[ROOT][Surnia]Moto E 2015 root all the things! - E 2015 General

disclaimer:
Code:
I take no responsibility for any devices that may be bricked,
or any bad things that will happen to you.
flash/boot twrp from here
either flash SuperSU by chainfire, or reboot system and accept installing supersu via TWRP.
we've experienced a bug on the first boot after flashing supersu, where there is no boot animation. instead the warning sign will stay up saying "you're unlocked".
Do not worry. It will still load, and supersu will prompt you to finish installing SU. do so, and everything will be back to normal.
A known issue happens, where root breaks the camera.
If this happens to you, then change SeLinux to permissive. I may look in to fixing it properly at a later point.
thank you to @fix-this for testing
previous post:
Please note this is a development thread. If something is said that is NOT constructive, I will have it deleted.
OK so this thread doesn't tell you how to root your device... yet.
in the process of rooting my device, I have essentially soft bricked it until I can get hold of either a boot/recovery image, or I find out the kernel base, ramdisk offset and tags offset.
long story short, I shouldn't have been messing about with the system while I was tired, so I forgot about dm-verity, and now it won't boot since the boot image contains a dm-verity key. hurrah for perma root prevention systems finally working.. sort of..
Motorola has implemented a nifty method in to their bootloaders. It essentially allows you to dump a partition. This is when I stumbled on yet another security measure. to allow you to do anything with the bootloader, you must flick a switch in the android dev settings to give full access... oh wait, I can't load the system I don't know if this switch is done by writing a value to memory, or is passed on with the reboot reason. I don't know Java that well, and I sure as hell don't know smali.
So far I have attempted:
Dump a modified system image (Failed because dm-verity).
Pull the boot image (Failed because SELinux)
Dump the boot image via moto fastboot (failed because either outdated mfastboot, or security from [read above])
Boot directly in to DLOAD mode. (Failed. seems with the msm8916, they've changed the method of accessing it, and having dload mode is now optional [which they disabled.. probably..]. I'm not going to risk wiping the bootloader to see if DLOAD mode will load as a fail safe).
so how can you help?
method failed. trying something else..
I need someone who doesn't mind unlocking their bootloader (or already has done), and doesn't need their hand holding. (request for hand holding isn't development, it will be deleted).
unlock bootloader.
get mfastboot
go to settings, dev settings, and allow oem unlock
boot to fastboot/bootloader
run this command
Code:
mfastboot oem partition dump recovery
If this fails, then try this (with this fastboot) (Thank you @m1cha for this version of fastboot, sources here)
Code:
fastboot_dump dump recovery.img oem partition moto-dump recovery
send the results back to me
Hopefully, this will all go well. If not, I'll spend a few hours figuring out the values they've used for the kernel base and offsets.
If anyone else has any ideas (even if it's to get a temp root), then feel free to share them
Big thankyou to @PotatoJ who has donated a very generous $20

And it finally begins

Gave em both the commands, nothing. Both are restricted. Ugh...
C:\windows\system32>fastboot dump recovery.img oem partition moto-dump recovery
...
(bootloader) Command Restricted
FAILED (remote failure)
finished. total time: 0.002s

more updates. just been told that those commands are for internal use only.
had an idea though.. will get back to you

cybojenix said:
more updates. just been told that those commands are for internal use only.
had an idea though.. will get back to you
Click to expand...
Click to collapse
Whatever you need, let me know. I've got the phone waiting for commands.

if im correct i think the system images are now available. ill help with what i can to obtain root. id hope rooting this wont be too hard considering we can unlock the bootloader via moto.
i also messaged jcase to see if he might be able to help us.

fix-this! said:
if im correct i think the system images are now available. ill help with what i can to obtain root. id hope rooting this wont be too hard considering we can unlock the bootloader via moto.
i also messaged jcase to see if he might be able to help us.
Click to expand...
Click to collapse
No need for jcase now. the boot image is out. I can patch it, and talk with chainfire about how to best handle dm-verity

cybojenix said:
No need for jcase now. the boot image is out. I can patch it, and talk with chainfire about how to best handle dm-verity
Click to expand...
Click to collapse
Yeah jcase responded and said since we can unlock the bootloader all we needed was a custom recovery to flash superuser. Was just trying to help.

fix-this! said:
Yeah jcase responded and said since we can unlock the bootloader all we needed was a custom recovery to flash superuser. Was just trying to help.
Click to expand...
Click to collapse
it's kind of a pain to make a custom recovery without having a recovery/boot image

Do you plan on making the recovery work with the boost mobile Variant

903tex said:
Do you plan on making the recovery work with the boost mobile Variant
Click to expand...
Click to collapse
no. I don't have the device.
btw, got twrp on it, however the return of the "No touch till screen goes off" bug is back.

Xda seems to be glitching, and won't show there's a thread in original dev from the main forum, so here's a direct link.
http://forum.xda-developers.com/moto-e-2015/orig-development/twrp-moto-e-2015-recovery-t3049726

if you need me to test, pm me. otherwise ill wait until you say its ok to root.

Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #

cybojenix said:
Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #
Click to expand...
Click to collapse
congratulation to you to gaining root access. :good::good::good:
we want rooting all together:laugh::laugh:

cybojenix said:
Code:
$ adb shell
[email protected]_umts:/ $ su
[email protected]_umts:/ #
Click to expand...
Click to collapse
you hard work is much appreciated.

so some bad news. the GB and EU variants have different camera blobs it seems.
unless I get decent testers, I will not be supporting the different variants.

cybojenix said:
so some bad news. the GB and EU variants have different camera blobs it seems.
unless I get decent testers, I will not be supporting the different variants.
Click to expand...
Click to collapse
how would i know if i have a gb or eu variant? and yes that's sad indeed for users. ill test whatever you need. i have an unlocked lte gsm model from moto.

root is done, thanks @fix-this for doing the final testing

cybojenix said:
root is done, thanks @fix-this for doing the final testing
Click to expand...
Click to collapse
Whatever you need for the CDMA variant I'll be happy to provide!

Related

[Tutorial] Camera2api ( Gcam ) Without ROOT

I dont take responsibility for possible damages!​'
1. When you unlock the bootloader, all your data will be erased!
2. When you try to lock the bootloader, your data will be erased and you will lose the API.
3. YOU CAN RECEIVE OTA UPDATES WITH THE BOOTLOADER UNLOCKED!​
Download the tool: https://forum.xda-developers.com/mi-a2/how-to/mi-a2-toolkit-unlock-bootloader-root-t3834585
1. Unlock the bootloader (I will not go into detail, the tool is intuitive, follow the tool's instructions!.)
2. Start your phone and enable USB debugging.
3. Put your cellphone in Fastboot.
4. In the tool, use option 4 (This will not install TWRP, just start) (follow the tool's instructions!)
5. When entering TWRP, if prompted, check "Keep system read only".
6. Open in the tool folder "Open CMD here"
7. Run the command: adb shell
8. Now enter the following command: "setprop persist.camera.HAL3.enabled 1" without quotation marks, and enter. - This command enables the required core API for GCAM.
9. Now type "exit" to exit adb.
10. Go back to the phone, in TWRP -> Reboot -> System -> Do Not Install
Ready.
I did this tutorial quickly. Any questions, use the comments!
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
kaiwanted said:
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
Click to expand...
Click to collapse
The tool just has the August picture. But the functions used for the gcam works in the September patch.
Yes. I have.
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
asuturo said:
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
Click to expand...
Click to collapse
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Rafaelboxer said:
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Click to expand...
Click to collapse
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
This command should tell you which slot is active:
fastboot getvar current-slot
ki69 said:
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
Click to expand...
Click to collapse
I got the september boot.img from another topic and rooted
Still no working solution for the ones that have setember update, and don´t want to root or use magisk??? I think the problem is that TWRP does not work with september update. Any easy way to downgrade to August again??
I'm thinking of installing Camera2API/GCamera, but I wonder if it's worth it. What are the real benefits? Does this make the camera compatible with more applications (eg Snapchat), avoiding them from making a screen of the camera ?
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
ricardohnn said:
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
Click to expand...
Click to collapse
If you did a search on that 'persist' command, you'd find that it does persist, to many of the tables that type of information is stored in. It does not change the info in the properties file in 'System'. It does change the 'Data' partition, but that's okay, as there's only 1 of those (used no matters which slot boots up). The reason for booting on the non-active partition is a twrp / dual slot phone type of thing. I know it works as I've done it, but the 'setprop persist' changes the one and only Data partition, which both slots use, that's why it works.
ricardohnn said:
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
Click to expand...
Click to collapse
I thought the patched image would have some su capabilities also, but it doesn't. It only installs the Magisk stub, which you can further install magisk from. Magisk is a great and sophisticated app. Has numerous Magisk modules which do a wide variety of things. But if you don't need any of those things, and don't need root, it's pretty over the top for just setting the cam2api, imho.
ricardohnn said:
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
Click to expand...
Click to collapse
If you change 'System' directly you will not get any OTA updates, so yer right, don't change that. There's no need to consider changing it anywhere else, as the 'setprop persist etc' command populates all the tables for you. 'System' is not affected and OTA updates will continue. There's no removing Magisk, restoring boot image, reinstalling etc etc etc.
One thing I would warn others about, using the various 'Tools'. You don't know what commands they are running, so you can't be sure what they will do. I say that because one of the tools I recently downloaded and went through and found the commands in it. The first thing it did after booting TWRP was to mount 'System' as Read / Write!! Why does that matter? From what I've read, doing that stops OTA from happening. Just mounting it R/W will change the date stamp on it concerning modifications, and that's all the OTA needs to know to say 'it's been modified'.
good luck, cheers
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
ricardohnn said:
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
Click to expand...
Click to collapse
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
AsItLies said:
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
Click to expand...
Click to collapse
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
minnuss said:
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
Click to expand...
Click to collapse
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
About the setprop, even after the reboot isn't returning the prop, so that's why i am not sure if it is actually keeping it after twrp boot.
About the AB partition... well...
it's more or less like this...
let's say some simple partition scheme....
Preloader
Boot
System
Vendor
ODM
Data
So the phone will probably have many boot images type... like the usual boot.img or recovery.img (before treble) etc.
The boot.img will have the kernel image bla bla bla... since this is a google update, i believe that the AB partition procedures starts here (meaning all the relevant code of checking whether is A or B)
Google wanted to make things faster for the OEM (Samsung, LG etc) so they wanted to separate their ****s from google's one.
So (if things didn't change) you will have the following partitions now (actually i am not sure if they kept the system AB, but i believe so, since it seems to be working in other phones like that )
BootA
BootB
SystemA
SystemB
VendorA
VendorB
OEMA
OEMB
Data
So let's say google wants to update some security patches, from kernel til android, it will have to update boot and system. So in a OTA (changes if it is a google phone or a branded phone) before treble, it would update like... download the image containing boot and system into cache partition or data partition (depending the OTA size), after the download the update manager apk would set as a update booting and reboot your phone. Once booted, the phone would copy the partitions to the correct place (not being detailed) and rereboot. After the rereboot, if everything went normal, it would delete the downloaded image from your data/cache partition.
Now it's different like... instead of sending the update to the data partition and copying. It has a flag to set whether you are in A or B partition.
If you are (for eg.) in A partition, it will download the OTA to the B partition. (consider that in an untouched phone, A and B would have identical copies). So after downloading it, the flag is set to the B partition and reboot the phone. When booting, this time, it will not follow the A booting flow, like...
Before the update booting process would be
BootA
SystemA
VendorA
ODMA
Data
After the update the boot process will be
BootB
SystemB
VendorB
ODMB
Data
But i didn't update the vendor or ODM... why not keep in A? Because it's too hard to manage it.
So if anything fails in this update, it can easily go back into A booting process (which means you have a backup of your old boot).
Since system is too big, i am not sure if the system AB exists (it would just take up too much space... but anyway...).
It is also not a way to prevent bootloop, it is related to update. If an update fails (say, the image is corrupted or has no signature etc) the boot will change back, but if the update is "correct" it will boot as it should, even if the image is bad.
So again... when we do the fastboot boot boot.img, we are copying this boot into some cache or data to boot up, instead of our original boot. When we reboot, it will use the original boot. So, is there a difference from using twrp flashed and booted?
I know that fastboot boot will trigger different booting process (meaning signatures verifying etc) but don't think that it will not mount a partition or something...
Well... anyway... so after the reboot, when you setprop in TWRP, the getprop returned the prop correctly? I recall something about getprop not returning the prop but camera2 was enabled anyway with the setprop... well... can you just confirm one thing for me?
The steps you used was... fastboot flash patchboot and then reboot into twrp and then reboot back to usual partition.
You didn't do fastboot boot patched boot -> twrp -> reboot
Right?
---------- Post added at 09:44 AM ---------- Previous post was at 09:42 AM ----------
AsItLies said:
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
Click to expand...
Click to collapse
Oh didn't see this one. OK...
Damn... hmm... strange... well thanks anyway...
---------- Post added at 09:50 AM ---------- Previous post was at 09:44 AM ----------
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
Oh by the way, i saw one part
"But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images. "
I think this is wrong (at least if TWRP team didn't change stuff), but all images are bootable images... (by all images i mean... boot.img recovery.img Flashing.img).
I once thought that they used a common kernel image, but in fact, all the booting process image has the kernel image copied (literally) to prevent brick. So even with a corrupted boot img, you still can boot into recovery or into download mode.
So that's why TWRP must have a kernel.
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
AsItLies said:
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
Click to expand...
Click to collapse
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
ricardohnn said:
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
Click to expand...
Click to collapse
What version of TWRP did you use, there is now two versions, I used last one, from a few days ago, and in first try I did manage to boot from fastboot, not flash it, but ADB did not worked.
So, if adb did work for you, maybe it was earlier version ?
Anyway, as you say, it is not permanent setprop, maybe because the twrp is not stable one, or maybe it needs to be flashed to work, not just booted.
I personally do not have doubts that this tutorial works, I just did not want to flash twrp. :good:

Very simple way to enable cam2api using patched_image

Not even going to keep this for the learning experience, it's not worth it.
Hi! Tks for you suport.
I have 2 questions if you can help me. I´m a noob for this phone, but i used to update mu Xperia with Remix and i unsdestand a little bit of installing costum firmware.
1- Do we need after this to install again stock boot.img? Because i read in were and MIUI forum that patch boot.img will not give OTA updates.
But installing stock will not remove Camera2api also?
2- I Have V9.6.13.0.ODIMIFE ( second september update) i try to seach for patch boot.img for A2 in were, but i only find the full stock image
in https://forum.xda-developers.com/mi-a2/how-to/fastboot-xiaomi-mi-a2-fastboot-images-t3824849
I read what you said about teaching to fishing rather give a fish, but if for this thime you could put the link, in future updates we all will be more confortable do do other updates.
Kind regards
ki69 said:
1- Do we need after this to install again stock boot.img? Because i read in were and MIUI forum that patch boot.img will not give OTA updates.
But installing stock will not remove Camera2api also?
Click to expand...
Click to collapse
Ki, this is a great example of where one needs to look carefully at the command, and do some research. If you look closely the code says "boot" patched_boot. The point there is that it doesn't say "flash". Booting it won't flash it. That command will read it from your hard drive into rom memory of the device, and NOT write it to the flash memory of the device. I.E. The boot.img on the device will not change, so no reason to flash it again.
ki69 said:
2- I Have V9.6.13.0.ODIMIFE ( second september update) i try to seach for patch boot.img for A2 in were, but i only find the full stock image
in https://forum.xda-developers.com/mi-a2/how-to/fastboot-xiaomi-mi-a2-fastboot-images-t3824849
Click to expand...
Click to collapse
Bring up all the topics in the MiA2 Guide(s) forum. At the top right is "Search This Forum". So... obviously... type in; patched_boot.
The first thread, OTA Jasmine (etc) has many posts with links to specific versions of (magisk) patched_boot images. (hint; search that thread also if you don't want to page through the posts!) - and don't forget to thank (use thank button!) cpkv5 for his efforts of extracting the boot.img and patching it for everyone, and making it available for easy download!
AsItLies said:
So to enable Cam2API w/out root, and continue to get OTA updates;
1) You need to be familiar with using ADB and FASTBOOT. Pls look at easily searchable documentation for them. Have them installed and usable on your pc / laptop. Try some of the commands out before using this guide, to get use to them / verify working.
2) You have to unlock the bootloader, which will wipe the device. It will also have to stay unlocked, which means your phone will be considered 'uncertified' in Play Store. Because we don't have NFC, and I don't do any banking apps on my phone... no worries for me.
3) You need the patched_boot.img for your current software version. The patched image (and the original boot image) are readily available. Just search the MiA2 forums and you'll find numerous links to new and previous images for the various software versions that have existed for our MiA2's.
So, you should already know how to enable adb and to OEM unlock in developer options (pls SEARCH if not!). So make an adb connection to do:
Code:
adb devices
The above will verify your pc sees the phone, obviously.
Code:
adb reboot bootloader
The above is an easy way to get to fastboot mode.
Code:
fastboot devices
The above will verify fastboot sees our device
Code:
fastboot oem unlock
The above unlocks the bootloader and wipes / reboots device. Again recheck to be sure in Dev options adb is on.
Code:
adb reboot bootloader
Above to get back to fastboot mode.
Code:
fastboot boot patched_boot.img
The above will now boot the device. Be sure the patched boot image is in the directory you are issuing the command from, and again, it needs to be the patched image that corresponds to the current software version you are using.
At this point, I'd recommend to not do anything with the device. It should be booted and appear normal. Back at our command prompt;
Code:
adb devices
Assuming we still see our device:
Code:
adb shell
The above will now put our command prompt into a linux shell, and then type the following:
Code:
setprop persist.camera.HAL3.enabled 1
and then
Code:
setprop persist.camera.eis.enable 1
At this point, it's about done. The above settings will get propagated to the appropriate tables after rebooting the device. They won't change system settings. So OTA updates should work.
Next, we just type 'exit' in the command prompt to exit the adb shell. Lastly we again issue 'adb reboot bootloader' and once we're back into fastboot, just issue 'fastboot reboot'.
That's it. We never flashed anything, only booted the patched image. So nothing really gets touched, that could inhibit OTA updates. When we do the reboot, it will read the original (untouched) boot image and boot as normal. This also keeps us from touching the other 'Slot' (not really needed). This is much simpler than using TWRP imho.
Click to expand...
Click to collapse
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Abbey Bhatt said:
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Click to expand...
Click to collapse
Yes I saw that Abbey, just updated the original post. At this point pls use the TWRP method I mentioned in similar thread. That works for sure.
I thought the Magisk patched boot image would have the same abilities (in this sense) as twrp, but it seems it does not. Will update if I find a solution.
Abbey Bhatt said:
THANKS MATE, I REACHED TO FINAL STAGE & BOOTED IN TO THE PATCHED IMAGE BUT
AFTER putting command prompt into a linux shell it gives error failed to set property. please help i am awiting your reply.
Click to expand...
Click to collapse
hey mate after rebooting, magisk appeared in app drawer, did i flashed patched boot image. by using this code? please advise
AsItLies said:
Ki, this is a great example of where one needs to look carefully at the command, and do some research. If you look closely the code says "boot" patched_boot. The point there is that it doesn't say "flash". Booting it won't flash it. That command will read it from your hard drive into rom memory of the device, and NOT write it to the flash memory of the device. I.E. The boot.img on the device will not change, so no reason to flash it again.
Click to expand...
Click to collapse
Yes, i didn´t read carefully, but my question has because i read that we need magisk after put patche boot.img, then enable, then remove magisk then flash stock boot.img
I read that you update the firt post informing of the need of that.
AsItLies said:
Bring up all the topics in the MiA2 Guide(s) forum. At the top right is "Search This Forum". So... obviously... type in; patched_boot.
The first thread, OTA Jasmine (etc) has many posts with links to specific versions of (magisk) patched_boot images. (hint; search that thread also if you don't want to page through the posts!) - and don't forget to thank (use thank button!) cpkv5 for his efforts of extracting the boot.img and patching it for everyone, and making it available for easy download!
Click to expand...
Click to collapse
Sorry, i only find this one:
https://forum.xda-developers.com/showpost.php?p=77295065&postcount=22
that have magisk, but with that like i said before i will mess with system/root, the thing i did´t want. so for me is not the path i want to take. I prefer the patch you give in:
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
And because is a diferente path i think that that thread should be reopen by mods.
Abbey Bhatt said:
hey mate after rebooting, magisk appeared in app drawer, did i flashed patched boot image. by using this code? please advise
Click to expand...
Click to collapse
It shouldn't have flashed it, should have just booted it. I just uninstalled the magisk in app drawer myself. It looks as though a part of the magisk patched boot image installs that 'stub' part of magisk, to then allow a full install I'm sure. So that seems to happen whether you flash it or boot it.
ki69 said:
Yes, i didn´t read carefully,
Sorry, i only find this one:
Click to expand...
Click to collapse
You're looking in the ROM forums, not the indicated GUIDES forum.
AsItLies said:
It shouldn't have flashed it, should have just booted it. I just uninstalled the magisk in app drawer myself. It looks as though a part of the magisk patched boot image installs that 'stub' part of magisk, to then allow a full install I'm sure. So that seems to happen whether you flash it or boot it.
Click to expand...
Click to collapse
hey i am now wish to follow method presented in this thread
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
but at stage of fastboot getvar currdent-slot
it showing failed. no any partition showed
Abbey Bhatt said:
hey i am now wish to follow method presented in this thread
https://forum.xda-developers.com/mi-a2/how-to/guide-enable-cam2api-root-t3848058
but at stage of fastboot getvar currdent-slot
it showing failed. no any partition showed
Click to expand...
Click to collapse
Not sure what's going on. When I do the same the result is:
fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.000s
Did you flash it by mistake instead of boot it? Have you tried to do a 'fastboot set_active' ?
AsItLies said:
Not sure what's going on. When I do the same the result is:
fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.000s
Did you flash it by mistake instead of boot it? Have you tried to do a 'fastboot set_active' ?
Click to expand...
Click to collapse
Humble request,
If you don't know about device or appropriate procedure don't post irrelevant things. As I know this device is tricky and more chances for hard brick if something goes wrong.
Abbey Bhatt said:
Humble request,
If you don't know about device or appropriate procedure don't post irrelevant things. As I know this device is tricky and more chances for hard brick if something goes wrong.
Click to expand...
Click to collapse
out and out flagrant request, if you can't follow directions, don't even try what is suggested.
There's no way anything I indicated would brick a phone. I've done it. Mine is not bricked. As indicated the setprop commands won't work with patched boot image. Then all you have to do is exactly what the procedure says and it's back to normal.
You're the reason people don't bother to post guides.
I do know about device and relevant procedure, it's not irrelevant. Your inability is what's irrelevant.
AsItLies said:
out and out flagrant request, if you can't follow directions, don't even try what is suggested.
There's no way anything I indicated would brick a phone. I've done it. Mine is not bricked. As indicated the setprop commands won't work with patched boot image. Then all you have to do is exactly what the procedure says and it's back to normal.
You're the reason people don't bother to post guides.
I do know about device and relevant procedure, it's not irrelevant. Your inability is what's irrelevant.
Click to expand...
Click to collapse
Hero how's your age how long been in this you are the people who doesn't know things and phones and wage all around being as op. Now cut this crappy out and first learn and then come for advice.
Abbey Bhatt said:
Hero how's your age how long been in this you are the people who doesn't know things and phones and wage all around being as op. Now cut this crappy out and first learn and then come for advice.
Click to expand...
Click to collapse
I'm sorry you screwed up your device. But it's not my fault. Nothing I indicated, if followed, would have caused that.
I'd suggest quitting the childish attempts at personal attacks. Your problems are not my fault.
@oka1 Hi again, sorry, this is the 2nd time! Please close this thread, and delete if possible. It' no longer provides any benefit.
Thanks! Won't happen again.

HOW-TO Unlock, Root and get Xposed for Onn 8" Walmart tablet

Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.
edit: I had this tucked away and easy to miss so here it is.
magisk_patched.img, mt8163_scatter and a few more things
IMG Files pulled from device using dd
I have added a full backup taken with TFM Tool that can be flashed with TFM or individually with fastboot
(Folder emptied by google)
There is an SP Flash Tool backup and tools on @CaffeinePizza 's server here: https://www.nathanbar.net/files/android/
There is also a flashing guide that works very well in post #192 by @CaffeinePizza
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Wow... I totally entered the wrong commands in fastboot /facepalm
This is really good to know though. @diplomatic was able to help me unlock the bootloader on my 10" Onn tablet via 'other' means... but it's awesome that's not required and thus available to a large audience!
I'll give this a shot on both variants of the 10" (the one with the keyboard actually has slightly different hardware/software)
Also, thanks for drawing my attention here with the mention @diplomatic
I have been trying to build TWRP for this thing, but haven't been successful just yet.
If anyone cares to lend some guidance, I wouldn't turn it down
tek3195 said:
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates....
...Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader.
Click to expand...
Click to collapse
Confirmed working (not there was any doubt). Thanks for you excellent post.
---------- Post added at 11:41 PM ---------- Previous post was at 11:36 PM ----------
diplomatic said:
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Click to expand...
Click to collapse
Not necessarily. Your tool has two distinct advantages:
- ability to easily lock and unlock
- preserves contents of data partition
In the absence of TWRP I would be loath to unlock via the stock method unless working with a virgin device. Yes, there are ways to backup/restore contents ofthe data partition outside of a dedicated recovery but I don't have the time or ambition to mess with such clumsy approaches. Your non-destructive unlockbl.sh script makes it easy.
DB126 said:
In the absence of TWRP...
Click to expand...
Click to collapse
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
NFSP G35 said:
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
Click to expand...
Click to collapse
Can I get a copy of your TWRP ?
Nevermind, just realized you said both 10" and not 8".
tek3195 said:
Can I get a copy of your TWRP ?
Nevermind, just realized you said both 10" and not 8".
Click to expand...
Click to collapse
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.
diplomatic said:
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root.
Click to expand...
Click to collapse
What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
NFSP G35 said:
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!).
Click to expand...
Click to collapse
Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ? I have Magisk fully operational already. Or do I need to un-root before pulling recovery.img ? Shouldn't matter should it?
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell
NFSP G35 said:
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:
Click to expand...
Click to collapse
I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.
tek3195 said:
What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
Click to expand...
Click to collapse
Well, you need to get root first to unlock it from Android. And I'm not sure it'll work on the mt8127....
tek3195 said:
Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ?
Click to expand...
Click to collapse
Although not directly related I opt for mtk-su for simplicity and portability. No prep required other than changing permissions on the executable.
diplomatic said:
I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.
Click to expand...
Click to collapse
Yeah, I saw that in several guides. I fought with compiling from source several times and just can't seem to get it even close to working. It took several tries just to get the build to finish and even then it just boot looped.
Doing a repack was the only thing I could get to boot.
I'd prefer to build from source, but it's kinda overwhelming.
NFSP G35 said:
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell
Click to expand...
Click to collapse
Ok cool, just making sure. Not trying to avoid or discount mtk-su, I think it's freakin awesome. But, you can also use adb shell from pc with Magisk. When you get shell and enter su you just have to grant permission for shell when prompted on device.
This is great!
Has anyone searched for a way to hide the walmart nav bar button?
blueberry.sky said:
This is great!
Has anyone searched for a way to hide the stupid walmart nav bar button?
Click to expand...
Click to collapse
Just use the Custom Navigation Bar app or adb commands to customize the Navbar.
You don't even need root.
^ can confirm. Actually, I saw the post in my email and was coming here to answer, but creeve4 beat me to it lol
Wait, if it has Treble support, is it possible to flash an Android Q GSI whenever it comes out?
Pix12 said:
Wait, if it has Treble support, is it possible to flash an Android Q GSI whenever it comes out?
Click to expand...
Click to collapse
Should be possible. Android Q Beta 4 GSI is out if anyone wants to try now.
xda-developers.com/install-android-q-beta-gsi-project-treble
NFSP G35 said:
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473
You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.
Click to expand...
Click to collapse
tek3195 said:
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.
Click to expand...
Click to collapse
How do you get to fastboot mode? When I tried it with the one in the store I managed to get it to the menu where you can choose recovery, bootloader/fastboot, or normal boot but it just froze after choosing fastboot. Which I thought meant that they removed fastboot entirely like some other tablets do.

Root without unlocking bootloader

Hi,
I'd like to root my zenfone 2 laser (ze550kl z00ld). I've been trying to unlock the bootloader with the Asus app (version 9.0.0.3) for a few days but it fails every time as for many other users (can't post urls but several threads on asus zentalk forums). I can't find version 9.1.0.0 of the tool unfortunately. However, it looks like I could root the phone without unlocking the bootloader because I can use adb to reboot to fastboot mode (adb reboot bootloader from pc command line) as I have enabled developer mode with usb debugging and the computer is allowed on the phone.
Am I right to do this?
- download latest twrp recovery image for phone model (twrp-3.3.1-0-Z00L.img from dl.twrp.me) on computer
- connect phone to computer (linux OS) & reboot to fastboot mode
- flash twrp image via
Code:
flashboot flash recovery twrp-3.3.1-0-Z00L.img
from computer
- simultaneously reboot the phone from computer via
Code:
fastboot reboot
while simultaneously holding down the volume down key on the phone
- this should allow me to reboot into twrp recovery from which I can flash the supersu app zip dowloaded from supersu.com and copied from the computer onto the phone's sd card root
Does this seem correct to you? Is this likely to succeed or should I continue trying to unlock the bootloader?
Thank you very much!
DrWaste said:
Hi,
Does this seem correct to you? Is this likely to succeed or should I continue trying to unlock the bootloader?
Thank you very much!
Click to expand...
Click to collapse
Hello
You won't be able to install TWRP without unlocking the bootloader.
The official unlocking tool is very buggy, and pretty much useless since it never works.
I recommend you follow this unofficial method.
https://forum.xda-developers.com/ze...de-unlock-bootloader-asus-unlock-app-t3405850
You should be able to unlock the bootloader in less than 5minutes. Just enable adb, boot into fastboot and run the code available in that thread, and it should do the trick.
After unlocking, then you can install TWRP and then Magisk, if all you want is to have root.
Hello,
FHC1998 said:
I recommend you follow this unofficial method.
https://forum.xda-developers.com/ze...de-unlock-bootloader-asus-unlock-app-t3405850
Click to expand...
Click to collapse
There's something I don't understand. On the first message of that thread it says:
You MUST be rooted to use this method.
Click to expand...
Click to collapse
That can't work for me as my phone isn't rooted.
It says to follow other methods given in another thread to try to root the phone beforehand. I'd read all these threads before. There are three which give a guide to root the zenfone 2 laser ze550kl. One requires to first unlock the bootloader (feels like I'm going round in circles here...) and the other two link to a firmware patch which used to be hosted on mega.nz but aren't available anymore.
I'd love to go the easy way and unlock the bootloader first before flashing twrp recovery and then rooting, but it seems like that's just not possible because all the guides are obsolete, or am I missing something more subtle?
Thanks!
DrWaste said:
Hello,
There's something I don't understand. On the first message of that thread it says:
That can't work for me as my phone isn't rooted.
It says to follow other methods given in another thread to try to root the phone beforehand. I'd read all these threads before. There are three which give a guide to root the zenfone 2 laser ze550kl. One requires to first unlock the bootloader (feels like I'm going round in circles here...) and the other two link to a firmware patch which used to be hosted on mega.nz but aren't available anymore.
I'd love to go the easy way and unlock the bootloader first before flashing twrp recovery and then rooting, but it seems like that's just not possible because all the guides are obsolete, or am I missing something more subtle?
Thanks!
Click to expand...
Click to collapse
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Hello,
FHC1998 said:
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Click to expand...
Click to collapse
OK, I'll give a shot that way. If you do find the system image that would be cool.
Thanks.
Hello,
FHC1998 said:
If I recall correctly, the root part is only used to make the partitions backup with adb shell.
The bootloader unlocking part (the two line code that goes "echo ....") doesn't need it.
I used this tutorial a long time ago, so take this info with a grain of salt.
The problem is that this phone is almost 4 years old now, so most links are not being updated or dead.
So it might be worth a shot trying to run that code without root. (By my understanding, root does not alter the fastboot binaries, so it should not be necessary).
In any case, I might have a backup of a patched system IMG somewhere on my computer. I'll try searching for it and if I find I'll upload it to you.
Click to expand...
Click to collapse
Nope, seems to require root to modify the hex value of byte 16 on the boot device (I presume that's what the command does, there's no man accessible via adb shell but that's what that dd command does on unix machines). I can't even, as normal user, list /dev/block or even /dev:
Code:
1|[email protected]_Z00L_63:/ $
count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo <
dd: /dev/block/bootdevice/by-name/devinfo: Permission denied
1|[email protected]_Z00L_63:/ $ ls /dev
/dev: Permission denied
Bummer, really hoped it would work. Back to unlocking the bootloader via the buggy Asus app it seems, or chucking the phone out of the window maybe...
Thanks for your help anyway :good:

[RECOVERY] TWRP for Onn Android Tablets (unofficial) - 2019-11-30

TWRP Custom Recovery for the Onn Android Tablet series​
This is the first fully-featured custom recovery for Walmart's MediaTek-based Onn tablets: ONA19TB002, ONA19TB003 and ONA19TB007. TWRP needs no introduction. If you have come here, you probably have some idea of what it is and what it's used for. This TWRP build does not need the bootloader unlocked or VBMeta verification disabled, although it's recommended that you at least unlock the bootloader.
DISCLAIMER
Everything described in this thread is done at your own risk. No one else will be responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.
FEATURES
Decrypted data partition
All USB modes functional: MTP, ADB, Mass Storage, OTG, Charging
Fast boot time
Adoptable storage mounting
Firmware image backup and restore
Works under locked bootloader
Android 9 build fits within the 16MB recovery partition -- no compromises or partition resizing necessary
INSTALLATION METHOD 1
Download the recovery to your PC and unzip the image
Unlock the bootloader (skip if you have already done this)
Enable OEM Unlock in Developer Options in Android Settings
Boot into fastboot mode either by holding vol. up+power to power it on and selecting "Fastboot mode", or by running the 'adb reboot bootloader' command from within Android.
Install fastboot and appropriate drivers on your PC if you have not set those up
Unlock the bootloader with the command
Code:
fastboot flashing unlock
...and follow the instructions on the screen. This will wipe your data.
Flash the custom recovery with
Code:
fastboot flash recovery twrp-3.3.1-ONA19TB002.img
(use the right file name path for your device)
Reboot to recovery with
Code:
fastboot oem reboot-recovery
INSTALLATION METHOD 2
This assumes you are familiar with SP Flash Tool or can figure it out on your own
Download the recovery to your PC and unzip the image
Get the appropriate scatter file for your device. The scatter file may be found in the device's firmware under /system/data/misc.
Set up SPFT Download tab as Download Only. Load your scatter file.
Under the recovery line, double-click Location and open your TWRP image.
Click Download and connect your powered-off tablet to your PC. SPFT will automatically flash the recovery to the emmc and disconnect when finished.
INSTALLATION METHOD 3
Head over to Amazing Temp Root for MediaTek ARMv8, read the requirements and directions, and grab the latest mtk-su.
Open a root shell with mtk-su
Flash the (unzipped) recovery with the command:
Code:
dd bs=1048576 if=twrp-3.3.1-0-ONA19TB002.img of=/dev/block/by-name/recovery
(replace the if= file name with your appropriate recovery image path)
Exit root shell
START RECOVERY
Three methods:
On a powered off tablet, hold Vol. up+power for about 3 seconds. In the menu that appears, select "Recovery mode"
With Android ADB, use the command 'adb reboot recovery'
From Android root shell, use the command 'reboot recovery' or just use any root app with OS reboot features
NOTES
Kind of important: Make a backup of your Crypto Footer as soon as you can. This is the encryption key to your data partition. When accessed from TWRP, this key can get "upgraded" so that you will get locked out of Android. TWRP uses a hacky workaround that saves and restores the original footer on every /data decrypt. But that method is not what I would call 100% reliable.
Make sure you have a backup of the untouched stock system and vendor images. There are no official firmware packages available to download.
Only mount system/vendor partitions in read/write mode if you have unlocked the bootloader. It is recommended to choose to leave system read-only at the startup prompt unless you have a specific reason to modify it. If the bootloader is locked, then dm-verity is enforced.* So merely mounting it once in r/w will cause a boot loop.
It's currently not possible to install incremental OTA updates using this TWRP. Use the stock recovery to update the FW. That will only work if you have never mounted system/vendor in write mode.
DOWNLOAD (Nov. 30, 2019)
Current version: 3.3.1-1
ONA19TB002 - Onn 8" model
ONA19TB003 - Onn 10.1" model
ONA19TB007 - Onn 10.1" w/keyboard model
Source code
ONA19TB002 | ONA19TB003 | ONA19TB007
ACKNOWLEDGEMENTS
The team behind TWRP & OmniROM
@tek3195 for testing and feedback on the 8" model
Please post feedback since these are still pretty new and not exhaustively tested. Let me know if I should port it to other models in the series.
Reserved also
grabbing this one too cuz why not
Very nice! I'll download and test the 003 one soon.
I also have a 007 model to experiment with.
I tried about a dozen times to build TWRP and failed miserably LOL. Closest I got was one that would boot but the rotation was all messed up, USB wouldn't work, didn't mount some partitions... Yeah, it was a hot mess.
Do you happen to have sources available?
Hi @NFSP G35,
I'll have the source code soon. Most of the tricks involved patching bootable/recovery. So I need to commit those changes and include the proper patch set from my tree....
Amazing!! Gonna install and test 8" right now.
Has anyone tried a GSI on these tablets yet?
MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I do know @tek3195 , the Onn 8 thread starter, has tried many of them as well as others here, somewhere on that thread he listed his tests and opinion of several of them.
I'm pretty sure others on that thread have also tried GSI's.
MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I did try both Phhuson vanilla and also Liquid Remix (I'm keeping this one for now). I didn't flash them through twrp, but using fastboot via bootloader.
WoW! AwEsOmE! I cannot wait to try this! THANK YOU!!!!!!
Hey,
This is a neat thing to see for the Onn tablets. I have a question though. I own a device based on the mt8163, and am trying to help people with another device I don't own (the powkiddy x18 which also uses the mt8163). One of the things I wanted to do was to make a custom rom for the x18, since it's stock firmware is horrible. And of course, one of the first steps to custom roms is twrp. So I have a question for you that I hope you can answer for me. How did you make this build of twrp? I have seen no device trees for this device so I was kinda curious. If you can help me in any way, I'd be so grateful, and I'm sure the other people with the x18 would be grateful for help.
@diplomatic
Is there a different procedure for installing TWRP on a locked bootloader?
I can confirm that using SP Flash to load your TWRP.img will produce a bootloop when installing to a device with the BL locked. Reflashing the original recovery.img makes the problem go away. You mentioned in the OP that this TWRP will work on a locked BL so I thought I would share my case study with you in following the procedure you defined.
MY SINCERE GRATITUDE FOR YOUR EFFORTS IN PORTING THIS TO THE ONN!
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
diplomatic said:
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
Click to expand...
Click to collapse
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
At one time I did run with the bootloader unlocked (with --disable-verification on stock vbmeta) and I ran Phusson's AOSP, Liquid Remix and Bliss. I found there was no benefit to me in running the other mods so I reverted back to stock courtesy of @CaffeinePizza and the bootloader re-locked to get rid of that annoying 5 second orange state.
In each instance, I always used SP Flash tools to load all .img files. I only used fastboot to install magisk_patched.img onto the stock installation. Unlocking the bootloader erases all data and I did not feel like reinstalling everything again, so I figured I would try to install TWRP per your instruction to see if it would work while the BL was still locked... Restoring the original recovery got rid of the bootloop. I do want to try your TWRP so I will try it with BL unlocked when I get some free time to do so.
Spatry said:
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
Click to expand...
Click to collapse
This sounds like you might have flashed a wrong/corrupt image to recovery. It may have to do with AVB checks rather than bootloader lock. But those conditions might be interdependent somehow so I can't tell you for sure. The fact that you are able to boot a patched image on a locked BL says it doesn't care too much about verification. I can tell you for sure that any recovery image must have avb metadata, not necessarily the required hash, for both Android and recovery to boot. Can you try to unzip the image file and flash it over again?
Hmm, the situation with the bootloader lock sounds eerily similar to the Nabi SE. The latter also had a similar implementation where there's not much in the way of locking things down, other than an (easily circumvented) SP Flash Tool signature check and different preloader keys. And here's the real kicker: the nearly-identical Fisher Price Nabi also ran on the MT8163, so it makes me wonder if it's possible to boot Pie on it, or perhaps a GSI assuming that Treble can be tacked onto it.
Also, do you have the source repo to this TWRP port of yours?
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Where do I find crypto footer to backup
diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Kinda cool without the ads isn't it. I know I sent one about a week ago or so. I think everybody ought to send you one, you deserve it. THANKS and AWESOME work.

Categories

Resources