Database Info

How to go back from custom rom to factory

files are from current available factory image available. be sure to use latest available fastboot application.
1. reboot to fastboot
2. fastboot erase userdata (all data is deleted, have a backup)
3. fastboot reboot-bootloader
4. fastboot flash bootloader bootloader-sunfish-s5-0.2-6539975.img
5. fastboot reboot-bootloader
6. fastboot flash radio radio-sunfish-g7150-00018-200701-b-6643937.img
7. fastboot reboot-bootloader
8. fastboot update image-sunfish-rp1a.201005.006.zip
9. fastboot reboot-bootloader
10. choose recovery
11. on the android icon with the red warning shield hold power and press volume up
12. Stock recovery appears. Choose wipe data / factory reset
if in any case the fastboot command gets stuck, replug the device and/or restart bootloader. BE CAREFULL WHEN DOING THIS WHILE RUNNING fastboot flash bootloader !!!!BRICK POSSIBLE!!!!!
After that you can boot up and see its working.
if everything is right, you should flash both slots before
relocking bootloader
so repeat above steps and do point 4. and 6. fastboot flash with
fastboot flash --slot all
from above steps. Check phone boots on both slots. Active slot can be switched via
fastboot --set-active=a
verify it boots then
fastboot --set-active=b
verify again it boots
then proceed with
fastboot flashing lock
(data will be wiped)

If you're doing it this way you should flash the images to both slots.
Fastboot flash bootloader --slot all (image)
Reboot bootloader
Fastboot flash radio --slot all (image)
Reboot bootloader
Then
Fastboot update (extracted sunfish folder)
Let it do its thing.
Incase there's any doubt on both slots being stock you can just adb sideload the OTA after you boot

Edmontonchef said:
If you're doing it this way you should flash the images to both slots.
Fastboot flash bootloader --slot all (image)
Reboot bootloader
Fastboot flash radio --slot all (image)
Reboot bootloader
Then
Fastboot update (extracted taimen folder)
Let it do its thing.
Incase there's any doubt on both slots being stock you can just adb sideload the OTA after you boot
Click to expand...
Click to collapse
indeed that is correct , ill add this to the post though in case something goes wrong i normally only affect active slot to reduce brick possibility

Is it safe to downgrade from 11 to 10 this way?

forty-second said:
Is it safe to downgrade from 11 to 10 this way?
Click to expand...
Click to collapse
Yes, just keep in mind whenever rolling back asb or android versions you'll have to format data.

You can do this in a more simple way by flash the stock image via official website from android, just click and follow the instruction

forty-second said:
Is it safe to downgrade from 11 to 10 this way?
Click to expand...
Click to collapse
from stock to stock its easier

I9602283 said:
You can do this in a more simple way by flash the stock image via official website from android, just click and follow the instruction
Click to expand...
Click to collapse
if that would be the case i would not have written this guide

It'll be nice when we have a working TWRP, then you can format data and flash/sideload an OTA if needed.

Edmontonchef said:
It'll be nice when we have a working TWRP, then you can format data and flash/sideload an OTA if needed.
Click to expand...
Click to collapse
Seems unlikely; lots of challenges getting custom recoveries working w/A11+

guide
r0tt0r said:
if that would be the case i would not have written this guide
Click to expand...
Click to collapse
Did you ever look at factory packs? It has flash_all scripts for Linux and Windows and its do all steps as needed.
Or I'm wrong?

boomo15 said:
Did you ever look at factory packs? It has flash_all scripts for Linux and Windows and its do all steps as needed.
Or I'm wrong?
Click to expand...
Click to collapse
go and unlock ur phone, flash superiorOS fe. (that was the one i was on) then go back to stock.
tell me if it was all so easy. this guide is meant if you run into issues like i did and i wanted to not have you struggle through the same.
if you think running "bat" without seeing any output of what is happening and sit for an hour without anything has happened at all cause fastboot is stuck, then do so and skip this thread.

Edmontonchef said:
If you're doing it this way you should flash the images to both slots.
Fastboot flash bootloader --slot all (image)
Reboot bootloader
Fastboot flash radio --slot all (image)
Reboot bootloader
Then
Fastboot update (extracted taimen folder)
Let it do its thing.
Incase there's any doubt on both slots being stock you can just adb sideload the OTA after you boot
Click to expand...
Click to collapse
Im confused when you mentioned "Fastboot update (extracted taimen folder)" taimen?
thanks is advance

mauri311 said:
Im confused when you mentioned "Fastboot update (extracted taimen folder)" taimen?
thanks is advance
Click to expand...
Click to collapse
Sorry I meant sunfish (brainfart)
When you extract the factory image a second folder will show up. It'll say image.sunfish.
You can type in the terminal ( fastboot update ) then drag and drop that folder. Works the same way as flash-all. Just update bootloader and radio first.

Not enough space
Hello,
I end at point 8:
error: failed to load 'image-sunfish-rp1a.201005.006.zip': Not enough space
How can I fix the problem ?

foxxof said:
Hello,
I end at point 8:
error: failed to load 'image-sunfish-rp1a.201005.006.zip': Not enough space
How can I fix the problem ?
Click to expand...
Click to collapse
it should be fixable by
fastboot erase system_a
or
fastboot erase system_b
depending on your current active slot.

r0tt0r said:
it should be fixable by
fastboot erase system_a
or
fastboot erase system_b
depending on your current active slot.
Click to expand...
Click to collapse
fastboot erase system_a
output :
erasing 'system_a' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.138s
fastboot erase system_b
output :
erasing 'system_b' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.147s
:crying:
i downloaded the latest sdk. (r30.0.5 not 30.0.4)
now it works!

foxxof said:
fastboot erase system_a
output :
erasing 'system_a' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.138s
fastboot erase system_b
output :
erasing 'system_b' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.147s
:crying:
i downloaded the latest sdk. (r30.0.5 not 30.0.4)
now it works!
Click to expand...
Click to collapse
btw the message partition should be erased in fastbootd is as far i know the recovery fastboot not the one coming at first (boot recovery, at little android press power+vol)

Partition should be erased in fastbootd
foxxof said:
fastboot erase system_a
output :
erasing 'system_a' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.138s
fastboot erase system_b
output :
erasing 'system_b' . . .
FAILED (remote: Partition should be erased in fastbootd)
finished. total time: 0.147s
Click to expand...
Click to collapse
adb reboot bootloader
fastboot reboot fastboot
fastboot erase system_a or system_b
---------- Post added at 02:45 PM ---------- Previous post was at 02:16 PM ----------
r0tt0r said:
go and unlock ur phone, flash superiorOS fe. (that was the one i was on) then go back to stock.
tell me if it was all so easy. this guide is meant if you run into issues like i did and i wanted to not have you struggle through the same.
if you think running "bat" without seeing any output of what is happening and sit for an hour without anything has happened at all cause fastboot is stuck, then do so and skip this thread.
Click to expand...
Click to collapse
Way! Why so much emotions over simple suggestion? You where unlucky and give people a guide in case which is replicate all commands from scripts. Good!
And for record my experience with this device in short!
Received – setup – Android 11 – OTA to 006 – Canary – root – boot – check all stuff – install my apps – check again – pm list for bloatware
flash superiorOS – make notes not working stuff – root – check again – same not working stuff
flash factory android 10 with flash_all – boot – check
flash CalyxOS – check – root – worked – back to stock with flash all Android 10 – check – all good
flash RR – check – root – buggy for me
flash Android 11 with flash_all – flash GrapheOS -- root -- some apps not working
flash SuperiorOS – root – flashed blu-spark kernel – remove unneeded stuff – restore backup – same bugs
flash factory – root – blu-spark – debloat – working on stock now.
All time I used flash-all and no any problems. And thank you for your suggestion to skip this tread!:good:

Awesome guide - Thank you!
FYI - To lock the bootloder, I had to use " fastboot flashing lock "

Unable to reinstall Oxygen OS from custom ROM. FAILED (remote: Flashing is not allowed for Critical Partitions ). Need assistance, details below.

Hello, friends. So I am here following this exact tutorial :
How to Restore OnePlus Nord Back to Stock OxygenOS Software - A Complete Guide
In this guide, we will show you how to restore the stock OxygenOS software on the OnePlus Nord by flashing the factory image/Fastboot ROM. Things like custom ROMs, TWRP, and Magisk root are pretty…
www.thecustomdroid.com
I currently am stuck there
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot flash abl abl.img
target reported max download size of 805306368 bytes
sending 'abl' (1996 KB)...
OKAY [ 0.055s]
writing 'abl'...
FAILED (remote: Flashing is not allowed for Critical Partitions
)
finished. total time: 0.057s
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot flashing unlock_critical
...
FAILED (remote: Device already : unlocked!)
finished. total time: 0.000s
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot flashing unlock
...
FAILED (remote: Device already : unlocked!)
finished. total time: 0.000s
Click to expand...
Click to collapse
I just simply do not understand what could be wrong here.
In fastoot mode I get "device - State unlocked"
As you already saw, it seems the device is completely unlocked. What could be wrong ?
Also, some steps before, I get that :
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot reboot fastboot
fastboot: usage: unknown reboot target fastboot
Click to expand...
Click to collapse
I suspect switching to the automated in Windows won't change much.
It is strange because I am able to perform these steps without problems, ones the ones after seem to not work :
./fastboot flash boot boot.img
./fastboot flash dtbo dtbo.img
./fastboot flash modem modem.img
./fastboot flash recovery recovery.img
./fastboot --disable-verity flash vbmeta vbmeta.img
./fastboot --disable-verity flash vbmeta_system vbmeta_system.img
Click to expand...
Click to collapse
I might be doing something wrong ? Be located in the wrong folder or something ? For instance, when I type these commands it does not work if I write the "./" before fastboot, it tells me
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ ./fastboot flash boot boot.img
bash: ./fastboot: No such file or directory
Click to expand...
Click to collapse
My phone is a Oneplus Nord and I am using the advised Oxygen OS ROM provided in the tutorial I linked at the beginning of my message.
I hope you'll be able to get me out of this as I unfortunately can't figure out how to solve this problem on my own.
Best regards

krakard said:
I might be doing something wrong ? Be located in the wrong folder or something ? For instance, when I type these commands it does not work if I write the "./" before fastboot, it tells me
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ ./fastboot flash boot boot.img
bash: ./fastboot: No such file or directory
Click to expand...
Click to collapse
Yes, that makes sense.
Fastboot should be located at /usr/bin/fastboot. Since you're not in that directory, ./fastboot won't work. (This ./ means: "Look at the current working directory for the command fastboot." If it cannot find fastboot there or it isn't a shell command, it will throw an error.)
However, since you didn't install fastboot globaly, you have to address its exact path inside your platform-tools folder. If fastboot is not in Partition-image folder, ./ won't work.
Can't help you with your main issue though.
Edit: You seem to have fastboot installed globally though:
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot reboot fastboot
fastboot: usage: unknown reboot target fastboot
Click to expand...
Click to collapse
So my first explaination is valid.

Thank you for clarifying that. I understand the issue there. Which is a non-issue indeed since I already installed it globally. But well, it at least teaches me how Linux work.
Of course however, the main issue remains that's for sure.

krakard said:
Thank you for clarifying that. I understand the issue there. Which is a non-issue indeed since I already installed it globally. But well, it at least teaches me how Linux work.
Of course however, the main issue remains that's for sure.
Click to expand...
Click to collapse
You're welcome.
BTW:
krakard said:
@pop-os:~/Desktop/platform-tools_r31.0.2-linux/platform-tools/Partition-image$ fastboot reboot fastboot
fastboot: usage: unknown reboot target fastboot
Click to expand...
Click to collapse
There is no "fastboot" to boot into. Instead, type
Code:
fastboot reboot bootloader
I didn't mention that yesterday for some reason.

Guys, here is where I am at now. Still struggling but I feel I am very near ! Some help maybe ?
https://forum.xda-developers.com/t/...your-device-to-oxygenos.4148415/post-85022511
best regards

SOLVED

krakard said:
SOLVED
Click to expand...
Click to collapse
How did you fixed this? I'm currently stuck at the same point as you with a oneplus 8

Same here, how did you managed to solve the "Flashing is not allowed for Critical Partitions: error with the fastboot ROM batch file?

mbootsman1 said:
Same here, how did you managed to solve the "Flashing is not allowed for Critical Partitions: error with the fastboot ROM batch file?
Click to expand...
Click to collapse
I found the solution, you have to do fastboot reboot fastboot which reboots you to fastbootd instead of fastboot. There you can flash critical partitions without issue.

Hi,
As the command recommanded everywhere :
Code:
fastboot flashing unlock_critical
had never worked for me in the bootloader environment,
I have to reboot i my rom embedded recovery in order to flash the file (apply update menu) through the :
fastbootD
To sum up :
#From Android (while having all prerequisite done ie bootloader unlocked...)
Code:
adb reboot bootloader
#From the bootloader I choose to boot to recovery and I get to the rom custom recovery
#In the custom recovery, I choose the menu "apply update" that will lead me to the fastbootD mode
#I type the appropriate command to flash the persist partition
Code:
fastboot flash persist "c:\your_path_to_your_persist_file\persist.img"
#Then I simply reboot the phone
Code:
fastboot reboot
PS : Initially flash the OxygenOS (OOS) 11, then apply the CRdroid Android v8 custom rom (based on Android 12)

I did it similar like solid-snake:
In my case I also had no access to fastbootD
The solution came randomly when I flashed back the first part from my lineageOS package:dtbo.img, vbmeta.img and the recovery.img --> after that my phone naturally booted in a fastbootD mode from the lineageOS package.
I modified the flash-all.bat from the stock ROM fastboot flash package:
I removed the line with the reboot command, because I'm already in the fastbootD mode.
Then I ran the modified flash-all.bat and everything went well.

If anyone else struggles (like I did) to get the phone in EDL mode, or the "Flashing is not allowed for Critical Partitions" error ,even if the "fastboot flashing unlock_critical" cmd was executed, here are some hints that might help.
I tried forever on a Linux computer without any luck, so I ended up installing Windows 10 on actual hardware to finally unbrick my One Plus Nord (Avicii). Here are the most important steps, YMMV, execute at own risk:
bcdedit.exe /set nointegritychecks off run this cmd as admin in terminal, toggle to "on"
then install edl drivers as admin, This is where I struggled the most, I finally found an .exe file(QDLoader HS-USB Driver_64bit_Setup.exe) that I just installed and then phone showed up as it should in device manager. ("Qualcomm HS-USB QDLoader 9008," not "QUSB_BULK")
install adb and fastboot. (platform-tools)
install MSM-Download-Tool
download stock OS for use in MSM-Download-Tool program
open msm tool, if phone is not recognised try turning on and holding power pluss both volume, or just one of the volumes.
uncheck the "sha hash check" box
flash
if you get the "Sahara Communication Failed", just try again, it worked for me.
wipe
erase Windows 10 and replace with any Linux distro, tell your PC it will never happen again.
enjoy
Here are link to the EDL-drivers that worked for me. Or just do a web-search for "QDLoader HS-USB Driver_64bit_Setup.exe"
The flashing process will take over 300 seconds, be patient.

Why use no-verity-opt-encrypt zip file?

I rooted my Chinese phone without a custom recovery (haven't bothered for last few phones).
However, I am considering putting TWRP on and when I had a quick look on the Internet to see if one was around for my phone (being a Chinese phone) I naturally came across rooting guides and I noticed they seem to talk about flashing a no-verity-opt-encrypt zip file.
I do not understand why this file is needed?
To cut a long story short...
I extracted what I needed from the stock rom, patched with Magisk as normal and flashed using fastboot.
Then to bypass a bootloop from a signature mismatch because of Android verified boot, I flashed vbmeta using the following options:
--disable-verity --disable-verification
Android boots fine and my device is rooted (verified by Magisk and root checker app).
So why is there the need to flash the additional file no-verity-opt-encrypt zip?
People seem to be using it on many devices so there must be a reason I am missing.

Point is: your Chinese phone is not the only phone China produced. In my Chinese phone you cannot flash neither modified boot.img nor modified recovery.img. If you try, phone swithes to red state
And my Chinese phohe has empty vbmeta partition (ROM is based on android 8.1), so, evidently, it is not vbmeta but some other mechanism that prevents me from rooting my phone or from flashing TWRP/boot. And for those who are proud owners of such ****ty Chinese phones like mine, using verity disabler script might be the last resourt.
I'll tell you even more: with your Chinese phone you still could flash vbmeta using fastboot. Ho-ho-ho-ho.... Not true Chinese phone. Look at mine! It does NOT allow you to use fastboot for flashing. That is real Chinese phone!!
/However, I have no idea how am I supposed to flash verity disabler script if I don't have TWRP... If someone could help me with that.../

I am not sure you understand what I mean (sorry I probably was not clear).
Red State is absolutely correct for what you have done AND more importantly for you, if you copy the way I have done it you should remove the verification.
Your phone should return to Orange State and your device will be rooted without the need to flash/use TWRP or the no-verity-opt-encrypt zip file.
However, I do not understand what you mean when you say you can't flash using fastboot?
If I remember correctly, when my phone was in Red State it was difficult to enter Fastboot because it was in a Bootloop, but once you do you can flash as normal?
I can only give you advice flashing by Fastboot. So assuming you can (as above) then forget what the guides tell you and simply do this...
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot reboot
Your phone should reboot, show Orange state and boot into Android. If you patched with Magisk correctly it should be rooted. You can verify this in the Magisk app and any root checker app.
Note: I am using Android 10 not 8

Bondyuk said:
However, I do not understand what you mean when you say you can't flash using fastboot?
Click to expand...
Click to collapse
Better to see it once than to hear many times. This is how true Chinese phone (mine) behaves:
Code:
Z:\android\adb>adb reboot bootloader
Z:\android\adb>fastboot flash vbmeta vbmeta.img
Sending 'vbmeta' (4 KB) OKAY [ 0.006s]
Writing 'vbmeta' FAILED (remote: 'unknown command')
fastboot: error: Command failed
Z:\android\adb>fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.009s]
Writing 'vbmeta' FAILED (remote: 'unknown command')
fastboot: error: Command failed
Z:\android\adb>
Apart from this ugly fastboot implementation I should stress once again that vbmeta partition on my device is blank meaning the partition has all zeroes. Also, this partition is NOT supposed to be flashed when I flash stock ROM. Here's what is there in rawprogram0.xml:
Code:
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmeta" ...
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmetabak" ...
To sum up: I do not believe any vbmeta juggling would help me.

Bondyuk said:
Red State is absolutely correct for what you have done
Click to expand...
Click to collapse
Are you saying any boot.img properly patched by Magisk and flashed to the phone should cause red state?

vp1117 said:
Better to see it once than to hear many times. This is how true Chinese phone (mine) behaves:
Code:
Z:\android\adb>adb reboot bootloader
Z:\android\adb>fastboot flash vbmeta vbmeta.img
Sending 'vbmeta' (4 KB) OKAY [ 0.006s]
Writing 'vbmeta' FAILED (remote: 'unknown command')
fastboot: error: Command failed
Z:\android\adb>fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.009s]
Writing 'vbmeta' FAILED (remote: 'unknown command')
fastboot: error: Command failed
Z:\android\adb>
Apart from this ugly fastboot implementation I should stress once again that vbmeta partition on my device is blank meaning the partition has all zeroes. Also, this partition is NOT supposed to be flashed when I flash stock ROM. Here's what is there in rawprogram0.xml:
Code:
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmeta" ...
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmetabak" ...
To sum up: I do not believe any vbmeta juggling would help me.
Click to expand...
Click to collapse
What happens when you try this:
adb reboot bootloader
fastboot unlock flash
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
There should actually be two implementations of Fastboot. The main one you reboot into and another called Fastboot.d within the recovery.

vp1117 said:
Are you saying any boot.img properly patched by Magisk and flashed to the phone should cause red state?
Click to expand...
Click to collapse
I am not sure, it does on mine.
The device verifies the boot.img checksum to make sure it is original/stock. Because Magisk modifies the boot.img it will no longer pass verification and puts the device into Red state.
As far as I am aware this is part of AVB so it only affects devices using it. I am not sure when it was implemented (Android 8, 9 or 10)

Bondyuk said:
What happens when you try this:
fastboot unlock flash
Click to expand...
Click to collapse
This command does not exist. Probably what you meant me to try is this:
Z:\android\adb>fastboot flashing unlock
FAILED (remote: ' Device already : unlocked!')
fastboot: error: Command failed
Z:\android\adb>
Bondyuk said:
There should actually be two implementations of Fastboot. The main one you reboot into and another called Fastboot.d within the recovery.
Click to expand...
Click to collapse
Fastboot.d is something which was introduced in A10. I'm on A8.

Bondyuk said:
Because Magisk modifies the boot.img it will no longer pass verification and puts the device into Red state.
Click to expand...
Click to collapse
Then every phone owner would shout "It does not work!" and magisk project would be closed soon. However, it does not happen. It means that only selected models are built in such a nasty way that they expect modified partition to be signed by vendor's key.
I do not have knowledge enough to continue this discussion. I just wanted to respond to your initial question as to why people might need verity-disabler script. There are different phones with different android versions, with different security implementation and not always you can achieve your goal following standard fastboot flashing commands.

@vp1117
To keep you updated:
The vbmeta image is cryptographically signed and contains verification data (e.g. cryptographic digests) for verifying boot.img, system.img, and other partitions/images.
Contents of vbmeta image is parsed by bootloader as 1st thing of all things unless parsing got disabled.
The vbmeta's signing basically must not be of interest to you, the vbmeta's signature key must never get changed by anyone.
To prepare modding phone's Android OS one run ADB / Fastboot commands as follows
Code:
adb devices
adb reboot fastboot
fastboot reboot fastboot 2>nul
fastboot flashing unlock
fastboot reboot
adb reboot fastboot
fastboot reboot fastboot 2>nul
fastboot --disable-verification --disable-verity flash vbmeta vbmeta.img
fastboot reboot
where the vbmeta.img what gets passed to Fastboot should get pulled out from phone before thus it's size is matching.

jwoegerbauer said:
@vp1117
To keep you updated:
The vbmeta image is cryptographically signed and contains verification data (e.g. cryptographic digests) for verifying boot.img, system.img, and other partitions/images.
Contents of vbmeta image is parsed by bootloader as 1st thing of all things unless parsing got disabled.
The vbmeta's signing basically must not be of interest to you, the vbmeta's signature key must never get changed by anyone.
where the vbmeta.img what gets passed to Fastboot should get pulled out from phone before thus it's size is matching.
Click to expand...
Click to collapse
Thank you Jwoegerbauer.
This is a clear and well written explanation.
Do you know if the no-verity-opt-encrypt zip file actually needs to be flashed in TWRP, rather than simply flashing vbmeta with the --disable-verification --disable-verity options?

vp1117 said:
Z:\android\adb>fastboot flashing unlock
FAILED (remote: ' Device already : unlocked!')
fastboot: error: Command failed
Z:\android\adb>
Click to expand...
Click to collapse
I find it really hard to believe they modified fastboot so drastically.
What I don't understand is that the flash command obviously does work, because you say that when you flash boot or recovery your phone enters Red state?!
Do you have another Thread about your problem?
If so post a link here, I would be interested to see what you have tried and see if I can help

Bondyuk said:
Thank you Jwoegerbauer.
This is a clear and well written explanation.
Do you know if the no-verity-opt-encrypt zip file actually needs to be flashed in TWRP, rather than simply flashing vbmeta with the --disable-verification --disable-verity options?
Click to expand...
Click to collapse
The no-verity-opt-encrypt.zip must only be applied on Android OS versions that don't come with vbmeta.img, means where dm-verity is incorporated in Android's boot.img.

Bondyuk said:
What I don't understand is that the flash command obviously does work, because you say that when you flash boot or recovery your phone enters Red state?!
Click to expand...
Click to collapse
Comon! Luckily, fastboot is not the only flashing tool on earth. I use QFIL for that.
I created 2 threads recently.
One was regarding custom recovery: https://forum.xda-developers.com/t/360-n6-lite-qiku-in-desperate-need-of-twrp-recovery.4273965/
Another - how to root the phone: https://forum.xda-developers.com/t/360-n6-lite-qiku-help-is-needed-to-root-the-device.4277407/
I'm planning to add questions on AVB to the 2nd thread.

jwoegerbauer said:
The no-verity-opt-encrypt.zip must only be applied on Android OS versions that don't come with vbmeta.img, means where dm-verity is incorporated in Android's boot.img.
Click to expand...
Click to collapse
That makes sense.
Could you manually do it by opening the boot.img in a hex editor, finding the verification or dm-verify string and zeroing it out?
Surely Magisk would do this as part of its patching process?
I must be wrong because otherwise the zip file would not be needed again

Bondyuk said:
Could you manually do it by opening the boot.img in a hex editor, finding the verification or dm-verify string and zeroing it out?
Click to expand...
Click to collapse
Look inside file boot-patcher.sh that comes with the no-verity-opt-encrypt.zip to see how patching boot.img is done.

jwoegerbauer said:
Look inside file boot-patcher.sh that comes with the no-verity-opt-encrypt.zip to see how patching boot.img is done.
Click to expand...
Click to collapse
I downloaded and had a looked at the zip file.
From what I can tell the actual patching is done by altering the fstab to pass dm-verify options to the kernel during boot?

vp1117 said:
Point is: your Chinese phone is not the only phone China produced. In my Chinese phone you cannot flash neither modified boot.img nor modified recovery.img. If you try, phone swithes to red state
And my Chinese phohe has empty vbmeta partition (ROM is based on android 8.1), so, evidently, it is not vbmeta but some other mechanism that prevents me from rooting my phone or from flashing TWRP/boot. And for those who are proud owners of such ****ty Chinese phones like mine, using verity disabler script might be the last resourt.
I'll tell you even more: with your Chinese phone you still could flash vbmeta using fastboot. Ho-ho-ho-ho.... Not true Chinese phone. Look at mine! It does NOT allow you to use fastboot for flashing. That is real Chinese phone!!
/However, I have no idea how am I supposed to flash verity disabler script if I don't have TWRP... If someone could help me with that.../
Click to expand...
Click to collapse
you are right i am also facing this problem on my vivo y20 phone if you find any solution tell me

Fastboot boot twrp.img not working in mediatek chipset

Hello there.
I have a Redmi pad running on mediatek helio g99(Treble A/B partition)
I have recently compiled orangefox recovery for my device and trying to boot from the image so that i can make my recovery permanent. But i get the following error:
Code:
fastboot boot OrangeFox-Unofficial-yunluo.img
Sending 'boot.img' (65536 KB) OKAY [ 1.826s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed
Any solutions?

Obviously the Fastboot command "boot" isn't supported on your
XIAOMI REDMI PAD ​( Android 12, MIUI 13.1 ).

ghostranger047 said:
Hello there.
I have a Redmi pad running on mediatek helio g99(Treble A/B partition)
I have recently compiled orangefox recovery for my device and trying to boot from the image so that i can make my recovery permanent. But i get the following error:
Code:
fastboot boot OrangeFox-Unofficial-yunluo.img
Sending 'boot.img' (65536 KB) OKAY [ 1.826s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed
Any solutions?
Click to expand...
Click to collapse
Try
fastboot boot recovery OrangeFox-Unofficial-yunluo.img

ghostranger047 said:
Hello there.
I have a Redmi pad running on mediatek helio g99(Treble A/B partition)
I have recently compiled orangefox recovery for my device and trying to boot from the image so that i can make my recovery permanent. But i get the following error:
Code:
fastboot boot OrangeFox-Unofficial-yunluo.img
Sending 'boot.img' (65536 KB) OKAY [ 1.826s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed
Any solutions?
Click to expand...
Click to collapse
Also on devices that have a neutered version of fastboot (or none at all) you can use mtkclient which can also unlock bootloader, etc on the pesky ones.
You can find mtkclient on github.com :
GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
If you're not really familiar with Linux, there's a gui for windows they were nice enough to include so it's not all terminal command line.

Droidriven said:
Try
fastboot boot recovery OrangeFox-Unofficial-yunluo.img
Click to expand...
Click to collapse
Didn't work.
Code:
fastboot: error: cannot load 'recovery': No such file or directory

ghostranger047 said:
Didn't work.
Code:
fastboot: error: cannot load 'recovery': No such file or directory
Click to expand...
Click to collapse
Do you have the recovery .img in the folder where fastboot.exe is located on your PC? If not, you will have to include a <path to flie> in your command line.

Droidriven said:
Do you have the recovery .img in the folder where fastboot.exe is located on your PC? If not, you will have to include a <path to flie> in your command line.
Click to expand...
Click to collapse
I dont have a recovery image for my device, its A/B partition with only boot image. And yes OrangeFox-Unofficial-yunluo.img is inside the same folder as fastboot.exe.

ghostranger047 said:
I dont have a recovery image for my device, its A/B partition with only boot image. And yes OrangeFox-Unofficial-yunluo.img is inside the same folder as fastboot.exe.
Click to expand...
Click to collapse
If you are trying to fastboot boot a TWRP or Orangefox recovery, you need a TWRP or Orangefox recovery.img to do it. There is a difference between a boot.img and a recovery.img.
Your posts are confusing and contradicting each other. To clarify, what exactly are you trying to boot? A boot.img or a recovery.img? The Orangefox .img you have is a boot.img or a recovery.img? Are you trying to boot a temporary TWRP session in order to install Orangefox recovery, or what? If you are using a boot.img, you should be trying to flash that boot.img instead of fastboot booting a TWRP or Orangefox recovery session. Typically, "fastboot boot" command is used to boot a temporary recovery session(usually on devices that have locked bootloader) and then use that temporary recovery session to flash a custom file or modify something on the device. Is your bootloader locked or unlocked? If it is unlocked, you should be able to flash your modified boot.img instead of having to fastboot boot TWRP or Orangefox.
Either you don't understand what you are doing or you are not wording yourself correctly and I'm misunderstanding your intent. Help me make sense of what you are trying to do and what you want your end result to be.

@Droidriven you are the noob here..

aIecxs said:
@Droidriven you are the noob here..
Click to expand...
Click to collapse
No. 10+ years is far from noob. I'm just trying to make sense of what they are after. In their first post, they said they had just compiled Orangefox recovery and the title says ("fastboot boot TWRP.img failed", this command is used to boot a recovery.img, not a boot.img) of which, both are recoveries but then they say they don't have a recovery.img and their original failed command says "boot.img". In my experience, to "fastboot boot TWRP.img" means to boot a temporary TWRP recovery session and then flashing/modifying from within that temporary recovery session, fastboot booting a boot.img is something completely different. I'm just trying to establish which of these is their actual goal. Now, do you see the convolutedness of what the title says and what their posts say and how the wording conflicts?
I've personally used fastboot boot TWRP.img command to boot a temporary TWRP recovery session, not a "boot.img". What they are describing is something different from that process but they are trying to use the same command that boots a temporary TWRP recovery session.
If they are trying to boot a "boot.img" then they should be using a "fastboot boot boot.img" command, not a "fastboot boot TWRP.img" command, correct? Again, conflicting information. Do you understand why I'm trying to clarify now?

see post #1 ghostranger047 for right usage.
the phone answered with FAILED (remote: 'unknown command')
the correct answer is in post #2. on SAR devices, init is in / rootdir of system partition. in case boot.img/recovery.img itself contains no kernel/ramdisk, booting straight from fastboot no longer works (might be the reason why Xiaomi disabled that cmd, or he's simply in fastbootd).
fastboot boot accepts 1 argument (file). you are giving advise to pass 2 arguments. 1st argument 'recovery': No such file or directory, 2nd argument is ignored.
you with 10+ years experience for sure know that fastboot boot cmd always state Sending 'boot.img' (65536 KB) regardless of the file name provided, be it recovery.img or boot.img
OP is very clear in what he said. He wants to boot in his own compiled (orangefox, based on twrp) recovery.img, nothing else.
you are confusing yourself.
edit: btw fastboot boot is forbidden on locked bootloader, otherwise anyone could just boot into magisk patched boot.img

found another possible reason why fastboot boot won't work when it should.
Exelios said:
Even worse than that "fastboot boot" works only if current slot is not marked as not bootable, so any try to launch TWRP fails once your in this mode.
Click to expand...
Click to collapse
Worth a try checking which slot is flagged bootable and set as active (the one with yes)
Code:
fastboot getvar current-slot
fastboot getvar slot-bootable
fastboot getvar slot-successful
fastboot --set-active=other

aIecxs said:
see post #1 ghostranger047 for right usage.
the phone answered with FAILED (remote: 'unknown command')
the correct answer is in post #2. on SAR devices, init is in / rootdir of system partition. in case boot.img/recovery.img itself contains no kernel/ramdisk, booting straight from fastboot no longer works (might be the reason why Xiaomi disabled that cmd, or he's simply in fastbootd).
fastboot boot accepts 1 argument (file). you are giving advise to pass 2 arguments. 1st argument 'recovery': No such file or directory, 2nd argument is ignored.
you with 10+ years experience for sure know that fastboot boot cmd always state Sending 'boot.img' (65536 KB) regardless of the file name provided, be it recovery.img or boot.img
OP is very clear in what he said. He wants to boot in his own compiled (orangefox, based on twrp) recovery.img, nothing else.
you are confusing yourself.
edit: btw fastboot boot is forbidden on locked bootloader, otherwise anyone could just boot into magisk patched boot.img
Click to expand...
Click to collapse
I used a tool that used a script with the fastboot boot command to boot a temporary TWRP img while in fastboot mode on a locked bootloader Intel Atom device. With A/B devices, partitions and where everything is at changed but the basic function of the commands changed very little.
As for the part you said about I should know that the command returns "sending boot.img", that has nothing to do with I said or why I said it, it has to do with the fact that the OP themselves stated that they didn't have a recovery .img, that they had a A/B device, that they were using a boot.img(not a recovery .img). See the confusion? You are confused by what I'm saying about being confused about what they are saying.

I think you got it

ghostranger047 said:
Hello there.
I have a Redmi pad running on mediatek helio g99(Treble A/B partition)
I have recently compiled orangefox recovery for my device and trying to boot from the image so that i can make my recovery permanent. But i get the following error:
Code:
fastboot boot OrangeFox-Unofficial-yunluo.img
Sending 'boot.img' (65536 KB) OKAY [ 1.826s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed
Any solutions?
Click to expand...
Click to collapse
did you manage to run this on your device?

Question I do everything correctly to root but it keep booting in to the bootloader

My steps
1. oem unlock and unlock bootloader with the command
2. get the files from lmsa
3. Patch boot.img using magisk
4. Flash boot.img and vbmeta.img
5. Reboot using fastboot reboot
It should boot me normaly but it boots in to the boot loader

What device are you talking about ?

f1tm0t said:
What device are you talking about ?
Click to expand...
Click to collapse
Tab p11 4gig

Return the stock boot.
I can't tell you anything specific about this device. I own other.
If there is TWRP for your version of Android, flash Magisk.zip from TWRP.

f1tm0t said:
Return the stock boot.
I can't tell you anything specific about this device. I own other.
If there is TWRP for your version of Android, flash Magisk.zip from TWRP.
Click to expand...
Click to collapse
Threr is no twrp sadly

blocky3321 said:
My steps
1. oem unlock and unlock bootloader with the command
2. get the files from lmsa
3. Patch boot.img using magisk
4. Flash boot.img and vbmeta.img
5. Reboot using fastboot reboot
It should boot me normaly but it boots in to the boot loader
Click to expand...
Click to collapse
who told you to flash vbmeta.img?
You should flash patched_boot.img in fastbootd

You need to edit out vbmeta.img / vbmeta_system.img to actually disable verification. Change the byte at offset 123 from 0x00 to 0x03.
Another way is to use the following command when flashing vbmeta. You may need to use a relatively newer version of fastboot binary to get it work.
Code:
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img

mingkee said:
who told you to flash vbmeta.img?
You should flash patched_boot.img in fastbootd
Click to expand...
Click to collapse
I tried it i flashed patched boot.img only in fastbootd still boots me in to the bootloader

LSS4181 said:
You need to edit out vbmeta.img / vbmeta_system.img to actually disable verification. Change the byte at offset 123 from 0x00 to 0x03.
Another way is to use the following command when flashing vbmeta. You may need to use a relatively newer version of fastboot binary to get it work.
Code:
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
Click to expand...
Click to collapse
now it only boot in to the bootloader earlier it would boot normaly if i did factory treset in recovery mode

blocky3321 said:
now it only boot in to the bootloader earlier it would boot normaly if i did factory treset in recovery mode
Click to expand...
Click to collapse
Which Magisk version did you use? From what I can tell any official Magisk version should work.
I haven't really tested the recent builds of vvb2060's Alpha or huskydg's Delta... so if you're using these versions I can't really help you much...
Additionally, you need to check which slot you are now, and through fastbootd check which slot actually has system, vendor and such. Normally the super partition only has enough size for one slot. You may have entered a wrong slot that doesn't have usable system.

blocky3321 said:
My steps
1. oem unlock and unlock bootloader with the command
2. get the files from lmsa
3. Patch boot.img using magisk
4. Flash boot.img and vbmeta.img
5. Reboot using fastboot reboot
It should boot me normaly but it boots in to the boot loader
Click to expand...
Click to collapse
Getting Started: What's Your Device ?
Tab p11 4gig
Device->settings->About : Model & Hardware -> Lenovo ??? (Tb-j606f,TB-J616F...) In your case stiker on box or on back.
mingkee said:
who told you to flash vbmeta.img?
Click to expand...
Click to collapse
???