I unfortunately have a Pixel 3, from Verizon (when I bought it it was not described as a phone issued by Verizon had I known it I wouldn't have bought it). I'm trying to accomplish The impossible by finding some way to unlock the bootloader. Everything has failed of course. But today I came across some Fastboot OEM commands, that actually do something but to the extent of what they accomplished I have no idea.
Code:
fastboot oem citadel
(bootloader) citadel <command>
(bootloader) Commands:
(bootloader) rescue Try to rescue Citadel
(bootloader) state Print current Citadel state
(bootloader) reset Reset Citadel
(bootloader) reset-locks Reset AVB locks
(bootloader) version Print citadel OS version
(bootloader) reprovision Reprovision device after a RMA unlock
(bootloader) suzyq on|off Enable or disable SuzyQable
FAILED (remote failure)
finished. total time: 0.060s
I have tried to reset command and also the reset-locks command. The reset command returns an 'okay' whereas the reset locks command comes back as a device error. The only thing I know is the reset locks command has something to do with AVB.
When running the state command, a number of things come up. Notably it lists the locks, there are 4 of them. 1-3 have a value of 1 whereas 4 has a value of 0. What these values mean it also lists "bootloader: 1", but after running the reset command, the value for "bootloader's changes to 0. There is also 'fastboot oem rma' which I have no idea what it stands for or what it does but when I run it it requires two other variables 'get_challenge' and 'send_response'. I can also enable or disable whatever suzyq is. Also 'fastboot oem continue-factory' works but only appears to reboot the device and if it does anything else, I have no idea.
I'm just trying to get some insight on what these commands might be and what they might do if anything and if anyone has any information I'd be happy to hear it.
ok here is the result when running
Code:
fastboot oem citadel state
2...
(bootloader) Citadel state:
(bootloader) Version : 1
(bootloader) Bootloader state: 1
(bootloader) Production state: 1
(bootloader) Number of locks : 4
(bootloader) Lock[0]: 1
(bootloader) Lock[1]: 1
(bootloader) Lock[2]: 1
(bootloader) Lock[3]: 0
OKAY [ 0.129s]
finished. total time: 0.129s
The fourth one i assume is NOT locked? I am just guessing 1 = locked, 0 = unlocked or what not. Heres what the values say after running
Code:
fastboot oem citadel reset
2...
OKAY [ 0.170s]
finished. total time: 0.170s
Here is the citadel STATE after running the reset command
Code:
2...
(bootloader) Citadel state:
(bootloader) Version : 1
(bootloader) Bootloader state: 0
(bootloader) Production state: 1
(bootloader) Number of locks : 4
(bootloader) Lock[0]: 1
(bootloader) Lock[1]: 1
(bootloader) Lock[2]: 1
(bootloader) Lock[3]: 0
OKAY [ 0.126s]
finished. total time: 0.126s
Now assuming 0 = unlocked, then the 'Bootloader state' after running reset command goes from having a value of 1 to a 0. Do we have anything here?
SuzyQable = ChromeOS debug cable.
The SuzyQable allows developers, hobbyists, and others to quickly access debugging, recovery, and developer features exposed through some of the USB-C ports on ChromeOS and other Google devices.
Click to expand...
Click to collapse
I can turn this feature on using the 'fastboot oem citadel suzyq on' command. Looks like if this is to be explored further, I going to have to buy one.
So...somehow I managed to change slots. As I saw, slot setting is not allowed on locked devices. So tell me how I changed the slot from slot _b to slot _a?
I have Verizon and I was able to unlock it) Read more on the Russian-language forum 4pda
MURFLY said:
I have Verizon and I was able to unlock it) Read more on the Russian-language forum 4pda
Click to expand...
Click to collapse
Can you leave a link so it can help other people who are trying to unlock it?
MURFLY said:
I have Verizon and I was able to unlock it) Read more on the Russian-language forum 4pda
Click to expand...
Click to collapse
I've only seen bits and pieces of this and haven't been able to gather too much because of the language barrier if there's any kind of links you can provide that will point me in the right direction or at least a better one it would be greatly appreciated. I've tried all the tricks that I can come across otherwise. Changing the date and time, taking the SIM card out doing a reset and using ADB to disable the phone, etc. I'm no expert but I can't find a single hint either in a hardware or software, with the exception of two applications that cannot be accessed without some kind of activity launcher and even then only one of them can be accessed without root access. And that is a phone sign up application for Verizon however even with that said there's nothing else to indicate whatsoever that this phone is actually Verizon so I'm kind of a little bit confused as to how this phone will be any different from the international variance if they're made of the same parts in the same exact software. I am currently running Android 12 on this from the developers preview. So if that matters then maybe I won't be able to do this maybe I will. But I'll do whatever it takes I have no shame in experimenting on a device. I already know the risks and have known for several years so I'm not doing anything I haven't already done on another device at some point.
Whoops.
Wrong thread.
Cheers.
DragonFire1024 said:
So...somehow I managed to change slots. As I saw, slot setting is not allowed on locked devices. So tell me how I changed the slot from slot _b to slot _a?
Click to expand...
Click to collapse
ive been following this thread since the begining. I have a verizon P3 xl. Please let me know if theres anything I can test.
tsuna27 said:
ive been following this thread since the begining. I have a verizon P3 xl. Please let me know if theres anything I can test.
Click to expand...
Click to collapse
Well until one of us goes out and gets. SuzyQ USB C type ChromeOS debugging cable (I will look online and see if there's any locally available at Walmart or the likes and if not, buy one on line this weekend). What I'm hoping is this cable will cancel out the 'device error' when doing a lock reset and if so, what it might do there after.
Just a neat little trick I have found in regards to a SIM card or whatnot. If you know of or use the settings database editor application they also have a feature pack which allows for some of these settings to persist upon a reboot and stopping Android from defaulting any of the settings you change. This might be of use to somebody with one of these devices who does not have one that's carrier unlocked.
Code:
adb shell settings put global euicc_provisioned 1
. Then use setting database editor feature pack (not sure if this is required but if you decide to use this function when turned on, it might be best to remove the persistence from settings database editor). This allowed me to get access right away to Google fi and other options to essentially get a new sim card with new service and allowed me to choose such service and all that other good stuff.
So apparently this debug cable does quite a bit of things. Including to some capacity the ability to read and write. If the device is supported, you have access to Closed Case Debugging and Servod. Some features this cable allows when they are activated in a chroot chromeOS environment using hdctools:
Control of firmware write protect.
Flashing of the AP and EC firmware.
EC RW console access.
Read I2C INA219 current sensors (though most production boards do not have them populated).
A subset of these features (e.g., UART lines) can be accessed without a cros_sdk chroot.
Once the SuzyQ is plugged in, three /dev/ttyUSB devices will enumerate:
Cr50 console
CPU/AP console (RW)
EC console (RW)
Click to expand...
Click to collapse
Ordered a cable. Should arrive on Sunday. If anyone is interested in one for themselves, you can get them on Amazon but there aren't many left. https://www.amazon.com/gp/aw/d/B07XF7V6CW?ref=ppx_pt2_mob_b_prod_image
DragonFire1024 said:
So apparently this debug cable does quite a bit of things. Including to some capacity the ability to read and write. If the device is supported, you have access to Closed Case Debugging and Servod. Some features this cable allows when they are activated in a chroot chromeOS environment using hdctools:
Click to expand...
Click to collapse
Here is the link for that information regarding what this cable might be able to do. Sorry that I forgot to post it and sorry that the above reply was so sloppy I didn't realize. https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md
From the source code of crosshatch:
Text is too coded when doing a copy paste. As soon as I get inside I will add the text I am speaking of.
DragonFire1024 said:
From the source code of crosshatch:
Text is too coded when doing a copy paste. As soon as I get inside I will add the text I am speaking of.
Click to expand...
Click to collapse
Here is a list in the source code for crosshatch, on what the citadel AVB locks are and do:
Code:
# Citadel
PRODUCT_PACKAGES += \
citadeld \
citadel_updater \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
wait_for_strongbox
# Citadel debug stuff
PRODUCT_PACKAGES_DEBUG += \
test_citadel
I can't wait for the cable to get here. I'm licking my chops.
source: https://android.googlesource.com/de...bfe57aaaf2cdd656a4476bbfb5c01314a09/device.mk
Note to self and others: DSU (Dynamic System Update), the ability to load a GSI over the current system, does not work on this device on Verizon variant. When device reboots, it immediately boots to a fastboot warning screen saying:
your device is corrupt. It cannot be trusted and may not work properly.
Click to expand...
Click to collapse
However, hitting the power button reboots the device to "no command", then I press power and vol. up for recovery and reboot system normally. I tried to boot a GSI from google (Android 11 GSI) and a Resurrection Remix GSI android Q and one or the other managed to write something somewhere to raise this warning. Device doesn't seem to be effected in any negative manner despite the warning.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hello:
Thank you for your work.
I used
Code:
adb shell settings put global euicc_provisioned 1
to enable my Verizon Pixel 3xl's eSIM function, but this function will not work after hard reset.
And do you know how to enable this phone's cdma network function with any codes?
Pixel 3xl said:
Hello:
Thank you for your work.
I used
Code:
adb shell settings put global euicc_provisioned 1
to enable my Verizon Pixel 3xl's eSIM function, but this function will not work after hard reset.
And do you know how to enable this phone's cdma network function with any codes?
Click to expand...
Click to collapse
I don't know if this will help you at all but I seem to recall something along the lines of changing CDMA through one of the phone applications but you have to use an activity launcher. If you do a Google search for activity runner APK that's the one I use. You would have to look for about phone or phone info in one of the four or five phone applications and launch the activity and options to that effect will come up whether they persist is another story.
I've tried the activity runner APK but failed, it comes up with require Android.Permission.
DragonFire1024 said:
I don't know if this will help you at all but I seem to recall something along the lines of changing CDMA through one of the phone applications but you have to use an activity launcher. If you do a Google search for activity runner APK that's the one I use. You would have to look for about phone or phone info in one of the four or five phone applications and launch the activity and options to that effect will come up whether they persist is another story.
Click to expand...
Click to collapse
Wait for your work to find out whether the bootloader can be unlocked.
Related
if you had your phone s offed by a java card,a result of the diag file "s58 data clean" is a change of your MID(Model ID) to a superMID of sorts: 0P6B2****
this has an advantage of allowing htcdev unlock without changing cid,but with s off, the bootloader can easily be unlocked without htcdev,so that is not of much importance.
since we dont know for sure if any future activities(turning s on,accepting OTAs,etc) will be affected by a non stock MID,it may be worthwhile to return the MID to stock 0P6B20000 "just in case"
this thread is for the folks who wish to revert to stock MID. the method described here is not the only way to skin the cat,but as long as your careful the risk is very minimal, its quick and easy and doesnt require any hboot downgrades,eng hboot install,data loss,or having to run an ruu.
credits:
-beaups for schooling me on the echo command protocol
-kdj67f for dumping partitions from his java card s-offed m7
-davehasninjas for dumping rumrunner s offed m7 partitions
-andybones for testing on a vzw m7 device
standard disclaimer: use this information at your own risk. it has been tested,but copying the command incorrectly could have consequences. if you melt your phone into a smoldering little pile of aluminum goo, its not my fault.
IF you are an advanced user with adb/fastboot set up and some basic knowlede of the cmd window,you can skip to #2
1)set up adb
-download this file
-install drivers: if you have htc sync installed,you should allready have drivers. if not,you can install htc sync,or install these modified htc drivers from revolutionary (driver mirror)
-unzip your miniadb_v1031.zip file. this is native funtionality in windows 7. you otherwise may need a utility such as "7-zip" to extract,or unzip it. place the unzipped folder onto the root of your C drive on your PC. root means the top level,not inside any folders. so just copy and paste,or drag and drop the folder onto C with everything else that is there. you may want to rename it to "miniadb_m7" since youll be putting some device specific files in here.
-open a command window. on windows 7,click the start bubble in the lower left and type "command" in the search box. xp i believe is similar or the same. doing this should open a small black command window.
-change to your miniadb_m7 directory. type the following at the prompt in your cmd window:
cd c:\miniadb_m7
your command promt should change to "c:miniadb_m7>" provided you: 1)unzipped the miniadb_v1031 zip file,and 2)put the folder on your c drive,and 3)entered the name of the folder correctly ("miniadb_m7" in this case)
-now make sure usb debugging is checked in developer options(you will need to turn it on first),and plug your phone into your PC with a usb cable
-make sure your phone is being recognized- type:
adb devices
if your drivers are installed correctly,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,then enter this command:
adb reboot bootloader
this should take your phone to the "fastboot" screen,wich is white with colored letters. this is one mode of your bootloaders interactive modes. at the top youll see fastboot devices as confirmation youre in fastboot.
now enter:
fastboot devices
again,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,you can enter the following to boot back to the phones OS:
fastboot reboot
and now,youve installed adb/fastboot and tested youre phones drivers. if at either spot,you have trouble and dont get your serial number back,there is some sort of connection issue. use these steps to troubleshoot:
troubleshooting connectivity issues:
-try a reboot of the PC
-try different usb cables and ports
-dont use a usb hub
-dont use usb 3.0
-make sure nothing capable of comunicating with the phone is enabled and running. htc sync,pdanet,easy tether,and even itunes have all been known to cause issues.
-windows 8 has been known to have issues. try a windows 7 or older machine
failing the above,
-i use these drivers for fastboot and adb(donwload and run as admin): http://downloads.unrevoked.com/HTCDriver3.0.0.007.exe (mirror)
failing that,try manually updating the drivers in the following manner:
-put the phone in fastboot mode(select fastboot from the hboot menu)
-open device manager on the PC
-plug in phone,watch for it to pop up in device manager.
-update drivers with device manager,pointing the wizard to the extracted
driver download folder from above
note that you can check the connectivity of the phone,and make sure drivers are working by in the following manner:
-open cmd window. change to directory containing adb/fastboot utilities
-adb with the phone in the booted OS,usb debug enabled,enter:
adb devices in a cmd window
-fastboot with phone in fastboot,enter:
fastboot devices in cmd window
in either case,a properly connected phone with working drivers installed should report back the phones serial number.
Click to expand...
Click to collapse
this process,in your cmd window,should look something like this:
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="red"]cd c:\miniadb_m7[/COLOR]
c:\miniadb_m7>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
FAxxxxxxxxxx device
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot devices[/COLOR]
FAxxxxxxxxxx fastboot
c:\miniadb_m7>[COLOR="red"]fastboot reboot[/COLOR]
rebooting...
finished. total time: 0.037s
c:\miniadb_m7>
2)restore your verizon MID
warning: *do not try and type the command. please copy and paste it
enter the following:
adb shell
su (if needed to get a #)
Code:
[B]echo -ne '\x30\x00\x50\x00\x36\x00\x42\x00\x32\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384[/B]
(the above is one big long command. make sure you copy it all,and dont get extra spaces when you paste it.)
exit
exit (<- only if needed to get back to your normal > prompt)
adb reboot bootloader
fastboot getvar mid (or getvar all)
verify 0P6B20000 for modelid
fastboot reboot
your command window should look like this:
Code:
c:\miniadb_m7>[COLOR="red"]adb shell[/COLOR]
[email protected]:/ # [COLOR="Red"]echo -ne '\x50\x00\x4e\x00\x30\x00\x37\x00\x33\x00\x31\x00\x30\x00\x
30\x00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384[/COLOR]
00\x30' | dd of=/dev/block/mmcblk0p6 bs=1 seek=16384 <
17+0 records in
17+0 records out
17 bytes transferred in 0.009 secs (1888 bytes/sec)
[email protected]:/ # [COLOR="red"]exit[/COLOR]
exit
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot getvar all[/COLOR]
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.44.0000
(bootloader) version-baseband: 4A.17.3250.20
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.27.531.8
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HTxxxxxxxxxx
(bootloader) imei: xxxxxxxxxxxxxxx
(bootloader) meid: 00000000000000
(bootloader) product: m7_ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0731000 [COLOR="Blue"]<-looky[/COLOR]
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 4175mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-f188f379dbbfee373cd551f7bc62b8435
getvar:all FAILED (unknown status code)
finished. total time: 0.092s
c:\miniadb_m7>[COLOR="Red"]fastboot reboot[/COLOR]
rebooting...
(bootloader) hbootpreupdate: 11
finished. total time: 7.288s
some other useful links if you have a java card s offed phone:
*links to come
is this for m8? tutorial only mentions m7.
Sent from my HTC6525LVW using XDA Premium 4 mobile app
so, why doesn't the s-off provider do this for you?
When I offered JTAG s-off on devices, the devices would return with the only change as S-OFF, not cid changed, nothing.
this seems like a lazy way to do it, since it can be scripted, so s-off... run script boom, perfect s-off.
djh816 said:
is this for m8? tutorial only mentions m7.
Sent from my HTC6525LVW using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Yes. This for m8. Sorry I'm lazy,and most of the thread is a paste from m7
This has not been tested on m8 since I don't have one. If someone wants to confirm,ill add them to the credits.
Sent from my HTC PG09410 using Tapatalk 2
dr_drache said:
so, why doesn't the s-off provider do this for you?
When I offered JTAG s-off on devices, the devices would return with the only change as S-OFF, not cid changed, nothing.
this seems like a lazy way to do it, since it can be scripted, so s-off... run script boom, perfect s-off.
Click to expand...
Click to collapse
I can't answer that,I'm not the java card guy. Whomever uses the java card is welcome to incoporate this into their process.
Personally,I would change cid and mid back to stock prior to returning the device.
Sent from my HTC PG09410 using Tapatalk 2
scotty1223 said:
I can't answer that,I'm not the java card guy. Whomever uses the java card is welcome to incoporate this into their process.
Personally,I would change cid and mid back to stock prior to returning the device.
Sent from my HTC PG09410 using Tapatalk 2
Click to expand...
Click to collapse
that's what I'd do, and that's what should be done.
dr_drache said:
that's what I'd do, and that's what should be done.
Click to expand...
Click to collapse
Yup. Change cid in fastboot,boot a recovery and enter the command.
Assuming fastboot boot recovery works,it would be quick and easy.
Sent from my HTC PG09410 using Tapatalk 2
Does adb work with Windows XP? My windows 7 laptop finally gave out on me, I can't get adb to work on my new laptop (windows 8...not 8.1) but I do have an old xp laptop that works just fine.
#1
your 8 should be 8.1 if you didn't update, you should it's free (check the store)
OTHERWISE,
you can manually apply the update 1 patches from M$, or wait until the 8th. it's fixed there
#2 yes it does, just not as well.
dr_drache said:
#1
your 8 should be 8.1 if you didn't update, you should it's free (check the store)
OTHERWISE,
you can manually apply the update 1 patches from M$, or wait until the 8th. it's fixed there
#2 yes it does, just not as well.
Click to expand...
Click to collapse
I did do the update to 8.1, but my laptop ran like crap afterward. So bad that I restored the computer back to 8.0. Does adb work with 8.1?
sofla2 said:
I did do the update to 8.1, but my laptop ran like crap afterward. So bad that I restored the computer back to 8.0. Does adb work with 8.1?
Click to expand...
Click to collapse
this I find very very hard to believe. since it's only windows 8 with a few tweaks.
but yes, and no.
adb works on everything, the issue with 8/8.1 is fastboot.
but with the patches that you can manually get now, OR when they are released on the 8th via windows update (8.1 only)
fastboot works.
dr_drache said:
this I find very very hard to believe. since it's only windows 8 with a few tweaks.
Click to expand...
Click to collapse
Well believe it. Example...after I did the upgrade, any program I clicked on took forever to open. I would see the little hour glass going round and round. With the web browser open, clicking on a link or shortcut would pretty much do the same. Even a simple web page like craigslist took forever to open up. Restore back to 8, all problems gone. I suppose maybe I got a bad download? They are releasing a new version on the 8th? Maybe I'll try again.
dr_drache said:
but yes, and no.
adb works on everything, the issue with 8/8.1 is fastboot.
but with the patches that you can manually get now, OR when they are released on the 8th via windows update (8.1 only)
fastboot works.
Click to expand...
Click to collapse
The problem I am having is my phone is not being recognized. And the drivers, like the one Scott posted above won't work. It says the driver installer is not supported for this operating system.
sofla2 said:
The problem I am having is my phone is not being recognized. And the drivers, like the one Scott posted above won't work. It says the driver installer is not supported for this operating system.
Click to expand...
Click to collapse
the drivers i listed are for windows 7 and below. sorry i cant help you on win 8+,im not familiar with it. another option would be to make an ubuntu live cd. no drivers eequired there
scotty1223 said:
the drivers i listed are for windows 7 and below. sorry i cant help you on win 8+,im not familiar with it. another option would be to make an ubuntu live cd. no drivers eequired there
Click to expand...
Click to collapse
I got adb and fastboot working fine on my old Windows XP Toshiba. Kind of scary though on a 12 year old laptop lol
i need this for the sprint one m8. i have changed it to a gsm mid and cant find the sprint one anywhere. youve made one for every variant except sprint: 0P6B17000
I'm sure theres no helping me, beings how im new to this, i run linux mint, not windows, and i made bad decisions to get here. i recently got a new moto g7 power with full intentions on using it as my guinea pig while i still had my old phone working. my plan was to not even install a sim card into my g7 until i had it properly rooted. i looked through all sorts of tutorials and tried many different things and learned alot along the way. long story short, ive been using the linux command line to do everything. i got my bootloader unlocked using the code that i requested from motorola. then i downloaded the 2 g7 ocean files, zip and img. i pushed the zip file into the /data/ folder, fastbooted from the .img file, got to twrp/ from there i went to advanced, install recovery Ramdisk, navigated to data, and selected the .img file. i tried this twice with no success, it would just boot normally and the twrp app wouldnt allow me to install the zip file, says its not rooted. so the last time i tried, i dont remember exactly how i did it but within the twrp recovery menu i found a way to boot slot b, but slot a was already selected by default. my thought was that i had installed the zip on slot b and not slot a. selected slot b, my phone shut off, and now nothing. just blank, wont even light a light, even if i plug it in.
i know that i shouldnt have been messing around with stuff i dont know much about, but hey, it beats watching the news right now, and that is why i didnt buy a 1000 dollar phone. also, i bought this phone from amazon prime, but im not sure id sleep good at night sending it back knowing i damaged it myself, however that was recommended to me. Thank you for any help/ info i may get.
Blank flash
jhomolac said:
I'm sure theres no helping me, beings how im new to this, i run linux mint, not windows, and i made bad decisions to get here. i recently got a new moto g7 power with full intentions on using it as my guinea pig while i still had my old phone working. my plan was to not even install a sim card into my g7 until i had it properly rooted. i looked through all sorts of tutorials and tried many different things and learned alot along the way. long story short, ive been using the linux command line to do everything. i got my bootloader unlocked using the code that i requested from motorola. then i downloaded the 2 g7 ocean files, zip and img. i pushed the zip file into the /data/ folder, fastbooted from the .img file, got to twrp/ from there i went to advanced, install recovery Ramdisk, navigated to data, and selected the .img file. i tried this twice with no success, it would just boot normally and the twrp app wouldnt allow me to install the zip file, says its not rooted. so the last time i tried, i dont remember exactly how i did it but within the twrp recovery menu i found a way to boot slot b, but slot a was already selected by default. my thought was that i had installed the zip on slot b and not slot a. selected slot b, my phone shut off, and now nothing. just blank, wont even light a light, even if i plug it in.
i know that i shouldnt have been messing around with stuff i dont know much about, but hey, it beats watching the news right now, and that is why i didnt buy a 1000 dollar phone. also, i bought this phone from amazon prime, but im not sure id sleep good at night sending it back knowing i damaged it myself, however that was recommended to me. Thank you for any help/ info i may get.
Click to expand...
Click to collapse
Most likely it's in Emergency download mode (EDL)
You will need a blankflash, several threads on this.
There's one here, that may work.
https://mirrors.lolinet.com/firmware/moto/ocean/blankflash/
Sent from my Moto E (4) using Tapatalk
EDL mode even though there is no sign of life whatsoever?
jhomolac said:
EDL mode even though there is no sign of life whatsoever?
Click to expand...
Click to collapse
There won't be anything on the phone, just a black screen, but it should show up on a PC's list of connected devices.
Sent from my Moto E (4) using Tapatalk
jhomolac said:
EDL mode even though there is no sign of life whatsoever?
Click to expand...
Click to collapse
Some phones will display a charge light some won't like he said it's in edl mode the PC sould display it and u should hear it make sound when u plugs the phone into PC on windows in not sure on Linux machine should b perty much the same on that aspect .One thing u might have to get different blank flashes for the different updates .If don't go the first time try again good luck
Thank you guys, i appreciate your time. sounds like i have to do some more research about flashing a motorola from linux. im somewhat new to linux as well.
jhomolac said:
Thank you guys, i appreciate your time. sounds like i have to do some more research about flashing a motorola from linux. im somewhat new to linux as well.
Click to expand...
Click to collapse
https://mirrors.lolinet.com/firmware/moto/ocean/ here is a blank flash that should get u going dose the PC recognise ur phone when u plug it in if dose open terminal an PC type fastboot devices if it sees it your in luck I can typ fastboot boot (the name of ur recovery) if it boot into twrp then u might b able to switch it to a slot. There is comands for fastboot to switch but I don't know them
My computer does not notify me when I plug in my phone. But I don't remember it doing that even when I used it before.thank you.
You might need to charge the phone. With a blank/black screen it can appear off when it's not. Thus draining the phone completely. It widely suggested to charge phones to at least 80% before tweaking/rooting.
I will feel like a real dummy if that's the case. It is now on the factory supplies charger. Haha. Crossing my fingers. Thank you
If I use command lsusd in terminal, my phone pops up as a Qualcomm wireless router. Command fastboot devices brings up nothing
jhomolac said:
If I use command lsusd in terminal, my phone pops up as a Qualcomm wireless router. Command fastboot devices brings up nothing
Click to expand...
Click to collapse
It's in edl mode, use the blankflash
Sent from my Moto E (4) using Tapatalk
I've never done a blank flash before, I thought it was done by using: fastboot flash command. But it doesn't seem possible if: fastboot devices doesn't bring everything up. I am on linux by the way
jhomolac said:
I've never done a blank flash before, I thought it was done by using: fastboot flash command. But it doesn't seem possible if: fastboot devices doesn't bring everything up. I am on linux by the way
Click to expand...
Click to collapse
You need QPST to interface with EDL mode. I don't know if anything in here works on Linux, but it definitely works on Windows 10.
QPST Utilities
decided to give this another try. i have managed to get a little further, however this is where i am getting stuck. i wish i was more savy with this stuff. any chance anyone could help me with this?
also, is it nessecary to have an sd card in the device when i do this?
blankflash_from_QCO30.85-18]# /home/joel/Desktop/blankflash_from_QCO30.85-18/blank-flash.sh
< waiting for device >
Motorola qboot utility version 3.40
[ 0.000] Opening device: /dev/ttyUSB0
[ 0.000] Detecting device
[ 0.005] ...cpu.id = 186 (0xba)
[ 0.005] ...cpu.sn = 2335135194 (0x8b2f55da)
[ 0.005] Opening singleimage
[ 0.005] Loading package
[ 0.013] ...filename = singleimage.pkg.xml
[ 0.018] Loading programmer
[ 0.019] ...filename = programmer.mbn
[ 0.019] Sending programmer
[ 0.318] Handling things over to programmer
[ 0.318] Identifying CPU version
[ 0.324] Waiting for firehose to get ready
[ 3.338] ...MSM8953 1.0
[ 3.338] Determining target secure state
[ 3.343] ...secure = yes
[ 3.387] Configuring device...
[ 3.394] Flashing GPT...
[ 3.394] Flashing partition with gpt.bin
[ 3.400] Initializing storage
[ 5.763] Target NAK!
[ 5.763] ...num_partition_sectors=61071360
[ 5.763] ...SECTOR_SIZE_IN_BYTES=512
[ 5.763] ...num_physical_partitions=3
[ 5.763] ...OEM_ID=74
[ 5.763] ...Product name=hB8aP>
[ 5.763] ...XML (0 bytes) not validated
[ 5.763] ERROR: do_package()->do_recipe()->do_flash()->flash_simg()->do_package()->do_recipe()->do_flash()->gpt_flash()->get_storage()->init_storage()->firehose_do_fmt()->do_recipe()->NAK
[ 5.763] Check qboot_log.txt for more details
[ 5.763] Total time: 5.763s
FAILED: qb_flash_singleimage()->do_package()->do_recipe()->do_flash()->flash_simg()->do_package()->do_recipe()->do_flash()->gpt_flash()->get_storage()->init_storage()->firehose_do_fmt()->do_recipe()->NAK
sd_shadow said:
There won't be anything on the phone, just a black screen, but it should show up on a PC's list of connected devices.
Sent from my Moto E (4) using Tapatalk
Click to expand...
Click to collapse
What do I do if it doesn't?
I tried all the possible button combinations but still nothing.
uwucake2020 said:
What do I do if it doesn't?
I tried all the possible button combinations but still nothing.
Click to expand...
Click to collapse
Is there anything on the phone screen?
sd_shadow said:
Is there anything on the phone screen?
Click to expand...
Click to collapse
There isn't anything, and it doesn't seem to be in EDL mode. (I checked in the device manager)
uwucake2020 said:
There isn't anything, and it doesn't seem to be in EDL mode. (I checked in the device manager)
Click to expand...
Click to collapse
Spoiler: It may be hidden in Ports like this
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hello,
I started to look for a way to move away from the big tech mosters and I've been on iPhones for a while (iPhone 11 Pro right now). I did develop for Android in the past, I am experienced developer and Linux admin so the technical side does not concern me too much. Long story short, I want to give Android another try but I want to be free of the unwanted baggage that comes with it.
Probably Nokia 8.3 was not the best pick but I consider it a strategic buy and the price was good. It is also somewhat nostalgic - I used to work at Nokia in the past, before the company got destroyed by you-know-who. So I would love to have something with their logo again
As far as I understand, currently there is no any alternative ROM available for this device. I was looking towards /e/OS or LineageOS, but probably it is too early. So, I am wondering what would be the best way to move forward with such a phone? So far my plan looks like this:
- unblock the bootloader immediately after receiving the phone, I would expect it to have Android 10 preinstalled and the "fix" seems to be available. I understand the risk but without the risk I will be the product, not the phone
- try to remove as much google as possible from the original system and move more or less to what I would have with LineageOS - MicroG and alternative apps
- wait for the official/beta support from one of these alternative ROMs and migrate
First, does it sound doable today? I found an excellent guide on this forum about "degoogling" the Android but it requires TWRP and it does not seem like it supports Nokia 8.3 yet.
I would really appreciate an advice on the best course of action.
Well, did not get too many answers, starting to write my own. I have received the toy today and had a bit of time to play with it. Happy to report that I went all the way through unlocking the device successfully and rooting it with Magisk. All by the book, no surprises. Maybe this will help someone:
- Started Nokia 8.3
- Accepted TOU
- Skipped all settings, offline
- verified it was running Android 10, Build number: 00WW_1_110 (00WW_1_110_B01)
- hardware: TA1243, product: lito, Variant: SM_ UFS
$ fastboot oem getversions
(bootloader) model=CaptainAmerica
(bootloader) sub_model=none
(bootloader) software version=00WW_1_110
(bootloader) SW model=
(bootloader) build number=A01
(bootloader) hardware version=A1-1
(bootloader) RF band id=
OKAY [ 0.001s]
Finished. Total time: 0.003s
$ fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [ 0.001s]
Finished. Total time: 0.001s
$ fastboot flash abl abl_proto.elf
Sending 'abl_a' (268 KB) OKAY [ 0.013s]
Writing 'abl_a' OKAY [ 0.003s]
Finished. Total time: 0.025s
$ fastboot flashing unlock_critical
FAILED (remote: 'unknown command')
fastboot: error: Command failed
$ fastboot flashing unlock
FAILED (remote: 'unknown command')
fastboot: error: Command failed
$ fastboot oem unlock-go
OKAY [ 0.045s]
Finished. Total time: 0.045s
Then I have connected WiFi network and OTA updated the device to 2_200 (Android 11)
Extracted boot.img from OTA zip using https://github.com/cyxx/extract_android_ota_payload.git
(used Python 3.8.3 and "pip install protobuf" before)
Followed https://topjohnwu.github.io/Magisk/install.html by the letter.
Patched boot.img with Magisk app, restarted into bootloader and flashed the modified boot image. Seems to be working
Next part - removing some software I do not want to see on this phone
I am with you
However, I used adb on host computer
Code:
adb reboot recovery
When you see dead bot, press both power + volume up buttons every 2 seconds to see actual recovery. You can choose adb sideload, and you can install ROM from host computer
Code:
adb sideload
Press spacebar once and drag and drop the ROM file to command window
Downgrade to 10 is still possible though you may see "downgrade not possible" (I flashed from 180 back to 150 in order to "patch" bootloader in order to unlock)
I successfully rooted mine and it looks like I am no longer abandoning it
TV streaming on Philo is no more hiccup
Headphones jack is capable up to 24bit/384kHz, but it's highly recommended to use USB C digital headphones adapter for maximum possible benefit
mingkee said:
I am with you
However, I used adb on host computer
Click to expand...
Click to collapse
I had old Android 10 preinstalled so I did not have to downgrade.
So far I am messing with the phone trying to minimize the data leaking while preserving the functionality I want. AFWall+ etc...So far seems OK. I also use Pi-Hole at home and planning to actually set up VPN on the device so it would be always connected to my home network. The only thing I am not sure about, I had to allow network access to Google Play Services, otherwise some apps would not work or behave in an odd way. For example, Waze worked with it disabled but Ring stops working minutes after logging in. I am wondering if allowing Google Play Services opens the floodgate of Google spyware. I am doing traffic analysis on the device, investigating who connects where. At the end I will write my "tutorial" on this. Personally I could not find one good tutorial about how to maximize your privacy with stock ROM and rooted phone.
Thanks for the tip about the audio!
Maybe you can run @AndyYan 's Lineage OS GSI on this phone.
When I discovered the unlock method, I've tried GSI already.
Here's the GSI test report I made for 8.3:
Nokia 8.3 5G
Notes about tinkering with Android Project Treble. Contribute to phhusson/treble_experimentations development by creating an account on GitHub.
github.com
To flash GSI, you'll need to boot to Fastbootd:
Code:
adb reboot fastboot
Then flash GSI (bvS variant):
Code:
fastboot erase system
fastboot flash system /path/to/lineage-18.1-20210411-UNOFFICIAL-treble_arm64_bvS.img
fastboot --disable-verity --disable-verification flash vbmeta /path/to/vbmeta.img
fastboot -w reboot
QLink Serrano 3
Model No. HPP-L55B
By Hot Pepper Mobile
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Bootloader Unlocking
And Rooting Guide
OVERVIEW:
This guide provides step-by-step instructions for unlocking the bootloader and achieving root access on the QLink Serrano 3. Please note that this guide is specifically for the QLink variant of the Serrano 3 (HPP-H55L), as I have not verified the applicability of this guide on other carrier variants of this smartphone. To simplify the rooting procedure, and to cater this guide to new and inexperienced members, I have provided a boot image pre-patched for Magisk systemless root support below, in the downloads section.
IMPORTANT NOTE: The pre-patched boot image in the downloads section below corresponds with firmware build HPP-L55B-J-9.0.0. If your Serrano is running a different build, flashing the pre-patched boot image provided may or may not result in compatibility issues. In short, the best rule of thumb when achieving systemless root is to always patch an image that matches the firmware build installed on your device, otherwise you may encounter issues such as broken WiFi, broken Bluetooth, or your device may not boot at all. Should any members encounter issues of this sort, you may flash your device with the HPP-L55B-J-9.0.0 firmware by following my firmware restoration guide for the Serrano here: QLink Serrano 3 Firmware Restoration Guide
PREREQUISITES:
You will need a Windows PC or laptop with the ADB & fastboot tools installed. I have provided a link below for the latest Minimal ADB & Fastboot tools. You will need the factory supplied, or a quality equivalent micro USB to USB-A data syncing/charging cable. And, you will need your QLink Serrano 3 smartphone. I again emphasize that this guide has only been tested on the QLink variant of the Serrano (HPP-L55B).
DISCLAIMER:
The tasks outlined in this guide encompass inherent risks to the integrity and operability of your smartphone. Moreover, unlocking the bootloader/rooting the device will void any active manufacturer's warranty you may have on your Serrano. By proceeding further, you are assuming full responsibility for the state and health of your smartphone. As such, you are hereby absolving me of any responsibility or civil liability in the unfortunate event things go badly. This guide has been fully and thoroughly tested. Follow the instructions carefully, employ some patience, and pay attention to detail and I'm confident things will go smoothly. It should also be noted that the tasks outlined herein can be carried out using a Mac or Linux computer as well. This particular guide, however, will focus solely on a Windows -based setup.
I.. INSTALLING ADB & FASTBOOT
Because both tasks outlined in this guide require ADB/Fastboot communication between your phone and PC/laptop, this first section will focus on proper installation of the ADB & Fastboot utilities on your Windows computer. If you already have a working ADB/Fastboot environment, skip down to the next section on unlocking the bootloader. Otherwise, follow these steps:
Download the Minimal ADB & Fastboot tools installer from the link below. Right click the .exe file and opt to run it as an administrator. Follow the on-screen prompts and complete the installation;
Open the Windows File Explorer, go to This PC and open your C: drive directory. Open Program Files x86 and locate the Minimal ADB & Fastboot folder. Copy the folder and then paste it on your desktop (this step merely configures the ADB & Fastboot directory to a more convenient location from which to work);
Open the Minimal ADB & Fastboot folder and double click the file named cmd-here. A command prompt will open. Next, connect your Serrano to your Windows computer using a suitable micro USB to USB-A data syncing cable. Ensure that USB Debugging is enabled in your Developer Options menu.
In the command window you opened in the previous step, execute this command:
Code:
adb devices
Watch your device display for a USB Debugging authorization prompt. Grant the request. If properly connected, the command window will output an alphanumeric string consistent with your device serial number;
If the command window does not display your serial number, or if you get a WAITING notification, your smartphone isn't communicating properly with your PC or laptop. Try another data syncing cable,; change USB ports; and/or reinstall the Minimal ADB & Fastboot tools on your computer;
Once you have established proper device communication, we will now test fastboot mode communication. Execute this command:
Code:
adb reboot bootloader
Your device should now boot into fastboot mode, which will be illustrated by a darkly backlit display with the words => FASTBOOT mode.... displayed in a white font at the bottom-left of the screen;
Next, execute this command:
Code:
fastboot devices
Similar to before, if properly connected, the command window will display your device S/N. If you don't see your S/N, or if the command window says WAITING, you are not properly connected. Again, try changing USB ports, try another data syncing cable, and/or reinstall the Minimal ADb & Fastboot tools on your computer.
II. UNLOCKING THE BOOTLOADER
WARNING: Unlocking the bootloader triggers a native Android security mechanism that forces the device into a factory data reset. This will erase all saved userdata on your phone. Before proceeding further, make a backup of all saved userdata you wish to keep.
Open device Settings>System>Developer Options, and enable the OEM Unlock option;
Boot into fastboot mode by executing:
Code:
adb reboot bootloader
Once in fastboot mode, it's time to initiate bootloader unlocking. Execute this command:
Code:
fastboot flashing unlock
Your smartphone display will now prompt you to tap Volume + to proceed with unlocking, or Volume - to cancel;
After pressing Volume +, the unlock sequence will finish in just a few seconds. Now reboot to complete the process: Execute:
Code:
fastboot reboot
As mentioned previously, your phone will now initiate a mandatory factory data reset, after which your device will boot into the initial setup phase of the Android OS. Your bootloader is now officially unlocked.
III. ROOTING THE SMARTPHONE
Now that the bootloader is unlocked, attaining root access is very straightforward.
Download the patched boot image and vbmeta image files from the links below and save the files in your Minimal ADB & Fastboot folder;
Double click the cmd-here.exe file to open a command window. Execute this command to flash the patched boot image:
Code:
fastboot flash boot patched_boot.img
Now we will disable dm-verity by executing this command:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Now, execute this command to reboot your phone:
Code:
fastboot reboot
Upon reboot into the Android OS, locate the Magisk app or its stub placeholder in your app drawer. Open Magisk, grant any requested permissions, and follow any prompts to finish setting up the root environment. Magisk may initiate a reboot to complete root setup. If the Magisk app or its stub placeholder is not in your app drawer, download the Magisk v25.2 APK from the link below and install it on your phone. That's it. You are rooted with the Magisk v25.2 systemless root solution.
DOWNLOADS:
• Minimal ADB & Fastboot v1.4.3
• Patched boot.img
• vbmeta.img
• Official Magisk Releases (GitHub)
Thank you for this I'm going to try this. Here are some of the issues I have been having. When I plug it in to charge it. It keeps trying to boot and will not stop. I have to press the power button to buy bypass an error message that says this device is corrupted. I just got this phone from qulink (Amazon) and it was doing this since I opened it. It will not update the system. I believe the boot issue may have something to do with it. I'm not sure what kind of bloat wear it has but I do know something is running rapidly in the back ground I have practically no battery life and charging it is a night near. Another important question is can I use a chrome book to do the procedure? Any input would be greatly appreciated.
Thanks
John Bridges
John Bridges said:
Thank you for this I'm going to try this. Here are some of the issues I have been having. When I plug it in to charge it. It keeps trying to boot and will not stop. I have to press the power button to buy bypass an error message that says this device is corrupted. I just got this phone from qulink (Amazon) and it was doing this since I opened it. It will not update the system. I believe the boot issue may have something to do with it. I'm not sure what kind of bloat wear it has but I do know something is running rapidly in the back ground I have practically no battery life and charging it is a night near. Another important question is can I use a chrome book to do the procedure? Any input would be greatly appreciated.
Thanks
John Bridges
Click to expand...
Click to collapse
Greetings @John Bridges. You have come to the right place. Sounds like you're stuck in a classic boot loop. Flashing the factory firmware offered in my guide should certainly restore your device to its stock factory state.
The firmware, unfortunately, does include the typical bloatware specific to QLink devices. Of course,, once you get your phone restored via firmware flashing, you can always opt to unlock your bootloader, achieve root and debloat tie stock OS. So, your best option may be to first restore your device by installing firmware, and then rooting.
Serrano Firmware Restoration Guide
Greetings Viva,
Thanks for the great response. I will try your great advice and respect you for dedicating you're time to help the Android epidemic.
John Bridges said:
Greetings Viva,
Thanks for the great response. I will try your great advice and respect you for dedicating you're time to help the Android epidemic.
Click to expand...
Click to collapse
Thank you for the kind words. The type of boot loop you are experiencing is caused from data corruption that occurs when Android decrypts the /userdata partition during the boot sequence. By default, Android encrypts all data on this partition for user security; as such, whenever your device boots up, Android decrypts the data to make it accessible. If any errors or data corruption are incurred during this process, you will be promoted to either try again or perform a factory data reset.
Sorry I just saw your reference to the Chromebook. I'm afraid it won't be much help on this. My guide focuses on a Windows setup; however, Linux or Max can also be used. Out of curiosity, have you first tried factory resetting the phone?
Yes I did still didn't help When I'd tried to start it a message would appear saying the device is court press power button to continue and it came out of the box with this problem. I tried to update it and several different errors would show up,one was something about OTA, Would it be possible to do the procedure with a chrome book?
John Bridges said:
Yes I did still didn't help When I'd tried to start it a message would appear saying the device is court press power button to continue and it came out of the box with this problem. I tried to update it and several different errors would show up,one was something about OTA, Would it be possible to do the procedure with a chrome book?
Click to expand...
Click to collapse
The device is court I mean.
Corrupt I mean
John Bridges said:
Corrupt I mean
Click to expand...
Click to collapse
I understand on the device being data corrupted. Firmware restoration is definitely your best option. I know of no way to flash firmware using a Chromebook. I'll research it and see if it can be done.
Okay I did find an XDA guide on utilizing ADB & fastboot on Chromebook. https://forum.xda-developers.com/t/...-chromeos-adb-fastboot.2157230/#post-38232908
However, even the developers who posted in that thread refer to the procedure as extremely complex.
@John Bridges have you had any luck with restoring your firmware via Chromebook?
For those members who detest the abundance of bloatware included in the factory firmware package, I have unpacked the super.img, removed a considerable amount of the QLink apps, services and other bloatware, and then repacked the super.img. I have removed the annoying QLink lock screen, the QLink "free WiFi" service, a number of the preinstalled Google apps, and some other RAM demanding apps & services. I've noticed a remarkable improvement in performance on my own device as a result of debloating the stock OS in this manner.
I will post a new thread this weekend with this debloated stock OS, and instructions for fastboot installation. You will need an unlocked bootloader to install it.
VivaI
I just haven't had time to do it yet I am anxious to do it however and I will let you know how it went for sure.
VivaI and others,
It is a shame that people like myself that have to get these government phones to have one or hacked and it's a great thing you all are doing to give us a phone that will be actually uncorrupted. I don't know if this matters but the phone I got was from Amazon and it is supposed to be unlocked I don't know if that means the bootlegger is unlocked or anything else but I thought it may be helpful to you to know this.
John Bridges said:
VivaI and others,
It is a shame that people like myself that have to get these government phones to have one or hacked and it's a great thing you all are doing to give us a phone that will be actually uncorrupted. I don't know if this matters but the phone I got was from Amazon and it is supposed to be unlocked I don't know if that means the bootlegger is unlocked or anything else but I thought it may be helpful to you to know this.
Click to expand...
Click to collapse
And I'm talking about the phone or the replacement phone you get from q Link it is supposed to be unlocked and it comes from Amazon I checked on it online.
John Bridges said:
And I'm talking about the phone or the replacement phone you get from q Link it is supposed to be unlocked and it comes from Amazon I checked on it online.
Click to expand...
Click to collapse
To the best of my knowledge -- but not confirmed 100% -- all variants of the Serrano are GSM unlocked. Mine originally came from Amazon as well. By unlocked, I am referring to network unlocked and not the bootloader.
Very nice to know! I'm going to try and get it done tomorrow.
John Bridges said:
Very nice to know! I'm going to try and get it done tomorrow.
Click to expand...
Click to collapse
If you have any questions, or if you encounter any obstacles during the procedure, just let me know.
Viva La Android said:
For those members who detest the abundance of bloatware included in the factory firmware package, I have unpacked the super.img, removed a considerable amount of the QLink apps, services and other bloatware, and then repacked the super.img. I have removed the annoying QLink lock screen, the QLink "free WiFi" service, a number of the preinstalled Google apps, and some other RAM demanding apps & services. I've noticed a remarkable improvement in performance on my own device as a result of debloating the stock OS in this manner.
I will post a new thread this weekend with this debloated stock OS, and instructions for fastboot installation. You will need an unlocked bootloader to install it.
Click to expand...
Click to collapse
Could you share the link to this thread please? The search function on this forum is frustrating and not turning up any relevant results and with your profile set to private I coludn't search for your threads either.
Crap nevermind, I just noticed I could pull up threads you created using the search function and looks like it hasnt been posted yet. Could you update this thread when it is?
GIutton said:
Could you share the link to this thread please? The search function on this forum is frustrating and not turning up any relevant results and with your profile set to private I coludn't search for your threads either.
Crap nevermind, I just noticed I could pull up threads you created using the search function and looks like it hasnt been posted yet. Could you update this thread when it is?
Click to expand...
Click to collapse
Not finalized. There are bugs to work out.
Anyone know why we can't modify, add, or remove files from the system partition using an app like root explorer? I wanted to change my bootanimation on my hot pepper serrano 3 and remove unwanted apps and files since i now have it rooted with magisk 25.2 but system partition seems to be read only at the moment. You can delete stuff from the system partition but they come back after a reboot. Same goes with modifying or adding anything in /system. You need to mention in the OP that we only have partial root not full root. Can anyone confirm this and is there a solution to this problem? Is it just me that is having this issue?
TLDR:
I bought a cheap Teclast P25T tablet with slim-to-no support for customization/modding/rooting/etc. I really would appreciate any help I could get and will be very responsive, listen intently, and be very descriptive in my feedback. I consider myself very tech-savvy, but I am no expert in coding/software modding/android modding/hacking in general. In fact, I would say I'm rather new to this realm, and that is why I have come to ask for help from THE BEST, the XDA community.
(Short) Device Specs and Options:
Manufacturer: Teclast
Model: P25T
ID: P9A6
USB debugging: Enabled
OEM unlocking: Enabled
Why I bought the Device:
I recently bought a new Android tablet rather impulsively I will admit, my purpose for the device was to disable the bootloader and root the tablet for fun, exploration, and ultimately boot a custom Linux operating system that has root privileges for providing defensive network security to prevent and identify threats on free local wifis. This is proving to be a significant challenge for a few reasons.
My Personal Objectives:
Unlock the bootloader
Gain superuser/root privileges
Install Kali and remove the current OS/ROM (not sure what it's called)
Spoiler: Current Project Status:
Current Project Status:
Found the manufacturer's official software/firmware download page: https://en.teclast.com/pages/firmwaredownload
The RevDev_Tool has a "config.ini" file with an option under [Language] for changing the software language.
Change "Selected=1" to "Selected=2"
*Note i have no idea how to use this tool and the tool was not able to identify my device was plugged in
Found the official youtube channel and a 5-year-old video where they show how to "flash" the device
Official page: https://www.youtube.com/@TeclastOfficial
Title: "Teclast Root Process for Android Tablet"
Multiple comments state that this video does not in fact show any actual rooting of the device shown, but rather a way to "flash"
The video shows software that does not appear to be in the manufacturer's firmware folder when I downloaded the files from the official firmware page. (I made sure to use my device "ID": P9A6)
The software in the video (SCP_Flash_Tool) I was able to track down: https://spflashtool.com/
I downloaded platform tools & SamFW_Tool
I can see the device under ./adb devices, but not ./fastboot devices
research indicates it's likely a driver issue.
I have attempted to solve the issue but am yet to do so, and now I likely need to uninstall drivers to get a clean install since I have several drivers installed.
./adb reboot bootloader
The device turns off, turns on to the booting screen, *stops* (I have waited up to 10 minutes)
I then need to turn the device on/off 3 times to get to boot up
Using SamFW Tool I rebooted into [FASTBOOT] Recovery and was greeted with the "No Command" text and the android on its back with the caution logo image that is common
Loading into custom boot settings via external buttons & factory reboot
nothing has worked that I have tried:
Turn device off, then hold volume down + Power, *device boots normally*
Turn the device off, hold both volume keys + plug it into the computer, *Device boots normally*
In settings, I was able to locate the Factory Reboot option and was able to reboot
The device loaded a custom reboot screen before loading into the user setup process
the device performed a factory reset successfully
Spoiler: (Long) Device Specs:
(Long) Device Specs: (SamFW Tool 4.6)
I (REDACTED) some of the info I believed to be private. let me know if any of this is relevant to assisting me.
Device information
Model : P25T_ROW
Brand : Teclast
Device name : P25T_Y_ROW
Product name : P25T_Y_ROW
CPU : rk30sdk
Platform : rk356x
CPU Arch : arm64-v8a
Serial number : (REDACTED)
Software information
Build : V1.00_20221212
Version : 20220914
Build date : Mon Dec 12 11:53:52 CST 2022
Fingerprint : Teclast/P25T_Y_ROW/P25T_Y_ROW:12/SQ1D.211205.016.A5/20220914:user/release-keys
Security patch : 2022-09-05
Android version : 12
Android SDK : 32
Device status
USB : mtp,adb
Timezone : Asia/Shanghai
Language : en-US
Device state : locked
Network type : Unknown
Android ID : (REDACTED)
Wifi Address : (REDACTED)
Root status
Shell SU : NO
Binary Magisk : NO
Binary SU : NO
App Magisk : NO
App SuperSU : NO
Spoiler: Developer Menu Screenshots:
Developer menu screenshots:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Comments:
Hello, XDA community, I am new to the forums and did my best to try to properly label my question thread, post in the correct forum, and provide relevant info in this description. If I should repost, or modify the thread to comply or better communicate my needs and question I would be more than happy to do so. I apologize if my terminology and knowledge make it difficult to understand what my needs are, but I will be carefully reviewing all replies and will make sure to take notes and incorporate all feedback into my understanding.
I'm not familiar with that device, sounds like a cheap Chinese knockoff.
Have you tried the standard ADB commands to unlock the bootloader?
If you haven't already, download SDK Platform Tools 33.0.3, you can find it here at the top of the thread. Do not use 34.x+ as there's some rather fatal issues.
Extract the Platform Tools folder, launch a command window in the folder (where you see adb.exe and fastboot.exe), connect your tablet via USB and run adb devices
If it has to start the daemon, simply run the command again, and ensure you've authorized ADB on your device (you should get a popup about authorizing the PC). You should see the serial number of your device appear under adb devices
Next, reboot to bootloader: adb reboot bootloader. If you can, post a photo of the screen with the serial number redacted. Try to command bootloader unlock: fastboot flashing unlock
You may also need to use fastboot flashing unlock-critical
You should get a message on the screen confirming you want to unlock the bootloader. Proceeding will wipe data.
Once the bootloader is unlocked, you would be able to flash custom images. The best way to root is to use Magisk; see these instructions. The easiest way will be to extract the factory firmware and look for boot.img; patch this in Magisk on the device, then reboot to bootloader again and flash the patched image to /boot.
V0latyle said:
I'm not familiar with that device, sounds like a cheap Chinese knockoff.
Have you tried the standard ADB commands to unlock the bootloader?
If you haven't already, download SDK Platform Tools 33.0.3, you can find it here at the top of the thread. Do not use 34.x+ as there's some rather fatal issues.
Extract the Platform Tools folder, launch a command window in the folder (where you see adb.exe and fastboot.exe), connect your tablet via USB and run adb devices
If it has to start the daemon, simply run the command again, and ensure you've authorized ADB on your device (you should get a popup about authorizing the PC). You should see the serial number of your device appear under adb devices
Next, reboot to bootloader: adb reboot bootloader. If you can, post a photo of the screen with the serial number redacted. Try to command bootloader unlock: fastboot flashing unlock
You may also need to use fastboot flashing unlock-critical
You should get a message on the screen confirming you want to unlock the bootloader. Proceeding will wipe data.
Once the bootloader is unlocked, you would be able to flash custom images. The best way to root is to use Magisk; see these instructions. The easiest way will be to extract the factory firmware and look for boot.img; patch this in Magisk on the device, then reboot to bootloader again and flash the patched image to /boot.
Click to expand...
Click to collapse
It is truly the CHEAPEST of the Chinese knockoffs . Regardless, I still spent $130 on the thing including the accessories and shipping. Also, I think there needs to be more documentation on how to mod these things even though its highly unadvised to purchase one lol. Also I'm just a stubborn SOB, so I want to try my best to crack this nut.
So yes, I had tried the standard adb commands. But I had not tried the specific version of Platform Tools you recommended until now. Here is some feedback on your reply.
Spoiler: Feedback and More info:
So I went and grabbed those Platform Tools to begin with then I launched Powershell from the Platform Tools directory. I first ran the "devices commands to see if I was able to fetch a device using "fastboot devices". Unfortunately I am still facing an issue with this device being assigned the wrong drivers. More on that below this image:
Then I ran the other suggested commands you provided:
Research indicates that the "< waiting for any device >" pause (even when device is connected) is a symptom of incorrect driver installations for the device in question. Specifically the "Android Bootloader Interface" model within the "android_winusb.inf" driver options.
Something odd about the device is that it is very determined to remain a "Portable Device"classification and even when I begin appending permissions from TrustedInstaller and deleting the non-windows drivers it remains in this classification. I have also tried uninstalling it from device manager, and from the printers and devices menu with no success of reassigning it as of yet.
Here are the specific drivers that are assigned to it currently:
As you will be reading this I am working to resolve this issue first. Until advised otherwise.
Updates on this process:
Driver Signature Enforcement has been disabled, pc rebooted with no effect for assigning "android_winusb.inf" adb drivers
Thank you for your time and consideration!
TheFuzzyFuzz said:
It is truly the CHEAPEST of the Chinese knockoffs . Regardless, I still spent $130 on the thing including the accessories and shipping. Also, I think there needs to be more documentation on how to mod these things even though its highly unadvised to purchase one lol. Also I'm just a stubborn SOB, so I want to try my best to crack this nut.
So yes, I had tried the standard adb commands. But I had not tried the specific version of Platform Tools you recommended until now. Here is some feedback on your reply.
Spoiler: Feedback and More info:
So I went and grabbed those Platform Tools to begin with then I launched Powershell from the Platform Tools directory. I first ran the "devices commands to see if I was able to fetch a device using "fastboot devices". Unfortunately I am still facing an issue with this device being assigned the wrong drivers. More on that below this image:
View attachment 5894161
Then I ran the other suggested commands you provided:
View attachment 5894163
Research indicates that the "< waiting for any device >" pause (even when device is connected) is a symptom of incorrect driver installations for the device in question. Specifically the "Android Bootloader Interface" model within the "android_winusb.inf" driver options.
Something odd about the device is that it is very determined to remain a "Portable Device"classification and even when I begin appending permissions from TrustedInstaller and deleting the non-windows drivers it remains in this classification. I have also tried uninstalling it from device manager, and from the printers and devices menu with no success of reassigning it as of yet.
View attachment 5894175
Here are the specific drivers that are assigned to it currently:
View attachment 5894179
As you will be reading this I am working to resolve this issue first. Until advised otherwise.
Updates on this process:
Driver Signature Enforcement has been disabled, pc rebooted with no effect for assigning "android_winusb.inf" adb drivers
Thank you for your time and consideration!
Click to expand...
Click to collapse
Yeah looks like you'd have to install the correct driver. ADB drivers are usually generic, fastboot drivers are device specific.
When you commanded the device to reboot to bootloader, what was on the device screen?
V0latyle said:
Yeah looks like you'd have to install the correct driver. ADB drivers are usually generic, fastboot drivers are device specific.
When you commanded the device to reboot to bootloader, what was on the device screen?
Click to expand...
Click to collapse
I get the standard boot screen, It stops on this screen and then does nothing. Also something else kind of weird is that it will refuse to boot back up if it is NOT plugged in to my computer. And even WEIRDER is that i have only been able to charge/data transfer with the factory cord it came with. Which is, concerning to say the least, and kind of perplexing:
Also, I think I just found the solution to the driver issue. I just need to figure out how to use this tool I found:
Device manager for Windows 10 / 8 / 7 / Vista / XP
DevManView is an alternative to the standard Device Manager of Windows, which displays all devices and their properties in flat table, instead of tree viewer.
www.nirsoft.net
It was recommended by this reference article:
Device Manager Alternative: 3 Picks You Didn't Know About
Looking for a device manager alternative? If so, explore our top three choices so you can have more variety next time you experience issues.
windowsreport.com