came to my mind.
I'm also very sorry if this is the wrong place for this, i'm new to xda.
So as you might know for Realme phones there are people who have authorized account out there and once you pay them they will connect to yoprur computer and then start flashing ocess, online with no verification. I even tried getting my phone flashed but due to them not flashing twice if one package doesn't work my device was bricked (I have A.xx variant and i tried getting B.xx flashed) and i had to send to service center to wait for unbricking process which took over a month, yes you heard it right! They couldn't even repair it with software flashing so they had to replace the whole motherboard.... At least i'm grateful i didn't have to pay for motherboard replacement and it was considered in-warranty.
So yes, again let's go back to our topic and my idea.
What came to my mind is, what happens if i create a virtual machine using VMWare, get an authorized account to login to the application then cut connection of that TeamViewer connection and immediately "Save current state of VM" after someone logs in. Would that account be still logged in? This VM can also be shared with it's own folder as far as I know too! Is there a verification after you login to the app? As far as i know there's only a verification while you login to the app and there isn't anything afterwards which i think is also illogical to do so.
I know and i'm aware Realme can patch this possible "vulnerability" overnight because on the server side, literally everything depends on them (I really hope they don't) but thanks to their habit of not caring about development, releasing broken kernel sources and not even providing official bootloader unlock (even after nearly a year in my case) has come to a point where it's irresistably annoying for me so i decided to think of possible ways to maybe bypass the verification part of the application so that they can flash a firmware as their liking.
It's Android! It had to be free! It had to be allowed to do these type of stuffs to your Android phone! Why? Why? Why Realme?!
daeMysterious said:
Hello everyone!
So today something that could potentially let users flash/unbrick their phones using the current MSM Download tool came to my mind.
I'm also very sorry if this is the wrong place for this, i'm new to xda.
So as you might know for Realme phones there are people who have authorized account out there and once you pay them they will connect to yoprur computer and then start flashing ocess, online with no verification. I even tried getting my phone flashed but due to them not flashing twice if one package doesn't work my device was bricked (I have A.xx variant and i tried getting B.xx flashed) and i had to send to service center to wait for unbricking process which took over a month, yes you heard it right! They couldn't even repair it with software flashing so they had to replace the whole motherboard.... At least i'm grateful i didn't have to pay for motherboard replacement and it was considered in-warranty.
So yes, again let's go back to our topic and my idea.
What came to my mind is, what happens if i create a virtual machine using VMWare, get an authorized account to login to the application then cut connection of that TeamViewer connection and immediately "Save current state of VM" after someone logs in. Would that account be still logged in? This VM can also be shared with it's own folder as far as I know too! Is there a verification after you login to the app? As far as i know there's only a verification while you login to the app and there isn't anything afterwards which i think is also illogical to do so.
I know and i'm aware Realme can patch this possible "vulnerability" overnight because on the server side, literally everything depends on them (I really hope they don't) but thanks to their habit of not caring about development, releasing broken kernel sources and not even providing official bootloader unlock (even after nearly a year in my case) has come to a point where it's irresistably annoying for me so i decided to think of possible ways to maybe bypass the verification part of the application so that they can flash a firmware as their liking.
It's Android! It had to be free! It had to be allowed to do these type of stuffs to your Android phone! Why? Why? Why Realme?!
Click to expand...
Click to collapse
I flashed the stock recovery n stock rom on a RMX1993 Realme X2 that I had rooted already with TWRP.
Everything was fine, till I got the great idea on relocking the bootloader.
As soon as I put the command the device reboot and showed that message with chinese letters n "recovery/boot has been destroyed" etc.
Got no fastboot either, only com port EDL mode works. The next and main problem is I am not authorized to flash roms due to that user/pw in msm tool. I just found this out after bricking the device. Why the hell did I lock the bootloader....
I heard there are websites that offer user/password for msm tool flashing n you need to buy credits for it. I'm not gonna bother nor paying for something that I own and should have the right to fix by myself. Amaz0n will take care from it this time, they'll probably refund.
Tip: Do not relock bootloaders,
and a better one: do not buy realme devices.
Morphine1 said:
I flashed the stock recovery n stock rom on a RMX1993 Realme X2 that I had rooted already with TWRP.
Everything was fine, till I got the great idea on relocking the bootloader.
As soon as I put the command the device reboot and showed that message with chinese letters n "recovery/boot has been destroyed" etc.
Got no fastboot either, only com port EDL mode works. The next and main problem is I am not authorized to flash roms due to that user/pw in msm tool. I just found this out after bricking the device. Why the hell did I lock the bootloader....
I heard there are websites that offer user/password for msm tool flashing n you need to buy credits for it. I'm not gonna bother nor paying for something that I own and should have the right to fix by myself. Amaz0n will take care from it this time, they'll probably refund.
Tip: Do not relock bootloaders,
and a better one: do not buy realme devices.
Click to expand...
Click to collapse
Same mistake as yours, Did you found any fix/bought new phone? Regretting now.
PrateekPanwar64X said:
Same mistake as yours, Did you found any fix/bought new phone? Regretting now.
Click to expand...
Click to collapse
did you find any solution stuck with the same problem
ZUESHACKED said:
did you find any solution stuck with the same problem
Click to expand...
Click to collapse
Yeah, I wrote later in a forum: https://forum.xda-developers.com/t/...tloader-and-no-recovery.4316853/post-86998293
I decided to load gsi via dsu loader in the settings app, I had oem unlocking enabled, and then I installed one of the gsi--it was random, I don't know too much about these types of things, like arm64 or something, at the time, so I just did the arm64 so for a bit, it was done downloading, all I needed to do was restarting the device, and then, after restarting it, it had this boot messages that says "dm-verity corruption. Your device is corrupt. It can't be trusted and may not work properly. Or, the device will power off in 5s". The device was working correctly except it just had that message everytime it boots, and it was still android 11 as normal instead of loading android 13 gsi. I tried to fix this dm-verity problems, with everything I can: I used adb and used the dm verity command (adb reboot dm-verity enforcing, adb reboot, fastboot set active other), I also did factory reset but that doesn't work, I contacted the customer services and they said as of right now, they don't provide roms or software to end user, and the only way to fix the devices with them is to send it to them and it cost 30 dollars, so i declined instead. I found these two application while on my way to research on fixing the devices: Unlocktools, and rom2box, but I am skeptical of them. I didn't found the firmware for this specific devices, but it did gave me hope that the only thing that came close is blu g91. I don't know what else to do besides use unlock tools, or rom2box, but I don't want to get my computer in danger, so I don't have that much choice.
Does anyone have a firmware file for BLU F91 5G though? I just founded one, but I can't download them, because I had to log in, but the website (Halabtech) seems kinda odd though, so I haven't log it in yet.
Nvm, I guess I'll just flash different gsi for different type of processor or something.
I Did same thing few weeks ago on my s91pro. Got same response from Blu and I can't seem to find a trusted place to get Firmware either. Sadly I don't have a pc to flash with but soon as I get my one plus device back I can try to sideload maybe.
Curios with your idea to flash again? If that works let me know please and good luck!!
My first idea was to use the dsu sideloading/vegebobo and shizuku for using gsi, my 2nd idea was to sue adb and fastboot, I would need to get gsi file, I could load either vb.meta, or just the system one instead. It took me a while because I was using outdated drivers, outdate adb, or just incorrect command. At first before all of this, I just wanna flash normal firmware, but I guess ill do that. It worked out for me, but I had problems with scren recording and wifi related in different gsi
btw, If u thinking of flash custom gsi on ur blu phone (in case if u don'twant to, I don't wanna force u or anything, just saying, so u don't have to deal with the burden) , I don't recommend using cdroid, in my expriences, wifi connected but doesn't work, and even using mobile data doesn't work either, lineageos was less worse.
Honestly with all the hassel it seems to cause I don't see it worth it. Hell even trying to fix the issue I have already seems to be a pain. I'm gonna just leave it be. Doesn't seem to cause any real issues other than the annoying warning during boottup. Which I just press the power one time and use phone as normal.
I am only using the Blu phone till I get my one plus back from warranty service. Then it's just a back up and alternate account I use for games.