Database Info

Galaxy S6 Edge Partition Layout

Code:
cat /proc/partitions
major minor #blocks name
8 0 62480384 sda
8 1 4096 sda1
8 2 4096 sda2
8 3 20480 sda3
8 4 4096 sda4
8 5 4096 sda5
8 6 4096 sda6
8 7 8192 sda7
8 8 28672 sda8
8 9 34816 sda9
8 10 8192 sda10
8 11 77824 sda11
8 12 1024 sda12
8 13 1024 sda13
8 14 768 sda14
8 15 256 sda15
259 0 9216 sda16
259 1 15360 sda17
259 2 3829760 sda18
259 3 307200 sda19
259 4 46080 sda20
259 5 58060800 sda21
8 16 4096 sdb
8 32 4096 sdc
~ # ls -al dev/block/platform/15570000.ufs/by-name
ls -al dev/block/platform/15570000.ufs/by-name
drwxr-xr-x 2 root root 460 May 8 23:56 .
drwxr-xr-x 4 root root 560 May 8 23:56 ..
lrwxrwxrwx 1 root root 15 May 8 23:56 BOOT -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 May 8 23:56 BOTA0 -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 May 8 23:56 BOTA1 -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 May 8 23:56 CACHE -> /dev/block/sda19
lrwxrwxrwx 1 root root 16 May 8 23:56 CARRIER -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 May 8 23:56 DNT -> /dev/block/sda13
lrwxrwxrwx 1 root root 15 May 8 23:56 EFS -> /dev/block/sda3
lrwxrwxrwx 1 root root 16 May 8 23:56 OTA -> /dev/block/sda10
lrwxrwxrwx 1 root root 15 May 8 23:56 PARAM -> /dev/block/sda7
lrwxrwxrwx 1 root root 16 May 8 23:56 PERSDATA -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 May 8 23:56 PERSISTENT -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 May 8 23:56 RADIO -> /dev/block/sda11
lrwxrwxrwx 1 root root 15 May 8 23:56 RECOVERY -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 May 8 23:56 SBFS -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 May 8 23:56 STEADY -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 May 8 23:56 SYSTEM -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 May 8 23:56 TOMBSTONES -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 May 8 23:56 USERDATA -> /dev/block/sda21
lrwxrwxrwx 1 root root 15 May 8 23:56 m9kefs1 -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 May 8 23:56 m9kefs2 -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 May 8 23:56 m9kefs3 -> /dev/block/sda6
~ #

Thanks alot for this : ) Cant wait for people to start creating ROMs in this Forum

Can,someone pull the MODEM plz? I need a radio/baseband or whatever itvos,called that shows a,basand on the phone. Please and thank you. Also would like it in the form of a,md5 or twrp flaahable.

Verizon Pixel Your device is corrupt. Bootloop, locked bootloader, no recovery. Help?

OTA update failed, the phone spontaneously shut off and rebooted to the beautiful "Your device is corrupt. It can't be trusted and may not work properly." screen. After being greeted by said screen, the phone reboots and goes to the same screen. Recovery doesn't boot. Fastboot doesn't allow me to flash any image (even signed from google). If I boot into fastboot and do a "fastboot continue", the phone boots to a blank screen with adb running in recovery mode, but with the port closed (can't flash a recovery OTA).
Someone please help. I've tried all solutions I could think of. I don't know what is left.

Sounds like a trip to a Verizon store is in your future :/

mruno said:
Sounds like a trip to a Verizon store is in your future :/
Click to expand...
Click to collapse
Any chance Google themselves would be able to take care of this?

mruno said:
Sounds like a trip to a Verizon store is in your future :/
Click to expand...
Click to collapse
I wonder if the OP unlocked the bootloader and rooted. If so, they might not take too kindly to replacing the device. If it's stock then head there today and get a new one. How about a factory reset attempt?

bobby janow said:
I wonder if the OP unlocked the bootloader and rooted. If so, they might not take too kindly to replacing the device. If it's stock then head there today and get a new one. How about a factory reset attempt?
Click to expand...
Click to collapse
Impossible to factory reset. Recovery does not boot. Bootloader is locked, as fastboot flashing unlock returns as invalid.

dwegiel said:
Impossible to factory reset. Recovery does not boot. Bootloader is locked, as fastboot flashing unlock returns as invalid.
Click to expand...
Click to collapse
Recovery doesn't boot? Do you get the dead Android or something else?

PiousInquisitor said:
Recovery doesn't boot? Do you get the dead Android or something else?
Click to expand...
Click to collapse
Same "Your device is corrupt. It can't be trusted and may not work properly.", and recovery fails to boot. Nothing on the display, phone either shuts off or boots to charging mode.

dwegiel said:
Same "Your device is corrupt. It can't be trusted and may not work properly.", and recovery fails to boot. Nothing on the display, phone either shuts off or boots to charging mode.
Click to expand...
Click to collapse
What was your situation before this started? Unlocked? Rooted?
Edit: I see you were updating.

PiousInquisitor said:
What was your situation before this started? Unlocked? Rooted?
Edit: I see you were updating.
Click to expand...
Click to collapse
None of the above, stock Android OS.

dwegiel said:
Same "Your device is corrupt. It can't be trusted and may not work properly.", and recovery fails to boot. Nothing on the display, phone either shuts off or boots to charging mode.
Click to expand...
Click to collapse
Recovery is sometimes not easy to get in to. I had to do it 3 times in a row before I got it to take. So I'm sure you know it's hold the power button and then hit vol up. But if you don't get it just right it will reboot or turn off. Does adb work?

Ok so this is getting weirder by the second. Just saw a teamwin recovery screen pop up...
I purchased this device second hand and used it with no problems until the first update, but it definitely looks somewhat tampered with. Any advice?
This occurs when I perform a fastboot continue. At that point I have adb up in recovery mode. But since I see nothing on screen, I can do nothing. Can't sideload because it's not at the sideload screen. Suggestions?
EDIT: Okay, so I have a VERY basic adb shell up through TWRP. I can't access TWRP directly because it "hasn't started". Ideas?
EDIT2: adb shell has basic busybox commands and is running root. I have downloaded a new TWRP image. What is the partition where the pixel has its recovery? Under /dev/block/mmc....?

Can you get into bootloader?
Which slot is active?
Can you
Fastboot set_active _b
Or
Fastboot set_active _a
And try getting to recovery or booting?
Sent from my sailfish using XDA Labs

nednednerb said:
Can you get into bootloader?
Which slot is active?
Can you
Fastboot set_active _b
Or
Fastboot set_active _a
And try getting to recovery or booting?
Sent from my sailfish using XDA Labs
Click to expand...
Click to collapse
b slot is active. Will reboot now and (attempt to) switch to a. Found the appropriate fastboot by googling, please hold...
Code:
Setting current slot to 'a'...
(bootloader) Command is not supported.
(bootloader) Please unlock device to enable this command.
FAILED (remote failure)
finished. total time: 0.098s
What a surprise
Also to clear up, the only way for me to get thrown into this psuedo adb shell in TWRP is to "fastboot continue" at the fastboot screen. Recovery fails to boot. System fails to boot. Fastboot is useless because oem unlock is not possible.

Partition table dumped. Any ideas for where the recovery resides?
Side note: I have never ever seen this many partitions on any device. Ever.
Code:
# cat /proc/partitions
major minor #blocks name
8 16 4096 sdb
8 17 4052 sdb1
8 32 4096 sdc
8 33 4052 sdc1
8 48 49152 sdd
8 49 1024 sdd1
8 50 8 sdd2
8 51 32768 sdd3
8 52 128 sdd4
8 53 4 sdd5
8 54 4 sdd6
8 55 1024 sdd7
8 56 4 sdd8
8 57 2048 sdd9
8 58 2048 sdd10
8 59 1024 sdd11
8 60 4 sdd12
8 61 9020 sdd13
8 0 124866560 sda
8 1 512 sda1
8 2 512 sda2
8 3 512 sda3
8 4 512 sda4
8 5 2048 sda5
8 6 2048 sda6
8 7 512 sda7
8 8 512 sda8
8 9 512 sda9
8 10 512 sda10
8 11 512 sda11
8 12 512 sda12
8 13 256 sda13
8 14 256 sda14
8 15 256 sda15
259 0 256 sda16
259 1 4096 sda17
259 2 4096 sda18
259 3 32768 sda19
259 4 32768 sda20
259 5 32768 sda21
259 6 32768 sda22
259 7 128 sda23
259 8 128 sda24
259 9 71680 sda25
259 10 71680 sda26
259 11 256 sda27
259 12 256 sda28
259 13 256 sda29
259 14 256 sda30
259 15 307200 sda31
259 16 307200 sda32
259 17 2097152 sda33
259 18 2097152 sda34
259 19 119758848 sda35
259 20 4820 sda36
8 64 36864 sde
8 65 512 sde1
8 66 6144 sde2
8 67 4096 sde3
8 68 2048 sde4
8 69 16384 sde5
8 70 7636 sde6
8 80 8192 sdf
8 81 16 sdf1
8 82 256 sdf2
8 83 2048 sdf3
8 84 4 sdf4
8 85 5824 sdf5

Full partition table dumped:
Code:
lrwxrwxrwx 1 root root 16 Jan 1 13:41 aboot_a -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 Jan 1 13:41 aboot_b -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 Jan 1 13:41 apdp_a -> /dev/block/sda29
lrwxrwxrwx 1 root root 16 Jan 1 13:41 apdp_b -> /dev/block/sda30
lrwxrwxrwx 1 root root 15 Jan 1 13:41 board_info -> /dev/block/sdf1
lrwxrwxrwx 1 root root 16 Jan 1 13:41 boot_a -> /dev/block/sda19
lrwxrwxrwx 1 root root 16 Jan 1 13:41 boot_b -> /dev/block/sda20
lrwxrwxrwx 1 root root 15 Jan 1 13:41 bootlocker_a -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 Jan 1 13:41 bootlocker_b -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 Jan 1 13:41 cdt -> /dev/block/sdd12
lrwxrwxrwx 1 root root 16 Jan 1 13:41 cmnlib32_a -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 Jan 1 13:41 cmnlib32_b -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 Jan 1 13:41 cmnlib64_a -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 Jan 1 13:41 cmnlib64_b -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 Jan 1 13:41 ddr -> /dev/block/sdd11
lrwxrwxrwx 1 root root 16 Jan 1 13:41 devcfg_a -> /dev/block/sda23
lrwxrwxrwx 1 root root 16 Jan 1 13:41 devcfg_b -> /dev/block/sda24
lrwxrwxrwx 1 root root 15 Jan 1 13:41 devinfo -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 Jan 1 13:41 devinfobak -> /dev/block/sdd5
lrwxrwxrwx 1 root root 15 Jan 1 13:41 dip -> /dev/block/sdd7
lrwxrwxrwx 1 root root 15 Jan 1 13:41 dpo -> /dev/block/sdd6
lrwxrwxrwx 1 root root 15 Jan 1 13:41 frp -> /dev/block/sde1
lrwxrwxrwx 1 root root 15 Jan 1 13:41 fsc -> /dev/block/sdd8
lrwxrwxrwx 1 root root 15 Jan 1 13:41 fsg -> /dev/block/sdf3
lrwxrwxrwx 1 root root 16 Jan 1 13:41 hosd_a -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 Jan 1 13:41 hosd_b -> /dev/block/sda22
lrwxrwxrwx 1 root root 16 Jan 1 13:41 hyp_a -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 Jan 1 13:41 hyp_b -> /dev/block/sda12
lrwxrwxrwx 1 root root 15 Jan 1 13:41 keymaster_a -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 Jan 1 13:41 keymaster_b -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 Jan 1 13:41 metadata -> /dev/block/sde5
lrwxrwxrwx 1 root root 15 Jan 1 13:41 mfg -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 Jan 1 13:41 misc -> /dev/block/sdd1
lrwxrwxrwx 1 root root 16 Jan 1 13:41 modem_a -> /dev/block/sda25
lrwxrwxrwx 1 root root 16 Jan 1 13:41 modem_b -> /dev/block/sda26
lrwxrwxrwx 1 root root 15 Jan 1 13:41 modemst1 -> /dev/block/sdd9
lrwxrwxrwx 1 root root 16 Jan 1 13:41 modemst2 -> /dev/block/sdd10
lrwxrwxrwx 1 root root 16 Jan 1 13:41 msadp_a -> /dev/block/sda27
lrwxrwxrwx 1 root root 16 Jan 1 13:41 msadp_b -> /dev/block/sda28
lrwxrwxrwx 1 root root 15 Jan 1 13:41 persist -> /dev/block/sdd3
lrwxrwxrwx 1 root root 15 Jan 1 13:41 pg1fs -> /dev/block/sde3
lrwxrwxrwx 1 root root 15 Jan 1 13:41 pg2fs -> /dev/block/sde4
lrwxrwxrwx 1 root root 15 Jan 1 13:41 pmic_a -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 Jan 1 13:41 pmic_b -> /dev/block/sda10
lrwxrwxrwx 1 root root 15 Jan 1 13:41 ramdump -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 Jan 1 13:41 reserve0 -> /dev/block/sda36
lrwxrwxrwx 1 root root 16 Jan 1 13:41 reserve3 -> /dev/block/sdd13
lrwxrwxrwx 1 root root 15 Jan 1 13:41 reserve4 -> /dev/block/sde6
lrwxrwxrwx 1 root root 15 Jan 1 13:41 reserve5 -> /dev/block/sdf5
lrwxrwxrwx 1 root root 15 Jan 1 13:41 rpm_a -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 Jan 1 13:41 rpm_b -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 Jan 1 13:41 sec -> /dev/block/sdd4
lrwxrwxrwx 1 root root 15 Jan 1 13:41 ssd -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 Jan 1 13:41 system_a -> /dev/block/sda33
lrwxrwxrwx 1 root root 16 Jan 1 13:41 system_b -> /dev/block/sda34
lrwxrwxrwx 1 root root 15 Jan 1 13:41 tz_a -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 Jan 1 13:41 tz_b -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 Jan 1 13:41 userdata -> /dev/block/sda35
lrwxrwxrwx 1 root root 16 Jan 1 13:41 vendor_a -> /dev/block/sda31
lrwxrwxrwx 1 root root 16 Jan 1 13:41 vendor_b -> /dev/block/sda32
lrwxrwxrwx 1 root root 15 Jan 1 13:41 xbl_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 Jan 1 13:41 xbl_b -> /dev/block/sdc1

SUCCESS. Stock recovery boots.
Used the gimped TWRP adb shell to push aboot.img and boot.img from a stock rom. And dded them to the respective partitions, on the _b boot slots.

dwegiel said:
SUCCESS. Stock recovery boots.
Used the gimped TWRP adb shell to push aboot.img and boot.img from a stock rom. And dded them to the respective partitions, on the _b boot slots.
Click to expand...
Click to collapse
May I suggest unlocking the bootloader now that you have things going better for you?
Did you ever get the system to boot up?

Can't FRP is locked. Guess the FRP partition got screwed.

dwegiel said:
SUCCESS. Stock recovery boots.
Used the gimped TWRP adb shell to push aboot.img and boot.img from a stock rom. And dded them to the respective partitions, on the _b boot slots.
Click to expand...
Click to collapse
I have the same problem. I'm trying to follow your steps, but I'm lost
Currently, phone is on Boot-slot: b
Code:
fastboot set_active_a
usage: fastboot [ <option> ] <command>
doesn't do anything
sorry I'm noob. Please help.

azn6929 said:
I have the same problem. I'm trying to follow your steps, but I'm lost
Currently, phone is on Boot-slot: b
Code:
fastboot set_active_a
usage: fastboot [ <option> ] <command>
doesn't do anything
sorry I'm noob. Please help.
Click to expand...
Click to collapse
How do you have the same problem. You have a locked bootloader with TWRP?
Sent from my Pixel using Tapatalk
---------- Post added at 04:03 AM ---------- Previous post was at 04:01 AM ----------
Can you push full OTA image in stock recovery?
Sent from my Pixel using Tapatalk

[HELP][Surrendered :( ] Fix Or Decrypt /data in order to retrieve files

Hi,
My phone is stuck at boot stage where the rom logo animation (CrDroid rom) is animating, so no freeze. The phone never goes further than that.
I can boot into either bootloader, Fastboot (Secure boot: enabled, Lock State: unlocked) and recovery. I also have access to ADB/Fastboot from PC. I've managed to init a shell but /sdcard is empty
When I enter recovery (TWRP 3.3.1-hh), this is the content of recovery log/terminal:
Code:
[COLOR="Red"]Could not mount /data and unable to find crypto footer.
Failed to mount '/data' (Invalid argument)
Unable to recreate /data/media folder.
Failed to mount '/cache' (Invalid argument)[/COLOR]
Updating partition details...
[COLOR="Red"]Failed to mount '/data' (Invalid argument)
Failed to mount '/cache' (Invalid argument)[/COLOR]
...done
[COLOR="red"]Unable to mount storage
Failed to mount '/data' (Invalid argument)[/COLOR]
Full SELinux support is present.
[COLOR="red"]Unable to mount /data/media/TRWP/.twrps[/COLOR]
MTP Enabled
What solution do I have in order to retrieve my data? I think I encrypted the phone with a SIM PIN code, but I'm not sure because I do it sometimes when I flash a ROM, but this time I may have decided not to do it. I can't remember for sure. The other reason for my doubt is if I understand correctly, some recent versions of Android are forced encrypted, though I thought that was only valid for stock ROM which is not my case.
I found this topic (https://forum.xda-developers.com/oneplus-6/how-to/tutorial-decrypt-flash-rom-pie-oreo-roms-t3838643) that seems to describe a process in order to get encrypted files back by flashing a ROM, but it's for OnePlus6. Do you guys think this can work for me?
Help would be much appreciated.
Best regards,
Specs: Nexus 5 (LG-D821), TWRP 3.3.1-HH, crDroidAndroid-9.0-20191014-hammerhead-v5.8 (https://forum.xda-developers.com/google-nexus-5/development/rom-crdroid-v5-4-t3931587)
EDIT: I gave it up in the end

Bump,
Anyone that can help?

danoussh said:
Hi,
My phone is stuck at boot stage where the rom logo animation (CrDroid rom) is animating, so no freeze. The phone never goes further than that.
I can boot into either bootloader, Fastboot (Secure boot: enabled, Lock State: unlocked) and recovery. I also have access to ADB/Fastboot from PC. I've managed to init a shell but /sdcard is empty
When I enter recovery (TWRP 3.3.1-hh), this is the content of recovery log/terminal:
What solution do I have in order to retrieve my data? I think I encrypted the phone with a SIM PIN code, but I'm not sure because I do it sometimes when I flash a ROM, but this time I may have decided not to do it. I can't remember for sure. The other reason for my doubt is if I understand correctly, some recent versions of Android are forced encrypted, though I thought that was only valid for stock ROM which is not my case.
I found this topic (https://forum.xda-developers.com/oneplus-6/how-to/tutorial-decrypt-flash-rom-pie-oreo-roms-t3838643) that seems to describe a process in order to get encrypted files back by flashing a ROM, but it's for OnePlus6. Do you guys think this can work for me?
Help would be much appreciated.
Best regards,
Specs: Nexus 5 (LG-D821), TWRP 3.3.1-HH, crDroidAndroid-9.0-20191014-hammerhead-v5.8 (https://forum.xda-developers.com/google-nexus-5/development/rom-crdroid-v5-4-t3931587)
Click to expand...
Click to collapse
You can't decrypt files on n5.
There are 2 types of encryption:
FBE - File Based Encryption
FDE - Full Disk Encryption
We don't have fbe. When you press the encrypt button in Rom settings. You will get fde. I don't know crdroid but if you encrypted your disk, than sorry afaik no chance to rescue your files here. Go and start with formatting data partition or flash stock 6.0.1 and flash another rom again.

lulli1 said:
You can't decrypt files on n5.
There are 2 types of encryption:
FBE - File Based Encryption
FDE - Full Disk Encryption
We don't have fbe. When you press the encrypt button in Rom settings. You will get fde. I don't know crdroid but if you encrypted your disk, than sorry afaik no chance to rescue your files here. Go and start with formatting data partition or flash stock 6.0.1 and flash another rom again.
Click to expand...
Click to collapse
Thanks for the reply. I really hoped there was a way by installing a new rom above which would allow full disk encryption to be unlocked again.
EDIT: Before I give up, here is some extra info.
I can navigate through the TRWP file manager on system through folders, I see files and folders. Is that a clue that my phone is not full disk encrypted, or is full disk encrypted only for user data and the full system?
Also here is a dump I did via ADB shell.
Code:
~ # [6ncat /proc/partitions
major minor #blocks name
179 0 15388672 mmcblk0
179 1 65536 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 512 mmcblk0p3
179 4 512 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 2048 mmcblk0p7
179 8 1024 mmcblk0p8
179 9 512 mmcblk0p9
179 10 512 mmcblk0p10
179 11 512 mmcblk0p11
179 12 3072 mmcblk0p12
179 13 3072 mmcblk0p13
179 14 512 mmcblk0p14
179 15 16384 mmcblk0p15
179 16 16384 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 22528 mmcblk0p18
179 19 22528 mmcblk0p19
179 20 22528 mmcblk0p20
179 21 3072 mmcblk0p21
179 22 512 mmcblk0p22
179 23 512 mmcblk0p23
179 24 512 mmcblk0p24
179 25 1500000 mmcblk0p25
179 26 30720 mmcblk0p26
179 27 265375 mmcblk0p27
179 28 13404138 mmcblk0p28
179 29 5 mmcblk0p29
179 32 4096 mmcblk0rpmb
~ # [6n
------------------------------------------
~ # ls -la /dev/block/platform/msm_sdcc.1/by-name/[J
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
drwxr-xr-x 2 root root 620 Jan 5 21:43 .
drwxr-xr-x 4 root root 700 Jan 5 21:43 ..
lrwxrwxrwx 1 root root 21 Jan 5 21:43 DDR -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 20 Jan 5 21:43 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 Jan 5 21:43 abootb -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 Jan 5 21:43 boot -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Jan 5 21:43 cache -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 Jan 5 21:43 crypto -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 Jan 5 21:43 fsc -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 Jan 5 21:43 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 Jan 5 21:43 grow -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 Jan 5 21:43 imgdata -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 Jan 5 21:43 laf -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 Jan 5 21:43 metadata -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Jan 5 21:43 misc -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 20 Jan 5 21:43 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Jan 5 21:43 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 Jan 5 21:43 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 Jan 5 21:43 pad -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 Jan 5 21:43 persist -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 Jan 5 21:43 recovery -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 20 Jan 5 21:43 rpm -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 Jan 5 21:43 rpmb -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 20 Jan 5 21:43 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 Jan 5 21:43 sbl1b -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 Jan 5 21:43 sdi -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 Jan 5 21:43 ssd -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 Jan 5 21:43 system -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 20 Jan 5 21:43 tz -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Jan 5 21:43 tzb -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Jan 5 21:43 userdata -> /dev/block/mmcblk0p28
~ # [6n

I gave up and decided to reinstall android.
For those who may have trouble flashing because of /data not wanting to format, try to flash new TWRP recovery (latest one for your device.). You should be able to boot back into recovery and then you can format/wipe /data.

Use custom rom inside Android Emulator

Hi,
This is my first project that I'm currently working on.
I recently bought a android dashcam which UI I would like to change based on my personal preferences. Unfortunately I'm struggling to setup an environment where I can test the changes I make before replacing the original UI on the device itself. I identified the SystemUI.apk to be the place where the manufacturer made customization. I will be using the SystemUI.apk built from AOSP and making my changes based on that. I had no luck trying to decompile the SystemUI.apk in a way that I could build it again.
I was thinking that I could use an android emulator to use the same ROM as the device itself. The manufacturer did not provide any support in providing stock firmware images in any way. So I used the following steps to 'export' the firmware.
1. Unlocking the bootloader using the Identifier Token so I can flash images using fastboot. TWRP was not an option here because I could not find any images for my device nor could I port an TWRP image myself.
2. Enable ADB debugging over usb
3. Enable ADB root privileges using the password: 2846 (if i remember correctly)
4. Use ADB remount and ADB root to gain privileges over the partitions
5. Gain information on partition data
6. Use ADB pull to export images based on partitions
After following the above steps the next thing was to import the images into an emulator. I used the following steps to do this:
1. Create a new device within Android Studio that has the same screen size and os.
2. Replace the system.img, ramdisk.img with the exported variants in ~/Android/Sdk/../arm64-v8a
3. Turn off EncryptUserData inside advancedFeatures.ini to prevent errors like partitions that are unable to encrypt
4. Use the command below to start the emulator
Code:
~/Android/Sdk/emulator/emulator -avd Junsun_A104_API_27 -verbose -show-kernel
5. After running the emulator I receive the error below and the screen of the emulator stays black.
Code:
Please append a correct "root=" boot option; here are the available partitions:
fe00 2867200 vda driver: virtio_blk
fe10 67584 vdb driver: virtio_blk
fe20 819200 vdc driver: virtio_blk
fe30 409600 vdd driver: virtio_blk
fe40 524288 vde driver: virtio_blk
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
My assumption is that the emulator does not contain the same partition model used on the device. I could try to export each partition but I wouldn't know how to let the emulator know how to use these partitions. I tried to export the kernel and import it inside the emulator without luck. I did not receive any errors that way.
So my main question is:
- Is there any way I can import the device's rom inside an android emulator
Spoiler: Emulator Config
AvdId=Junsun_A104_API_27
PlayStore.enabled=false
abi.type=arm64-v8a
avd.ini.displayname=Junsun A104 API 27
avd.ini.encoding=UTF-8
disk.dataPartition.size=800M
fastboot.chosenSnapshotFile=
fastboot.forceChosenSnapshotBoot=no
fastboot.forceColdBoot=no
fastboot.forceFastBoot=yes
hw.accelerometer=yes
hw.arc=false
hw.audioInput=yes
hw.battery=yes
hw.camera.back=virtualscene
hw.camera.front=emulated
hw.cpu.arch=arm64
hw.cpu.ncore=4
hw.dPad=no
hw.device.hash2=MD5:7834f5e80eb849ceb46ce01cd4c704f7
hw.device.manufacturer=User
hw.device.name=Junsun A104
hw.gps=yes
hw.gpu.enabled=no
hw.gpu.mode=off
hw.initialOrientation=landscape
hw.keyboard=yes
hw.lcd.density=120
hw.lcd.height=320
hw.lcd.width=1480
hw.mainKeys=no
hw.ramSize=2560
hw.sdCard=yes
hw.sensors.orientation=yes
hw.sensors.proximity=yes
hw.trackBall=no
image.sysdir.1=system-images/android-27/default/arm64-v8a/
runtime.network.latency=none
runtime.network.speed=full
sdcard.size=512M
showDeviceFrame=no
skin.dynamic=yes
skin.name=1480x320
skin.path=_no_skin
skin.path.backup=/home/dangelo/Android/Sdk/skins/tv_1080p
tag.display=Default Android System Image
tag.id=default
vm.heapSize=48
Spoiler: Partition data
$ cat /proc/partitions
major minor #blocks name
1 0 8192 ram0
1 1 8192 ram1
1 2 8192 ram2
1 3 8192 ram3
1 4 8192 ram4
1 5 8192 ram5
1 6 8192 ram6
1 7 8192 ram7
1 8 8192 ram8
1 9 8192 ram9
1 10 8192 ram10
1 11 8192 ram11
1 12 8192 ram12
1 13 8192 ram13
1 14 8192 ram14
1 15 8192 ram15
254 0 1572864 zram0
179 0 30670848 mmcblk0
179 1 5120 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 35840 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 6144 mmcblk0p5
179 6 6144 mmcblk0p6
179 7 1024 mmcblk0p7
259 0 1024 mmcblk0p8
259 1 1024 mmcblk0p9
259 2 1024 mmcblk0p10
259 3 4096 mmcblk0p11
259 4 1024 mmcblk0p12
259 5 1024 mmcblk0p13
259 6 1024 mmcblk0p14
259 7 1024 mmcblk0p15
259 8 1024 mmcblk0p16
259 9 1024 mmcblk0p17
259 10 1024 mmcblk0p18
259 11 1024 mmcblk0p19
259 12 10240 mmcblk0p20
259 13 2048 mmcblk0p21
259 14 25600 mmcblk0p22
259 15 1024 mmcblk0p23
259 16 10240 mmcblk0p24
259 17 20480 mmcblk0p25
259 18 1024 mmcblk0p26
259 19 35840 mmcblk0p27
259 20 2867200 mmcblk0p28
259 21 153600 mmcblk0p29
259 22 409600 mmcblk0p30
259 23 1024 mmcblk0p31
259 24 1024 mmcblk0p32
259 25 27059183 mmcblk0p33
179 24 4096 mmcblk0rpmb
179 16 4096 mmcblk0boot1
179 8 4096 mmcblk0boot0
253 0 27059167 dm-0
output using the ls command with arguments that I forgot
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 boot -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 cache -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 fbootlogo -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 gpsbd -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 gpsgl -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_deltanv -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_fixnv1 -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_fixnv2 -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_gdsp -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_ldsp -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_modem -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_runtimenv1 -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_runtimenv2 -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 logo -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 misc -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 miscdata -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 persist -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 pm_sys -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 prodnv -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 recovery -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 sml -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 sml_bak -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 system -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 trustos -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 trustos_bak -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 uboot -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 uboot_bak -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 uboot_log -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 userdata -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vbmeta -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vbmeta_bak -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vendor -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 wcnmodem -> /dev/block/mmcblk0p20
Spoiler: Device information
Device name: Junsun A104
Android: 8.1. Oreo API level 27
CPU:
64bit
ARM64-V8A
Spreadtrum SC9832e
Memory: 2GB
Kernel architecture: aarch64
Kernel version: 4.4.83-00001-g213b4e3

dangelob said:
Hi,
This is my first project that I'm currently working on.
I recently bought a android dashcam which UI I would like to change based on my personal preferences. Unfortunately I'm struggling to setup an environment where I can test the changes I make before replacing the original UI on the device itself. I identified the SystemUI.apk to be the place where the manufacturer made customization. I will be using the SystemUI.apk built from AOSP and making my changes based on that. I had no luck trying to decompile the SystemUI.apk in a way that I could build it again.
I was thinking that I could use an android emulator to use the same ROM as the device itself. The manufacturer did not provide any support in providing stock firmware images in any way. So I used the following steps to 'export' the firmware.
1. Unlocking the bootloader using the Identifier Token so I can flash images using fastboot. TWRP was not an option here because I could not find any images for my device nor could I port an TWRP image myself.
2. Enable ADB debugging over usb
3. Enable ADB root privileges using the password: 2846 (if i remember correctly)
4. Use ADB remount and ADB root to gain privileges over the partitions
5. Gain information on partition data
6. Use ADB pull to export images based on partitions
After following the above steps the next thing was to import the images into an emulator. I used the following steps to do this:
1. Create a new device within Android Studio that has the same screen size and os.
2. Replace the system.img, ramdisk.img with the exported variants in ~/Android/Sdk/../arm64-v8a
3. Turn off EncryptUserData inside advancedFeatures.ini to prevent errors like partitions that are unable to encrypt
4. Use the command below to start the emulator
Code:
~/Android/Sdk/emulator/emulator -avd Junsun_A104_API_27 -verbose -show-kernel
5. After running the emulator I receive the error below and the screen of the emulator stays black.
Code:
Please append a correct "root=" boot option; here are the available partitions:
fe00 2867200 vda driver: virtio_blk
fe10 67584 vdb driver: virtio_blk
fe20 819200 vdc driver: virtio_blk
fe30 409600 vdd driver: virtio_blk
fe40 524288 vde driver: virtio_blk
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
My assumption is that the emulator does not contain the same partition model used on the device. I could try to export each partition but I wouldn't know how to let the emulator know how to use these partitions. I tried to export the kernel and import it inside the emulator without luck. I did not receive any errors that way.
So my main question is:
- Is there any way I can import the device's rom inside an android emulator
Spoiler: Emulator Config
AvdId=Junsun_A104_API_27
PlayStore.enabled=false
abi.type=arm64-v8a
avd.ini.displayname=Junsun A104 API 27
avd.ini.encoding=UTF-8
disk.dataPartition.size=800M
fastboot.chosenSnapshotFile=
fastboot.forceChosenSnapshotBoot=no
fastboot.forceColdBoot=no
fastboot.forceFastBoot=yes
hw.accelerometer=yes
hw.arc=false
hw.audioInput=yes
hw.battery=yes
hw.camera.back=virtualscene
hw.camera.front=emulated
hw.cpu.arch=arm64
hw.cpu.ncore=4
hw.dPad=no
hw.device.hash2=MD5:7834f5e80eb849ceb46ce01cd4c704f7
hw.device.manufacturer=User
hw.device.name=Junsun A104
hw.gps=yes
hw.gpu.enabled=no
hw.gpu.mode=off
hw.initialOrientation=landscape
hw.keyboard=yes
hw.lcd.density=120
hw.lcd.height=320
hw.lcd.width=1480
hw.mainKeys=no
hw.ramSize=2560
hw.sdCard=yes
hw.sensors.orientation=yes
hw.sensors.proximity=yes
hw.trackBall=no
image.sysdir.1=system-images/android-27/default/arm64-v8a/
runtime.network.latency=none
runtime.network.speed=full
sdcard.size=512M
showDeviceFrame=no
skin.dynamic=yes
skin.name=1480x320
skin.path=_no_skin
skin.path.backup=/home/dangelo/Android/Sdk/skins/tv_1080p
tag.display=Default Android System Image
tag.id=default
vm.heapSize=48
Spoiler: Partition data
$ cat /proc/partitions
major minor #blocks name
1 0 8192 ram0
1 1 8192 ram1
1 2 8192 ram2
1 3 8192 ram3
1 4 8192 ram4
1 5 8192 ram5
1 6 8192 ram6
1 7 8192 ram7
1 8 8192 ram8
1 9 8192 ram9
1 10 8192 ram10
1 11 8192 ram11
1 12 8192 ram12
1 13 8192 ram13
1 14 8192 ram14
1 15 8192 ram15
254 0 1572864 zram0
179 0 30670848 mmcblk0
179 1 5120 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 35840 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 6144 mmcblk0p5
179 6 6144 mmcblk0p6
179 7 1024 mmcblk0p7
259 0 1024 mmcblk0p8
259 1 1024 mmcblk0p9
259 2 1024 mmcblk0p10
259 3 4096 mmcblk0p11
259 4 1024 mmcblk0p12
259 5 1024 mmcblk0p13
259 6 1024 mmcblk0p14
259 7 1024 mmcblk0p15
259 8 1024 mmcblk0p16
259 9 1024 mmcblk0p17
259 10 1024 mmcblk0p18
259 11 1024 mmcblk0p19
259 12 10240 mmcblk0p20
259 13 2048 mmcblk0p21
259 14 25600 mmcblk0p22
259 15 1024 mmcblk0p23
259 16 10240 mmcblk0p24
259 17 20480 mmcblk0p25
259 18 1024 mmcblk0p26
259 19 35840 mmcblk0p27
259 20 2867200 mmcblk0p28
259 21 153600 mmcblk0p29
259 22 409600 mmcblk0p30
259 23 1024 mmcblk0p31
259 24 1024 mmcblk0p32
259 25 27059183 mmcblk0p33
179 24 4096 mmcblk0rpmb
179 16 4096 mmcblk0boot1
179 8 4096 mmcblk0boot0
253 0 27059167 dm-0
output using the ls command with arguments that I forgot
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 boot -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 cache -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 fbootlogo -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 gpsbd -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 gpsgl -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_deltanv -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_fixnv1 -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_fixnv2 -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_gdsp -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_ldsp -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_modem -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_runtimenv1 -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 l_runtimenv2 -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 logo -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 misc -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 miscdata -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 persist -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 pm_sys -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 prodnv -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 recovery -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 sml -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 sml_bak -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 system -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 trustos -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 trustos_bak -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2022-04-29 14:35 uboot -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 uboot_bak -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 uboot_log -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 userdata -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vbmeta -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vbmeta_bak -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 vendor -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 2022-04-29 14:35 wcnmodem -> /dev/block/mmcblk0p20
Spoiler: Device information
Device name: Junsun A104
Android: 8.1. Oreo API level 27
CPU:
64bit
ARM64-V8A
Spreadtrum SC9832e
Memory: 2GB
Kernel architecture: aarch64
Kernel version: 4.4.83-00001-g213b4e3
Click to expand...
Click to collapse
All you should need is the system.img and the kernel, then extract the system.img untill you find the /system/app and/or the /system/priv-app(whichever folder contains your UI.apk), extract a copy of the UI.apk. Then use APKtool to remove the signature on the apk file then decompile the apk file then make your modifications then recompile and re-sign the apk file. Then place the newly modified UI.apk in the system folder where you extracted it from(overwrite/delete the old version of the apk). Then compress all the files back into the system.img like it was originally and then try to use your newly modified system.img in your emulator.
Try using Bluestacks or one of the other leading android emulators instead of using Android Studio.

Rooting the Retroid Pocket 3+

So Retroid recently came out with the RP3+.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
-It runs Android 11
-Has an option in developer settings for OEM unlocking
-Easy access to adb and fastboot
AND you can run shell scripts as ROOT from within the settings.
For now I'm simply trying to make a backup boot.img
The typical command would be:
dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img
But the file does not exist.
Ive been able to run some basic scripts successfully from the run shell script as root option leading to a complete file list of everything on the system.
Here is a list of all the files in ./dev/block/
./dev/block./dev/block/loop27./dev/block/dm-13./dev/block/dm-12./dev/blo - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com
Any help with rooting this device or simply backing up the system would be greatly appreciated.

ApatheticEuphoria said:
So Retroid recently came out with the RP3+.
-It runs Android 11
-Has an option in developer settings for OEM unlocking
-Easy access to adb and fastboot
AND you can run shell scripts as ROOT from within the settings.
For now I'm simply trying to make a backup boot.img
The typical command would be:
dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img
But the file does not exist.
Ive been able to run some basic scripts successfully from the run shell script as root option leading to a complete file list of everything on the system.
Here is a list of all the files in ./dev/block/
./dev/block./dev/block/loop27./dev/block/dm-13./dev/block/dm-12./dev/blo - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com
Any help with rooting this device or simply backing up the system would be greatly appreciated.
Click to expand...
Click to collapse
It's always difficult when the firmware isn't readily available for download. But it sounds like you're on the right track - dump the boot image, patch in Magisk, unlock the bootloader, and flash the patched image for root.
Try this guide, it sounds like you just need to establish where the boot partition is mounted

V0latyle said:
It's always difficult when the firmware isn't readily available for download. But it sounds like you're on the right track - dump the boot image, patch in Magisk, unlock the bootloader, and flash the patched image for root.
Try this guide, it sounds like you just need to establish where the boot partition is mounted
Click to expand...
Click to collapse
Thank you very much for the guide. It is indeed a start.
Here are the results from Ways #1,2:
Code:
major minor #blocks name
1 0 8192 ram0
1 1 8192 ram1
1 2 8192 ram2
1 3 8192 ram3
1 4 8192 ram4
1 5 8192 ram5
1 6 8192 ram6
1 7 8192 ram7
1 8 8192 ram8
1 9 8192 ram9
1 10 8192 ram10
1 11 8192 ram11
1 12 8192 ram12
1 13 8192 ram13
1 14 8192 ram14
1 15 8192 ram15
7 0 888 loop0
7 1 24676 loop1
7 2 84832 loop2
7 3 5152 loop3
7 4 111128 loop4
7 5 1904 loop5
7 6 888 loop6
7 7 24676 loop7
7 8 6564 loop8
7 9 8608 loop9
7 10 5020 loop10
7 11 736 loop11
7 12 740 loop12
7 13 19040 loop13
7 14 18372 loop14
7 15 3784 loop15
254 0 2222624 zram0
259 0 64 pmem0
179 0 122142720 mmcblk0
179 1 10240 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 6144 mmcblk0p4
179 5 6144 mmcblk0p5
179 6 1024 mmcblk0p6
179 7 1024 mmcblk0p7
259 1 1024 mmcblk0p8
259 2 1024 mmcblk0p9
259 3 4096 mmcblk0p10
259 4 8192 mmcblk0p11
259 5 8192 mmcblk0p12
259 6 2048 mmcblk0p13
259 7 2048 mmcblk0p14
259 8 2048 mmcblk0p15
259 9 2048 mmcblk0p16
259 10 2048 mmcblk0p17
259 11 2048 mmcblk0p18
259 12 1024 mmcblk0p19
259 13 1024 mmcblk0p20
259 14 10240 mmcblk0p21
259 15 10240 mmcblk0p22
259 16 2048 mmcblk0p23
259 17 25600 mmcblk0p24
259 18 25600 mmcblk0p25
259 19 1024 mmcblk0p26
259 20 1024 mmcblk0p27
259 21 10240 mmcblk0p28
259 22 10240 mmcblk0p29
259 23 20480 mmcblk0p30
259 24 20480 mmcblk0p31
259 25 6144 mmcblk0p32
259 26 6144 mmcblk0p33
259 27 1024 mmcblk0p34
259 28 1024 mmcblk0p35
259 29 1024 mmcblk0p36
259 30 1024 mmcblk0p37
259 31 1024 mmcblk0p38
259 32 1024 mmcblk0p39
259 33 10240 mmcblk0p40
259 34 10240 mmcblk0p41
259 35 65536 mmcblk0p42
259 36 65536 mmcblk0p43
259 37 102400 mmcblk0p44
259 38 102400 mmcblk0p45
259 39 8192 mmcblk0p46
259 40 8192 mmcblk0p47
259 41 8192 mmcblk0p48
259 42 8192 mmcblk0p49
259 43 6500352 mmcblk0p50
259 44 102400 mmcblk0p51
259 45 76800 mmcblk0p52
259 46 76800 mmcblk0p53
259 47 25600 mmcblk0p54
259 48 25600 mmcblk0p55
259 49 1024 mmcblk0p56
259 50 1024 mmcblk0p57
259 51 16384 mmcblk0p58
259 52 10240 mmcblk0p59
259 53 1024 mmcblk0p60
259 54 1024 mmcblk0p61
259 55 1024 mmcblk0p62
259 56 1024 mmcblk0p63
259 57 1024 mmcblk0p64
259 58 1024 mmcblk0p65
259 59 1024 mmcblk0p66
259 60 1024 mmcblk0p67
259 61 1024 mmcblk0p68
259 62 1024 mmcblk0p69
259 63 1024 mmcblk0p70
259 64 1024 mmcblk0p71
259 65 8192 mmcblk0p72
259 66 8192 mmcblk0p73
259 67 16384 mmcblk0p74
259 68 16384 mmcblk0p75
259 69 114635759 mmcblk0p76
179 16 4096 mmcblk0boot1
179 8 4096 mmcblk0boot0
179 24 125173760 mmcblk1
179 25 125157376 mmcblk1p1
253 0 1266204 dm-0
253 1 370464 dm-1
253 2 1733700 dm-2
253 3 595004 dm-3
253 4 1160912 dm-4
253 5 113704 dm-5
253 6 1244960 dm-6
253 7 1246136 dm-7
253 8 364532 dm-8
253 9 1706256 dm-9
253 10 585532 dm-10
7 16 6084 loop16
7 17 84832 loop17
7 18 10184 loop18
7 19 5152 loop19
7 20 264 loop20
7 21 7948 loop21
7 22 4732 loop22
7 23 2812 loop23
7 24 111128 loop24
7 25 1904 loop25
7 26 3732 loop26
253 11 75508 dm-11
253 12 25116 dm-12
253 13 114635756 dm-13
7 27 153600 loop27
Code:
total 0
drwxr-xr-x 2 root root 1560 2023-01-11 05:33 .
drwxr-xr-x 3 root root 1640 2023-01-11 05:33 ..
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 avbmeta_rs_a -> /dev/block/mmcblk0p70
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 avbmeta_rs_b -> /dev/block/mmcblk0p71
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 boot_a -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 boot_b -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 cache -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 common_rs1_a -> /dev/block/mmcblk0p72
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 common_rs1_b -> /dev/block/mmcblk0p73
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 common_rs2_a -> /dev/block/mmcblk0p74
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 common_rs2_b -> /dev/block/mmcblk0p75
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 dtb_a -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 dtb_b -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 dtbo_a -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 dtbo_b -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 fbootlogo -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 gnssmodem_a -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 gnssmodem_b -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 hypervsior_a -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 hypervsior_b -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_agdsp_a -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_agdsp_b -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_cdsp_a -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_cdsp_b -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_deltanv_a -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_deltanv_b -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_fixnv1_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_fixnv1_b -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_fixnv2_a -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_fixnv2_b -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_gdsp_a -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_gdsp_b -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_ldsp_a -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_ldsp_b -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_modem_a -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_modem_b -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_runtimenv1 -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 l_runtimenv2 -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 logo -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 metadata -> /dev/block/mmcblk0p58
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 misc -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 miscdata -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 odmko_a -> /dev/block/mmcblk0p54
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 odmko_b -> /dev/block/mmcblk0p55
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 persist -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 pm_sys_a -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 pm_sys_b -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 prodnv -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 sml_a -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 sml_b -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 socko_a -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 socko_b -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 super -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 sysdumpdb -> /dev/block/mmcblk0p59
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 teecfg_a -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 teecfg_b -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 trustos_a -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 trustos_b -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 uboot_a -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 2023-01-11 05:33 uboot_b -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 uboot_log -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 userdata -> /dev/block/mmcblk0p76
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_a -> /dev/block/mmcblk0p56
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_b -> /dev/block/mmcblk0p57
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_odm_a -> /dev/block/mmcblk0p68
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_odm_b -> /dev/block/mmcblk0p69
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_product_a -> /dev/block/mmcblk0p66
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_product_b -> /dev/block/mmcblk0p67
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_system_a -> /dev/block/mmcblk0p60
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_system_b -> /dev/block/mmcblk0p61
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_system_ext_a -> /dev/block/mmcblk0p64
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_system_ext_b -> /dev/block/mmcblk0p65
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_vendor_a -> /dev/block/mmcblk0p62
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vbmeta_vendor_b -> /dev/block/mmcblk0p63
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vendor_boot_a -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 vendor_boot_b -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 wcnmodem_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 2023-01-11 05:33 wcnmodem_b -> /dev/block/mmcblk0p22

ApatheticEuphoria said:
Thank you. Its a start. Tried Way #1 and got some info. Way #2 isnt working (Removed the color code*)
Code:
major minor #blocks name
1 0 8192 ram0
1 1 8192 ram1
1 2 8192 ram2
1 3 8192 ram3
1 4 8192 ram4
1 5 8192 ram5
1 6 8192 ram6
1 7 8192 ram7
1 8 8192 ram8
1 9 8192 ram9
1 10 8192 ram10
1 11 8192 ram11
1 12 8192 ram12
1 13 8192 ram13
1 14 8192 ram14
1 15 8192 ram15
7 0 888 loop0
7 1 24676 loop1
7 2 84832 loop2
7 3 5152 loop3
7 4 111128 loop4
7 5 1904 loop5
7 6 888 loop6
7 7 24676 loop7
7 8 6564 loop8
7 9 8608 loop9
7 10 5020 loop10
7 11 736 loop11
7 12 740 loop12
7 13 19040 loop13
7 14 18372 loop14
7 15 3784 loop15
254 0 2222624 zram0
259 0 64 pmem0
179 0 122142720 mmcblk0
179 1 10240 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 6144 mmcblk0p4
179 5 6144 mmcblk0p5
179 6 1024 mmcblk0p6
179 7 1024 mmcblk0p7
259 1 1024 mmcblk0p8
259 2 1024 mmcblk0p9
259 3 4096 mmcblk0p10
259 4 8192 mmcblk0p11
259 5 8192 mmcblk0p12
259 6 2048 mmcblk0p13
259 7 2048 mmcblk0p14
259 8 2048 mmcblk0p15
259 9 2048 mmcblk0p16
259 10 2048 mmcblk0p17
259 11 2048 mmcblk0p18
259 12 1024 mmcblk0p19
259 13 1024 mmcblk0p20
259 14 10240 mmcblk0p21
259 15 10240 mmcblk0p22
259 16 2048 mmcblk0p23
259 17 25600 mmcblk0p24
259 18 25600 mmcblk0p25
259 19 1024 mmcblk0p26
259 20 1024 mmcblk0p27
259 21 10240 mmcblk0p28
259 22 10240 mmcblk0p29
259 23 20480 mmcblk0p30
259 24 20480 mmcblk0p31
259 25 6144 mmcblk0p32
259 26 6144 mmcblk0p33
259 27 1024 mmcblk0p34
259 28 1024 mmcblk0p35
259 29 1024 mmcblk0p36
259 30 1024 mmcblk0p37
259 31 1024 mmcblk0p38
259 32 1024 mmcblk0p39
259 33 10240 mmcblk0p40
259 34 10240 mmcblk0p41
259 35 65536 mmcblk0p42
259 36 65536 mmcblk0p43
259 37 102400 mmcblk0p44
259 38 102400 mmcblk0p45
259 39 8192 mmcblk0p46
259 40 8192 mmcblk0p47
259 41 8192 mmcblk0p48
259 42 8192 mmcblk0p49
259 43 6500352 mmcblk0p50
259 44 102400 mmcblk0p51
259 45 76800 mmcblk0p52
259 46 76800 mmcblk0p53
259 47 25600 mmcblk0p54
259 48 25600 mmcblk0p55
259 49 1024 mmcblk0p56
259 50 1024 mmcblk0p57
259 51 16384 mmcblk0p58
259 52 10240 mmcblk0p59
259 53 1024 mmcblk0p60
259 54 1024 mmcblk0p61
259 55 1024 mmcblk0p62
259 56 1024 mmcblk0p63
259 57 1024 mmcblk0p64
259 58 1024 mmcblk0p65
259 59 1024 mmcblk0p66
259 60 1024 mmcblk0p67
259 61 1024 mmcblk0p68
259 62 1024 mmcblk0p69
259 63 1024 mmcblk0p70
259 64 1024 mmcblk0p71
259 65 8192 mmcblk0p72
259 66 8192 mmcblk0p73
259 67 16384 mmcblk0p74
259 68 16384 mmcblk0p75
259 69 114635759 mmcblk0p76
179 16 4096 mmcblk0boot1
179 8 4096 mmcblk0boot0
179 24 125173760 mmcblk1
179 25 125157376 mmcblk1p1
253 0 1266204 dm-0
253 1 370464 dm-1
253 2 1733700 dm-2
253 3 595004 dm-3
253 4 1160912 dm-4
253 5 113704 dm-5
253 6 1244960 dm-6
253 7 1246136 dm-7
253 8 364532 dm-8
253 9 1706256 dm-9
253 10 585532 dm-10
7 16 6084 loop16
7 17 84832 loop17
7 18 10184 loop18
7 19 5152 loop19
7 20 264 loop20
7 21 7948 loop21
7 22 4732 loop22
7 23 2812 loop23
7 24 111128 loop24
7 25 1904 loop25
7 26 3732 loop26
253 11 75508 dm-11
253 12 25116 dm-12
253 13 114635756 dm-13
7 27 153600 loop27
Click to expand...
Click to collapse
So you just need to figure out which partition is /boot. There's a way to do this but I forget how.
I did find this on Stack Exchange:
Run find /dev -name 'by-name' 2>/dev/null to find the by-name directory. It should list one, though if there are a couple, it shouldn't be a problem and both should work.
Take the directory name and run ls -la <by-name-directory> (replacing the place holder with the actual directory name)
Find the name of the partition you are interested in - if you want just the kernel, the name is boot, or if your device has multiple slots, it is probably boot_a - and record the physical partition path listed for it. It should be something like /dev/block/mmcblk0p22 (this is on my Mi A1 device - if you have a different one, the number after "p" will be different and possibly even the number before "p").
Click to expand...
Click to collapse
There's also this guide. At least you're able to run shell as root, that's a huge advantage.

V0latyle said:
So you just need to figure out which partition is /boot. There's a way to do this but I forget how.
I did find this on Stack Exchange:
There's also this guide. At least you're able to run shell as root, that's a huge advantage.
Click to expand...
Click to collapse
Right?! I seen that as an option and just had to see what I could do with it.
So to see the partitions I put in
Code:
ls -al /dev/block/platform/soc/soc:ap-apb/71400000.sdio/by-name/ > /sdcard/info.txt
Saved as info.sh and ran from the run root script option.
(The output file will be stored in Internal Storage for whatever reason.)
To backup the boot images I put in
Code:
dd if=/dev/block/mmcblk0p42 of=/sdcard/boot_a.img
dd if=/dev/block/mmcblk0p43 of=/sdcard/boot_b.img
and again saved as getboot.sh and ran from the setting.
So according to this guide:
Patch Stock Boot Image via Magisk and Flash it using Fastboot
If you want to root your Android device then you can check out how to Patch Stock Boot Image via Magisk and Flash it using Fastboot method.
www.getdroidtips.com
It seems to have an A/B partition.
Ive backed up my boot.img files.
Patched them with Magisk.
They're ready to flash.
Code:
sending 'boot_a' (65536 KB)...
OKAY [ 1.478s]
writing 'boot_a'...
FAILED (remote: Flashing Lock Flag is locked. Please unlock it first!)
finished. total time: 1.498s
As expected.
To unlock Bootloader, I am hesitant to try anything yet.

With help from some kind and knowledgeable members of the official Discord I got the bootloader unlocked.
However they advised me NOT to flash the magisk patched boot.img until it is "resigned with avbtool to match what the keys are in vbmeta."
They said if I try and flash as is I will likely brick or get stuck in bootloop.
So I'll need help with that part. No idea how to do that.
Here's what I did to get the bootloader unlocked:
Back up Internal Storage (User data will be erased).
Install the drivers from here https://androiddatahost.com/dsa6h
Boot the RP3+ into the Bootloader by powering off the device, Pressing and holding the PWR and VOL + buttons until it boots to recovery and then select reboot to bootloader from the recovery options.
Connect the device to the PC and go to https://turtleletortue.github.io/subut-rehost/ on Google Chrome.
Click Connect.
Click "fastboot gadget" and connect.
Click Unlock.
On the device there will be a warning "Warning: Unlock device may erase user data. Press volume down button to confirm that. Press volume up button to cancel."
Press volume down.
Wait for it to complete.
Then reboot by pressing and holding PWR and Vol down.
There is a warning everytime I reboot but it goes away shortly and boots normally.

ApatheticEuphoria said:
With help from some kind and knowledgeable members of the official Discord I got the bootloader unlocked.
However they advised me NOT to flash the magisk patched boot.img until it is "resigned with avbtool to match what the keys are in vbmeta."
They said if I try and flash as is I will likely brick or get stuck in bootloop.
So I'll need help with that part. No idea how to do that.
Here's what I did to get the bootloader unlocked:
Back up Internal Storage (User data will be erased).
Install the drivers from here https://androiddatahost.com/dsa6h
Boot the RP3+ into the Bootloader by powering off the device, Pressing and holding the PWR and VOL + buttons until it boots to recovery and then select reboot to bootloader from the recovery options.
Connect the device to the PC and go to https://turtleletortue.github.io/subut-rehost/ on Google Chrome.
Click Connect.
Click "fastboot gadget" and connect.
Click Unlock.
On the device there will be a warning "Warning: Unlock device may erase user data. Press volume down button to confirm that. Press volume up button to cancel."
Press volume down.
Wait for it to complete.
Then reboot by pressing and holding PWR and Vol down.
There is a warning everytime I reboot but it goes away shortly and boots normally.
Click to expand...
Click to collapse
I have the regular RP3. Every time I try going into bootloader, it directs me straight to the RP3 boot and it stays that way till I press Boot again. Nothing happens.
A video on how to do it would be better.

If anyone knowledgeable could help me get avbtool installed properly on either Linux or Windows , it should be simple to get the keys from the vbmeta images and resign my patched boot images. I just need help with that part and I'll be rooted.

ApatheticEuphoria said:
If anyone knowledgeable could help me get avbtool installed properly on either Linux or Windows , it should be simple to get the keys from the vbmeta images and resign my patched boot images. I just need help with that part and I'll be rooted.
Click to expand...
Click to collapse
Do you think it is possible, by unlocking the boot, to install a custom firmware on the retroid pocket 3+ ? (JelOS, AmberElec, Batocera, etc.) ?

gremen said:
I have the regular RP3. Every time I try going into bootloader, it directs me straight to the RP3 boot and it stays that way till I press Boot again. Nothing happens.
A video on how to do it would be better.
Click to expand...
Click to collapse
I'm Sorry. I don't own an RP3 so the process may be different.
SoPlissken77 said:
Do you think it is possible, by unlocking the boot, to install a custom firmware on the retroid pocket 3+ ? (JelOS, AmberElec, Batocera, etc.) ?
Click to expand...
Click to collapse
Yes, Definitely.
----
Slowly trying to get avbtool working on my own. (Im honestly not very good at this stuff).
For now I'll share the code for extracting the vbmeta images:
dd if=/dev/block/mmcblk0p56 of=/sdcard/vbmeta_a.img
dd if=/dev/block/mmcblk0p57 of=/sdcard/vbmeta_b.img
Saved as getvbmeta.sh and ran from the run root script option.
(The output files will be stored in Internal Storage)

So I've been collaborating with OP on Discord and made a set of scripts to do the dirty work for me... I had to fix avbtool and make a script to extract the vbmeta keys automatically... as well as add a neat little wrapper!
They wanted me to make a full writeup but tbh I'm too lazy so I made a 1-click solution instead!... Now I'd say THIS is a worthy Valentines day gift!
GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and boot images for RP3+
A set of python scripts that will autosign modified vbmeta and boot images for RP3+ - GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and ...
github.com

ApatheticEuphoria said:
I'm Sorry. I don't own an RP3 so the process may be different.
Yes, Definitely.
----
Slowly trying to get avbtool working on my own. (Im honestly not very good at this stuff).
For now I'll share the code for extracting the vbmeta images:
dd if=/dev/block/mmcblk0p56 of=/sdcard/vbmeta_a.img
dd if=/dev/block/mmcblk0p57 of=/sdcard/vbmeta_b.img
Saved as getvbmeta.sh and ran from the run root script option.
(The output files will be stored in Internal Storage)
Click to expand...
Click to collapse
I really like the RP3+ but I find Android unsuitable for retrogaming. On the Retroid discord or the Reddit, there are many requests for a linux port or a dualboot

UPDATE: There is now a successful public root available for the RP3+
GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and boot images for RP3+
A set of python scripts that will autosign modified vbmeta and boot images for RP3+ - GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and ...
github.com
Make backups and use at your own risk.

ApatheticEuphoria said:
UPDATE: There is now a successful public root available for the RP3+
GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and boot images for RP3+
A set of python scripts that will autosign modified vbmeta and boot images for RP3+ - GitHub - skompc/retroid-pocket-3-plus-autoroot: A set of python scripts that will autosign modified vbmeta and ...
github.com
Make backups and use at your own risk.
Click to expand...
Click to collapse
Can you help me with the backups. Been trying to figure it out but having a tough time because I'm not great at linux

Irishdude5280 said:
Can you help me with the backups. Been trying to figure it out but having a tough time because I'm not great at linux
Click to expand...
Click to collapse
Try this:
[GUIDE] How to do a FULL low level backup of your Android Device
This Guide is simple and is straight the point, but is helpful and may come in handy for those who experience a hard-bricked phone or missing file in your phone like I did. Basically, nandroid is not a FULL backup, it only backs up your system...
forum.xda-developers.com
Rather than a terminal emulator you just save the command as backup.sh and run from within the handheld's run script as root setting.

ApatheticEuphoria said:
Try this:
[GUIDE] How to do a FULL low level backup of your Android Device
This Guide is simple and is straight the point, but is helpful and may come in handy for those who experience a hard-bricked phone or missing file in your phone like I did. Basically, nandroid is not a FULL backup, it only backs up your system...
forum.xda-developers.com
Rather than a terminal emulator you just save the command as backup.sh and run from within the handheld's run script as root setting.
Click to expand...
Click to collapse
I will give this a shot! Thank you I found all of the info you put here very helpful!

So I took a full system backup to my SD card using
dd if=/dev/block/mmcblk0 of=/mnt/media_rw/D873-812D/mmcblk0.img
saved as backupSD.sh
I am assuming that the mnt point "/mnt/media_rw/D873-812D/" is just for my SD but not sure on that, I found it by running OP's info.sh with the card mounted.
EDIT: thought about it and I actually might have found it by running mount command in termux. Been a long day sorry.
It made a .img of 125 GB, which seems to be a block level backup of the entire internal storage like I wanted. I extracted it with 7zip and see individual .img files for each of the partitions shown in the info.txt
Trying to extract those I get
Cannot open file as archive
Tried mounting them in WSL with
sudo mount -t drvfs V: /mnt/v To mount my windows drive where image is
sudo mount -o ro,loop /mnt/v/mmcblk0.img /mnt/android
mount: /mnt/android: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.
dmesg(1) may have more information after failed mount system call.
It honestly looks like it worked perfectly im just trying to figure out forsure i have a good backup before going forward. that is why I was trying to mount it somehow.
also ran OP's commands for backing up boot a and b and vbmeta a and b
So I am ready to try and root it just want some confidence in my backups first. Any thoughts would be appreciated.

Irishdude5280 said:
So I took a full system backup to my SD card using
dd if=/dev/block/mmcblk0 of=/mnt/media_rw/D873-812D/mmcblk0.img
saved as backupSD.sh
I am assuming that the mnt point "/mnt/media_rw/D873-812D/" is just for my SD but not sure on that, I found it by running OP's info.sh with the card mounted.
EDIT: thought about it and I actually might have found it by running mount command in termux. Been a long day sorry.
It made a .img of 125 GB, which seems to be a block level backup of the entire internal storage like I wanted. I extracted it with 7zip and see individual .img files for each of the partitions shown in the info.txt
Trying to extract those I get
Cannot open file as archive
Tried mounting them in WSL with
sudo mount -t drvfs V: /mnt/v To mount my windows drive where image is
sudo mount -o ro,loop /mnt/v/mmcblk0.img /mnt/android
mount: /mnt/android: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.
dmesg(1) may have more information after failed mount system call.
It honestly looks like it worked perfectly im just trying to figure out forsure i have a good backup before going forward. that is why I was trying to mount it somehow.
also ran OP's commands for backing up boot a and b and vbmeta a and b
So I am ready to try and root it just want some confidence in my backups first. Any thoughts would be appreciated.
Click to expand...
Click to collapse
Interesting. Thank you. I was wondering why it was saving files to internal storage and not the SD card. That seems to be the proper way to do it. As for why you can't extract the individual partitions, maybe it has something to do with 7zip, have you tried different software to explore the .img files? Maybe extract the main .img and then the partitions with something like Power ISO or WinRAR.

I tried your suggestion and PowerISO apparently likes adware so my AV blocked it. I threw the exe in Virus Total and it too says its full of Adware. WinRar by memory is full of adds for itself, tried it anyways with no luck.
I then found this https://www.sleuthkit.org/sleuthkit/ which is basically forensic tools for examining DD images from android devices. I was able to determine with those tools that the data is in fact there, but encrypted.
In theory a restore should still work if restored to the same device so I feel a little bit better, but still not sure i have a rock solid backup. Not even sure how I could verify at this point considering its encrypted
So did you successfully root your device? I want to try it but I am nervous without knowing if i can restore. One thing I wanted to clear up on too is with what I have read about devices with the a/b partitions, my understanding is I only need to patch 1 set of boot and vbmeta images right? Then I just flash the patched images to both the a and b partitions?

Full Root Guide for Retroid Pocket 3+
USE AT YOUR OWN RISK!!! I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR DEVICE!!! ALWAYS ENSURE YOU HAVE A BACKUP!!!
-----------------
1. Doing a full partition backup to your SD Card. (You'll need 128gb or greater)
To get the path to your SD enter the following command in a text editor and save as SDNAME.sh
Code:
ls /mnt/media_rw/ > /sdcard/SDNAME.txt
To run the script, copy the .sh file to your RP3+, go to the Settings of your device, then Handheld Settings > Advanced > Run Script as Root. Navigate to the .sh file and run it.
The SDNAME.txt will be found on Internal Storage.
The output should be in this format: ####-####
Next enter the following command in a text editor and save as BACKUP.sh
Code:
dd if=/dev/block/mmcblk0 of=/mnt/media_rw/####-####/backup.img
Replace ####-#### with the result from SDNAME.txt
To run the script, copy the .sh file to your RP3+, go to the Settings of your device, then Handheld Settings > Advanced > Run Script as Root. Navigate to the .sh file and run it.
The recovery image will be saved as backup.img on your SD Card and will include ALL partitions of the RP3+.
-----------------
2. Unlocking the bootloader.
On your Windows PC go to:
https://androiddatahost.com/wp-content/uploads/SPD_Driver_R4.20.4201.zip
Download and extract the zip file and Install the driver specific to your OS.
Power off your RP3+.
Press and hold the POWER and VOLUME UP buttons until it boots to recovery mode.
Select reboot to bootloader from the recovery options.
Connect the device to the PC and go to:
Spreadtrum / Unisoc Bootloader Unlock Tool
on Google Chrome.
Click Connect.
Click "fastboot gadget" and connect.
Click Unlock.
On the device there will be a warning:
"Warning: Unlock device may erase user data. Press volume down button to confirm that. Press volume up button to cancel."
Press volume down.
Wait for it to complete. It may take awhile so be patient and do not interrupt the process*
When its complete reboot by pressing and holding POWER and VOLUME DOWN.
There is a warning everytime you reboot now but it goes away shortly and boots normally.
-----------------
3. Dumping your boot_a and vbmeta_a partitions.
Enter the following commands in a text editor and save as getbootandvbmeta.sh
Code:
dd if=/dev/block/mmcblk0p42 of=/sdcard/boot_a.img
dd if=/dev/block/mmcblk0p56 of=/sdcard/vbmeta_a.img
To run the script, copy the .sh file to your RP3+, go to the Settings of your device, then Handheld Settings > Advanced > Run Script as Root. Navigate to the .sh file and run it.
The boot_a.img and vbmeta_a.img files will be stored on Internal Storage.
-----------------
4. Patching the boot_a.img file with Magisk.
Go to:
Releases · topjohnwu/Magisk
The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.
github.com
Scroll down to Assets and download, then install the latest Magisk.apk
Open Magisk.
Tap "Install" Next to Magisk at the top.
Tap "Select and Patch a File"
Navigate to your boot_a.img file and tap it.
Tap "LET'S GO -->"
The patched boot_a.img file will have an output similar to magisk_patched-26000_Lf8IC.img and will be stored in the Download directory on Internal Storage.
-----------------
5. Resigning the keys for boot_a.img and vbmeta_a.img
Boot up a 64-bit Linux OS.
Open a terminal and enter:
Code:
git clone https://github.com/skompc/retroid-pocket-3-plus-autoroot
Navigate to the downloaded retroid-pocket-3-plus-autoroot folder.
Right click patch.sh and go to properties.
Click Permissions.
Change Access to Read & Write for all.
Tick the "Allow this file to run as a program" box
Click Close.
Open a browser and go to:
https://repo.anaconda.com/archive/Anaconda3-2023.03-Linux-x86_64.sh
To download Anaconda3.
Go to your downloads folder, Right click Anaconda3-2023.03-Linux-x86_64.sh and click properties.
Click Permissions.
Change Access to Read & Write for all.
Tick the "Allow this file to run as a program" box
Click Close.
Right click in the Download folder and Click "Open Terminal Here".
Drag Anaconda3-2023.03-Linux-x86_64.sh into the terminal and press Enter.
Press Enter to review the license agreement. Then press and hold Enter to scroll.
When you see ( END ) type yes then yes again.
Press Enter to Install Anaconda3 to your root directory.
The installer prompts you to choose whether to initialize Anaconda Distribution by running conda init. Anaconda recommends entering “yes”.
The installer finishes and displays, “Thank you for installing Anaconda3"
Connect your RP3+ to the system and copy your vbmeta_a.img and magisk_patched-26000_Lf8IC.img files to the retroid-pocket-3-plus-autoroot directory on your Linux OS.
Rename vbmeta_a.img to vbmeta.img
Rename magisk_patched-26000_Lf8IC.img to magisk.img
Right click in the retroid-pocket-3-plus-autoroot folder and Click "Open Terminal Here".
Drag patch.sh into the Terminal and press Enter.
"Extracting keys from vbmeta
Creating custom key for boot
Creating custom vbmeta and signing
Signing magisk.img
DONE!!!
Press any key to continue"
Press the Any Key.
-----------------
6. Flashing the Signed Images.
Copy the vbmeta_custom.img and magisk.img files over to your Windows OS.
Download and extract Minimal adb and fastboot:
Minimal ADB and Fastboot
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com
Run openCMDhere.bat
Power off your RP3+.
Press and hold the POWER and VOLUME UP buttons until it boots to recovery mode.
Select reboot to fastboot/bootloader from the recovery options.
Connect the RP3+ to your PC.
On the CMD Terminal, Enter:
Code:
fastboot devices
You should see the device listed.
To flash the 4 necessary boot and vbmeta partitions enter the following commands:
Code:
fastboot flash vbmeta_a /YOUR PATH HERE/vbmeta_custom.img
Code:
fastboot flash vbmeta_b /YOUR PATH HERE/vbmeta_custom.img
Code:
fastboot flash boot_a /YOUR PATH HERE/magisk.img
Code:
fastboot flash boot_b /YOUR PATH HERE/magisk.img
Code:
fastboot reboot
-----------------
You now have Magisk ROOT!!!
!!!!WARNINGS!!!!
NEVER UPDATE MAGISK THROUGH THE APP! ALWAYS REPATCH YOUR ORIGINAL BOOT IMAGE!
IF BY ANY CHANCE YOU RECEIVE A PROMPT TO DO AN OTA UPDATE, DON'T DO IT! YOU WILL BOOTLOOP! (Go into settings and disable all automatic updates, Enable Developer options and Disable OTA updates)
MAKE SURE TO HAVE MULTIPLE BACKUPS ON HAND IN CASE OF A BRICK! WHILE SOMEONE IS MAKING AN UNBRICKING TOOL IT WILL NOT WORK WITHOUT BACKUPS!
-----------------
Credits to skompc AKA SquirrelHurtz AKA u/FoxyCatDogThing for the avb patch script.
Credits to Turtle and hartleysch for the bootloader unlock.
Credits to ApatheticEuphoria for the comprehensive guide.