cnc-bootloader: Bootloader access on any phone! - Upgrading, Modifying and Unlocking

cnc-bootloader
When you need fastboot but just can't get to it
So I was working with my phone trying to see what I can do with it. I got it rooted (via towelroot) installed busybox, SuperSu, the usual. Then I installed custom recovery and then installed a script to enter recovery via VolDown+Power. It softbricked the phone gave me a LG Security Error. I fixed it and thought hey? Why not create an exploit that forces the phone into bootloader mode.
There sadly is no common access to bootloader mode and so unless you softbrick there is no bl mode. Until cnc-bootloader (command and conquer bootloader) is released (now lol). This exploit creates a backup of the boot partition then erases it. I am also developing a computer gui to make it easier and safer. It uses a slightly different method of doing it and it can be a lot safer too, so if you aren't comfortable with this then I'll post a link when I release it. (NOTE: This gui is released by Trident-Dev. It is not open source.) So heres how it works
Download the cnc-bootloader exploit and run with root permission on your device.
It will then make a backup called boot.img and erase your boot partition.
WARNING: Make sure to backup boot.img to your computer before you reboot. This is the only way to exit bootloader mode
Then just reboot your phone like n0rmal and it should be in a bootloader loop!
(This can be fixed by reflashing the backed up boot.img)
The exploit is available on GitHub at (Give me some time to get these 10 posts down and I will post the link. I have it up on Androidforums.com so yea. Just search for rpgslayer redtelko there and it will be one of the only threads you will see
More information is available in the README.md file and stay tuned for the release of our GUI version!

I would like to try this on my Sprint LG G4 to unlock bootloader. Please provide the link.

https://www.codeaurora.org/projects...unds-checking-when-flashing-sparse-images-cve
Based of this?

your account on github doesn't exist.

Related

[RECOVERY][Unofficial][tetra] TWRP 2.8.3.0 for Sony Smartwatch 3

Unofficial TWRP 2.8.3.0 for Sony Smartwatch 3 (SWR50) (tetra)
If you don't know, what TWRP is then read http://teamw.in/project/twrp2 before flashing anything.
If you know, what TWRP is then read the disclaimer: use at your own risk, neither XDA, TeamWin nor I are responsible for anything bad and going wrong.
Installation Instruction
First of all you need adb and fastboot drivers and binaries installed on your PC. Grab them from the Android SDK, that suites to your PC's OS. Windows user may need the generic usb drivers. Linux users may need to start adb and fastboot with root rights, if they don't have the needed udev rules.
Unlock bootloader
If your bootloader isn't unlocked yet, then you have to unlock it. There are to ways to boot into the fastboot mode.
]1. way to boot into fastboot mode:
Turn off your device
Press and hold power button until the "Insert USB" animation appears
double press the power button to enter the boot menu. (you may need several attempts)
within the bootmenu press power once to navigate, twice to select. Press twice to boot into fastboot
now you can connect your watch with your PC.
2. way to boot into fastboot mode:
enable developer settings and ADB debugging from within the settings menu (you have to press 7 times the About->build number)
connect your watch with your PC. Enter "adb devices" in your terminal/cmd and confirm adb permission for your watch on your smartphone.
boot into bootloader with "adb reboot bootloader"
Now, in fastboot mode enter "fastboot oem unlock" twice to unlock the bootloader. Attention: this will factory reset your Smartwatch 3.
Some users reported, that their devises stuck on boot without the commands "fastboot format cache" and "fastboot format userdata", you should enter this commands before you the reboot, too.
Afterwards reboot your device and set it up again. Enable adb debugging, too.
Flashing TWRP
Boot into fastboot mode
enter "fastboot flash recovery <NAMEOFTHE.IMG>"
Power off the device
(to power off try "fastboot continue", it should boot into charging mode and then unplug the device)
Now, TWRP is installed and you should boot straight into it with holding power button and selecting "Recovery" from the boot menu (see first way to boot into fastboot mode)
If you boot into system without booting twrp once, the system overwrittes twrp with the stock recovery. If this happens to you, then boot into fastboot and boot twrp without flashing it with "fastboot boot <NAMEOFTHE.IMG>". Afterwards boot into bootloader from the recovery's reboot menu and flash twrp again.
Download link: unofficial-twrp-2.8.3.0-tetra.img Updated on 30.12.2014
Now, if you want to root your Smartwatch 3 with Wear 5.0.1, go to http://www.xda-developers.com/android/root-android-wear-5-0-1-xdatv, download the "Wear supersu.zip" and flash it with your newly installed TWRP recovery.
If you want to use "adb sideload" make sure that you have the most recent adb binary on your pc.
Kernel source code: can be downloaded from https://android.googlesource.com/ke...-wear-release/arch/arm/mach-java/sony/brooks/
TWRP device tree: https://github.com/perpe/android_device_sony_tetra
Many thanks to @Dees_Troy for making twrp avaible
Good job, I'll post stock recovery extracted from PC companion image later tonight.
I have a copy of the stock recovery, created with dd from the device. I can upload it, if it is needed
Can someone please upload a twrp image of the stock rom? I want to get rid of my pre release debug version
Sent from my SM-N910G using XDA Premium 4 mobile app
Works great, both using boot or flash recovery and both from boot menu and adb reboot recovery from system.
BTW, thanks for boot menu hint.
---------- Post added at 12:29 AM ---------- Previous post was at 12:28 AM ----------
The only issue it is extremely hard to press on home button and I was not able to press on back button
@julz
Please, can you make a backup of your prerelese version with twrp? I will upload a stock 5.0.1 version with all neccessary parts later today.
@XorZone
Nice to read. I was unsure with the overwrite, if people don't boot the twrp once, because there isn't a install-recovery.sh, but it seem that this happens.
perpe said:
@julz
Please, can you make a backup of your prerelese version with twrp? I will upload a stock 5.0.1 version with all neccessary parts later today.
@XorZone
Nice to read. I was unsure with the overwrite, if people don't boot the twrp once, because there isn't a install-recovery.sh, but it seem that this happens.
Click to expand...
Click to collapse
Yep will do! Thanks!
---------- Post added at 09:12 PM ---------- Previous post was at 08:29 PM ----------
Hey @perpe you might want to add the following to your bootloader unlock instructions as I had to go to the old rooting thread to find this out:
4. fastboot format cache
5. fastboot format userdata
6. fastboot getvar all (and verify that it is)
7. fastboot reboot
Hi all - link to the pre-release version recovery image (tetra-userdebug 4.4W KGW38C 1046 test-keys):
http://1drv.ms/1y100TI
That's incredible. as explained here but even that does not work. yet all the usb driver days with the sdk. Can not even watch fastboot mode, while in adb way possible.
I do not understand why it does not work.
the model of the watch is LWX48P
--- nvm, fixed it.---
julz said:
you might want to add the following to your bootloader unlock instructions as I had to go to the old rooting thread to find this out:
4. fastboot format cache
5. fastboot format userdata
6. fastboot getvar all (and verify that it is)
7. fastboot reboot
Click to expand...
Click to collapse
This is not needed. Look at http://source.android.com/source/building-devices.html#unlocking-the-bootloader format cache & userdata is only needed on Nexus 10. Our device formats cache and userdata automatically on bootloader unlock. getvar is useless with out telling the people what they have to verify
Many thanks for your dump, but it contains the data partition, too. Please, delete that from your zip package, because data contains your personal setup. It's not a good idea making it public.
I made a flashable zip of the stock LWX48P and will open a thread for it. I had a deeper look into the partitions and I really don't know if it's a good idea to flash the stock ROM on to your test build device. This can brick it.
My zip file contains all necessary partitons from the update KNX01V -> LWX48P, but there are some other partitions that may be necessary for you. These partitions are not included within my zip. There are 10 partition, which are part of the board firmware (recovery.fstab calls them "Needed for radio.img").
The more relevant partition for you should be the s1sbl partition, this is the Sony bootloader. I can't say, if the stock rom works with your device or if it bricks it. Have you tried flashing the stock ROM with the Sony PC Companion? You should try this first. If it doesn't work, I would recommend a binary comparison of the s1sbl partition of your device and an official release version. For this I need a copy of yours, you can make it with dd. If they are the same it should be relative safe to flash the stock ROM, if not then it gets tricky, you may want to flash the stock s1 bootloader before flashing the ROM. I really don't know, what could be the best in this case.
ced360 said:
That's incredible. as explained here but even that does not work. yet all the usb driver days with the sdk. Can not even watch fastboot mode, while in adb way possible.
I do not understand why it does not work.
the model of the watch is LWX48P
Click to expand...
Click to collapse
The problem is with your PC. Make sure there are no background Android Sync applications, like Samsung Kies, HTC Sync Manager..., are running. These applications block adb. Look into the windows device manager, too. If the Sony Smartwatch 3 has a triangle, then it is not recognized with a driver. This can happen if you have several adb drivers installed. Remove them or associate one of them manually from the device managers driver installation. I can't help you here, I'm a Linux user, not Windows.
@all
There was a little error in the recovery, I've fixed it and also removed the SuperSu install question, because it doesn't work right with wear. The recovery is updated and the old one removed, please use this one in the future.
@perpe - I had to format cache and userdata for my SmartWatch 3 to boot again - got stuck in a bootloop after unlocking.
Are you able to point me to somewhere that explains how to use DD? Do I run it via ADB Shell?
Thanks!
---------- Post added at 01:51 PM ---------- Previous post was at 01:46 PM ----------
Unfortunately the Sony PC Companion doesn't update my watch Says to update my PC Companion but then says it's up to date
Yepp, my watch needed format cache or I didn't know it that time so just reflashed with PC companion tricking it to update connected Sony smartphone (and I'm glad they are checking version from s1 and not by user selection) as PC companion was telling no new update and not giving an option to repair back then.
perpe said:
I made a flashable zip of the stock LWX48P and will open a thread for it. I had a deeper look into the partitions and I really don't know if it's a good idea to flash the stock ROM on to your test build device. This can brick it.
My zip file contains all necessary partitons from the update KNX01V -> LWX48P, but there are some other partitions that may be necessary for you. These partitions are not included within my zip. There are 10 partition, which are part of the board firmware (recovery.fstab calls them "Needed for radio.img").
The more relevant partition for you should be the s1sbl partition, this is the Sony bootloader. I can't say, if the stock rom works with your device or if it bricks it. Have you tried flashing the stock ROM with the Sony PC Companion? You should try this first. If it doesn't work, I would recommend a binary comparison of the s1sbl partition of your device and an official release version. For this I need a copy of yours, you can make it with dd. If they are the same it should be relative safe to flash the stock ROM, if not then it gets tricky, you may want to flash the stock s1 bootloader before flashing the ROM. I really don't know, what could be the best in this case.
Click to expand...
Click to collapse
Full list of files in PC Companion fileset:
Code:
abi-sec.sin
abi.sin
boot.sin
cache.sin
cp-boot.sin
cp-image.sin
dsp-dram.sin
dsp-pram.sin
dt-blob.sin
hwconf.sin
kernel-dtb.sin
loader.sin
parm-spml-dep.sin
parm-spml-ind.sin
partition-image.sin
ramdump-dtb.sin
ramdump.sin
recovery.sin
s1sbl.sin
sys-parm-dep.sin
sys-parm-ind.sin
system.sin
u-boot.sin
ubootlogo.sin
umts-cal.sin
userdata.sin
version-info.sin
@XorZone
Did you unlocked your bootloader with with current firmware or the previous one? I did it with the current one and it wasn't needed. If I lock my device and unlock it again it is also not needed. Unlock resets it everytime, but no stuck on boot. Anyway I added it.
@julz
Code:
adb shell
su
dd if=/dev/block/platform/sdhci.1/by-name/s1sbl of=/sdcard/s1sbl.img
this makes a dump of your s1 bootloader on sdcard. You need root for it. If your system is still unrooted, you can use the recovery's adb, too. In the recovery you may need to change the sdcard path.(the "of" part)
It would be good if you can make a dump of your ta partition, too. but don't give it away, because the ta partitions contains your serial number. (change s1sbl to ta in the command above).
Copy both dumps to your pc. Try to open the ta dump with a hexeditor and search for your serial number, afterward it list the model number (SWR50 on my device), then the bootloader version (1286-0320 S1BOOT_BCM23550_Release_REL105) and a timestamp of my last flash with the PC companion. Please compare them with yours.
I have found the u-boot source code on the Sony site. On boot the device first boots u-boot and u-boot handles the boot process. The s1 bootloader is only booted by user request (connecting it via usb when the USB animation appears). For me this means, s1 is only needed for recognition/updating with pc companion and it should be possible to flash it without bricking and without s1sbl. But I don't call myself a developer and this is my first Sony device. You may want to start a thread in the Sony Cross-Device General board. There are more experienced devs than me. I'm sure they know, if your devices could be flashed with pc companion if you swap the s1sbl with a regular one. There are also several unofficial tools to create and flash Sony firmware, but as I said, I'm very new to Sony and don't know how to handle them yet (and even don't know if they support a Broadcom SoC)
If you make a dump of the s1sbl, then send me a link for a compare.
Download link of the u-boot source: http://developer.sonymobile.com/dow...e-for-smartwatch-3-lwx48p-android-wear-5-0-1/ (look into /u-boot/hawaii/board/broadcom/javaboard/s1/cmd_s1boot.c for the boot selection)
perpe said:
@XorZone
Did you unlocked your bootloader with with current firmware or the previous one? I did it with the current one and it wasn't needed. If I lock my device and unlock it again it is also not needed. Unlock resets it everytime, but no stuck on boot. Anyway I added it.
Click to expand...
Click to collapse
On 4.4, they might fixed it in 5.0.
Back then this forum was blank and I had no idea how sony devices works, so spoiled by nexus experience the first thing after enabling adb I went and unlocked oem and had some skipped heartbeats when I got stuck on bootlogo.
perpe said:
There are also several unofficial tools to create and flash Sony firmware, but as I said, I'm very new to Sony and don't know how to handle them yet (and even don't know if they support a Broadcom SoC)
Click to expand...
Click to collapse
I'm using flashtool from http://www.flashtool.net/index.php to decrypt sony fileset and extract sin files, this tool should work with any s1 protocol devices, but there is no configuration for the SWR50 so I was not able to flash with it.
After flashing from test to 5.0 in twrp it might hang with power button unresponsive so the only way out would be to wait for discharge to get into s1 and then with PC Companion not updating...
BTW, @julz does PC Companion able to repair your test version, e.g. saying that there is no new update, but still asks to repair or just saying no new update bye-bye?
@XorZone
I used it also to get the stock recovery as a base for my TWRP. But I don't want to flash my device with it. I had some problems with it, dumped boot/recovery images (with sin editor) stucked on boot. I had to repack them to boot right. I wasn't able to dump cp-image. It ate all my free space and aborted. Another problem is my Linux doesn't recognize the swr50 right in s1 mode. My USB port goes wild. That's why I stand back from any flash test with it. If I don't trust a tool (or don't know how to use it right) I can't advise others to try anything with it without consulting the experts.
Configuration file should be something like this
Code:
#Fri Aug 08 18:46:20 CEST 2014
internalname=SWR50
canfastboot=true
busyboxhelper=1.20.2
recognition=SWR50,tetra
variant=SWR50,tetra
cankernel=false
busyboxinstallpath=/system/xbin
realname=Sony Smartwatch 3
loader=1f5089f1c617e5aa3e7bae0a8c2f8ae2
canrecovery=true
buildprop=ro.product.device
canflash=true
I'm unsure with the cankernel. loader.sin should be the same loader.sin that you get after the decrypt? I've created the loader md5 for it. tetra in "recognition" is needed for julz' device
perpe said:
@XorZone
I used it also to get the stock recovery as a base for my TWRP. But I don't want to flash my device with it. I had some problems with it, dumped boot/recovery images (with sin editor) stucked on boot. I had to repack them to boot right. I wasn't able to dump cp-image. It ate all my free space and aborted. Another problem is my Linux doesn't recognize the swr50 right in s1 mode. My USB port goes wild. That's why I stand back from any flash test with it. If I don't trust a tool (or don't know how to use it right) I can't advise others to try anything with it without consulting the experts.
Configuration file should be something like this
Code:
#Fri Aug 08 18:46:20 CEST 2014
internalname=SWR50
canfastboot=true
busyboxhelper=1.20.2
recognition=SWR50,tetra
variant=SWR50,tetra
cankernel=false
busyboxinstallpath=/system/xbin
realname=Sony Smartwatch 3
loader=1f5089f1c617e5aa3e7bae0a8c2f8ae2
canrecovery=true
buildprop=ro.product.device
canflash=true
I'm unsure with the cankernel. loader.sin should be the same loader.sin that you get after the decrypt? I've created the loader md5 for it. tetra in "recognition" is needed for julz' device
Click to expand...
Click to collapse
Strange, I was able to boot straight from extracted boot/recovery images. With cp-image use dump raw instead.
I have almost the same config file, but was not able to flash system sin when I screwed mine while testing first rooting boot.img.
And if PC Companion do not repair his test version, I would not proceed at least until other partitions compared to release version.
@julz, please dump version info as well:
Code:
dd if=/dev/block/platform/sdhci.1/by-name/version-info of=/sdcard/version-info.img
Oh yes, version-info is very important, u-boot checks it on boot.
I tried the raw dump, but it adds a strange header to most of my dumps.
@perpe - Thanks for the DD instructions.
I've dumped my S1SBL, TA and VERSION-INFO partitions now.
I've also had a look in my TA image and this is what is after my serial number (excluding the random ASCII):
Mine is 1286-0320 S1BOOT_BCM23550_Release_29
(yours is 1286-0320 S1BOOT_BCM23550_Release_REL105)
KGW83C (my build number)
My model simply refers to 'tetra' and not SWR50.
I had no PC companion timestamps as I can't flash with PC companion.
@XorZone - I can't select an option in PC Companion to reset/reflash my watch. Simply says no update is available.
My S1SBL and VERSION-INFO partitions are uploaded here:
http://1drv.ms/1xwGMSW
Thanks!

Asus ZenPad 8.0 (Z380KL) Information Repository

Just going to dump all the info I've found about this device into this thread. All the threads pertaining to this thread are in Russian and I can't read Russian, so this might be helpful to any English speaking owners of this tablet.
Special thanks to Telegram user @SSDD_1744 (don't know your XDA/Reddit user, I'm sorry) for basically spoonfeeding me all these instructions!
WARNING: If you need to flash to stock for whatever reason, be sure to download a image file specific to your country. If you don't, you'll hard brick your device that can only be fixed QPST (supposedly).
Rooting:
(Tested on 5.0.2)
Install KingRoot. Let it root your device.
Install Super-SU Me, to get rid of the bloatware that comes with KingRoot.
Installing Xposed:
I used Flashify to flash TWRP. Be sure to flash the right version though (2.8.7.7 v2) or else you won't be able to mount cache.
Then download Xposed (version sdk21 ARM) and flash it.
WARNING: Flash v1 of the modded TWRP and you won't be able install any apps after flashing Xposed.
Unbricking:
Still working on it. Downloaded QPST but have not been able to get QPST 2.7 to read the tablet.
Links:
Discussion:
https://translate.googleusercontent...690491&usg=ALkJrhiWSlkbZ-tUofZx68NPSGIv8pjIPA
Root:
https://translate.googleusercontent...JrhhQszcRvUo8HILThvz57JmsLj4L9g#entry44556703
https://translate.googleusercontent...JrhiCt__6apcRhk-gtcBExYJCnC9nGQ#entry41676452
Instructions for obtaining the rights to Ruth phones / tablets.
Tested on Android 4.4+
perhaps this algorithm works on Android 5+, I have no way to verify
All transactions with their phones / tablets are performing at your own risk !!!
To get started, read this post from start to finish and only then proceed to action!
Introduction
This instruction is written based on my own experience obtaining root on their plates, and then on the Xperia M2, bought plemyashki. For instructions attached versions of applications that were relevant at the time, the new version can download the relevant topics on the forum, there will find all information on how to work with the proposed programs and algorithms for their actions (links to topics added).
For all the action with your phone / tablet you are responsible for yourself!
Download all the necessary tools to obtain Root (of instructions / topics on the forum), obespechte for phone / tablet access to the Internet (Wi-F / mobile data) and let the phone settings / tablet installation from unknown sources.
Needed Downloads
KingRoot_V4.5.0B202.apk (6.76 MB)
Me_5.9.apk-SuperSU (9.07 MB)
V2.49 Beta.apk SuperSU (5.63 MB)
eu.chainfire.supersu.pro.205.apk (52,88 KB)
Next in series:
1. Install KingRoot .
Get Ruth's right, in the device may reboot.
2. Set SuperSU-Me, .
Run the grantor, the program deletes KingRoot and Chinese KingUser with replacement SuperSu.
Remove the longer SuperSu-Me the desired program.
3. Obnovyaem SuperSu to the latest version. Then set PRO-key .
Installing Pro-key Optionally !!! Use Cases SuperSu without installing key .
4. Open SuperSu and on-demand update binary SU normal way. After a successful update, confirm the request to restart.
5. To make sure that everything is done correctly, check the correct installation and operation of Ruth (mount the system partition on the record), I used the Root Checker Pro and Root Explorer , respectively.
The output is a complete rut without kitayschiny with SuperSu Pro. We use and enjoy
Click to expand...
Click to collapse
Unlocking bootloader (haven't tried this):
https://translate.googleusercontent...Jrhh6g4wI-8Hb_LzAcPnIUxYvWNzZ0A#entry46711087
Stock firmware:
https://translate.googleusercontent...?s=&showtopic=703414&view=findpost&p=45272695
Damn, development has really boomed on this little tablet! Finally got it back after a few months (I sent it into Asus to repair it for me).
Stock ROM:
https://www.asus.com/ru/Tablets/ASUS_ZenPad_80_Z380KL/HelpDesk_Download/ (I can't get the English version to load, delete the /ru/ and you'll be redirected to the English site)
https://www.asus.com.cn/Tablets/ASUS_ZenPad_80_Z380KL/HelpDesk_Download/ (Chinese site)
==== REMEMBER TO DOWNLOAD THE CORRECT COUNTRY OR YOU'LL BE BRICKED) ====
https://yadi.sk/d/b1NMLXHBsNV8C (latest software for the worldwide model)
[http://4pda.ru/forum/index.php?showtopic=703414&st=320#entry50270292]
http://4pda.ru/forum/index.php?showtopic=703414&st=200#entry49389176 (Asus Flash Tool and stock ROM v4.8.2 WW [WorldWide])
Unlocking bootloader:
http://4pda.ru/forum/index.php?showtopic=690491&st=1280#entry48200665 (use fastboot oem device-info to check if it's unlocked)
Root:
http://4pda.ru/forum/index.php?showtopic=690491&st=580#entry44778545 (KingRoot - you'll need a 4PDA.ru account to download this)
http://4pda.ru/forum/index.php?showtopic=690491&st=1280#entry48185323 (last section of the post)
CM13:
http://get.cm/?device=P024&type=nightly
https://vasy.ru/CM13/
http://forum.xda-developers.com/android/help/asus-zenpad-8-z380kl-custom-rom-t3370277
http://forum.xda-developers.com/android/development/kernel-asus-z380kl-p024-kcal2-t3405595 (Kernel)
Recovery:
https://vasy.ru/TWRP/P024/
http://4pda.ru/forum/index.php?showtopic=690491&st=1220#entry48094504 (TWRP 2.8.7.0)
http://forum.xda-developers.com/android/help/asus-zenpad-8-0-z380kl-bootloop-t3373051
Guides:
http://4pda.ru/forum/index.php?showtopic=690491&st=1280#entry48185323 (this has a lot of instructions: root, recovery, boot partition restore, adb drivers etc.)
http://forum.xda-developers.com/android/help/asus-zenpad-8-0-z380kl-bootloop-t3373051 (this has a bunch of files, Resurrection Remix [I haven't tested it yet tho], and instructions on getting out a bootloop)
http://4pda.ru/forum/index.php?showtopic=690491&st=1640#entry49724823 (flashing stock software)
If you want to open the engineering menu, type " * # * # 4636 # * # * "
To boot into fastboot, restart/turn on the device and hold volume up. It'll pop you into a menu with three options.
To boot into recovery, from the fastboot screen (three options), use the volume buttons and navigate to the second option "factory reset" and hit power to confirm. It'll boot into recovery.
=====================================================================================
Recommended way to flash ROMs:
1) Download TWRP. Use adb to boot (NOT flash) into TWRP. Flash ROM there.
2) use KingRoot to root. Use Flashify to flash the ROM.
======================================================================================
If you want to go look up some more info or guides, go here:
http://4pda.ru/forum/index.php?act=...=rel&subforums=0&query=z380kl&forums=570&st=0
and use GTranslate to translate the page. The first page is the earliest posts with the keyword, the last page are the latest post.
please add these ROM's for this Device:
Ressurection Remix:
https://www.androidfilehost.com/?w=files&flid=121811
AICP 12.1:
https://www.androidfilehost.com/?w=files&flid=136181
The latest Official ROM P024 model:
http://dlcdnet.asus.com/pub/ASUS/Ee...ser.zip?_ga=1.109506565.1670552787.1483182775
ZenPad 8 Z380KL Firmware: V5.9.0.0 (WW SKU version only)
Improved Item:
1. Update Google security patch
2. Support unlock tool
9008 brick info:
https://4pda.ru/forum/index.php?showtopic=643084
Pertaining to p024:
https://4pda.ru/forum/index.php?showtopic=643084&st=5740
https://4pda.ru/forum/index.php?showtopic=643084&st=3660 (page 179 - 180, 183 - 185 discusses the files needed to unbrick and how you would - CTRL + F Russ and read the people who quote him)
How I bricked: https://4pda.ru/forum/index.php?showtopic=703414&st=180#entry49329798
https://4pda.ru/forum/index.php?showtopic=690491&st=1420#entry48527044 (unbricking files - dead link though)
https://4pda.ru/forum/index.php?showtopic=703414&st=140 (discussing how to fix using the images from the dump)
I see that Lineage OS is supported on Z380KL. However, I found the wiki spec showing Snapdragon 410, but I found Z380KL in Asia with Snapdragon 615. Before I commit, I'd like to know if anyone knows whether LineageOS is fully compatible with Z380KL with Snapdragon 615 chipsets? Thanks.
Special thanks to @a350tv for helping me comb through 4PDA - this process would've been a lot slower or just wouldn't have happened if he hadn't offered to translate guides and download links to me. So most of the credit goes to him.
Flashing TWRP on 6.0.1 (Sept 1, 2016 patch):
1) grab your drivers (W10: boot into "no driver signature verification mode" to install the drivers needed for fastboot)
https://drive.google.com/open?id=1cGcoDCvmTxfXWNTG0iOXHw1WScmYBrKS
2) turn on debugging
3) type in "adb devices", verify that your computer sees your tablet (if you don't have ADB/Fastboot, get https://forum.xda-developers.com/showthread.php?t=2317790)
4) type in "adb reboot bootloader"
5) you'll see three options: 1. Enter SD DL mode, 2. Factory Reset, 3. Exit update mode
6) type in "fastboot devices", verify that your computer sees your tablet
7) grab your TWRP file (http://vasy.ru/TWRP/P024/) and type in "fastboot flash recovery [replace w/ location of the TWRP file].img"
8) once it says "finished", click factory reset mode (use volume buttons to navigate, power button to enter)
9) it should reboot into TWRP, slide to allow modifications
10) Boom, TWRP is installed.
OPTIONAL, BUT HELPS TO KEEP TWRP INSTALLED: Flash Magisk.
That way, stock recovery won't overwrite TWRP when you reboot.
IF YOU WANT TO KEEP TWRP BUT DON'T WANT Magisk:
1) After first boot into TWRP, turn off tablet.
2) Then turn on and hold Volume Up + Power. That will boot you into Bootloader Mode.
3) Go into factory reset and it should boot you into TWRP.
Now, it's safe to boot into the OS.
(TL;DR: Boot into TWRP twice before booting into the OS or else stock recovery will overwrite TWRP.)
Flashing LineageOS:
1) DL LOS from https://download.lineageos.org/P024
2) DL GApps from http://opengapps.org/ (choose 7.1)
3) boot into TWRP
4) go into Wipe, slide to wipe
5) go to Install, click on LOS file > add to queue, click on Open GApps file > add to queue, flash
6) wait til it's done, click "reboot"
7) wait a while (took mine 3 or so minutes to boot)
8) enjoy!
My GDrive folder with all files needed (except ROM and GApps)
https://drive.google.com/open?id=0BzJ-WWaQYXttTkttdHNELVBEc2M
To do:
Use this tutorial to backup all my partitions, just in case I get bricked yet again.
https://forum.xda-developers.com/showthread.php?t=2450045
Links to unbrick device via Asus FlashTool
Links to service ROMs (for use with AFT)
Add original links from 4PDA
ROMs
LineageOS: https://download.lineageos.org/P024
AICP: https://saki-sss.blogspot.com.by/2016/12/z380k-aicp-121.html
Resurrection Remix: https://androidfilehost.com/?w=files&flid=121811
(made by https://androidfilehost.com/?w=profile&uid=457095661767100043, found from http://andmem.blogspot.jp/2016/05/asus-zenpad-8-z380kl-root-rom.html#chapter-19) - abandoned?
seities said:
I see that Lineage OS is supported on Z380KL. However, I found the wiki spec showing Snapdragon 410, but I found Z380KL in Asia with Snapdragon 615. Before I commit, I'd like to know if anyone knows whether LineageOS is fully compatible with Z380KL with Snapdragon 615 chipsets? Thanks.
Click to expand...
Click to collapse
probably not. I think it's only compatible with the SD 410.
xDark_ said:
Special thanks to @a350tv for helping me comb through 4PDA - this process would've been a lot slower or just wouldn't have happened if he hadn't offered to translate guides and download links to me. So most of the credit goes to him.
Flashing TWRP on 6.0.1 (Sept 1, 2016 patch):
1) grab your drivers (W10: boot into "no driver signature verification mode" to install the drivers needed for fastboot)
https://drive.google.com/open?id=1cGcoDCvmTxfXWNTG0iOXHw1WScmYBrKS
2) turn on debugging
3) type in "adb devices", verify that your computer sees your tablet (if you don't have ADB/Fastboot, get https://forum.xda-developers.com/showthread.php?t=2317790)
4) type in "adb reboot bootloader"
5) you'll see three options: 1. Enter SD DL mode, 2. Factory Reset, 3. Exit update mode
6) type in "fastboot devices", verify that your computer sees your tablet
7) grab your TWRP file (http://vasy.ru/TWRP/P024/) and type in "fastboot flash recovery [replace w/ location of the TWRP file].img"
8) once it says "finished", click factory reset mode (use volume buttons to navigate, power button to enter)
9) it should reboot into TWRP, slide to allow modifications
10) Boom, TWRP is installed.
OPTIONAL, BUT HELPS TO KEEP TWRP INSTALLED: Flash Magisk.
That way, stock recovery won't overwrite TWRP when you reboot.
IF YOU WANT TO KEEP TWRP BUT DON'T WANT Magisk:
1) After first boot into TWRP, turn off tablet.
2) Then turn on and hold Volume Up + Power. That will boot you into Bootloader Mode.
3) Go into factory reset and it should boot you into TWRP.
Now, it's safe to boot into the OS.
(TL;DR: Boot into TWRP twice before booting into the OS or else stock recovery will overwrite TWRP.)
Flashing LineageOS:
1) DL LOS from https://download.lineageos.org/P024
2) DL GApps from http://opengapps.org/ (choose 7.1)
3) boot into TWRP
4) go into Wipe, slide to wipe
5) go to Install, click on LOS file > add to queue, click on Open GApps file > add to queue, flash
6) wait til it's done, click "reboot"
7) wait a while (took mine 3 or so minutes to boot)
8) enjoy!
My GDrive folder with all files needed (except ROM and GApps)
https://drive.google.com/open?id=0BzJ-WWaQYXttTkttdHNELVBEc2M
To do:
Use this tutorial to backup all my partitions, just in case I get bricked yet again.
https://forum.xda-developers.com/showthread.php?t=2450045
Links to unbrick device via Asus FlashTool
Links to service ROMs (for use with AFT)
Add original links from 4PDA
Click to expand...
Click to collapse
Thanks for the tutorial, I had already dared to flash twrp recovery before you wrote this tutorial...
I believe my bootloader is still locked. And I could not reproduce/ write exactly what I did. But, in my case, just for information, when I want to go back into twrp, I can boot into bootloader (power volume up) and then option 2 reset the device gives me the twrp... I am not sure if that is how you get it, but for me, I still had twrp.
I think i will install magisk after reading your post.
jutphaas said:
Thanks for the tutorial, I had already dared to flash twrp recovery before you wrote this tutorial...
I believe my bootloader is still locked. And I could not reproduce/ write exactly what I did. But, in my case, just for information, when I want to go back into twrp, I can boot into bootloader (power volume up) and then option 2 reset the device gives me the twrp... I am not sure if that is how you get it, but for me, I still had twrp.
I think i will install magisk after reading your post.
Click to expand...
Click to collapse
I don't think unlocking the BL is necessary for flashing LOS. But yes, that's how I get into TWRP as well.
Hello I'm new in the forum and I write from Italy, yesterday unfortunately I had the brilliant idea to downgrade my Asus z380kl through ADB, Fastboot and TWRP from pc so far so good, I go to flash the new rom and gives me error, I try to restore the backup here too error result? Tablet locked the only way to make it recognize to the PC is with ASUS FLASH TOOL ROM problem in format.raw unobtainable not even on the Russian site. Any good soul has the possibility to let me download it? Thanks, Sorry English but it is a translation of the very useful Google translate.
pucci2 said:
Hello I'm new in the forum and I write from Italy, yesterday unfortunately I had the brilliant idea to downgrade my Asus z380kl through ADB, Fastboot and TWRP from pc so far so good, I go to flash the new rom and gives me error, I try to restore the backup here too error result? Tablet locked the only way to make it recognize to the PC is with ASUS FLASH TOOL ROM problem in format.raw unobtainable not even on the Russian site. Any good soul has the possibility to let me download it? Thanks, Sorry English but it is a translation of the very useful Google translate.
Click to expand...
Click to collapse
Can you still access fastboot, then at least you can flash twrp as described before in this thread and install from twrp lineageos p024 (lineage-14.1-20180105-nightly-P024-signed.zip) and Open gapps to get google playstore etc , select Arm, (not 64) then version 7.1, then Pico would work.
If you have twrp, you at least can still use your asus... I have found no way to flash original stock... stock must not be flashed from twrp.
Since you mention twrp already used, you can try: turn your device off, then press volume up then the bootloader menu comes, select 2: reset to enter twrp(where it says reset. if you had flashed twrp, that is how you can get into twrp) from there, install lineage os and gapps from micro sd card
My rom is MMB29M.WW_P024-V5.9.4-20170613
xDark_ said:
OPTIONAL, BUT HELPS TO KEEP TWRP INSTALLED: Flash Magisk.
That way, stock recovery won't overwrite TWRP when you reboot.
Click to expand...
Click to collapse
I assume this is on stock rom ? What version of magisk would work? I found I can be back at stock with my twrp backup so ..
But magisk 15.3 zip failed to install on stock-
I also used supersu v82 working on stock, or lineageos.
Would you know what magisk works on lineageos?
I like the exsd extension of magisk so I would like to try it on this device, either stock or lineageos
jutphaas said:
I assume this is on stock rom ? What version of magisk would work? I found I can be back at stock with my twrp backup so ..
But magisk 15.3 zip failed to install on stock-
I also used supersu v82 working on stock, or lineageos.
Would you know what magisk works on lineageos?
I like the exsd extension of magisk so I would like to try it on this device, either stock or lineageos
Click to expand...
Click to collapse
Yes it was. I flashed 15.2 on both stock and LOS. I've heard of some issues with 15.x so you can try .2 or 14.x.
pucci2 said:
Hello I'm new in the forum and I write from Italy, yesterday unfortunately I had the brilliant idea to downgrade my Asus z380kl through ADB, Fastboot and TWRP from pc so far so good, I go to flash the new rom and gives me error, I try to restore the backup here too error result? Tablet locked the only way to make it recognize to the PC is with ASUS FLASH TOOL ROM problem in format.raw unobtainable not even on the Russian site. Any good soul has the possibility to let me download it? Thanks, Sorry English but it is a translation of the very useful Google translate.
Click to expand...
Click to collapse
What error was given? What do you see when you connect it to a computer? What does "tablet locked" mean? Would help if you gave some pictures too.
I'm currently in the process of getting the RAW files/service ROMs for AFT but I don't have an ETA on when I'll be able to get that.
No on the tablet I have not installed TWRP and no other recovery.When I go into the original recovery of the tablet there is always the screen with the lock closed at the bottom right and there is no way to show it to the PC even with adb sideload, l 'only program that recognizes me the tablet is Asus flash tool, however, as I have already written the damn ROM in RAW format is untraceable.
pucci2 said:
No on the tablet I have not installed TWRP and no other recovery.When I go into the original recovery of the tablet there is always the screen with the lock closed at the bottom right and there is no way to show it to the PC even with adb sideload, l 'only program that recognizes me the tablet is Asus flash tool, however, as I have already written the damn ROM in RAW format is untraceable.
Click to expand...
Click to collapse
Does it respons to adb devices of fastboot devices in this stage?
no, it is not recognized

[Guide][Tutorial] Root TWRP LG G5 using Autorecowvery[H830 & V20A only][Noobfriendly]

[Guide][Tutorial] Root TWRP LG G5 using Autorecowvery[H830 & V20A only][Noobfriendly]
This is guide to root and install twrp on lg g5 T-Mobile using recowvery method.
Read 4th post before proceeding​This method is to root & install TWRP on only T-Mobile LG G5 running Nougat 20a software. If your phone isn't on 20a then first downgrade/upgrade to 20a software.
Before asking a question, first, see FAQ in 3rd post. In that way you can save a lot of time.
For Video Guide refer to 5th Post
You need to disable antivirus before extracting files. Because we are using DirtyCow vulnerability here. Which is technically a virus (It's not dangerous for pc but for exploiting android to get root access). If you can't disable AV then don't proceed because process will not work
Download:​1: Recowvery (2nd post)
2: Minimal adb (2nd post)
3: TWRP
A: H830 | For H850 (Refer to this Post and read carefully)
[Download TWRP 3.0.2 as 3.1.0 is having some little issues with flashing with autorecowvery] Always download latest TWRP available for your device to avoid most issues.
(rename it to recovery.img)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Procedure:​Drivers should be installed. Also install minimal ADB and fastboot.
1: Make sure to unlock bootloader. Backup internal data because it will be erased.
A: First enable developer options and toggle “Enable OEM unlock” to ON. Also enable “USB Debugging”.
B: Run Minimal ADB and Fastboot. Enter Command
Code:
adb devices
C: You will see permission dialogue on phone. Tick “Always allow” and ok.
D: Now enter.
Code:
adb reboot bootloader
E: Now phone be in fastboot mode. Enter
Code:
fastboot oem unlock
F: This will wipe all data on internal storage. Now Enter
Code:
fastboot reboot
G: Now OS will get booted. Bootloader will be unlocked but phone should be in factory reset condition. So again enable “USB Debugging”.
THEN​
2: Connect phone with pc in MTP mode and copy recovery.img to phone’s internal storage (Make sure to select MTP as always to avoid problem during procedure). Extract recowvery software. (If it causes permission problems extract it to USB device and perform process from there)
3: Run “EasyRecowvery.cmd”. Press “5” -->Enter then press “7” -->Enter to disable integrity check. Then enter “0” to go back. Skip it if you are using Recowvery G5 modified.
4: Now press “2” and wait until it says warning. Press “y” -->Enter. (It won't say warning in Recowvery G5 modified)
5: It will do rest process. After Flashing TWRP it will flash “no-opt-encrypt” (This is most important to save twrp from being removed by OS)
6: Phone will boot into TWRP. Here on phone it will ask for decrypt code. Cancel it. Swipe to allow modification.
7: On pc press any key, the flashing process on phone will automatically get started. Then it will reboot into OS.
8: To flash supersu, select option 3 from recowvery windows and phone will boot into twrp. Same as step 5-6 it will automatically flash supersu.
Now Your rooted and have twrp install.
Note: For removing Encryption.
To flash a custom rom and remove encryption in twrp, you need to once format data in twrp else you won’t be able to wipe and install any custom rom in your phone.
Attachments
Recowvery G5 modified is fully working, so you can try it.
I'm still keeping easyrecowvery 1.3 in this thread as a backup plan.
Read Read Read Before using This
Test Version --> Ricksy-Recowvery | Mirror
(Ricksy Recowvery is streamlined, checks free version of EasyRecowvery. It has no unlock checks, no model verification so use it only if you're fully sured about what you're doing. It includes but isn't limited to unlocked bootloader, USB Debugging Enabled, Being on V20a firmware, LG Drivers installed, PC allowed as Trusted in USB Debugging as always)
Remember to copy latest TWRP to root of internal storage as recovery.img before proceeding.
Old Test
There is also Addition of Recowvery G5 modified 2.0 Test version as well (This script has some additional features)
(I have also turned off most security checks, so you should have an more easy rooting experience. However, this increase risk of bricking device if you do not read things properly). If you can provide your experience of using this script please share your knowledge.
Download Test version either from here or here or through attachments
FAQ​
Recowvery tool is causing permission errors when I run it through computer's internal HDD storage. What shall I do?
Ans: There are possibly 2 workarounds for that.
A: Extract the zip to external USB storage and Run the tool.
B: Change the name of folder, in which recowvery tool is, to "1" and copy to root of storage e.g. "Computer:\D:\1".
Can I re-lock my bootloader after rooting and TWRP flashing?
Ans: No, as recovery partition modified now, this will brick your device.
Can I use V20C or later on my phone after rooting and flashing TWRP?
And: You can't take OTA after rooting as this might create a brick but fortunately @autoprime created TWRP flashable zips of firmwares e.g 20c,20f,20i and he might create newer builds too. Anyways here's the Auto Prime's thread, Go to "LG G5 Files" link and download file as per your variant and choice.
I bricked my phone after following this guide and now I can access only download mode, what shall I do now?
I'm on other version than 20a, What shall I do?
Ans: Really? It seems like you're kidding because this guide can never harm your device, It can either do it's work or not but there is no way for it to brick a device (Unless you don't read carefully).
Ans: You can take your phone back to v20a by using the following guide.
Anyways​You can always bring your phone back to life by following this Back to Life thread.
How to remove encryption in TWRP? or I'm unable to access my phone's internal storage from TWRP, What shall I do?
Ans: So for this process.
a: Boot into twrp.
(you can boot to TWRP by any app or by vol- and power button combination or from option “5” --> “5” in recowvery toolkit (command window).
b: In TWRP, cancel code Windows, Swipe to allow modification then
Click -->Wipe-->Format Data-->type “yes”-->enter.
You need to do this only once. After that you can flash roms and zips unlimited times.
Will this root method work on 20c/d/e/f or others?
Well, it shouldn't. Because I tried this on 20c and it never worked, so I believe it will not work on any software other than 20a because LG removed that exploit to root after 20a. But you can try your luck and tell me if you succeed.
a: Thanks a lot i have one lg g5 h830 and i have some fear to lose the unlocking and i want to modify the phone.
b: Same i have anyone please answer it will i lost the UNLOCKING (Modified by shopkeeper) if i FLASH another ROM?
What are you people trying to ask here?
Bootloader Unlock:
Bootloader can be locked and unlocked anytime you can to do so just by typing commands in fastboot mode. In T-Mobile G5 the fastboot mode do not accept flash command that's why we can only lock and unlock bootloader.
TWRP:
As commands are limited in fastboot mode of T-Mobile G5, we are unable to flash twrp through fastboot mode. So, for this process we rely vulnerability found in G5 firmware. The only currently found method for doing so is by using dirtycow exploit to flash TWRP on H830. Only V20a contains this vulnerability to do so.
Summary:
So to flash TWRP and enjoy freedom of using custom rom (Which I suppose you refer as Unlock to) you need to be on V20a. Which can be flashed easily through LGUP with Uppercut or use my LG FlashTool method (Link in FAQ section). When on V20a firmware simply use this or your preferred method for flashing TWRP.
If you want to go back to stock, simply flash any stock KDZ and lock bootloader. If you want to get TWRP again, simply unlock bootloader and flash V20a kdz (or flash V20a kdz and unlock bootloader) then instal TWRP by using the process.
Important:
Currently our stock firmwares are running Anti-Rollback (ARB 01), LG can increment this whenever they want, whenever LG increase ARB to 02 or upper then you won't be able to get back to ARB 01 firmwares (e.g V20a ) again. Which means you can unlock bootloader but won't be able to flash TWRP as dirtycow is patched after 20a. So you will lose the ability to flash TWRP which means unlocked bootloader is useless unless someone finds another method of flashing TWRP.
So, if you want to stay unlocked, then make sure to install TWRP as described above and flash latest TWRP flashable stock base zips or use other roms like Fulmics or AOSP based. It's very simple and easy .
First of All:
​After Flashing let me know about your experience by answering the poll, this will help me in updating this post.
POLL is ended, so let me know about your experience with toolkit and thread readability in comments.
Disclaimer:
​Before proceeding, remember I’m not responsible for anything bad happened to your device by following this or any of my guide. I’m just trying to help. So always do it on your own risk…
Don’t blame me or Any other developer.
All tools here are developed by different personalities. I’m just providing a guide on using these tool. Always say thanks to me and them. And If possible, donate them. They really deserve it.
Thanks be to:
@jcadduono For Recowvery tool
Source thread [V20 originated]
Due to some issue YouTube video aren't being played directly on XDA. So, you need to watch it here (Maybe some resistance on XDA side because things are good on my blog)
https://www.youtube.com/watch?v=F5PdTW8QHcA&t
Video Tutorial:
<iframe allowfullscreen="" frameborder="0" height="270" src="https://www.youtube.com/embed/F5PdTW8QHcA" width="480"></iframe>
https://youtu.be/G_4ayiZbSkM<br />
<br />
<br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe width="320" height="266" class="YOUTUBE-iframe-video" data-thumbnail-src="https://i.ytimg.com/vi/G_4ayiZbSkM/0.jpg" src="https://www.youtube.com/embed/G_4ayiZbSkM?feature=player_embedded" frameborder="0" allowfullscreen></iframe></div>
<br />
[YOUTUBE]<object width="445" height="364"><param name="movie"
value="http://www.youtube.com/v/AK9aZyJJNIo&hl=en_US&fs=1&rel=0&color1=0x234900&color2=0x4e9e00&border=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/AK9aZyJJNIo&hl=en_US&fs=1&rel=0&color1=0x234900&color2=0x4e9e00&border=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="445" height="364"></embed></object>[/YOUTUBE]
For which software version is this applicable?
arjunking said:
For which software version is this applicable?
Click to expand...
Click to collapse
Nougat v20a only as the thread title says.
I had to extract to a USB device to get recowvery to work but it went smoothly from there, until I got to TWRP to flash the no verity zip. It hung on hit any key to continue, it didn't dawn on me till later I should have mounted USB storage (derp), but I already had the no verity zip and SuperSU on my external SD so I just flashed them manually, booted, and had root. Then I formatted data, lost root, and flashed SuperSU again to get it back. I later flashed @autoprime 20c zip with SuperSU and now I'm rooted with TWRP on 20c, tyvm for the tutorial
Char_G said:
I had to extract to a USB device to get recowvery to work but it went smoothly from there, until I got to TWRP to flash the no verity zip. It hung on hit any key to continue, it didn't dawn on me till later I should have mounted USB storage (derp), but I already had the no verity zip and SuperSU on my external SD so I just flashed them manually, booted, and had root. Then I formatted data, lost root, and flashed SuperSU again to get it back. I later flashed @autoprime 20c zip with SuperSU and now I'm rooted with TWRP on 20c, tyvm for the tutorial
Click to expand...
Click to collapse
First of all you welcome, 2nd thanks for writing about your experience.
I am not completely assured but to make recowvery work in internal hard drive you need to change the name of recowvery folder to "1". Next time whenever you root try this method and let me know wether it worked...
And as you mentioned about having difficulty in flashing no verity. I think this issue is happening only on TWRP 3.1.0, on TWRP 3.0.1 it works fine, i think .
Does this method work with the latest update to 20f? Can I just try it without bricking my phone?
Sent from my LG-H830 using Tapatalk
dksoni411 said:
First of all you welcome, 2nd thanks for writing about your experience.
I am not completely assured but to make recowvery work in internal hard drive you need to change the name of recowvery folder to "1". Next time whenevee you root try this method and let me know wether it worked...
And as you mentioned about having difficulty in flashing no verity. I think this issue is happening only on TWRP 3.1.0, on TWRP 3.0.1 it works fine, i think .
Click to expand...
Click to collapse
Thanks, I'll try that next time. I did use TWRP 3.0.1 though, but I'm thinking that without mounting USB storage, perhaps the verity zip couldn't be found to be flashed.
This worked perfectly!! Thank you so much again! I had to extract the recowvery to a usb stick and run it from there (it wouldn't run properly from the computer hd) and at first I got an error as I had put the recovery.img on the external phone sd. My bad. Anyway... I just copied it over to the phone sd and started over, and it worked exactly as explained in the OP.
AWESOME effort by everyone involved. XDA rules!
Btw... can I relock the bootloader now? And one more thing... I turned off "automatic system updates" in developer mode. I assume if I update to v20c or newer I will lose root? And I guess I should not update the supersu either?
Thanks again! You rock!!
d3th.m0nk3y said:
This worked perfectly!! Thank you so much again! I had to extract the recowvery to a usb stick and run it from there (it wouldn't run properly from the computer hd) and at first I got an error as I had put the recovery.img on the external phone sd. My bad. Anyway... I just copied it over to the phone sd and started over, and it worked exactly as explained in the OP.
AWESOME effort by everyone involved. XDA rules!
Btw... can I relock the bootloader now? And one more thing... I turned off "automatic system updates" in developer mode. I assume if I update to v20c or newer I will lose root? And I guess I should not update the supersu either?
Thanks again! You rock!!
Click to expand...
Click to collapse
As you installed TWRP, so recovery partition is modified which means if you relock bootloader, you will brick your device.
Also if you want to use V20c check @autoprime's thread for the TWRP flashable zip of V20c or later (if there any).
And if you want to update supersu you can do it either by newest supersu zip to flash it through TWRP or by updating it through playstore then update binary through supersu it self, but I think updating supersu mostly changes nothing.
dksoni411 said:
As you installed TWRP, so recovery partition is modified which means if you relock bootloader, you will brick your device.
Also if you want to use V20c check @autoprime's thread for the TWRP flashable zip of V20c or later (if there any).
And if you want to update supersu you can do it either by newest supersu zip to flash it through TWRP or by updating it through playstore then update binary through supersu it self, but I think updating supersu mostly changes nothing.
Click to expand...
Click to collapse
Ok. Thanks for all the info. I think I will keep the v20a with the current supersu. It works perfectly! Hopefully it will not "automatically update between 23:00 and 04:00" as it says in "about phone/update center/system updates". From what I understand, it shouldn't as long as I have the "automatic system updates" set to OFF in developer options.
How can I boot into TWRP? When I reboot and try to enter TWRP I always end up in the hard reset menu where it asks if I want to wipe the phone... Do I have to boot into TWRP through ADB fastboot?
d3th.m0nk3y said:
Ok. Thanks for all the info. I think I will keep the v20a with the current supersu. It works perfectly! Hopefully it will not "automatically update between 23:00 and 04:00" as it says in "about phone/update center/system updates". From what I understand, it shouldn't as long as I have the "automatic system updates" set to OFF in developer options.
How can I boot into TWRP? When I reboot and try to enter TWRP I always end up in the hard reset menu where it asks if I want to wipe the phone... Do I have to boot into TWRP through ADB fastboot?
Click to expand...
Click to collapse
When you boot to recovery through hardware key combination, say yes through hardware keys twice (as you want to reset), it will take you to TWRP, thats the logic from lg g2
dksoni411 said:
When you boot to recovery through hardware key combination, say yes through hardware keys twice (as you want to reset), it will take you to TWRP, thats the logic from lg g2
Click to expand...
Click to collapse
He is absolutely correct. That's exactly what I did on my H830 yesterday.
Keep up the great work people......
Got it after a few attempts
Thanks for the step by step. It is a good walkthrough for a tough device. With all the previous complicated, and sometimes confusing/conflicting, instructions in other (older) threads for the H830 I was nervous to try.
I struggled a little getting it to work; 1) .cmd returned "don't have permission to create log or backup files..." when running from my "documents" directory, had to run it in a root folder. 2) I got the wrong TWRP version at first and the process said success, but never made it to TWRP.
It was the most challenging of any device I have owned to get root, but happy to crack it. Thanks!
root 20f?
does this root method work on 20f?
hp786 said:
does this root method work on 20f?
Click to expand...
Click to collapse
Well, it shouldn't. Because I tried this on 20c and it never worked, so I believe it will not work on any software other than 20a. But you can try your luck and tell me if you succeed.
Salam bro,I followed your method and rooted the phone,after rooting I wiped system, data and cache so I could flash fulmics 2(based on v20c) which I had already downloaded,it flashed successfully but after booting on startup screen there's this popup error"settings keep closing " because of which I can't do anything so can u please tell me where did I go wrong,should I have wiped the system or not?

Blackview BV9000 Pro-F ROOT SUCCESS [TWRP + Magisk v16 + Stock Rom]

EDIT: included rough procedures for OEM unlocking, and updated link to recovery-verified.img (Sorry for uploading the wrong file ><)
Hi all bv9000 pro Users!
Recently I went on a journey to root this awesome rugged phone with one purspose: to remove that F*@(#&$ god awful loud annoying sound triggered by the OS when you use a camera app to take a picture + the boot startup sound (A bug blackview hasn't gotten around to fixing).
I successfully managed to port TWRP 3.1.1 from the Blackview bv8000 Pro and run it on the Blackview bv9000 Pro-f!
I've then managed to flash in Magisk to gain root access.
DISCLAIMER: I do not take responsibility for any bricked phones caused by the process, do so at your own risk (yadayadayada).
NOTE 1: Although I've got it running on the bv9000 Pro-F, this image should also work for the non-fullHD version, if someone can test this I'd be happy.
The link to the stock ROM (with the modified recovery img) can be found in the post below.
NOTE 2: No need to download anything other than what I've listed, Magisk is included in my custom recovery to circumvent the need to load the devices encrypted storage (or any other external storage) nothing stops you from mounting external usb storage.
What you'll need:
- USB Mouse (As there is no touchscreen input support, your device should have come with a usb-c otg cable so there's no problem here!)
- MediaTek SP Flash tools (I'd recommend the latest version) https://spflashtool.com/
- unlocked bootloader (You should be able to do this via the developer settings -> unlock OEM Bootloader)
EDIT: To unlock the boot loader, do the following:
1) Go to settings -> unlock OEM Bootloader (tick)
2) plug your device in (assuming you have ADB installed), use adb to access fastboot via. command prompt:
"adb reboot bootloader"
Then once the device is rebooted into fastboot mode
"fastboot oem unlock"
KEEP IN MIND THIS WILL REMOVE ANY FILES, so back them up
- I've done this with windows, but you should be able to repeat with linux no problems!
- A little patience
Pre-preparation:
First install any updates and back up your data (it's just easiest to use the google cloud backup as restoring becomes easy as pie, updating also fixes the setup wizard crashing on first setup). This is necessary because OTA updates cannot be performed with TWRP recovery, and flashing TWRP before doing OTA updates will flick the device into a recovery boot loop.
Install the SP Flash tools, and the MediaTek VCOM Drivers
(I won't link the specifics here, a quick google search should be able to help you, just note you might need to disable driver signature enforcement)
Two options for flashing:
1)
My Full Stock ROM already pre-prepared for flashing:
Patched ROM
No need for extra prep here! you should just be able to load the scatter
2)
My custom patched TWRP stock rom: recovery-verified.img
Blackiew's stock rom: stock rom
- Download the stock rom, backup the recovery-verified.img in the R06 folder, and then replace it with my custom patched TWRP stock rom (file name should be the same).
- Run "CheckSum_Gen.exe" once you replaced the file, it will generate the necessary checksum to allow SP flash tools to successfully flash recovery.
Once you've done with the pre-prep, switch off your device, take a deep breath and you're ready to go!
Steps!
1) Load up SP Flash Tools, select the android scatter file you've downloaded in the R06 folder
2) Select Download Only (I MEAN IT, FORMATTING WILL REMOVE YOUR IMEI AND RENDER THE PHONE USELESS)
3) Deselect everything but recovery (You only want to flash this)
4) Hit download
https://pasteboard.co/HkufwZZ.png
5) Hold volume up + power and plug in your phone, keep the volume up button held
6) very quickly the flash should be complete, and you should be greeted with a big ol' green tick to verify
https://pasteboard.co/HkuiTBB.png
7) Once you're done, remove your USB cable, plug in the OTG then we proceed to flash magisk
8) Hold power + volume up until you reach the bootloader, then use the menu to select recovery
9) You *should* be greeted with the TWRP recovery screen (Which is great success! )
DON'T PANIC IF YOU CANNOT USE THE TOUCH SCREEN, the kernel I've patched is missing this, seems the driver is different between touch screens, just plug in your OTG mouse to continue from here!
10) Use your mouse to first hit cancel, we don't need to decrypt the user data storage.
11) But oh no! it's all in Russian (no problem, Next step sorts that)
12) Use your mouse to navigate the menus as shown here to change to English! (or your preferred language) Change Language
13) Click install, then navigate up folder levels until you are in the root directory
14) scroll down and click on Magisk.zip, install it, allow it to install any apps as system apps (because this will then install to the system image, not the userdata)
15) reboot the phone (if it hasn't rebooted already)
16) You should be able to boot into your usual phones OS, if you don't see Magisk listed in your phone apps, just download it from here:
Magisk Manager
17) Congratulations! You should have complete root access :laugh::laugh::laugh:
Feel free to express your thanks, or list any problems you have, but keep in mind my studies take all my life, so I may not be able to help with all the problems you have
Congrats! Would it work on the BV9000 HD version?
Hi!
From what I've seen they both run the helio p25 chip
(Just a difference in RAM size) so it should.
You're more than welcome to try.
Just keep a backup of the original ROMs recovery. If something goes wrong during the boot to recovery you can easily re flash
hi i tried both optinos but they didn't work for me
I tried the first and the second options and it was showed me same error:
ERROR: STATUS INSUFFICIENT_BUFFER(0XC0010007)
I tried download only, format all and download, if i install original ROM its installing without problems!
In settings-> developer options -> OEM unlocking is enabled
can someone give me tips if I'm doing something wrong. thanks
My phone is Blackview BV9000PRO-F
Hello,
i have the blackview 9000 pro Hd (not full hd)
i first tried your prepared patched rom = not working (get erorrers in step 6)
then i chose step 2 and i was thinking to use the stock rom from the NOT full hd rom
now i get a green screen from the flashing: but after rebooting in recovery nothing happens, just normal reboot then
perhaps this is not so clair for me:
- Download the stock rom, backup the recovery-verified.img in the R06 folder, and then replace it with my custom patched TWRP stock rom (file name should be the same).
- Run "CheckSum_Gen.exe" once you replaced the file, it will generate the necessary checksum to allow SP flash tools to successfully flash recovery.
the file name you posted here " My custom patched TWRP stock rom: recovery-verified.img" is ramdisk-recovery.img
i replaced the ramdisk-recovery.img... it is not clair need to replace recovery-verified.img to?
>I tried the first and the second options and it was >showed me same error:
>ERROR: STATUS INSUFFICIENT_BUFFER(0XC0010007)
> tried download only, format all and download, if i install >original ROM its installing without problems!
>can someone give me tips if I'm doing something wrong. >thanks
>My phone is Blackview BV9000PRO-F
Hi, you need to unlock the OEM bootloader, if this is still locked it will prevent the flashing of custom ROMS.
I might've missed this step, will update post as necessary.
>
dingsje said:
Hello,
>i have the blackview 9000 pro Hd (not full hd)
>i first tried your prepared patched rom = not working >(get erorrers in step 6)
>then i chose step 2 and i was thinking to use the stock >rom from the NOT full hd rom
>now i get a green screen from the flashing: but after >rebooting in recovery nothing happens, just normal >reboot then
>perhaps this is not so clair for me:
>- Download the stock rom, backup the recovery->verified.img in the R06 folder, and then replace it with >my custom patched TWRP stock rom (file name should >be the same).
>- Run "CheckSum_Gen.exe" once you replaced the file, >it will generate the necessary checksum to allow SP >flash tools to successfully flash recovery.
>the file name you posted here " My custom patched >TWRP stock rom: recovery-verified.img" is ramdisk->recovery.img
>i replaced the ramdisk-recovery.img... it is not clair >need to replace recovery-verified.img to?
Click to expand...
Click to collapse
Hi,
I've uploaded the wrong file, the uploaded file should be recovery-verified.img.
I'm uploading a new file and will correct the link now,
Please accept my apologies ><
hyperlethalvector92 said:
>I tried the first and the second options and it was >showed me same error:
>ERROR: STATUS INSUFFICIENT_BUFFER(0XC0010007)
> tried download only, format all and download, if i install >original ROM its installing without problems!
>can someone give me tips if I'm doing something wrong. >thanks
>My phone is Blackview BV9000PRO-F
Hi, you need to unlock the OEM bootloader, if this is still locked it will prevent the flashing of custom ROMS.
I might've missed this step, will update post as necessary.
Click to expand...
Click to collapse
I already did this step:
Enable developer options-> OEM unlocking is enabled
Is that enough for this MTK phone to be unlocked the bootloader ?
And tried the both options but the results are same.
I have been unlocking bootloaders on many phones but first time MTK phones. If i try with adb commands it recognize when is in the android with command adb devices and show my device but if I try reboot bootloader and check in device manager in windows its show its connected and drives are correct but if i try to show the devices, it doesn't show any device connected
Hi,
You need to install fastboot drivers once it's in bootloader mode,
then use fastboot, not adb.
"fastboot oem unlock"
Then follow instructions.
simply doing settings -> oem unlock won't unlock the bootloader, it allows you to do so later via. fastboot
Check the original post, I've added the extra instructions sorry about the confusion!
Thanks a lot. I finally succeeded to unlock the bootloader and root my phone and install the magisk.. I did without use your rom just I unlocked the bootloader and install your twrp file and after in the recovery mode i format the data and istall magic and i still have the last updated android.
I hope this it ill help to other people. Cheers
zlatkomas said:
Thanks a lot. I finally succeeded to unlock the bootloader and root my phone and install the magisk.. I did without use your rom just I unlocked the bootloader and install your twrp file and after in the recovery mode i format the data and istall magic and i still have the last updated android.
I hope this it ill help to other people. Cheers
Click to expand...
Click to collapse
I'm glad ^______^
Enjoy your rooted phone
I used this video to root my bv9000 pro hd
much easier than this above, i think it works to on bv9000 pro fhd
https://www.youtube.com/watch?v=c48ISLPjn4Q
Congratulations .... I need a tip,.
And, brother, thank you very much. Worked perfectly.
But first I would like to get you a tip ..
One of the main reasons I have done all this complicated process was to be able to disable the crap of the loud music that plays when the device is started.
I want complete silence at startup.
How do I disable this ****?
Code for Huawei mobile Wi-Fi e5577s-321
Pls help unlock my Huawei mobile Wi-Fi e5577s-321
Imei
860782038163889
TWRP looping after OTA update
My dear, the procedure worked very well, until an OTA update was downloaded.
You are now looping on TWRP. How do I get out of this?
:crying:
help!
i missed to run wireless software update,so ROM clashed.
How can i re-install custom ROM?
mackie_ma said:
help!
i missed to run wireless software update,so ROM clashed.
How can i re-install custom ROM?
Click to expand...
Click to collapse
Hi guys, lemme apologize for disappearing, life and whatnot!
For those stuck in a TWRP boot loop, simply restoring the original recovery then restarting the phone will be enough to fix the problem.
(Actually you really don't need TWRP after the phone is rooted, maybe I should update the guide?)
Many Thanks
First off, thank you for your hard work. Loved the "**** it we have an OTG cable let's use it" haha. It works fine for me.
Second, do you happen to know if someone has ported Oreo on our bv9000 ? Or do you know of any ETA ?
Thanks again,
Cheers
Anyone tried on the BV9000 Pro? Don't think mine is 'F' OR 'Fhd'.... I must have first model brought out...
Ugh.. Windows and Drivers?!?!
I keep getting Driver not Recognized in Windows 7 Pro X86.
I installed the latest vcom/usb drivers, in legacy also. No Go.
I installed from several other sources the drivers, including the Automatic Mediatek driver install. No Go.
So if anyone has a tip for me, please let me know because once more Windows is proving itself ridiculous. I can't even get to the storage of my phone. Did something change with a Windows Update that it's not allowed anymore?
I put my BV9000 Pro in OEM Unlock and USB Debugging. I backupped everything. My phone is ready for it. It's as ready as Amy having coitus with Sheldon for the first time.

How To Guide [Stock ROM] How to root the Snapdragon Moto E 2020

Alexenferman is not responsible for any damages or bricks made to your device. Please do some research if you have any concerns about rooting, its features and downsides. You are choosing to make these modifications, you should blame yourself for any mistakes you make.
Rooting may require a factory reset, please backup your data. Rooting will void your device warrany. By rooting your device, you will not be able to install OTA updates on your phone.
US carrier specific devices such as Verizon and Sprint might not be bootloader unlockable, therefore, not rootable.[/B]
You will need:
Platform Tools (Download from here)
Motorola Drivers
Windows or Linux PC
Bootloader Unlocked Moto E 2020
Your phone must be bootloader unlocked. Rooting your phone and not unlocking the bootloader will result in a soft brick.
Download the latest Magisk Manager APK from Github: https://github.com/topjohnwu/Magisk/releases/download/manager-v8.0.0/MagiskManager-v8.0.0.apk
Install the APK file. Make sure to enable "Unknown Sources" in the Settings app
Patching the boot image
To retrieve the boot image in order to patch it, you will need to download the stock ROM for your specific variant.
Download the ROM from your variant from here: https://mirrors.lolinet.com/firmware/moto/ginna/official/
To check which region is your device, go to Settings > About Phone > Software Channel.
After downloading, open the ROM zip file with an archive manager.
Extract the boot.img file only.
Transfer the boot.img file on your phone.
On your phone, open the Magisk app.
Select "Install" > "Install" > "Select and Patch a File"
Locate the boot image in the internal storage on your phone. Select the boot.img file.
Transfer the magisk_patched.img file on your computer.
Rooting the device
Boot the device into fastboot mode by holding the [Volume Down] and [Power] buttons.
Connect your phone to your PC.
On your PC, open a fastboot console window.
Type:
Code:
fastboot devices
Your phone serial number should be displayed along with the word "fastboot" or "device" in the console.
Now, type the following commands:
Code:
fastboot flash boot_a patched_boot.img
fastboot flash boot_b patched_boot.img
Replace patched_boot.img with the path to your boot image we patched previously.
To reboot the device, type:
Code:
fastboot reboot
Once the device rebooted, open the Magisk app.
If you see the "Magisk is installed" message, you have successfully rooted your device!
You are done!
To view instructions with images, follow these instructions: https://www.alexenferman.com/articles/MotoE2020/root-moto-e-2020-magisk
I can confirm this works, I was about to give up on root or TWRP until I saw this. I'm now rooted, but I still can't find a download link for the latest TWRP for the Ginna model.
Hypercore said:
I can confirm this works, I was about to give up on root or TWRP until I saw this. I'm now rooted, but I still can't find a download link for the latest TWRP for the Ginna model.
Click to expand...
Click to collapse
Me neither, can anyone provide a TWRP for ginna?
I eventually found it after a ton of digging. I've uploaded it to my drive to assure the link stays active for anyone else who may need it.
For peace of mind, here's the VirusTotal scan HERE.
And here is the link to twrp-3.4.0-10_0-ginna HERE.
Hypercore said:
I eventually found it after a ton of digging. I've uploaded it to my drive to assure the link stays active for anyone else who may need it.
For peace of mind, here's the VirusTotal scan HERE.
And here is the link to twrp-3.4.0-10_0-ginna HERE.
Click to expand...
Click to collapse
Confirmed working. Tyvm!
Before I brick my phone. Can anyone confirm if the Tracphone version XT2052DL is rootable?
I'd like to know, too. Can we root our Tracfone XT2025DLs? Anyone successful?
dragonfire0501 said:
Before I brick my phone. Can anyone confirm if the Tracphone version XT2052DL is rootable?
Click to expand...
Click to collapse
Ranthalion75 said:
I'd like to know, too. Can we root our Tracfone XT2025DLs? Anyone successful?
Click to expand...
Click to collapse
I have one too and I've tried to unlock the bootloader however Motorola's website says the bootloader for this phone is not unlockable. It seems like this is what's preventing me from being able to install a different firmware like the stock one or root the device.
I do not know if there is any sort of workaround for this
For some reason on a Moto E, after rescuing using the Moto rescue assistant and then using
you guys can also use OFox Recovery and swipe magisk to root
Thank you. I used this guide to root my Moto E
QPGS30.82-135-2_Root.img
This method works well for QPGS30.82-135-2, but I just attempted it with QPGS30.82-135-9 and unfortunately the Magisk patched boot image will not work. I tried it 3 times, re-patching boot image each time. I suppose Motorola updated something in android to block this?
i can't get this to work at all, i cannot find a matching stock firmware being qpg30.82-135, there's no extra S and nothing else after the 135, got this phone from my motorola insiders rewards and now it's bootlooping after trying the 135-2 patched image
Has anyone been able to root and hopefully install a custom recovery on the lastest update? Mine is QPGS30.82-135-14, and so far I've only been able to get orangefox to boot but couldn't get it to decrypt my storage or install magisk. I tried twrp first, but to no avail, touch screen still doesn't work on it, so now I'm asking on a few different threads for this phone lol. Any help would be great!
Do you know of an updated method to get it to flash correctly? I was able to boot into ofox, but couldn't get it to properly flash. Ended up stuck on a screen that said my phone was unlocked and couldn't be trusted and that it'll reboot in 5 seconds. I don't know much about ofox either, been using twrp for years lol, it looks too different. Anyhow, any help would be appreciate much!
ace120ms said:
you guys can also use OFox Recovery and swipe magisk to root
Click to expand...
Click to collapse
You have to fastboot boot it anyway I don't have this phone anymore so idk
bouyakasha said:
This method works well for QPGS30.82-135-2, but I just attempted it with QPGS30.82-135-9 and unfortunately the Magisk patched boot image will not work. I tried it 3 times, re-patching boot image each time. I suppose Motorola updated something in android to block this?
Click to expand...
Click to collapse
I have the same problem with QPGS30.82-135-9. I can't get it to boot after Magisk patched boot image.

Categories

Resources