Database Info

[GUIDE] Rooting the UMIDIGI F2 | Magisk | TWRP

This is an attempt at rooting the UMIDIGI F2. Caution be advised, we are not responsible for your mistakes; but rest assured, most of them can be corrected.
Rooting the F2
Disclaimers
This is important, please read thoughtfully.
whatever you do, never ever use SP Flash Tool in "Format All+Download" mode. This will wipe your IMEIs and some other bad stuff will happen like loss of fingerprint sensor. This cannot be reversed by us.
Once bootloader is unlocked, warranty is considered void. By following this guide, you consent to that happening. Safety net CTS will not pass anymore unless you flash Magisk which hides the unlocked bootloader.
Never relock your bootloader while running anything unofficial as the phone will not boot until you unlock again.
And, once again, a lot of bad things can happen like bootloops, if that happens to you don't freak out and reflash stock, redoing the rooting process from the start. It might be time consuming, but that's your safest bet!
More important even, have fun rooting, it's before all a hobby!
Various Resources
>>> Latest official stock ROM <<<
Minimal ADB and Fastboot by shimp208
> Magisk (and Manager) by topjohnwu <
Mediatek SP Flash Tool
Latest unofficial TWRP
Unlocking Bootloader
ATTENTION!! After unlocking the bootloader, all user data in the phone's memory will be lost, so do not forget to throw all the most important things on your computer or flash drive!
1) Activate "Developer options" through Settings > About Phone > Tap Build Number multiple times.
2) Open "Developer options" in Settings > System > Tap Advanced.
Enable "OEM Unlocking" and enter your password to confirm. Enable "USB Debugging" as well.
3) On Windows, download and install Minimal ADB and Fastboot by shimp208
On Linux, use your packet manager to install android-tools-adb and android-tools-fastboot
4) Open command prompt (Win + R > type cmd) or a terminal on linux.
5) Plug your phone, accept the prompt about adb and the PC signature.
6) Type adb reboot bootloader to reboot in fastboot mode.
THESE NEXT TWO STEPS WILL COMPLETELY WIPE YOUR DATA
7) Unlock the bootloader using fastboot flashing unlock and pressing Vol+
8) Unlock the secure partitions using fastboot flashing unlock_critical and pressing Vol+
9) Restart using fastboot reboot
You will now always see "Orange State" at boot; this is completely fine and will only delay your boot by 5 seconds.
Rooting using Magisk patched boot.img
This is "experimental" and is probably overkill, but everyone managed to install Magisk with it.
1) Clean install UMIDIGI_F2_V1.0_20200106.V3.08 with SPFT by selecting the scatter file, pressing download an rebooting the phone (Make sure it is in "Download Mode" and not "Format + Download")
2) Patch boot.img by copying it to your device, using Magisk Manager to patch it, and get back the magisk_patched.img in the Download folder back to your PC.
3) Start ADB while booted; run adb reboot bootloader. Alternative is to reboot to recovery and selecting "reboot to bootloader"
4) unlock if not already done with fastboot flashing unlock followed by fastboot flashing unlock_critical
You can try without --disable-verity --disable-verification if those commands are not recognized. I have not tested without them.
6) fastboot --disable-verity --disable-verification flash boot magisk_patched.img
7) fastboot --disable-verity --disable-verification flash recovery recovery.img (recovery.img from stock)
8) fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img (vbmeta.img from stock)
9) fastboot reboot
When rebooting, install Magisk Manager. It will prompt to finalize the installation, you can do so.
Congratulations ! You are now a proud Magisk user ! All credits goes to @topjohnwu he's the real MVP here.
Returning to stock / Resolving issues
The best way to resolve any issue is to return to stock. Here is the method.
1) Download latest stock ROM ("SPFT .zip") on UMIDIGI's forums
2) Download SP Flash Tool if you don't have it yet (Windows only)
3) Extract stock ROM in SP Flash Tool directory
4) Open SP Flash Tool, Download Tab, "Choose" in Scatter-loading file, select the scatter file in the stock ROM directory.
5) If you want to keep your data, untick "userdata" partition
6) Press Download and connect your device via USB. Reboot the phone or turn it off and everything will be flashed.
7) If you want a full stock experience, I recommend relocking the bootloader so that SafetyNet will pass. Get into fastboot mode by using adb reboot bootloader and use fastboot flashing lock_critical followed by fastboot flashing lock. This will wipe your data once more.
You should be good to go.
TWRP
Device Tree
>> Download my latest build here <<
Flash in Bootloader mode with fastboot flash recovery twrp_f2.img
Android 10 and TWRP aren't compatible yet. /system and /vendor cannot be mounted. /data partition is encrypted. You can still flash .img and some zips that alter different partitions. Nothing I can do about it.
Misc
Different boot modes
Recovery / TWRP :
Turn off the phone (or reboot)
Press Vol+ and Power until some choice comes up to you
Navigate using Vol+, select Recovery Mode using Vol-
Bootloader mode :
Boot into TWRP, select Reboot, Bootloader
Or use adb reboot bootloader either in recovery or system
Or use fastboot reboot-bootloader in fastboot mode
Magisk and EdXposed
Fixing Magisk bootloop
Two techniques that could work after installing a module that broke everything :
Hook your device up to a computer (or other device you can run adb from) and execute the following command:
adb wait-for-device shell magisk --remove-modules
After that you can start your device and as soon as adb is available the command will activate, the modules will be removed and the device will reboot.
Click to expand...
Click to collapse
-----
You could also try :
If you can't boot your device, this can be done by placing a file in /cache (/data/cache on A/B devices) named ".disable_magisk" (without quotation marks and with the leading dot). This will enable Core Only Mode and you can boot up your device, uninstall the troublesome module and then go into the Manager settings, disable Core Only Mode and reboot. In TWRP you can create the file through the TWRP terminal with the touch command, see below for an example.
Click to expand...
Click to collapse
Installing EdXposed
Please use the latest YAHFA or Sandhook canary build. I have a report of Xposed-SandHook-v0.4.6.1 (4504)-tdgptedc-release working.

_cab13_ said:
This is an attempt at rooting the UMIDIGI F2. For now, unsuccessful. Any help would be appreciated!
Click to expand...
Click to collapse
ATTENTION!! After unlocking the bootloader, all user data in the phone's memory will be lost, so do not forget to throw all the most important things on your computer or flash drive!
1) Activate the "for developers" item in the settings (7 times click on the "build number" in the "about phone" settings at the bottom)
2) Go to "Settings"(the main screen of the application) go to "for developers" and move the switches to the enabled position near the items "USB Debugging" and " Unlocking the bootloader"
3) Then download platform tools from here https://developer.andr...eleases/platform-tools
4) Unpack the archive from platform tools to the root of the C: drive(so that the platform-tools folder is in the root of the C drive: )
5) if the process does not go install VCOM driver
6) Switch your smartphone to fastboot mode:
6.1) connect the included phone to the computer
6.2) Open the command prompt
6.2.1) Click Win+R
6.2.2) in the window that appears, write "cmd" and click " OK"
6.3) in the command line when the phone is turned on, write(without quotes)
6.3.1) " cd " (note that there is a space after "cd") and drag the "platform-tools" folder with the cursor to the command line window, press Enter
6.3.2) the Following command "adb reboot bootloader"
6.3.3) Your phone should reboot into Fastboot mode or a window should appear on the phone asking for debugging permission for this computer - put a check mark "Always allow debugging from this computer" and click "OK", repeat point 6.3.2
7) After that, on the computer in the same command line, enter " fastboot flashing unlock"
8) when the smartphone screen will prompt confirm by pressing vol+
9) after you see Finished, restart your device
Now the logo will be labeled Orange state when loading

I've rooted my F2. I used magisk to patch the boot.img then flashed the boot.img through fastboot on Linux. It didn't work with magisk 20.1. Had to used the newest magisk manager. I am interested in your twrp if you have one to try. Would you upload it so I may try to flash it.

Please upload your patched boot.img file. Thanks

I would love to have that boot image as well! What magisk version did you use then ? I can start crafting a guide.
EDIT: what boxes did you tick in Magisk Manager ?
EDIT 2: did you pad the boot image with DD ? Or maybe you wiped the boot partition beforehand to make it all zeroes ? It seems to be the missing thing and a known bug in Magisk.

Magisk 20.2 was what I used. Then flashed the boot through fastboot using Debian Linux.
Rooted f2 boot IMG

I've tried everything to get it rooted but any magisk patched boot image I flash just sends it into a bootloop including the one posted in this thread. It doesn't matter whether I flash it in Linux or Windows, in fastboot or in SP Flash Tool. What stock build are you guys on, the European or the Global? It seems that the boot.img is the same in both.

Apparently the issue is that the bootloader really doesn't like the fact that the image is not the full size of the partition. I'll try to dd it to the "max" size so it completely replaces the boot image and not only parts of it.

Seems to be an issue with the bootloader which doesn't like being flashed with a smaller boot image than it's partition size. Could you try padding it ? https://github.com/topjohnwu/Magisk/issues/2005
With this command
Code:
dd if=/dev/zero of=magisk_patched.img bs=1 count=1 seek=33554431
EDIT: Double post, my internet is pretty bad, I thought the first one didn't go. Can't delete apparently.

When I unlocked the bootloader I also unlocked critical areas
fastboot flashing unlock_critical
Warning---- this will wipe your phone again just like the bootloader unlock.

Haha seems to be the key to it ! Thanks for the update !

I've tried everything as well. Still bootloop. Your patched image doesn't work for me. I've unlocked critical as well as regular unlock.
1. Did you tick any box in Magisk Manager ?
2. Did you relock afterwards ?
3. What firmware version ?

I downloaded the new update today and I haven't been able to root the boot.IMG so far. I will keep trying and note anything that is successful.

GOOD NEWS ! I managed to make it work, I don't really know how, but I now have Magisk 20.2 installed. Here is what I did.
1) Clean install UMIDIGI_F2_V1.0_20200106.V3.08 with SPFT
2) Download the f2rootedboot file from zironia
3) Start ADB while booted; run adb reboot bootloader
4) unlock if not already done with fastboot flashing unlock followed by fastboot flashing unlock_critical
5) I flashed a bunch of partitions with dm-verity disabled.
6) fastboot --disable-verity --disable-verification flash boot f2rootedboot.img
7) fastboot --disable-verity --disable-verification flash recovery recovery.img
8) fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
9) fastboot --disable-verity --disable-verification flash super super.img
10) fastboot --disable-verity --disable-verification flash tee1 tee.img
11) fastboot --disable-verity --disable-verification flash tee2 tee.img
12) fastboot --disable-verity --disable-verification flash cache cache.img
13)/!\ WILL RESET DATA : fastboot --disable-verity --disable-verification flash userdata userdata.img
13) fastboot reboot
I'm really not sure if you really need all that hassle, but that made it work for me. PLEASE USE FASTBOOT FROM BOOTLOADER (adb reboot bootloader, or choose "Reboot in Bootloader" in recovery / fastbootd)

_cab13_ said:
GOOD NEWS ! I managed to make it work, I don't really know how, but I now have Magisk 20.2 installed. Here is what I did.
1) Clean install UMIDIGI_F2_V1.0_20200106.V3.08 with SPFT
2) Download the f2rootedboot file from zironia
3) Start ADB while booted; run adb reboot bootloader
4) unlock if not already done with fastboot flashing unlock followed by fastboot flashing unlock_critical
5) I flashed a bunch of partitions with dm-verity disabled.
6) fastboot --disable-verity --disable-verification flash boot f2rootedboot.img
7) fastboot --disable-verity --disable-verification flash recovery recovery.img
8) fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
9) fastboot --disable-verity --disable-verification flash super super.img
10) fastboot --disable-verity --disable-verification flash tee1 tee.img
11) fastboot --disable-verity --disable-verification flash tee2 tee.img
12) fastboot --disable-verity --disable-verification flash cache cache.img
13)/!\ WILL RESET DATA : fastboot --disable-verity --disable-verification flash userdata userdata.img
13) fastboot reboot
I'm really not sure if you really need all that hassle, but that made it work for me. PLEASE USE FASTBOOT FROM BOOTLOADER (adb reboot bootloader, or choose "Reboot in Bootloader" in recovery / fastbootd)
Click to expand...
Click to collapse
This worked for me to reroot after the update today. Not sure what part of it is necessary for the boot image to work right though. I left off the userdata.img so I could keep my files in place.

_cab13_ said:
GOOD NEWS ! I managed to make it work, I don't really know how, but I now have Magisk 20.2 installed. Here is what I did.
1) Clean install UMIDIGI_F2_V1.0_20200106.V3.08 with SPFT
2) Download the f2rootedboot file from zironia
3) Start ADB while booted; run adb reboot bootloader
4) unlock if not already done with fastboot flashing unlock followed by fastboot flashing unlock_critical
5) I flashed a bunch of partitions with dm-verity disabled.
6) fastboot --disable-verity --disable-verification flash boot f2rootedboot.img
7) fastboot --disable-verity --disable-verification flash recovery recovery.img
8) fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
9) fastboot --disable-verity --disable-verification flash super super.img
10) fastboot --disable-verity --disable-verification flash tee1 tee.img
11) fastboot --disable-verity --disable-verification flash tee2 tee.img
12) fastboot --disable-verity --disable-verification flash cache cache.img
13)/!\ WILL RESET DATA : fastboot --disable-verity --disable-verification flash userdata userdata.img
13) fastboot reboot
I'm really not sure if you really need all that hassle, but that made it work for me. PLEASE USE FASTBOOT FROM BOOTLOADER (adb reboot bootloader, or choose "Reboot in Bootloader" in recovery / fastbootd)
Click to expand...
Click to collapse
Confirmed working, thanks. I ended up patching the new boot.img myself and that also worked. I own a Note 10 + and OnePlus 7 Pro and honestly I think the Umidigi is an awesome deal, everything is pretty good on the device. It's something I wanted to try out and I'm actually impressed.

Did one of you already tried some treble roms on the f2? lineagOS, Havoc 3.0 or aosp?

ubuntuh said:
Did one of you already tried some treble roms on the f2? lineagOS, Havoc 3.0 or aosp?
Click to expand...
Click to collapse
Currently there is no twrp recovery for the f2. I've tried a couple ports of twrp but can't get past the splash screen.

We don't need TWRP to flash ROMs. Fastboot / SPFT should suffice.

_cab13_ said:
We don't need TWRP to flash ROMs. Fastboot / SPFT should suffice.
Click to expand...
Click to collapse
True. Twrp just makes it quicker and has easier backup option

How can the Ulefone Armor 8 be rooted?

Hello to all,
i've been trying since 1 week now to root an Ulefone Armor 8, but it doesn't work. All drivers are installed. The OS installed on the device is Android 10, the build version is X70WSFFB.GQU.EEA.FHJ.Q0.TJAPA9VDYPTS.0703.V3.01. I have already contacted Ulefone and asked if there is another build version (for EU), but it is the only one currently available.
In the firmware there are two boot.img. One is called "boot.img" and the other is called "boot-debug-img". First I only patched the "boot.img" with Magisk and flashed the patched "magisk-patched.img" via ADB. After that the Armor 8 had a bootloop. The bootloop could be removed by flashing the original "boot.img" via ADB. The Armor started normally again.
After that I patched the "boot.img" and the "boot-debug.img" with Magisk and renamed them to "magisk-patched1.img" and "magisk-patched2.img". After that I flashed first the " magisk-patched1.img" and then the " magisk-patched2.img" via ADB. The Armor 8 then had a boot loop again. To get the bootloop away, the original "boot.img" was flashed back and Armor 8 is back in its factory default state.
How can it be rooted, what should I do differently? Could it be because there are two "boot" files in the firmware?
Sorry if my english is not perfect.
Thanks for your help and tips.
Greetings

https://www.getdroidtips.com/root-ulefone-armor-8/

I have tried that too, but it doesn' t work.
I flashed the "boot.img" with Magisk, from this Magisk created the file "patched_magisk.img". I moved this file to the ADB folder. After that I did it again with the file "boot-debug.img". Then I put the armor in fastboot mode and first I entered the command "fastboot flash boot_a magisk_patched.img".
ADB writes: writing 'boot_ a'... FAILED (remote: This partition doesn't exist)
After that I still moved the patched "boot-debug.img" into the ADB folder and entered the command "fastboot flash boot_b magisk_patched.img".
ADB writes: writing 'boot_b'... FAILED (status read failed (Too many links))
Magisk didn't create 2 patched files from 1 "boot.img", but in the unpacked ROM there are 2 .img files, namely "boot.img" and "boot-debug.img", which I patched one after the other and then flashed.
I have also downloaded the firmware of Armor 7. Of course not to install it, just to see if there are 2 boot.img (= boot.img + boot-debug.img) in it, too. For Armor 7 there is only 1 file "boot.img". For Armor 8 in the firmware there are "boot.img" and "boot-debug.img"
I have now tried overall:
just flash the patched "boot.img" = bootloop
flash only the patched "boot-debug.img" = bootloop
then first the patched "boot.img" and then the patched "boot-debug.img" = bootloop
Now just now again with the command "fastboot flash boot_a magisk_patched.img" = error message and then continue with the command "fastboot flash boot_b magisk_patched.img" = error message.
I think the problem is that there are 2x boot.img files in the ROM?
Edit:
And the SP-Flash-Tool shows that I should remove the battery, but the Armor has a fixed battery.

The SP Flash Tool now works after reinstalling the Vcom driver.
I have now extracted the boot.img of Armor 8 with the SP Flash Tool via "Readback". This file was then patched with Magisk. The file "magisk_patched.img" is together with the file boot.img in the same folder.
This was then flashed to the Armor with the SP Flash Tool in "Download only" mode. The flashing process is running normally and finally "Download Ok".
After that the Armor 8 will start normally and without bootloop, but it still has no root.
Does anyone have an idea?

I also have an armor 8 and I noticed that when u enter developer mode u can unlock the bootloader from there. Which allows you to install root access more successfully
after tapping on the kernel build go back and enter the option where it says system. There u will find the developer options.
after that, I had to follow some steps from this video
I got the stock ROM from the Ulefone website https://www.ulefone.com/support/software-download.html
where I was able to get the boot.img and patch it with magisk however I kept on getting a boot loop so I'll probably figure out another way to root it
1st
2nd

ignore

Have you succeeded yet? I am interested in this phone but want to be sure it can be rooted
Instead of trying to patch it from fastboot, just try booting! Follow the instructions below.
You may want to try the following steps: Just ignore the part about using their rom since it is a different phone. You should be using the Ulefone ROM
[Guide] Install Magisk on your device, updated to handle OTAs easily
[Update in 1st September 2018] Magisk v17 stable has been released, so the August security update: a new method, more OTA-compliant, is written. Hi all, this section is quite gaunt, so I'll post my experience on unlocking and rooting my brand...
forum.xda-developers.com
So save you some clicking, I'll just paste the relevant part below:
How to root
0. You need "debug usb" and "oem unlock" enabled under "developer options" on phone's settings.
1. First, if you don't have already done it, unlock phone's bootloader:
Code:
adb reboot bootloader
fastboot oem unlock
ATTENTION: THIS WILL WIPE YOUR DEVICE, ALL USER DATA WILL BE LOST! And no, when you'll have finish this guide, you can't lock it again (each lock-unlock operation will wipe the device)
2. Download ROM system image from official site. Pay attention to download the corresponding version of your actual OS (look in system settings your current build number).
3. Extract "boot.img" from the just downloaded archive and put somewhere in your device (e.g. in a microSD, just remember where you put it).
4. Download and install Magisk Manager apk.
5. Open Magisk, choosing "yes" when it asks to install Magisk-v*.zip, then choose "patch boot image" and select "boot.img" copied in step 3.
6. At the end of patching process, Magisk will tell you where "patched_boot.img" is been stored, keep a note on it and close.
Now's the updated part, that will make possible to apply OTAs:
7. Copy "patched_boot.img" on your computer, then run this on a terminal:
Code:
adb reboot bootloader
fastboot boot patched_boot.img
fastboot reboot
This will temporarily give you root privileges (until next reboot).
8. Magisk Manager can now make the root permanent: open it and tap "Install", then "direct install (recommended)". This way (instead of flashing directly patched_boot.img) Magisk Manager can remove and reinstall root privileges directly.
9. Just to be sure that your phone doesn't install updates without your acknowledgement, go to Developer Options and disable "Automatic system updates".
Ta-dà! Now you should have Magisk permanently installed (you can check it re-opening Magisk Manager).
-------------------------------------------------------
Time to update? Here's how
If you've followed what is written above, applying an OTA should be quite easy now.
a. Go to Magisk Manager → Uninstall → Restore Images. Do not reboot now or you will have Magisk uninstalled!
b. Now go to Settings → System → System Update and apply OTA. If it fails you've some tweak on system partition that you've forgot to remove, so try to figure it out and retry. Wait for the installation to complete. DO NOT RESTART NOW.
c. Open Magisk Manager again and press Install → Install to Inactive Slot.
d. Reboot and enjoy
-----------------------
PLEASE ADVISE IF THIS WORKS!

As the guy clearly mentioned, there's a boot.img and a debug_boot.img whenever i try to patch any of that and use fastboot to flash it I only get a bootloop
The bootloader is already unlocked and there's nothing else I can do to get this phone rooted
There's also no twrp currently supported for.it and that's pretty much it
I just needed help with this but it seems like this phone is very unknown and unsupported

MasDbs101 said:
As the guy clearly mentioned, there's a boot.img and a debug_boot.img whenever i try to patch any of that and use fastboot to flash it I only get a bootloop
The bootloader is already unlocked and there's nothing else I can do to get this phone rooted
There's also no twrp currently supported for.it and that's pretty much it
I just needed help with this but it seems like this phone is very unknown and unsupported
Click to expand...
Click to collapse
Have you explicitly tried
fastboot BOOT patched_boot.img
just BOOTING the patched boot image. just ignoring the the flash command for now.
This shouldn't cause a bootloop since it'll just revert back to the virgin boot.img
TWRP isn't needed for rooting.

Thank you for sharing this , I will try it later today and let you know what happens.

MasDbs101 said:
Thank you for sharing this , I will try it later today and let you know what happens.
Click to expand...
Click to collapse
Any luck?

stizarch said:
Any luck?
Click to expand...
Click to collapse
Bootloop

Finally, I successfully rooted! Procedure is the same as in the post 7, but before flashing patched boot you should flash empty vbmeta image:
fastboot flash vbmeta vbmeta_null.img
and then:
fastboot flash boot boot_magisk_patched_root.img
and reboot to system:
fastboot reboot
I attached empty vbmeta and patched boot.

knedlyk said:
Finally, I successfully rooted! Procedure is the same as in the post 7, but before flashing patched boot you should flash empty vbmeta image:
fastboot flash vbmeta vbmeta_null.img
and then:
fastboot flash boot boot_magisk_patched_root.img
and reboot to system:
fastboot reboot
I attached empty vbmeta and patched boot.
Click to expand...
Click to collapse
how did you get a null vbmeta file i need one for the ulefone armor 10 5g i wonder if its just empty it will work or something will try

zenoblank34 said:
how did you get a null vbmeta file i need one for the ulefone armor 10 5g i wonder if its just empty it will work or something will try
Click to expand...
Click to collapse
yes flashing vbmeta null over vbmeta on ulefone armor 10 5g worked as well i got root access

Armor8 said:
Hello to all,
i've been trying since 1 week now to root an Ulefone Armor 8, but it doesn't work. All drivers are installed. The OS installed on the device is Android 10, the build version is X70WSFFB.GQU.EEA.FHJ.Q0.TJAPA9VDYPTS.0703.V3.01. I have already contacted Ulefone and asked if there is another build version (for EU), but it is the only one currently available.
In the firmware there are two boot.img. One is called "boot.img" and the other is called "boot-debug-img". First I only patched the "boot.img" with Magisk and flashed the patched "magisk-patched.img" via ADB. After that the Armor 8 had a bootloop. The bootloop could be removed by flashing the original "boot.img" via ADB. The Armor started normally again.
After that I patched the "boot.img" and the "boot-debug.img" with Magisk and renamed them to "magisk-patched1.img" and "magisk-patched2.img". After that I flashed first the " magisk-patched1.img" and then the " magisk-patched2.img" via ADB. The Armor 8 then had a boot loop again. To get the bootloop away, the original "boot.img" was flashed back and Armor 8 is back in its factory default state.
How can it be rooted, what should I do differently? Could it be because there are two "boot" files in the firmware?
Sorry if my english is not perfect.
Thanks for your help and tips.
Greetings
Click to expand...
Click to collapse
Hello I tried but I fail ..
I install all drivers..
But when
Adb reboot bootloader .. rebooted..ok
Fastboot oem unlock ... Waiting for device...
So I cannot unlock the bootloader

have you tried
fastboot flashing oem
or
fastboot flash oem

zenoblank34 said:
have you tried
fastboot flashing oem
or
fastboot flash oem
Click to expand...
Click to collapse
Only work for me
adb reboot bootloader
fastboot -i 0x0E8D devices
fastboot -i 0x0E8D flashing unlock
fastboot -i 0x0E8D flash boot magisk_patched.img
fastboot -i 0x0E8D flash vbmeta vbmeta_null.img
fastboot -i 0x0E8D reboot
rebooting...

Thanks people, it worked for me.
Can you tell me how much time do you need to fully charge from 0 to 100% ?
And do you use charger from box?

PabloWalker13 said:
Only work for me
adb reboot bootloader
fastboot -i 0x0E8D devices
fastboot -i 0x0E8D flashing unlock
fastboot -i 0x0E8D flash boot magisk_patched.img
fastboot -i 0x0E8D flash vbmeta vbmeta_null.img
fastboot -i 0x0E8D reboot
rebooting...
Click to expand...
Click to collapse
What does it mean the code 0x0E8D?

Where to get vbmeta.img for my phone

I followed a tutorial and it gave a single vbmeta.img file that it can be used for all Android devices. Is this true or does each device have its own vbmeta.img file? If Each device has its own then where can I get that of my phone (Tecno Spark 4 KC8 Android 10)? Can I get it from the Stock Firmware? If yes how do I go about it? If no then how can I get it
Please I need help.

Sakodie King TI said:
I followed a tutorial and it gave a single vbmeta.img file that it can be used for all Android devices. Is this true or does each device have its own vbmeta.img file? If Each device has its own then where can I get that of my phone (Tecno Spark 4 KC8 Android 10)? Can I get it from the Stock Firmware? If yes how do I go about it? If no then how can I get it
Please I need help.
Click to expand...
Click to collapse
vbmeta.img is unique for the phone model.
you can get it be extracting your stock firmware.

Kenora_I said:
vbmeta.img is unique for the phone model.
you can get it be extracting your stock firmware.
Click to expand...
Click to collapse
Hi #[email protected] thanks very much. So you mean if I extract the stock firmware of my model I should be able to see a file named vbmeta right (or do I need to go an extra mile to get the vbmeta file)? Now what of a blank (empty) vbmeta.img file. How do I get it because I need to flash it before flashing custom recovery? Also can I use a universal empty vbmeta.img as I saw on a tutorial or my model also has its specific empty vbmeta.img file?

The one in the tutorial.is fine.

Kenora_I said:
The one in the tutorial.is fine.
Click to expand...
Click to collapse
Um, So, To install TWRP, I need -dm-verity-opt-encrypt.zip and vbmeta.img. Should the Vbmeta, be specific for each device, only to install a custom rom? or also specific to install a recovery like TWRP, If I install TWRP, I still need the Vbmeta, to install custom roms, or I only need it when using ADB, Um, Also, Do I need no-verity-opt-encrypt, I saw a post, that I need to flash it in order to install the TWRP, If I dont need the dm-verity to install the TWRP, Can I directly flash vbmeta?
I saw this code to install TWRP on my device:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery TWRP.img
I need to ask 2 more things:
1) how to check if my device is compatible with No-verity-opt-Encrypt?
2) Differences between DM Verity, OPT Encrypt, and Force Encryption Disabler?
Why would I need to disable verity? What is No verity, and what is vbmeta?
Is there any FULL Comprehensive Tutorial on this mobile Custom Rom Cooking lecture, So that I could know about treble, recoveries, kernels, and etc. Please.
Thanks

Hi TechySkills see my answer in the next comment below for a clear explanation.

TechySkills said:
Um, So, To install TWRP, I need -dm-verity-opt-encrypt.zip and vbmeta.img. Should the Vbmeta, be specific for each device, only to install a custom rom? or also specific to install a recovery like TWRP, If I install TWRP, I still need the Vbmeta, to install custom roms, or I only need it when using ADB, Um, Also, Do I need no-verity-opt-encrypt, I saw a post, that I need to flash it in order to install the TWRP, If I dont need the dm-verity to install the TWRP, Can I directly flash vbmeta?
I saw this code to install TWRP on my device:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery TWRP.img
I need to ask 2 more things:
1) how to check if my device is compatible with No-verity-opt-Encrypt?
2) Differences between DM Verity, OPT Encrypt, and Force Encryption Disabler?
Why would I need to disable verity? What is No verity, and what is vbmeta?
Is there any FULL Comprehensive Tutorial on this mobile Custom Rom Cooking lecture, So that I could know about treble, recoveries, kernels, and etc. Please.
Thanks
Click to expand...
Click to collapse
[Links have been attached at the end of the explanation]...
I started this thread sometime ago and after following up, I have now documented everything.
-- DM-Verity (or Verified Boot), Forceencryption and SafetyNet are some basic Android security features. For security reasons, Android should boot with what the OEM has provided (modifications to partitions or modified/custom partitions are not trusted; the reason your phone won't boot or boots with a warning if you make changes to the OS).
-- DM-Verity checks for alterations when your phone is booting and if detected, Forceencryption encrypts the data partition to prevent a data breach. Meanwhile Safetynet is also triggered when you alter the OS and apps that depend on the strict Android security won't work well if SafetyNet fails.
-- TWRP (which can be flashed using: fastboot flash recovery TWRP.img)
is a custom recovery partition (not provided or approved by the OEM), GSI is a custom system partition (not approved by the OEM) and to install any custom partition, it is wise to disable the security barriers (Forceencryption, DM-Verity). As you are taking over control of your phone, whatever issue you fall into afterwards should be addressed to yourself.
-- In older Android versions, DM-verity sits in the boot partition. But in recent Android versions (9, 10, etc), it sits in the dedicated vbmeta partition and that is why you have to flash an empty/signed vbmeta image (using:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img) to bypass DM-Verity. Google has a universal vbmeta image that works for all devices. For Forceencryption, you need to flash a disabler zip like dm-verity-and-forceencrypt-disabler zip (also disables DM-verity) or no-verity-opt-encrypt zip. Or you can also edit the vendor fstab file to remove encryption.
-- See What Is Verified Boot (DM-Verity) In Android And How To Disable It https://sakophone.wordpress.com/202...ce=728bab228a&preview=true&_thumbnail_id=4446
-- See Encryption, Decryption And Forceencryptin https://sakophone.wordpress.com/2022/01/03/encryption-decryption-and-forceencryptin/#forceencryption

Hello,
1. In the first link you gave, It says, that, after flashing a custom recovery, flash forceencryption, I don't know how to flash forceencryption through adb, cuz, If i just flash the TWRP, and boot, In my guess, It will not open, unless you flash the forceencrytption.
2. As you said in your reply, "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" So this removes the need to flash the zip file as mentioned in the first step?? But right after you said that, You also need to flash the dm-verity zip file. I am very very confused.
3. Also, What is exactly vbmeta, I understood about dm-verity etc, But I am still confused about vbmeta, can you please comprehend it to me?
4. What is the need of rooting the phone, after unlocking the bootloader, like, why root phone, when the phone is already unlocked? Please remove these stupid confusions of mine.
Thanks

TechySkills said:
Hello,
1. In the first link you gave, It says, that, after flashing a custom recovery, flash forceencryption, I don't know how to flash forceencryption through adb, cuz, If i just flash the TWRP, and boot, In my guess, It will not open, unless you flash the forceencrytption.
2. As you said in your reply, "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" So this removes the need to flash the zip file as mentioned in the first step?? But right after you said that, You also need to flash the dm-verity zip file. I am very very confused.
3. Also, What is exactly vbmeta, I understood about dm-verity etc, But I am still confused about vbmeta, can you please comprehend it to me?
4. What is the need of rooting the phone, after unlocking the bootloader, like, why root phone, when the phone is already unlocked? Please remove these stupid confusions of mine.
Thanks
Click to expand...
Click to collapse
If you went through the guides I sent, you should have all your answers there.
1. The key used by DM-Verity is signed and kept in the vbmeta partition (from Android 8 onwards). Therefore you have to flash a vbmeta that has been signed or an empty vbmeta (that holds no key to do a check) to disable DM-VERITY.
2. vbmeta disables DM-verity and not Forceencryption. The disabler zips disable Forceencryption (and some disable DM-VERITY too). For zips that disable both Forceencryption and DM-Verity, you can use just it and not use the signed/empty vbmeta.
3. Your phone is protected out of the box for your own safety. If you want to take total control over it, you must alert the system by unlocking it (unlocking the bootloader). If you want to give back all the control to your phone, relock bootloader. Note that unlocking/locking bootloader wipes all your data so do backups first.
4. Bootloader is the first step and must be done, if not, the phone won't boot. After bootloader then comes turning off security barriers (DM-Verity, Forceencryption).
5. Though the steps might vary, they usually follow this manner:
• Unlock bootloader. Turn on the toggle in Developer options and then use fastboot to complete the unlocking
• Flash vbmeta to disable DM-VERITY
• Flash TWRP. Though Forceencryption has not been removed yet, TWRP will boot. Now format data in TWRP to temporarily make the phone decrypted. With a temporarily decrypted state, you can access your internal storage to select Forceencryption disabler zip. Flashing the zip makes decryption Permanent.
• You can now reboot or continue flashing other stuff like other recovery, GSI, custom ROM, magisk, etc. Most of them can be done from TWRP itself (the reason you need TWRP in the first place)
• Rooting is optional. You can decide not to root even if you have TWRP, custom ROM, etc. Some apps need superuser privileges to work and you can only use them in a rooted phone (the reason people root their phone). These apps are mostly those that modify the OS. Flashing magisk roots your phone.
Any doubts again?

Sakodie King TI said:
If you went through the guides I sent, you should have all your answers there.
1. The key used by DM-Verity is signed and kept in the vbmeta partition (from Android 8 onwards). Therefore you have to flash a vbmeta that has been signed or an empty vbmeta (that holds no key to do a check) to disable DM-VERITY.
2. vbmeta disables DM-verity and not Forceencryption. The disabler zips disable Forceencryption (and some disable DM-VERITY too). For zips that disable both Forceencryption and DM-Verity, you can use just it and not use the signed/empty vbmeta.
3. Your phone is protected out of the box for your own safety. If you want to take total control over it, you must alert the system by unlocking it (unlocking the bootloader). If you want to give back all the control to your phone, relock bootloader. Note that unlocking/locking bootloader wipes all your data so do backups first.
4. Bootloader is the first step and must be done, if not, the phone won't boot. After bootloader then comes turning off security barriers (DM-Verity, Forceencryption).
5. Though the steps might vary, they usually follow this manner:
• Unlock bootloader. Turn on the toggle in Developer options and then use fastboot to complete the unlocking
• Flash vbmeta to disable DM-VERITY
• Flash TWRP. Though Forceencryption has not been removed yet, TWRP will boot. Now format data in TWRP to temporarily make the phone decrypted. With a temporarily decrypted state, you can access your internal storage to select Forceencryption disabler zip. Flashing the zip makes decryption Permanent.
• You can now reboot or continue flashing other stuff like other recovery, GSI, custom ROM, magisk, etc. Most of them can be done from TWRP itself (the reason you need TWRP in the first place)
• Rooting is optional. You can decide not to root even if you have TWRP, custom ROM, etc. Some apps need superuser privileges to work and you can only use them in a rooted phone (the reason people root their phone). These apps are mostly those that modify the OS. Flashing magisk roots your phone.
Any doubts again?
Click to expand...
Click to collapse
Um, No, Thank you very very very much, You literally fixed all my confusions, I actually bricked my phone and had to go to support office previous month, and pay 2$ (500PKR) to fix it. That is why, I was asking and clearing my confusions. Thank you, Now I am very confident, That, I can now flash my device. Thank you!

TechySkills said:
Um, No, Thank you very very very much, You literally fixed all my confusions, I actually bricked my phone and had to go to support office previous month, and pay 2$ (500PKR) to fix it. That is why, I was asking and clearing my confusions. Thank you, Now I am very confident, That, I can now flash my device. Thank you!
Click to expand...
Click to collapse
Good to hear
{Mod edit: Quotation fixed - Oswald Boelcke, Moderator}

Sakodie King TI said:
[Links have been attached at the end of the explanation]...
I started this thread sometime ago and after following up, I have now documented everything.
-- DM-Verity (or Verified Boot), Forceencryption and SafetyNet are some basic Android security features. For security reasons, Android should boot with what the OEM has provided (modifications to partitions or modified/custom partitions are not trusted; the reason your phone won't boot or boots with a warning if you make changes to the OS).
-- DM-Verity checks for alterations when your phone is booting and if detected, Forceencryption encrypts the data partition to prevent a data breach. Meanwhile Safetynet is also triggered when you alter the OS and apps that depend on the strict Android security won't work well if SafetyNet fails.
-- TWRP (which can be flashed using: fastboot flash recovery TWRP.img)
is a custom recovery partition (not provided or approved by the OEM), GSI is a custom system partition (not approved by the OEM) and to install any custom partition, it is wise to disable the security barriers (Forceencryption, DM-Verity). As you are taking over control of your phone, whatever issue you fall into afterwards should be addressed to yourself.
-- In older Android versions, DM-verity sits in the boot partition. But in recent Android versions (9, 10, etc), it sits in the dedicated vbmeta partition and that is why you have to flash an empty/signed vbmeta image (using:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img) to bypass DM-Verity. Google has a universal vbmeta image that works for all devices. For Forceencryption, you need to flash a disabler zip like dm-verity-and-forceencrypt-disabler zip (also disables DM-verity) or no-verity-opt-encrypt zip. Or you can also edit the vendor fstab file to remove encryption.
-- See What Is Verified Boot (DM-Verity) In Android And How To Disable It https://sakophone.wordpress.com/202...ce=728bab228a&preview=true&_thumbnail_id=4446
-- See Encryption, Decryption And Forceencryptin https://sakophone.wordpress.com/2022/01/03/encryption-decryption-and-forceencryptin/#forceencryption
Click to expand...
Click to collapse
So, I want to install twrp to install a custom rom, but you said if I want to change from miui to a custom rom, it needs a file called "vbmeta" but after I did a search, the vbmeta file is only needed if the device is running Android 8 and above, whereas my device is on Android 7 | MIUI 10 | Santoni, and it says it only needs DM-verity? What should I do to be able to install a custom ROM?

kjisoo said:
So, I want to install twrp to install a custom rom, but you said if I want to change from miui to a custom rom, it needs a file called "vbmeta" but after I did a search, the vbmeta file is only needed if the device is running Android 8 and above, whereas my device is on Android 7 | MIUI 10 | Santoni, and it says it only needs DM-verity? What should I do to be able to install a custom ROM?
Click to expand...
Click to collapse
vbmeta was introduced starting Android 8, so no need looking for a vbmeta if you are on Android 7. Starting Android 7, dm-verity had to be strictly enforcing (optional). If this is your case, then you can disable it in Android 7 by using flasher zips. Everything is in this guide.
What Is Verified Boot (DM-Verity) In Android And How To Disable It
Last Updated: February/21/2023 Contents Getting Started What Actually Is Verified Boot And Dm-Verity In Android How Verified Boot And DM-Verity Work In Older Devices (Android 7 And Below) How Verif…
sakophone.wordpress.com

@Kenora_I hi, maybe you know. I have Redmi 9 with soft upgraded to android 12.1 and i wanted boot temporary to SHRP. I tried fasboot flash recovery shrp.img and fasboot reboot recovery after but my device did not boot to recovery but started normally into system. May it be problem with vbmeta? My device ia A partition only.

Slawek_ said:
@Kenora_I hi, maybe you know. I have Redmi 9 with soft upgraded to android 12.1 and i wanted boot temporary to SHRP. I tried fasboot flash recovery shrp.img and fasboot reboot recovery after but my device did not boot to recovery but started normally into system. May it be problem with vbmeta? My device ia A partition only.
Click to expand...
Click to collapse
PART 1:
Maybe your device lacks recovery partition (common with new and AB slot devices). If this is so, "fastboot flash recovery shrp.img" won't work because there's no recovery partition (recovery now sits in boot partition as boot-ramdisk).
Such devices need two recovery files: img and zip. If you have the two, the ZIP should be in your phone and the img in your PC then first boot the SHRP:
fastboot boot shrp.img
When recovery boots up, locate and flash the ZIP then from SHRP, reboot recovery and enjoy.
NB: I am assuming the name of your img file is shrp.img which might differ.
PART 2:
However, if you are sure your device is A-only, then here you go (make sure the shrp.img is the one for your device and you have the universal vbmeta disable):
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery shrp.img
## For AB devices with recovery partition, you can specify slot
fastboot flash recovery_a shrp.img
fastboot flash recovery_b shrp.img
Fastboot reboot
NB: You can choose to boot shrp (instead of permanently install) if you want to use it just now:
fastboot boot shrp.img

Hi @Sakodie King TI ,
I tried fastboot boot command but im getting "too many links error."
Treble check saying my phone is A partition only.
I also checked
fastboot flash recovery shrp.img
then rebooting manualy by volume up + pwr but then im getting bootloop while holding these keys.
That is why i asked is this can be caused by vbmeta.

Sakodie King TI said:
Maybe your device lacks recovery partition (common with new and AB slot devices). If this is so, "fastboot flash recovery shrp.img" won't work because there's no recovery partition (recovery now sits in boot partition as boot-ramdisk).
Such devices need two recovery files: img and zip. If you have the two, the ZIP should be in your phone and the img in your PC then first boot the SHRP:
fastboot boot shrp.img
When recovery boots up, locate and flash the ZIP then from SHRP, reboot recovery and enjoy.
NB: I am assuming the name of your img file is shrp.img which might diffe
Click to expand...
Click to collapse
Slawek_ said:
Hi @Sakodie King TI ,
I tried fastboot boot command but im getting "too many links error."
Treble check saying my phone is A partition only.
I also checked
fastboot flash recovery shrp.img
then rebooting manualy by volume up + pwr but then im getting bootloop while holding these keys.
That is why i asked is this can be caused by vbmeta.
Click to expand...
Click to collapse
Did you flash vbmeta first?
And try "fastboot reboot recovery" after flashing instead of using volume keys

I did not flash vbmeta at all. I'm afraid i will brick device.
Shouldn't shrp boot temporary without flashing vbmeta?

Slawek_ said:
I did not flash vbmeta at all. I'm afraid i will brick device.
Shouldn't shrp boot temporary without flashing vbmeta?
Click to expand...
Click to collapse
You have to flash vbmeta first. instead, doing it without flashing vbmeta means you are looking for ways to brick your device.

Hey @Sakodie King TI
So i did this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After reboot recovery i got rebooted to system not recovery.
Also when i'm rebooting to recovery manually, i'm still on old muiu recovery nothing changed.
I took vbmeta from my firmware lancelot_eea_global_images_V13.0.3.0.SJCEUXM_20230111.0000.00_12.0_eea.
In that firmware there are also vbmeta_system.img and vbmeta_vendor.img maybe need to flash them also with --disable-verity --disable-verification parameters?

[CLOSED] Android 12 Upgrade Discussion

I am closing this thread as it is no longer relevant. For rooting instructions or further discussion, please go here.
Spoiler: Deprecated
Current status as of October 21: Data wipe required for permanent root. Patched boot image can be live booted after upgrade for temporary root.
Update 10-29: I have posted a thread over in the Android Development forum so that developers can hopefully take a look at what might be causing our boot issues. Please don't post there but feel free to check for updates.
Since some of us are running into issues with root after upgrading to Android 12, I'd like to invite everyone to share their results here.
Please be as descriptive as possible, and include at the very least the following information:
* What software you were running before the update
* What method you used to update:
- Automatic OTA
- Manual OTA
- Android Flash Tool
- Manual factory image
* Whether or not you wiped /data or did a factory reset
* Any issues you ran into during the process
* Your current state (bootloop, bootloader error, recovery error, system with or without root)
Hopefully this will help us narrow down on exactly what is causing some of the problems.

I have a pixel 5, was running Android 11 with oct. 5 security update.
I flashed the non verizon factory image from the google factory image repository.
then patched my boot image
then tried to flash magisk patched boot
it kept going to bootloader saying error from @V0latyle where the boot image did not match because I didn't disable the flag.
I reflashed the non verizon factory image for pixel 5.
I went through the initial google setup and then adb back into bootloader.
I tried using the disable flags command in the flash-all.bat file from the factory image. It failed and went to recovery and said I had a corrupt system image in recovery mode.
I factory reset and reflashed factory image without flags in the flash-all.bat file
Went through google initial setup
adb back into fastboot.
pushed the disable flag commaned with --slot=all
patched magisk image
booted into A12 with root.
So far root has taken for everything and no issues.

yes i did wipe, i was on protonaosp 11.60 - Pixel 4a5g
So basically I copied 4 files into my platform-tools folder (flash-all.bat, bootloader, image, radio)
Then edited the flash-all.bat a little bit (highlighted blue below) based on your guide
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-bramble-b5-0.4-7617461.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash radio radio-bramble-g7250-00147-210811-b-7631450.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot --disable-verity --disable-verification -w update image-bramble-sp1a.210812.015.zip
echo Press any key to exit...
pause >nul
exit
Then
adb reboot bootloader
flash-all
Wait, done. Follow the usual magisk patched setup. So far no issue. Just sharing my experience here.

rester555 said:
I have a pixel 5, was running Android 11 with oct. 5 security update.
I flashed the non verizon factory image from the google factory image repository.
then patched my boot image
then tried to flash magisk patched boot
it kept going to bootloader saying error from @V0latyle where the boot image did not match because I didn't disable the flag.
I reflashed the non verizon factory image for pixel 5.
I went through the initial google setup and then adb back into bootloader.
I tried using the disable flags command in the flash-all.bat file from the factory image. It failed and went to recovery and said I had a corrupt system image in recovery mode.
I factory reset and reflashed factory image without flags in the flash-all.bat file
Went through google initial setup
adb back into fastboot.
pushed the disable flag commaned with --slot=all
patched magisk image
booted into A12 with root.
So far root has taken for everything and no issues.
Click to expand...
Click to collapse
To be clear, you initially tried to dirty flash the factory image without a data wipe?

Pixel 4a 5G. Was running rooted A11 before the update, never installed any betas.
1. Dirty flashed the non-Verizon OTA image via recovery sideload, didn't wipe anything
2. Patched boot.img from the latest factory image with Magisk, flashed it
3. Got into a bootloop with "Failed to load/verify boot images"
4. Reverted everything by flashing the full factory image (without -w), booted into the system
5. Went back to fastboot, flashed vbmeta.img with --disable- flags but no --slot=all
6. Flashed the patched boot.img again, tried to boot
7. Saw the corrupt system screen, decided not to format data
8. Repeated step 4
So now I have a working system and no root.

V0latyle said:
To be clear, you initially tried to dirty flash the factory image without a data wipe?
Click to expand...
Click to collapse
sorry I didn't try dirty flashing from A11 to A12... I did a -w on the initial install.

esta0 said:
Pixel 4a 5G. Was running rooted A11 before the update, never installed any betas.
1. Dirty flashed the non-Verizon OTA image via recovery sideload, didn't wipe anything
2. Patched boot.img from the latest factory image with Magisk, flashed it
3. Got into a bootloop with "Failed to load/verify boot images"
4. Reverted everything by flashing the full factory image (without -w), booted into the system
5. Went back to fastboot, flashed vbmeta.img with --disable- flags but no --slot=all
6. Flashed the patched boot.img again, tried to boot
7. Saw the corrupt system screen, decided not to format data
8. Repeated step 4
So now I have a working system and no root.
Click to expand...
Click to collapse
Try reflashing vbmeta with the disable flags and --slot=all, then try booting your patched boot image.
rester555 said:
sorry I didn't try dirty flashing from A11 to A12... I did a -w on the initial install.
Click to expand...
Click to collapse
Odd. Sounds like it should have worked the first time. You actually did it right, wiping data when upgrading using the factory image.

V0latyle said:
Try reflashing vbmeta with the disable flags and --slot=all, then try booting your patched boot image.
Odd. Sounds like it should have worked the first time. You actually did it right, wiping data when upgrading using the factory image.
Click to expand...
Click to collapse
Yeah, I wonder if my patched image became corrupt or something... transferring boot images from windows to android devices always freak me out. I should do a hash check on them.
In the future I might just download the image directly to my phone extract the boot images for magisk patching... then bringing them over to my windows environment.

Pixel 4a 5G, coming from the June/July patch of stock Android 11 (for some reason I did not get the October patch even though I started regularly checking for updates - hoping for A12 - about 10 days ago) - it was rooted and I didn't disable anything (regarding Magisk) in advance.
Dirty flashed A12 OTA through the UI and rebooted - went fine (with the exception that when I hit reboot from settings, phone turned off instead of rebooting; upon turning on again, update went normally, and IIRC Magisk Manager asked by itself to reinstall the app).
I patched boot.img extracted from the latest FI (non-Verizon) and attempted to flash it; flash went fine, but afterwards I got to "failed to load/verify boot images" in fastboot.
As per suggestions from @V0latyle I ran "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" which got me to recovery and a corrupt system state.
Ran "fastboot flash vbmeta vbmeta.img" after which I could boot normally and there was no data loss (but no root)
Tried "fastboot --disable-verity --disable-verification flash vbmeta vbmeta-beta5.img" (where "vbmeta-beta5.img" is vbmeta from Beta 5), IIRC it got me again to "failed to load/verify boot images" again.
Ran step 4 which got me to boot normally.
Sometime at this point I patched boot.img in Magisk again and managed to boot from it ("fastboot boot magisk_patched-xxxxx_yyyyy"), and system booted up with root; from then on tried direct install of Magisk - it went fine, but upon reboot I was back at "failed to load/verify boot images".
Ran 4 again, in addition to that I flashed unmodified boot.img and here I am - running system, no data loss, no root.
I haven't used the --slot flag anywhere, and I think fastboot always reported only touching slot a.

killchain said:
Pixel 4a 5G, coming from the June/July patch of stock Android 11 (for some reason I did not get the October patch even though I started regularly checking for updates - hoping for A12 - about 10 days ago) - it was rooted and I didn't disable anything (regarding Magisk) in advance.
Dirty flashed A12 OTA through the UI and rebooted - went fine (with the exception that when I hit reboot from settings, phone turned off instead of rebooting; upon turning on again, update went normally, and IIRC Magisk Manager asked by itself to reinstall the app).
I patched boot.img extracted from the latest FI (non-Verizon) and attempted to flash it; flash went fine, but afterwards I got to "failed to load/verify boot images" in fastboot.
As per suggestions from @V0latyle I ran "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" which got me to recovery and a corrupt system state.
Ran "fastboot flash vbmeta vbmeta.img" after which I could boot normally and there was no data loss (but no root)
Tried "fastboot --disable-verity --disable-verification flash vbmeta vbmeta-beta5.img" (where "vbmeta-beta5.img" is vbmeta from Beta 5), IIRC it got me again to "failed to load/verify boot images" again.
Ran step 4 which got me to boot normally.
Sometime at this point I patched boot.img in Magisk again and managed to boot from it ("fastboot boot magisk_patched-xxxxx_yyyyy"), and system booted up with root; from then on tried direct install of Magisk - it went fine, but upon reboot I was back at "failed to load/verify boot images".
Ran 4 again, in addition to that I flashed unmodified boot.img and here I am - running system, no data loss, no root.
I haven't used the --slot flag anywhere, and I think fastboot always reported only touching slot a.
Click to expand...
Click to collapse
Guess what I would recommend you try next? Lol.
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
fastboot reboot bootloader
fastboot flash boot magisk_patched.img
fastboot reboot

V0latyle said:
Guess what I would recommend you try next? Lol.
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
fastboot reboot bootloader
fastboot flash boot magisk_patched.img
fastboot reboot
Click to expand...
Click to collapse
You can also try this if that doesn't work..
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
fastboot reboot bootloader
fastboot flash boot --slot=all magisk_patched.img
fastboot reboot

rester555 said:
You can also try this if that doesn't work..
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
fastboot reboot bootloader
fastboot flash boot --slot=all magisk_patched.img
fastboot reboot
Click to expand...
Click to collapse
Good point actually, if it's giving us issues with the a/b slots on vbmeta, we should make sure that both /boot slots match too.

rester555 said:
You can also try this if that doesn't work..
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
fastboot reboot bootloader
fastboot flash boot --slot=all magisk_patched.img
fastboot reboot
Click to expand...
Click to collapse
Did you do the --slot=all for flashing the magisk patched image in your steps above (your first post where you said you finally got it work)?

pappy97 said:
Did you do the --slot=all for flashing the magisk patched image in your steps above (your first post where you said you finally got it work)?
Click to expand...
Click to collapse
This is what I am wondering as well, has flashing both boot slots actually fixed a problem for anyone?

What was the idea of the two slots? Wasn't it something dealing with seamless updates? Does it make sense to want to check what's in the other slot and whether it is what's causing trouble?

V0latyle said:
This is what I am wondering as well, has flashing both boot slots actually fixed a problem for anyone?
Click to expand...
Click to collapse
Well I tried those steps including flash magisk patched image to both slots, I still had the same issue. Gonna wait to see if others are able to do it successfully with a dirty flash before trying again. Thanks for your help!

Well, it looks like I'm definitely not immune.
Started from 12b5 (clean flash coming from Android 11), rooted.
Took the OTA today, rebooted, no root as expected.
Got home, flashed vbmeta to both slots with boot verification disabled.
Attempted to live boot my patched boot image from the 12 Beta, got boot.img missing cmdline or OS version
Bootlooped twice, got the "data may be corrupt" error in recovery
Reflashed vbmeta to both slots without disable flags, same result.
Dirty flashed factory image via ADB without disable flags, same result.
Dirty flashed factory image via Android Flash Tool without disable flags, same result.
Dirty flashed Beta 5 factory image via ADB, same result.
Tried to reflash vbmeta, vbmeta_system, and boot. Same result.
Now doing a CLEAN flash of the 210812.015 factory image with disable flags set. Booted and going through setup.
Patched boot image. Able to live boot patched image. Performed Magisk "direct install", about to reboot.
It worked! Now rooted on 12 Final, but had to wipe data.
Working on Safetynet now.
So to recap:
Nothing worked until I clean flashed the factory image with verity and verification disabled. I was then able to successfully root, and did not have to reflash anything. Unfortunately, it did require a data wipe.

pappy97 said:
Did you do the --slot=all for flashing the magisk patched image in your steps above (your first post where you said you finally got it work)?
Click to expand...
Click to collapse
yes

Can't get my device to pass attestation now. Installed the latest universal fix 2.1.1. There are currently no Android 12 fingerprints for props config. It's failing both basicIntegrity and ctsProfile, does say eval type is basic. Magisk is hidden. gPay and Play Services are 'hidden', cache and storage were cleared. Phone was rebooted. Funnily enough the banking apps work, but gPay does not.

ZeoFateX said:
Can't get my device to pass attestation now. Installed the latest universal fix 2.1.1. There are currently no Android 12 fingerprints for props config. It's failing both basicIntegrity and ctsProfile, does say eval type is basic. Magisk is hidden. gPay and Play Services are 'hidden', cache and storage were cleared. Phone was rebooted. Funnily enough the banking apps work, but gPay does not.
Click to expand...
Click to collapse
Weird. I haven't tried GPay yet but I think I'm passing...
Update: GPay works, I had no trouble adding cards. The only thing I've noticed is the NFC icon has a line through it and it says "Not set up". Not sure why.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Question Installing GSI on Moto G Stylus 5G (2021)

In a moment of weakness, I finally allowed my G Stylus to update to Android 12, and my stability has been a nightmare since then. I have been reading through many guides here and elsewhere to getting a GSI installed.
So far, I have unlocked the bootloader and followed the instructions for installing TWRP using adb/fastboot for my device. When try to flash a GSI, the partitions in TWRP don't look like anything I've seen in guides. The options it shows me are:
-Boot
-Dtbo
-Persist
-Super (system system_ext product vendor)
-Install Recovery Ramdisk
I tried installing on Super, as I found a thread mentioning it should contain both vendor and system. However, when I flash the img for a gsi to it, it will only boot to bootoader. I can get it into TWRP recovery but the screen is entirely unresponsive, even attempting to power off prompt's a restart. I was able to use Moto's Rescue program to get it back in working order, but each time this happens I have to start over at square one.
I tried with a GSI for crDroid on my first attempt, and then LineageOS on a follow-up attempt, both I had the same issue.
I'm new to Android modding, so I could really use some guidance through getting this set up. I've extensively referenced guides on here and elsewhere, but I've struggled with parsing and figuring out what I need to do in this case. Currently my device has TWRP installed but I'll be doing nothing else until I know what the best way forward is. I'd be happy to provide additional info.
Edit: Just found the dedicated 5G section. Sorry about this.

I am not sure why people use TWRP and a GSI/crDroid /w LineageOS rom.
All you need to do is install the magisk module L Speed
Remember this phone has 2 boot partitions....1 is secured (even if you have the bootloader unlocked and your rooted) So if you trip the SafetyNet your going to have bootloading issues and boot loops

Not sure what the previous comment was about, what does safetynet have to do with anything? It fails the second you unlock the bootloader.
First, you'll want to make sure to have installed at least one OTA update so both your slots are occupied. You could also install copy-partitions from a custom recovery. Otherwise your phone might brick if it ever switches to slot b.
Download and extract the official firmware for your device that matches what is installed
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com
And reflash your vbmeta partition(s) from fastboot to disable verity
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot --disable-verity --disable-verification flash vbmeta vbmeta_system.img
Then you need to reboot into fastbootd (you can also get into it from a custom recovery)
Code:
fastboot reboot fastboot
From there you can erase your system, install the GSI, wipe data, and reboot
Code:
fastboot erase system
fastboot flash system GSI_system.img
fastboot -w
fastboot reboot