Database Info

Stuck in Bootloop when installing Magisk

Helloguys and gals,
I just got a Pixel 3 and wanted to root it. I followed this guide: https://www.youtube.com/watch?v=BgV1xxkcBk8
I installed the latest TWRP recovery (didn't keep it read only, maybe this was a mistake?). After that I installed Magisk which was followed by a bootloop.
To fix the bootloop I used TWRPs fix bootloop fix which worked. But that makes Magisk undone.
So my Questions is how to install Magisk? Do I need to flash the stock image on both slots and start again? Is the guide outdated? If so, which guide should I follow?
Edit: My phone is still on the update from November 2018.

On A/B devices there is no dedicated recovery partition anymore, recovery is contained in the boot partition, so if you install Magisk it's advised not to install TWRP on those devices anymore to avoid both modifying the same image, but instead to always fastboot boot when you need to use TWRP.
These are the steps I follow every time I need to factory reset then root my own Pixel 3 :
Boot to bootloader
Flash stock image on current slot
Flash stock image on other slot
Boot the system, enable Developer options and USB debugging
Fastboot boot TWRP image
Backup Boot partition
Flash Magisk
[optional] Flash custom kernel (check flashing order depending on kernel)
Reboot

bafforosso said:
On A/B devices there is no dedicated recovery partition anymore, recovery is contained in the boot partition, so if you install Magisk it's advised not to install TWRP on those devices anymore to avoid both modifying the same image, but instead to always fastboot boot when you need to use TWRP.
These are the steps I follow every time I need to factory reset then root my own Pixel 3 :
Boot to bootloader
Flash stock image on current slot
Flash stock image on other slot
Boot the system, enable Developer options and USB debugging
Fastboot boot TWRP image
Backup Boot partition
Flash Magisk
[optional] Flash custom kernel (check flashing order depending on kernel)
Reboot
Click to expand...
Click to collapse
Allright, thank you for your explanation! I used the stock image and the flash-all.bat to install the stock image. Will it be enough since you are speaking of two different slots? if not, how can i do both slots?
thx in advance

I run twrp as the devices recovery and have magisk. I would follow the twrp and magisk guides for this device. First boot twrp then use the installer, second reboot, third get to recovery and flash magisk. The boot partition needs to be rebooted before root. It is an initialization thing. Get twrp, reboot, magisk.

Having a similar issue here. I was rooted till the latest OTA happened a few days ago. Trying to re-root in several different ways, but all result in boot loop.
Methods I've tried:
Extracted boot.img from factory image, patched with Magisk Manager, flashed with fastboot
Fastboot boot twrp-3.3.0-0-blueline.img, installed Magisk-v19.3.zip
Fastboot boot twrp-3.3.0-0-blueline.img, installed twrp-pixel3-installer-blueline-3.3.0-0.zip, rebooted recovery, installed Magisk-v19.3.zip
Any ideas?

levibuko said:
Allright, thank you for your explanation! I used the stock image and the flash-all.bat to install the stock image. Will it be enough since you are speaking of two different slots? if not, how can i do both slots?
thx in advance
Click to expand...
Click to collapse
I tinker a lot with my phone so I usually want to have both slots clean flashed when I start back from scratch, not sure that is really necessary, but here are the steps I use for flashing both slots :
Code:
fastboot getvar current-slot
./flash-all.sh
fastboot --set-active=x (x being a or b, the other slot than the one you get with the fastboot getvar command)
./flash-all.sh

Exactly the same issue here, no luck. I'm only able to boot if I flash the stock boot.img. However, no root.
---------- Post added at 08:00 PM ---------- Previous post was at 07:52 PM ----------
tenthousandfeet said:
Having a similar issue here. I was rooted till the latest OTA happened a few days ago. Trying to re-root in several different ways, but all result in boot loop.
Methods I've tried:
Extracted boot.img from factory image, patched with Magisk Manager, flashed with fastboot
Fastboot boot twrp-3.3.0-0-blueline.img, installed Magisk-v19.3.zip
Fastboot boot twrp-3.3.0-0-blueline.img, installed twrp-pixel3-installer-blueline-3.3.0-0.zip, rebooted recovery, installed Magisk-v19.3.zip
Any ideas?
Click to expand...
Click to collapse
Exactly the same issue here, no luck. I'm only able to boot if I flash the stock boot.img. However, no root.

Boot twrp and install it, then reboot to system, then reboot recovery and install magisk. You need to boot system before installing magisk.

wangdaning said:
Boot twrp and install it, then reboot to system, then reboot recovery and install magisk. You need to boot system before installing magisk.
Click to expand...
Click to collapse
Tried that. No success.

Only thing I can think is to install an older magisk then let it update. I originally installed 18 something and have just let it update. I do not use google's factory image though, so cannot really help troubleshoot.

wangdaning said:
Only thing I can think is to install an older magisk then let it update. I originally installed 18 something and have just let it update. I do not use google's factory image though, so cannot really help troubleshoot.
Click to expand...
Click to collapse
I had a similar thought, but no dice. Tried installing Magisk 19.2, which boot looped just like the latest 19.3.
I even went back to 16.7, and though that one didn't boot loop it also didn't show up in the system. Magisk Manager didn't recognize it, anyway.
Though I'm loathe to do a full wipe/reset and then reconfigure all my junk, I may be headed in that direction as I'm running out of other ideas. Perhaps I'll save a backup just before that I can return to if the reset is fruitless.
---------- Post added at 07:53 AM ---------- Previous post was at 07:36 AM ----------
Magisk 18.0 does the same as 16.7 - no bootloop, but no root.
Interestingly, I noticed that the 18.0 and 16.7 zip installers say something about the partition being boot_a, whereas the bootlooping 19.2 and 19.3 zip installers say it's boot_b.

Run the Magisk uninstaller. Flash boot.img to both slots. Do a flash-all (minus the -w). With those things done, you should be essentially at reset state for this problem.

sliding_billy said:
Run the Magisk uninstaller. Flash boot.img to both slots. Do a flash-all (minus the -w). With those things done, you should be essentially at reset state for this problem.
Click to expand...
Click to collapse
Done. Followed that up with a TWRP flash of Magisk 19.2. Then... bootloop! Arg.

tenthousandfeet said:
Done. Followed that up with a TWRP flash of Magisk 19.2. Then... bootloop! Arg.
Click to expand...
Click to collapse
That stinks. Have you tried changing slots in fastboot boot instance of TWRP and then installing Magisk? It sure sounds like your slots are out of sync somehow, and the easiest way to remedy that is to run flash-all with -w in place.

sliding_billy said:
That stinks. Have you tried changing slots in fastboot boot instance of TWRP and then installing Magisk? It sure sounds like your slots are out of sync somehow, and the easiest way to remedy that is to run flash-all with -w in place.
Click to expand...
Click to collapse
I'm not sure if it's related to slots or not, actually. I was thinking that it was, but I've now done a flash-all on both slots (one after the other), then tried my TWRP flash of the Magisk installer again. Results? Bootloop.
I've also tried flashing Magisk Manager's patched_boot.img to both boot_a and boot_b, with the now-familiar outcome.

tenthousandfeet said:
I'm not sure if it's related to slots or not, actually. I was thinking that it was, but I've now done a flash-all on both slots (one after the other), then tried my TWRP flash of the Magisk installer again. Results? Bootloop.
I've also tried flashing Magisk Manager's patched_boot.img to both boot_a and boot_b, with the now-familiar outcome.
Click to expand...
Click to collapse
I hear you about flash-all on both slots, but if you left yourself on the same active slot there could still potentially be an issue. I'll need to think about this some more when I wake. I'd hate to see you do a full reset and end up with the same issue if it is something in the procedural that is causing it. One other thing that shouldn't be a concern, but are you using the proper/current TWRP for the P3 (twrp-3.3.0-0-blueline)? And yet one more thing... try rooting with a patched boot instead of running the installer in TWRP. I can't do the instructions by memory, but they are on here. Check the P3 XL page if they are not readily available on the P3 page.

tenthousandfeet said:
Done. Followed that up with a TWRP flash of Magisk 19.2. Then... bootloop! Arg.
Click to expand...
Click to collapse
Please update when/if you find a solution. We are both in the same boat.
I'll let you know if I get anything working.

sliding_billy said:
I hear you about flash-all on both slots, but if you left yourself on the same active slot there could still potentially be an issue. I'll need to think about this some more when I wake. I'd hate to see you do a full reset and end up with the same issue if it is something in the procedural that is causing it. One other thing that shouldn't be a concern, but are you using the proper/current TWRP for the P3 (twrp-3.3.0-0-blueline)? And yet one more thing... try rooting with a patched boot instead of running the installer in TWRP. I can't do the instructions by memory, but they are on here. Check the P3 XL page if they are not readily available on the P3 page.
Click to expand...
Click to collapse
Here's what I did to get both slots:
Code:
fastboot --set-active=_a
flash-all
fastboot reboot-bootloader
fastboot --set-active=_b
flash-all
fastboot reboot
adb reboot bootloader
fastboot boot twrp-3.3.0-0-blueline.img
Note the TWRP image is the latest - 3.3.0.
I've also tried flashing the Magisk-patched boot, using the following:
Code:
fastboot flash boot patched_boot.img
...and...
Code:
fastboot flash boot_a patched_boot.img
fastboot flash boot_b patched_boot.img
Everything reports success while flashing, but won't boot.
One more thing I could try is an updated ADB/Fastboot. Mine is probably a little dated, though I wouldn't expect that would have any ramifications for flashing with TWRP.

tenthousandfeet said:
Here's what I did to get both slots:
Code:
fastboot --set-active=_a
flash-all
fastboot reboot-bootloader
fastboot --set-active=_b
flash-all
fastboot reboot
adb reboot bootloader
fastboot boot twrp-3.3.0-0-blueline.img
Note the TWRP image is the latest - 3.3.0.
I've also tried flashing the Magisk-patched boot, using the following:
Code:
fastboot flash boot patched_boot.img
...and...
Code:
fastboot flash boot_a patched_boot.img
fastboot flash boot_b patched_boot.img
Everything reports success while flashing, but won't boot.
One more thing I could try is an updated ADB/Fastboot. Mine is probably a little dated, though I wouldn't expect that would have any ramifications for flashing with TWRP.
Click to expand...
Click to collapse
It still looks like your boot slot ended up the one you had tried already (b), since you changes to a and ran flash-all, changed back to b and ran flash-all and rebooted. As for the old platform tools, that could definnitly have an impact on running the fastboot of the patched boot. Other than that, I think a flash-all with the -w is the only approach left.

I'm also in the same boat. I've tried all the various install methods, and done the double "flash-all" on both slots, and no matter what, it ends in a bootloop.
Haven't tried the -w yet so I'll be interested if anyone gives that a go. Until then I'm dying with no root

Guide for January 2021 OTA Android 11 and Restore Root?

Any guides available for this latest OTA security update to preserve or restore root after applying?
Haven't yet done this on a 4a. Last did something similar on a Pixel 3a, but don't want to risk assuming the steps are the same, or even similar.
Anyone succesfully applied the security update yet and been able to restore Magisk?

This is what i did:
1. download both the full OTA file and the factory image file.
2. extract the boot.img from the factory image
3. in magisk patch the extracted boot image, copy back to PC
4. apply update in recovery - adb sideload ota_file.zip
5. reboot to bootloader
6. flash your rooted boot image from step 3
7. reboot phone.
8. i failed safety net and had to install this module through magisk - https://github.com/kdrag0n/safetynet-fix

I downloaded and installed the Jan OTA before realizing the Magisk inactive slot trick was broken :-(
Instead of restarting (and losing root) I patched the latest booot.img, restarted to fastboot, flashed the patched boot... Now when I try to restart it's the black google screen for a while, then back to fastboot with "no valid slot to boot" massage. Any advice on how to fix this? Or if it can't be fixed, best way to start fresh with rooted factory rom? Thanks!

Just try to flash both slots:
fastboot flash boot_a boot.root.sunfish-rq1a.210105.002.img
fastboot flash boot_b boot.root.sunfish-rq1a.210105.002.img

mrpeters said:
Any guides available for this latest OTA security update to preserve or restore root after applying?
Haven't yet done this on a 4a. Last did something similar on a Pixel 3a, but don't want to risk assuming the steps are the same, or even similar.
Anyone succesfully applied the security update yet and been able to restore Magisk?
Click to expand...
Click to collapse
Yea its all basically the same procedure on all A/B devices today and Magisk!

Meth0d said:
Just try to flash both slots:
fastboot flash boot_a boot.root.sunfish-rq1a.210105.002.img
fastboot flash boot_b boot.root.sunfish-rq1a.210105.002.img
Click to expand...
Click to collapse
Thanks so much for the suggestion. Unfortunately that didn't work, still was getting to the black google screen for a couple min and then back to fastboot.
So I used google's flash link to install the newest version of stock ROM via chrome browser, and it worked, my data was preserved as well! Root was lost.
In case anyone else had this problem, when I went to re-root using fastboot flash boot (patched img) I was getting:
FAILED (remote: Failed to write to partition Not Found)
So I flashed as you described above to boot_a and boot_b and IT WORKED! THANK YOU!!

Android 12 Beta 2 Root Question

Hello.
I had root in beta 1 by flashing a modified boot image patched by magisk (after wiping my device and disabling verification on vbmeta with fastboot). I was able to boot into the system no problem and root was achieved.
Now that I have flashed Beta 2, I'm not able to root. I tried flashing disable verification with vbmeta but it won't go past the Google logo. It says the data is (damaged). I tried flashing just the modified boot image of Beta 2 (from magisk) and it says it's not able to verify the boot image. I also tried booting into the boot image, flashing magisk directly through the app, but when it reboots, it gives the same error.
The only thing I haven't tried is factory reset my data.
Any help would be appreciated, thanks.

Don't use the beta. That's why it's a beta there's always bound to be issues

thatsupnow said:
Don't use the beta. That's why it's a beta there's always bound to be issues
Click to expand...
Click to collapse
Will I have to wipe my data after flashing the modified vbmeta?

Machuda said:
Will I have to wipe my data after flashing the modified vbmeta?
Click to expand...
Click to collapse
I would just to be sure that all traces are gone

I ran into the same problem until I used the flash tool and disabled verity and verification. If you don't do this, you'll be unable to boot if you have a modified boot image.

To root Android 12 you have to flash the beta image and than do this:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Click to expand...
Click to collapse
And I think when you do a update, its broke the disabled verity & verification.
I find this and you can to update with this command
fastboot update --disable-verity --disable-verification image-redfin.zip
Click to expand...
Click to collapse
but I don't know I its work.

Where to get vbmeta.img for my phone

I followed a tutorial and it gave a single vbmeta.img file that it can be used for all Android devices. Is this true or does each device have its own vbmeta.img file? If Each device has its own then where can I get that of my phone (Tecno Spark 4 KC8 Android 10)? Can I get it from the Stock Firmware? If yes how do I go about it? If no then how can I get it
Please I need help.

Sakodie King TI said:
I followed a tutorial and it gave a single vbmeta.img file that it can be used for all Android devices. Is this true or does each device have its own vbmeta.img file? If Each device has its own then where can I get that of my phone (Tecno Spark 4 KC8 Android 10)? Can I get it from the Stock Firmware? If yes how do I go about it? If no then how can I get it
Please I need help.
Click to expand...
Click to collapse
vbmeta.img is unique for the phone model.
you can get it be extracting your stock firmware.

Kenora_I said:
vbmeta.img is unique for the phone model.
you can get it be extracting your stock firmware.
Click to expand...
Click to collapse
Hi #[email protected] thanks very much. So you mean if I extract the stock firmware of my model I should be able to see a file named vbmeta right (or do I need to go an extra mile to get the vbmeta file)? Now what of a blank (empty) vbmeta.img file. How do I get it because I need to flash it before flashing custom recovery? Also can I use a universal empty vbmeta.img as I saw on a tutorial or my model also has its specific empty vbmeta.img file?

The one in the tutorial.is fine.

Kenora_I said:
The one in the tutorial.is fine.
Click to expand...
Click to collapse
Um, So, To install TWRP, I need -dm-verity-opt-encrypt.zip and vbmeta.img. Should the Vbmeta, be specific for each device, only to install a custom rom? or also specific to install a recovery like TWRP, If I install TWRP, I still need the Vbmeta, to install custom roms, or I only need it when using ADB, Um, Also, Do I need no-verity-opt-encrypt, I saw a post, that I need to flash it in order to install the TWRP, If I dont need the dm-verity to install the TWRP, Can I directly flash vbmeta?
I saw this code to install TWRP on my device:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery TWRP.img
I need to ask 2 more things:
1) how to check if my device is compatible with No-verity-opt-Encrypt?
2) Differences between DM Verity, OPT Encrypt, and Force Encryption Disabler?
Why would I need to disable verity? What is No verity, and what is vbmeta?
Is there any FULL Comprehensive Tutorial on this mobile Custom Rom Cooking lecture, So that I could know about treble, recoveries, kernels, and etc. Please.
Thanks

Hi TechySkills see my answer in the next comment below for a clear explanation.

TechySkills said:
Um, So, To install TWRP, I need -dm-verity-opt-encrypt.zip and vbmeta.img. Should the Vbmeta, be specific for each device, only to install a custom rom? or also specific to install a recovery like TWRP, If I install TWRP, I still need the Vbmeta, to install custom roms, or I only need it when using ADB, Um, Also, Do I need no-verity-opt-encrypt, I saw a post, that I need to flash it in order to install the TWRP, If I dont need the dm-verity to install the TWRP, Can I directly flash vbmeta?
I saw this code to install TWRP on my device:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery TWRP.img
I need to ask 2 more things:
1) how to check if my device is compatible with No-verity-opt-Encrypt?
2) Differences between DM Verity, OPT Encrypt, and Force Encryption Disabler?
Why would I need to disable verity? What is No verity, and what is vbmeta?
Is there any FULL Comprehensive Tutorial on this mobile Custom Rom Cooking lecture, So that I could know about treble, recoveries, kernels, and etc. Please.
Thanks
Click to expand...
Click to collapse
[Links have been attached at the end of the explanation]...
I started this thread sometime ago and after following up, I have now documented everything.
-- DM-Verity (or Verified Boot), Forceencryption and SafetyNet are some basic Android security features. For security reasons, Android should boot with what the OEM has provided (modifications to partitions or modified/custom partitions are not trusted; the reason your phone won't boot or boots with a warning if you make changes to the OS).
-- DM-Verity checks for alterations when your phone is booting and if detected, Forceencryption encrypts the data partition to prevent a data breach. Meanwhile Safetynet is also triggered when you alter the OS and apps that depend on the strict Android security won't work well if SafetyNet fails.
-- TWRP (which can be flashed using: fastboot flash recovery TWRP.img)
is a custom recovery partition (not provided or approved by the OEM), GSI is a custom system partition (not approved by the OEM) and to install any custom partition, it is wise to disable the security barriers (Forceencryption, DM-Verity). As you are taking over control of your phone, whatever issue you fall into afterwards should be addressed to yourself.
-- In older Android versions, DM-verity sits in the boot partition. But in recent Android versions (9, 10, etc), it sits in the dedicated vbmeta partition and that is why you have to flash an empty/signed vbmeta image (using:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img) to bypass DM-Verity. Google has a universal vbmeta image that works for all devices. For Forceencryption, you need to flash a disabler zip like dm-verity-and-forceencrypt-disabler zip (also disables DM-verity) or no-verity-opt-encrypt zip. Or you can also edit the vendor fstab file to remove encryption.
-- See What Is Verified Boot (DM-Verity) In Android And How To Disable It https://sakophone.wordpress.com/202...ce=728bab228a&preview=true&_thumbnail_id=4446
-- See Encryption, Decryption And Forceencryptin https://sakophone.wordpress.com/2022/01/03/encryption-decryption-and-forceencryptin/#forceencryption

Hello,
1. In the first link you gave, It says, that, after flashing a custom recovery, flash forceencryption, I don't know how to flash forceencryption through adb, cuz, If i just flash the TWRP, and boot, In my guess, It will not open, unless you flash the forceencrytption.
2. As you said in your reply, "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" So this removes the need to flash the zip file as mentioned in the first step?? But right after you said that, You also need to flash the dm-verity zip file. I am very very confused.
3. Also, What is exactly vbmeta, I understood about dm-verity etc, But I am still confused about vbmeta, can you please comprehend it to me?
4. What is the need of rooting the phone, after unlocking the bootloader, like, why root phone, when the phone is already unlocked? Please remove these stupid confusions of mine.
Thanks

TechySkills said:
Hello,
1. In the first link you gave, It says, that, after flashing a custom recovery, flash forceencryption, I don't know how to flash forceencryption through adb, cuz, If i just flash the TWRP, and boot, In my guess, It will not open, unless you flash the forceencrytption.
2. As you said in your reply, "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" So this removes the need to flash the zip file as mentioned in the first step?? But right after you said that, You also need to flash the dm-verity zip file. I am very very confused.
3. Also, What is exactly vbmeta, I understood about dm-verity etc, But I am still confused about vbmeta, can you please comprehend it to me?
4. What is the need of rooting the phone, after unlocking the bootloader, like, why root phone, when the phone is already unlocked? Please remove these stupid confusions of mine.
Thanks
Click to expand...
Click to collapse
If you went through the guides I sent, you should have all your answers there.
1. The key used by DM-Verity is signed and kept in the vbmeta partition (from Android 8 onwards). Therefore you have to flash a vbmeta that has been signed or an empty vbmeta (that holds no key to do a check) to disable DM-VERITY.
2. vbmeta disables DM-verity and not Forceencryption. The disabler zips disable Forceencryption (and some disable DM-VERITY too). For zips that disable both Forceencryption and DM-Verity, you can use just it and not use the signed/empty vbmeta.
3. Your phone is protected out of the box for your own safety. If you want to take total control over it, you must alert the system by unlocking it (unlocking the bootloader). If you want to give back all the control to your phone, relock bootloader. Note that unlocking/locking bootloader wipes all your data so do backups first.
4. Bootloader is the first step and must be done, if not, the phone won't boot. After bootloader then comes turning off security barriers (DM-Verity, Forceencryption).
5. Though the steps might vary, they usually follow this manner:
• Unlock bootloader. Turn on the toggle in Developer options and then use fastboot to complete the unlocking
• Flash vbmeta to disable DM-VERITY
• Flash TWRP. Though Forceencryption has not been removed yet, TWRP will boot. Now format data in TWRP to temporarily make the phone decrypted. With a temporarily decrypted state, you can access your internal storage to select Forceencryption disabler zip. Flashing the zip makes decryption Permanent.
• You can now reboot or continue flashing other stuff like other recovery, GSI, custom ROM, magisk, etc. Most of them can be done from TWRP itself (the reason you need TWRP in the first place)
• Rooting is optional. You can decide not to root even if you have TWRP, custom ROM, etc. Some apps need superuser privileges to work and you can only use them in a rooted phone (the reason people root their phone). These apps are mostly those that modify the OS. Flashing magisk roots your phone.
Any doubts again?

Sakodie King TI said:
If you went through the guides I sent, you should have all your answers there.
1. The key used by DM-Verity is signed and kept in the vbmeta partition (from Android 8 onwards). Therefore you have to flash a vbmeta that has been signed or an empty vbmeta (that holds no key to do a check) to disable DM-VERITY.
2. vbmeta disables DM-verity and not Forceencryption. The disabler zips disable Forceencryption (and some disable DM-VERITY too). For zips that disable both Forceencryption and DM-Verity, you can use just it and not use the signed/empty vbmeta.
3. Your phone is protected out of the box for your own safety. If you want to take total control over it, you must alert the system by unlocking it (unlocking the bootloader). If you want to give back all the control to your phone, relock bootloader. Note that unlocking/locking bootloader wipes all your data so do backups first.
4. Bootloader is the first step and must be done, if not, the phone won't boot. After bootloader then comes turning off security barriers (DM-Verity, Forceencryption).
5. Though the steps might vary, they usually follow this manner:
• Unlock bootloader. Turn on the toggle in Developer options and then use fastboot to complete the unlocking
• Flash vbmeta to disable DM-VERITY
• Flash TWRP. Though Forceencryption has not been removed yet, TWRP will boot. Now format data in TWRP to temporarily make the phone decrypted. With a temporarily decrypted state, you can access your internal storage to select Forceencryption disabler zip. Flashing the zip makes decryption Permanent.
• You can now reboot or continue flashing other stuff like other recovery, GSI, custom ROM, magisk, etc. Most of them can be done from TWRP itself (the reason you need TWRP in the first place)
• Rooting is optional. You can decide not to root even if you have TWRP, custom ROM, etc. Some apps need superuser privileges to work and you can only use them in a rooted phone (the reason people root their phone). These apps are mostly those that modify the OS. Flashing magisk roots your phone.
Any doubts again?
Click to expand...
Click to collapse
Um, No, Thank you very very very much, You literally fixed all my confusions, I actually bricked my phone and had to go to support office previous month, and pay 2$ (500PKR) to fix it. That is why, I was asking and clearing my confusions. Thank you, Now I am very confident, That, I can now flash my device. Thank you!

TechySkills said:
Um, No, Thank you very very very much, You literally fixed all my confusions, I actually bricked my phone and had to go to support office previous month, and pay 2$ (500PKR) to fix it. That is why, I was asking and clearing my confusions. Thank you, Now I am very confident, That, I can now flash my device. Thank you!
Click to expand...
Click to collapse
Good to hear
{Mod edit: Quotation fixed - Oswald Boelcke, Moderator}

Sakodie King TI said:
[Links have been attached at the end of the explanation]...
I started this thread sometime ago and after following up, I have now documented everything.
-- DM-Verity (or Verified Boot), Forceencryption and SafetyNet are some basic Android security features. For security reasons, Android should boot with what the OEM has provided (modifications to partitions or modified/custom partitions are not trusted; the reason your phone won't boot or boots with a warning if you make changes to the OS).
-- DM-Verity checks for alterations when your phone is booting and if detected, Forceencryption encrypts the data partition to prevent a data breach. Meanwhile Safetynet is also triggered when you alter the OS and apps that depend on the strict Android security won't work well if SafetyNet fails.
-- TWRP (which can be flashed using: fastboot flash recovery TWRP.img)
is a custom recovery partition (not provided or approved by the OEM), GSI is a custom system partition (not approved by the OEM) and to install any custom partition, it is wise to disable the security barriers (Forceencryption, DM-Verity). As you are taking over control of your phone, whatever issue you fall into afterwards should be addressed to yourself.
-- In older Android versions, DM-verity sits in the boot partition. But in recent Android versions (9, 10, etc), it sits in the dedicated vbmeta partition and that is why you have to flash an empty/signed vbmeta image (using:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img) to bypass DM-Verity. Google has a universal vbmeta image that works for all devices. For Forceencryption, you need to flash a disabler zip like dm-verity-and-forceencrypt-disabler zip (also disables DM-verity) or no-verity-opt-encrypt zip. Or you can also edit the vendor fstab file to remove encryption.
-- See What Is Verified Boot (DM-Verity) In Android And How To Disable It https://sakophone.wordpress.com/202...ce=728bab228a&preview=true&_thumbnail_id=4446
-- See Encryption, Decryption And Forceencryptin https://sakophone.wordpress.com/2022/01/03/encryption-decryption-and-forceencryptin/#forceencryption
Click to expand...
Click to collapse
So, I want to install twrp to install a custom rom, but you said if I want to change from miui to a custom rom, it needs a file called "vbmeta" but after I did a search, the vbmeta file is only needed if the device is running Android 8 and above, whereas my device is on Android 7 | MIUI 10 | Santoni, and it says it only needs DM-verity? What should I do to be able to install a custom ROM?

kjisoo said:
So, I want to install twrp to install a custom rom, but you said if I want to change from miui to a custom rom, it needs a file called "vbmeta" but after I did a search, the vbmeta file is only needed if the device is running Android 8 and above, whereas my device is on Android 7 | MIUI 10 | Santoni, and it says it only needs DM-verity? What should I do to be able to install a custom ROM?
Click to expand...
Click to collapse
vbmeta was introduced starting Android 8, so no need looking for a vbmeta if you are on Android 7. Starting Android 7, dm-verity had to be strictly enforcing (optional). If this is your case, then you can disable it in Android 7 by using flasher zips. Everything is in this guide.
What Is Verified Boot (DM-Verity) In Android And How To Disable It
Last Updated: February/21/2023 Contents Getting Started What Actually Is Verified Boot And Dm-Verity In Android How Verified Boot And DM-Verity Work In Older Devices (Android 7 And Below) How Verif…
sakophone.wordpress.com

@Kenora_I hi, maybe you know. I have Redmi 9 with soft upgraded to android 12.1 and i wanted boot temporary to SHRP. I tried fasboot flash recovery shrp.img and fasboot reboot recovery after but my device did not boot to recovery but started normally into system. May it be problem with vbmeta? My device ia A partition only.

Slawek_ said:
@Kenora_I hi, maybe you know. I have Redmi 9 with soft upgraded to android 12.1 and i wanted boot temporary to SHRP. I tried fasboot flash recovery shrp.img and fasboot reboot recovery after but my device did not boot to recovery but started normally into system. May it be problem with vbmeta? My device ia A partition only.
Click to expand...
Click to collapse
PART 1:
Maybe your device lacks recovery partition (common with new and AB slot devices). If this is so, "fastboot flash recovery shrp.img" won't work because there's no recovery partition (recovery now sits in boot partition as boot-ramdisk).
Such devices need two recovery files: img and zip. If you have the two, the ZIP should be in your phone and the img in your PC then first boot the SHRP:
fastboot boot shrp.img
When recovery boots up, locate and flash the ZIP then from SHRP, reboot recovery and enjoy.
NB: I am assuming the name of your img file is shrp.img which might differ.
PART 2:
However, if you are sure your device is A-only, then here you go (make sure the shrp.img is the one for your device and you have the universal vbmeta disable):
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash recovery shrp.img
## For AB devices with recovery partition, you can specify slot
fastboot flash recovery_a shrp.img
fastboot flash recovery_b shrp.img
Fastboot reboot
NB: You can choose to boot shrp (instead of permanently install) if you want to use it just now:
fastboot boot shrp.img

Hi @Sakodie King TI ,
I tried fastboot boot command but im getting "too many links error."
Treble check saying my phone is A partition only.
I also checked
fastboot flash recovery shrp.img
then rebooting manualy by volume up + pwr but then im getting bootloop while holding these keys.
That is why i asked is this can be caused by vbmeta.

Sakodie King TI said:
Maybe your device lacks recovery partition (common with new and AB slot devices). If this is so, "fastboot flash recovery shrp.img" won't work because there's no recovery partition (recovery now sits in boot partition as boot-ramdisk).
Such devices need two recovery files: img and zip. If you have the two, the ZIP should be in your phone and the img in your PC then first boot the SHRP:
fastboot boot shrp.img
When recovery boots up, locate and flash the ZIP then from SHRP, reboot recovery and enjoy.
NB: I am assuming the name of your img file is shrp.img which might diffe
Click to expand...
Click to collapse
Slawek_ said:
Hi @Sakodie King TI ,
I tried fastboot boot command but im getting "too many links error."
Treble check saying my phone is A partition only.
I also checked
fastboot flash recovery shrp.img
then rebooting manualy by volume up + pwr but then im getting bootloop while holding these keys.
That is why i asked is this can be caused by vbmeta.
Click to expand...
Click to collapse
Did you flash vbmeta first?
And try "fastboot reboot recovery" after flashing instead of using volume keys

I did not flash vbmeta at all. I'm afraid i will brick device.
Shouldn't shrp boot temporary without flashing vbmeta?

Slawek_ said:
I did not flash vbmeta at all. I'm afraid i will brick device.
Shouldn't shrp boot temporary without flashing vbmeta?
Click to expand...
Click to collapse
You have to flash vbmeta first. instead, doing it without flashing vbmeta means you are looking for ways to brick your device.

Hey @Sakodie King TI
So i did this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After reboot recovery i got rebooted to system not recovery.
Also when i'm rebooting to recovery manually, i'm still on old muiu recovery nothing changed.
I took vbmeta from my firmware lancelot_eea_global_images_V13.0.3.0.SJCEUXM_20230111.0000.00_12.0_eea.
In that firmware there are also vbmeta_system.img and vbmeta_vendor.img maybe need to flash them also with --disable-verity --disable-verification parameters?

[Closed] Android 12 Update and Root ***Obsolete***

Update 12-16: I am closing this thread as it is no longer relevant. Please refer to this guide.

@V0latyle Can you help me out I installed a magisk module that caused a bootloop and I tried the adb wait-for-device shell magisk --remove-modules and it doesn't work for me I'm on the P5 a12 beta 5 I have since flashed the stock boot.img. What can I do to remove this module?

elong7681 said:
@V0latyle Can you help me out I installed a magisk module that caused a bootloop and I tried the adb wait-for-device shell magisk --remove-modules and it doesn't work for me I'm on the P5 a12 beta 5 I have since flashed the stock boot.img. What can I do to remove this module?
Click to expand...
Click to collapse
I'm honestly not that familiar with Magisk, sorry. I suggest you ask in the Magisk thread, they'll be of more help to you over there. Magisk modules live in /data, not /boot, so a data wipe would get rid of the module...and all your user data too.

V0latyle said:
I'm honestly not that familiar with Magisk, sorry. I suggest you ask in the Magisk thread, they'll be of more help to you over there. Magisk modules live in /data, not /boot, so a data wipe would get rid of the module...and all your user data too.
Click to expand...
Click to collapse
Ok thanks for your help I appreciate it

elong7681 said:
@V0latyle Can you help me out I installed a magisk module that caused a bootloop and I tried the adb wait-for-device shell magisk --remove-modules and it doesn't work for me I'm on the P5 a12 beta 5 I have since flashed the stock boot.img. What can I do to remove this module?
Click to expand...
Click to collapse
Wiki:
Module Issues:Magisk and MagiskHide Installation and Troubleshooting guide
www.didgeridoohan.com
Scroll down to read how to disable modules through Safe Mode
There is also a section how to manage modules from custom Recovery (if TWRP applies to your phone)

You seem to understand the issue with vmeta (and the associated data wipe). So I went from android 11 to android 12 beta without a wipe and although on andorid 11 i could flash my kernels, on android 12 i cannot without vmeta/wipe. I thought I read that it was because 12 was in beta. I plan to flash the factory image of 12 today, withotu doing a wipe of course. Will i be able to flash my custom kernles again?

How do we get in the download mode to install the OTA?
I do use adb reboot recovery
but every time, I got this.
E:\platform-tools>adb sideload E:\platform-tools\blueline-ota-sp1a.210812.015-cee465f5.zip
adb: sideload connection failed: device unauthorized.
This adb server's $ADB_VENDOR_KEYS is not set
Try 'adb kill-server' if that seems wrong.
Otherwise check for a confirmation dialog on your device.
adb: trying pre-KitKat sideload method...
adb: pre-KitKat sideload connection failed: device unauthorized.
This adb server's $ADB_VENDOR_KEYS is not set
Try 'adb kill-server' if that seems wrong.
Otherwise check for a confirmation dialog on your device.
E:\platform-tools>adb sideload E:\platform-tools\blueline-ota-sp1a.210812.015-cee465f5.zip
adb: sideload connection failed: no devices/emulators found
adb: trying pre-KitKat sideload method...
adb: pre-KitKat sideload connection failed: no devices/emulators found

ShadowJP88 said:
How do we get in the download mode to install the OTA?
I do use adb reboot recovery
but every time, I got this.
.....
Click to expand...
Click to collapse
Once you're in recovery, are you going into ADB sideload (hold the power button, then press the volume up key, then choose "Apply update from ADB")?

kfhughes said:
Once you're in recovery, are you going into ADB sideload (hold the power button, then press the volume up key, then choose "Apply update from ADB")?
Click to expand...
Click to collapse
I can't find out how... I only have the droid page with "no command" text

sorry i cant understand this:
* If, after flashing a patched boot image, you get the "unable to load/verify boot image", you probably didn't get the flags quite right. Just reflash vbmeta with the disable flags and that should fix the problem.
pixel 5 here, unlocked bootloader, did a clean flash, booted magisk , after direct install and restart i was stuck at booloader menu with that message, i don't understand what i have to do reading your post
where can i do this and how? Just reflash vbmeta with the disable flags
i had to clean flash again to use the phone

For re-flashing the vbmeta.img, my command has always been a little different than yours.
I use: fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
It's only a little different and your way might work, but if anyone has issues you could try this different command instead.

ShadowJP88 said:
I can't find out how... I only have the droid page with "no command" text
Click to expand...
Click to collapse
Hold down the power button and tap volume up to bring up the recovery menu.

V0latyle said:
With the Android 12 stable release just around the corner, I would like to make sure we have clear instructions on how to update with root.
These instructions work with the beta as well. This may seem redundant compared to other threads, but I wanted to consolidate the relevant information to one place.
WARNING: MANUALLY INSTALLING FACTORY UPDATES OR IMAGES REQUIRES AN UNLOCKED BOOTLOADER. If your bootloader is locked, DO NOT ATTEMPT THIS. You can, however, update using the OTA via ADB Sideload on a locked bootloader. DO NOT INSTALL THE BETA OTA WITH A LOCKED BOOTLOADER. BETA SOFTWARE IS EXPERIMENTAL AND MAY BE UNSTABLE, AND YOU MAY BE UNABLE TO RECOVER YOUR DEVICE IF SOMETHING GOES WRONG.
WARNING: MODIFY YOUR DEVICE AT YOUR OWN RISK. YOU ALONE WILL BE RESPONSIBLE FOR MALFUNCTION, DAMAGE, OR LOSS OF ANY KIND IF SOMETHING GOES WRONG.
Root will be done via Magisk. If you aren't already using it, download and install to your phone.
Warning: For the sake of simplicity, I frequently will use generalizations when referring to files ("[patched boot image]" instead of "magisk_patched-23001_xxxxx.img" for example). It is YOUR RESPONSIBILITY to ensure you are flashing the correct file. The easiest way to do this is type the command in the command line without the file itself, then drag and drop the file you want to flash into the command line window.
For those of you with a locked bootloader:
Simply install the update as usual via OTA, whether automatically through Android Update, or manually via adb sideload.
First, a bit of information on why you need to follow this guide (See this post)
Two new Verified Boot features implemented in Android 12 will interfere with attempts to root. A more detailed explanation is below if you would like.
Spoiler
Dm-verity (device-mapper-verity) is a method by which an image on block devices (the underlying storage layer of the file system) can be checked to determine if it matches an expected configuration, using a cryptographic hash tree. If the hash doesn't match, dm-verity prevents the stored code from loading.
Vbmeta verification is the other half of this - it provides a cryptographically signed reference hash which is used to verify the integrity of /boot, /system, and /vendor partitions. The vbmeta image is only used to verify /boot, while vbmeta-system is used to verify /system.
This was implemented to prevent persistent rootkits by means of a hardware level security check, to prevent "potentially harmful applications" such as Magisk from evading detection, as such applications residing within the kernel will have higher privileges than the detection applications.
What this means is that with these two enabled, a modified boot image will cause a verification error when flashed to the device, preventing boot. Interestingly, this check is not performed against "live" boot images loaded via ADB, so with dm-verity and vbmeta verification enabled, a modified image can be booted as long as the image in /boot is intact.
To update to Android 12 with data intact and reroot:
WARNING: Per Google, an Android 12 OTA should only be installed on a device running 12 DP or 12 Beta. However, other users were able to manually install the OTA via ADB without losing data, so DO THIS AT YOUR OWN RISK! It is currently unknown what Google's official instructions will be for installing the update, so the "best" current method is wait for automatic OTA.
Spoiler
If you update via automatic OTA:
1. Download the factory image (Yes, this is required) to your computer. Connect your device via USB.
2. Extract the contents of the factory image, then extract both boot.img and vbmeta.img from the image-[device].zip (where [device] is the codename for your device, such as Redfin for Pixel 5
3. Continue to Reflash vbmeta below
To manually install the OTA:
1. Download the OTA for your device, as well as the factory image (Yes, you need both) to your computer.
2. Install the OTA
3. Extract the contents of the factory image, then extract both boot.img and vbmeta.img from the image-[device].zip (where [device] is the codename for your device, such as Redfin for Pixel 5
4. Let the update complete, including reboot. Wait until you are in /system with the update process finished (no update notification)
5. Continue to Reflash vbmeta below
Reflash VBmeta
1. With device connected via USB, Developer Options enabled and USB Debugging enabled, reboot to bootloader using ADB:
Code:
adb reboot bootloader
2. Reflash vbmeta with dm-verity and boot verification disabled:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
3. Reboot to bootloader:
Code:
fastboot reboot bootloader
Continue to Patch Boot Image below.
To update to Android 12 using Android Flash Tool:
Spoiler
1. Open this link in Google Chrome (DO NOT USE MICROSOFT EDGE OR MOZILLA FIREFOX) Here is the link for beta
2. Connect your device via USB (make sure USB Debugging is enabled)
3. Enable ADB access in the browser
4. Select your device
5. Select the Android 12 build
6. IMPORTANT: Click the pencil icon next to the selected build
7. Ensure Wipe Device, Disable Verification, and Disable Verity are checked. DATA WIPE IS REQUIRED when updating from an older version of Android. Don't lock your bootloader if you want root. Force flash all partitions should not be necessary (but use this if you've run into problems and are starting over). Skip Secondary and Force Debuggable should be unchecked, unless you want to use ADB for root access on the stock kernel for some reason.
8. Click Install Build.
9. Wait until the update finishes.
10. Continue to Patch Boot Image below.
To update to Android 12 via ADB using the factory image:
Spoiler
1. Download the factory image to your computer and connect your device via USB, with USB debugging enabled.
2. Extract the contents of the factory ZIP
3. Reboot to bootloader:
Code:
adb reboot bootloader
4. If necessary, update the bootloader: WARNING: IF DONE INCORRECTLY THIS WILL BRICK YOUR DEVICE!
Code:
fastboot flash bootloader [bootloader image]
Reboot back to bootloader.
5. If necessary, update the radio:
Code:
fastboot flash radio [radio image]
Reboot to bootloader.
6. Install the update:
Code:
fastboot --disable-verity --disable-verification -w update [factory image zip]
DATA WIPE IS REQUIRED when updating from an older version of Android.
7. Let the update complete
8. Continue to Patch Boot Image below
Patch Boot Image:
Spoiler
1. Extract boot.img from the factory image ZIP if you haven't done so already
2. Install Magisk on your phone
3. Move the boot image to your phone via USB, and patch it using "Select and Patch a File" in Magisk
4. Move the patched boot image back to your PC
5. Reboot to bootloader
6. Flash the patched boot image:
Code:
fastboot flash boot [patched boot image]
7. Reboot to system.
For subsequent updates to Android 12:
Either install the update via OTA Sideload, then reflash vbmeta with disable flags set, or dirty flash the factory image with disable flags set.
Live boot your patched boot image from bootloader (as long as you're still on Android 12, the old kernel should work fine):
Code:
fastboot boot [patched boot image]
In system, launch Magisk then select "Direct Install" to patch the stock image in /boot.
Key reminders:
* The OTA does not have a way to set the disable flags for vbmeta, so if you update via OTA, you will have to reflash vbmeta with the disable flags every time you update.
* If you forget to do this and have a patched boot image, bootloader will return an error: "failed to load/verify boot image"
* The fastest and easiest way to update is via OTA, but remember you will lose root until you're able to reflash vbmeta and repatch the boot image.
* Manually patching the new boot image in Magisk via "Select and Patch a File" should be unnecessary every time you update. You can, instead, just keep the image you originally patched, boot it every time you update, and flash the stock image in /boot using Magisk.
* If, after flashing a patched boot image, you get the "unable to load/verify boot image", you probably didn't get the flags quite right. Just reflash vbmeta with the disable flags and that should fix the problem.
Click to expand...
Click to collapse
@V0latyle I think I know why some people are having issues with obtaining root or maintaining root on Android 12 official release... When you use the following command,
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
I think after this command and then flashing the patched magisk boot image their might be a check on both slots. Would I be wrong suggesting for the disable vbmeta command be this instead?
Code:
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
I was having the same issue where it was saying that the system was corrupt and having to do a factory wipe after doing the command without --slot=all for the vbmeta disable flag command.

rester555 said:
@V0latyle I think I know why some people are having issues with obtaining root or maintaining root on Android 12 official release... When you use the following command,
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
I think after this command and then flashing the patched magisk boot image their might be a check on both slots. Would I be wrong suggesting for the disable vbmeta command be this instead?
Code:
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
I was having the same issue where it was saying that the system was corrupt and having to do a factory wipe after doing the command without --slot=all for the vbmeta disable flag command.
Click to expand...
Click to collapse
I haven't read his full instructions hidden behind the spoiler tags, but in my experience after flashing the vbmeta.img the first time, I needed to follow it with "fastboot -w" and wipe my phone, then flash the patched boot.img.
On subsequent updates as long as I booted to bootloader immediately after flashing the OTA.zip to flash vbmeta, I didn't have to wipe. If I boot to system by mistake, I'll need to fastboot -w again

rester555 said:
@V0latyle I think I know why some people are having issues with obtaining root or maintaining root on Android 12 official release... When you use the following command,
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
I think after this command and then flashing the patched magisk boot image their might be a check on both slots. Would I be wrong suggesting for the disable vbmeta command be this instead?
Code:
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
Click to expand...
Click to collapse
xunholyx said:
I haven't read his full instructions hidden behind the spoiler tags, but in my experience after flashing the vbmeta.img the first time, I needed to follow it with "fastboot -w" and wipe my phone, then flash the patched boot.img.
On subsequent updates as long as I booted to bootloader immediately after flashing the OTA.zip to flash vbmeta, I didn't have to wipe. If I boot to system by mistake, I'll need to fastboot -w again
Click to expand...
Click to collapse
@xunholyx I did what you suggested, flashing the vbmeta.img and then patching the magisk boot image and I got the corrupt system message in recovery. So I ended up reflashing stock image with wipe through adb.. did minimal initial setup, then reflashed the vbmeta.img to all slots and then immediately flashed the patched magisk image. That seemed to work for me to gain root on A12.

Did as you showed , and it works well .Thank!

4a 5G here (sorry, I know that this is the section for Pixel 5, but I assume most or all things are the same). I rushed and installed the OTA the normal way, thinking I'll be able to patch and flash boot.img afterwards (like normally). Update went fine (upgrading from 11, haven't used any of the DPs/betas), but after I flash the patched boot.img, I get "failed to load/verify boot images" in fastboot. Am I out of luck?

rester555 said:
@V0latyle I think I know why some people are having issues with obtaining root or maintaining root on Android 12 official release... When you use the following command,
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
I think after this command and then flashing the patched magisk boot image their might be a check on both slots. Would I be wrong suggesting for the disable vbmeta command be this instead?
Code:
fastboot --disable-verity --disable-verification flash --slot=all vbmeta vbmeta.img
I was having the same issue where it was saying that the system was corrupt and having to do a factory wipe after doing the command without --slot=all for the vbmeta disable flag command.
Click to expand...
Click to collapse
So are you saying that using the slot all flag fixed your problem?

killchain said:
4a 5G here (sorry, I know that this is the section for Pixel 5, but I assume most or all things are the same). I rushed and installed the OTA the normal way, thinking I'll be able to patch and flash boot.img afterwards (like normally). Update went fine (upgrading from 11, haven't used any of the DPs/betas), but after I flash the patched boot.img, I get "failed to load/verify boot images" in fastboot. Am I out of luck?
Click to expand...
Click to collapse
Did you follow the instructions on flashing vbmeta with the disable flags set?

Another 4a 5G owner here. I installed the OTA via recovery yesterday and tried to flash a patched boot.img, but got "failed to load/verify boot images". Reanimated the phone using a factory image, then tried to flash vbmeta.img with verification disabled (but no wipe) and patched boot.img. The phone couldn't boot into the system and offered to perform factory reset. I didn't want to wipe anything so I didn't go with it, but it seems like there is no way to root 4a 5G and keep your data (at least for now).
But I will be happy to be proven wrong!