Database Users

Full HTC Desire HD (sense 3.0/android 2.3.5) guide to root, S-OFF/Sim Unlock

Aahk2 is out please use that method instead, fully automated and much easier :
http://forum.xda-developers.com/showthread.php?t=2367322
Warning thanks to hacktrix2006:
hacktrix2006 said:
Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.
If you have SEM04G EMMC then your safe to continue.
If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.
Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.
Click to expand...
Click to collapse
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1.Unlock the bootloader at http://htcdev.com/bootloader/
2.Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
step 2.2: reboot into fastboot
step 2.3: execute in cmd-prompt "fastboot flash unlocktoken Unlock_code.bin"
3.Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
step 3.2 Make a effen GOLDCARD!!!
3.3 copy the ROM zip file to your SD card.
4.Install recovery image:
Open cmd and type:
•cd (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
•fastboot flash recovery recovery1.img
5.boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6.Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
•Adb shell
•Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
•Exit
Then again:
•Exit
Then:
•Adb push boot.img /data/local/tmp
•adb shell
root
dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
•adb pull /data/local/tmp/boot.img
•adb push goldcard /data/local/tmp
•adb shell
root
chmod 775 /data/local/tmp/goldcard
•adb shell
root
cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
•adb shell /data/local/tmp/goldcard -c -o /data/local/tmp/goldcard.img
•adb shell
root
dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
•adb push misc_version /data/local/tmp
•adb shell chmod 775 /data/local/tmp/misc_version
•adb shell /data/local/tmp/misc_version -s 1.11.111.1
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock
Then type:
•fastboot oem rebootRUU
•fastboot flash zip firmware.zip
•fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
•fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
•fastboot flash boot boot.img
next:
•fastboot flash recovery recovery.img
8.boot to recovery again then:
•adb push gfree /tmp/
•adb shell chmod 775 /tmp/gfree
•adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/

Nice work

Report it with the little orange triangle.

bananagranola said:
Report it with the little orange triangle.
Click to expand...
Click to collapse
updated first post again, opened thread in QandA section, thought it was more appropriate, ill leave it to the mods to decide which section it should be in, this thread is based on my experiences last night .

Step 3 reduced, to simpify method even further.

Does not work for me... got bootloop after flashing ROM. Any ideas?

Guide worked for me!!!!!
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
• fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
androidmodd said:
I probably won't ever update this.
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1. Unlock the bootloader at http://htcdev.com/bootloader/
2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
copy the ROM zip file to your SD card.
4. Install recovery image:
Open cmd and type:
• cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
• fastboot recovery1.img
5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
• Adb shell
• Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
• Exit
Then again:
• Exit
Then:
• Adb push boot.img /data/local/tmp
• adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
• adb pull /data/local/tmp/boot.img
• adb push goldcard /data/local/tmp
• adb shell chmod 775 /data/local/tmp/goldcard
• adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
• adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
• adb push misc_version /data/local/tmp
• adb shell chmod 775 /data/local/tmp/misc_version
• adb shell /data/local/tmp/misc_version -s 1.11.111.1
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock
Then type:
• fastboot oem rebootRUU
• fastboot flash zip firmware.zip
• fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
• fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
• fastboot flash boot boot.img
next:
• fastboot flash recovery recovery.img
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
View attachment 1858622
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
help me out if you feel like it by signing up to dropbox with my refferal link:
Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
Click to expand...
Click to collapse

ranger4740 said:
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
•fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
Click to expand...
Click to collapse
Thanks, ill update first post again.

After using this unlock and S-off method, I have been able to update my radio using the PD98IMG.ZIP via bootloader. file found on this post http://forum.xda-developers.com/showthread.php?p=39412003
Sent from my HTC Desire HD using xda app-developers app

vonski said:
Does not work for me... got bootloop after flashing ROM. Any ideas?
Click to expand...
Click to collapse
For your issue, you had already flashed custom Rom and boot.IMG before this guide? I think You need to flash the boot.IMG from the rom.
Sent from my HTC Desire HD using xda app-developers app

problems at step 8
androidmodd said:
I probably won't ever update this.
THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.
PREFACE:
Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87
Full HTC Desire HD guide to root, S-OFF/Sim Unlock
1. Unlock the bootloader at http://htcdev.com/bootloader/
2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.
3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
(link to rom thread: http://forum.xda-developers.com/showthread.php?t=1382235&highlight=rooted+stock )
copy the ROM zip file to your SD card.
4. Install recovery image:
Open cmd and type:
• cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.
In cmd:
• fastboot recovery1.img
5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
• Adb shell
• Su
You should see the $ turn into a #. If this happens, congrats you have root access.
Then type this:
• Exit
Then again:
• Exit
Then:
• Adb push boot.img /data/local/tmp
• adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
• adb pull /data/local/tmp/boot.img
• adb push goldcard /data/local/tmp
• adb shell chmod 775 /data/local/tmp/goldcard
• adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
take note of the string of numbers and letters that appear.
then:
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
• adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
• adb push misc_version /data/local/tmp
• adb shell chmod 775 /data/local/tmp/misc_version
• adb shell /data/local/tmp/misc_version -s 1.11.111.1
7. If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
• Fastboot oem lock
Then type:
• fastboot oem rebootRUU
• fastboot flash zip firmware.zip
• fastboot reboot-bootloader
unlock the bootloader again using the Unlock_code.bin you got from HTC:
• fastboot flash unlocktoken Unlock_code.bin
then flash boot.img in ace-tools folder:
• fastboot flash boot boot.img
next:
• fastboot flash recovery recovery.img
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.
VICTORY:
View attachment 1858622
I have also posted this over at modaco:
http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
help me out if you feel like it by signing up to dropbox with my refferal link:
Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
Click to expand...
Click to collapse
Hi I am having problems from step 8 onwards
8. boot to recovery again then:
• adb push gfree /tmp/
• adb shell chmod 775 /tmp/gfree
• adb shell /tmp/gfree -f
When i type adb push gfree /tmp/ in CMD I get
c:\ace-tools>adb push gfree /tmp/
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:
c:\ace-tools>
Any ideas I can not seem to get past it

saucernerp said:
Hi I am having problems from step 8 onwards
8.boot to recovery again then:
•adb push gfree /tmp/
•adb shell chmod 775 /tmp/gfree
•adb shell /tmp/gfree -f
When i type adb push gfree /tmp/ in CMD I get
c:\ace-tools>adb push gfree /tmp/
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:
c:\ace-tools>
Any ideas I can not seem to get past it
Click to expand...
Click to collapse
Hmm that's a problem with ADB on your computer, it can be for a number of reasons, but try restarting your PC checking for background ADB related plugins/processes and try running the commands again.
If it still doesn't work try another PC if available.

androidmodd said:
Hmm that's a problem with ADB on your computer, it can be for a number of reasons, but try restarting your PC checking for background ADB related plugins/processes and try running the commands again.
If it still doesn't work try another PC if available.
Click to expand...
Click to collapse
Thats great thanks got a bit futher now
OK I killed all of the ADB plugins and this is what I now get
c:\ace-tools>adb push gfree /tmp/
2916 KB/s (722728 bytes in 0.242s)
c:\ace-tools>adb shell chmod 775 /tmp/gfree
c:\ace-tools>adb shell /tmp/gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x00015398 (86936)
Section index for section name string table: 41
String table offset: 0x000151df (86495)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x000011cc (4556)
-- size: 0x000000c4 (196)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... Failed.
Module failed to power cycle eMMC.
c:\ace-tools>
I am still show as "ACE PVT SHIP S-ON RL
Anything else

ranger4740 said:
Hi all, reporting back my experience with this guide...
Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)
I basically followed this guide with a few little needed changes.
1st I backed up my rom using 4ext recovery.
1. same
2. same
3. same
4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).
5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).
5a. reboot into recovery and flashed rom
6. there was a typo in the line
"•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
there is an extra space between local & /tmp/ at the end of line, the command line should read
•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"
7.If this is all fine boot into bootloader again.
From bootloader go to fastboot.
Go back to the cmd window on your PC from earlier, type in:
•Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
Then type:
•fastboot oem rebootRUU
everything else was good....
My Hboot screen is the same as OP screen shot.
I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.
I pretty sure that's all, I hope this helps.
Click to expand...
Click to collapse
Did you read this post about the errors in the guide I wrote?

androidmodd said:
Did you read this post about the errors in the guide I wrote?
Click to expand...
Click to collapse
HI
Yep I have read through everything over the last two days and followed all the steps just stumbling at the last hurdle

I'm sorry, you'll have to wait for someone better at this than I am to help, did you ensure that you HTC-Dev unlocked before attempting this step?

androidmodd said:
I'm sorry, you'll have to wait for someone better at this than I am to help, did you ensure that you HTC-Dev unlocked before attempting this step?
Click to expand...
Click to collapse
Gfree failed to cycle eMMC at the end of the s-off procedure, so something's gone wrong.
I don't pretend to be an expert with DHD, and this is a bit different from working with HTC legend.
Just checking that you did the hboot update to version 2.00.029 (htcdev) and unlocked.
It sounds like it might be a hardware fault with phone. I have heard about lots of DHD users with fried eMMC but never with legend.
Sent from my HTC Desire HD using xda app-developers app

ranger4740 said:
Gfree failed to cycle eMMC at the end of the s-off procedure, so something's gone wrong.
I don't pretend to be an expert with DHD, and this is a bit different from working with HTC legend.
Just checking that you did the hboot update to version 2.00.029 (htcdev) and unlocked.
It sounds like it might be a hardware fault with phone. I have heard about lots of DHD users with fried eMMC but never with legend.
Sent from my HTC Desire HD using xda app-developers app
Click to expand...
Click to collapse
Yep I'm on HBOOT 2.00.0029 and my eMMC says boot next to it I just can not get cid to change from ORANG001 and sim is still lock
Bloody ORANGE
everything seemed to work fine until the final stages.
I have even tried Easy Radio tool but this fails after trying to push and I have also tried the Ultimate Multi Tool which allows me to Flash and check status but will not S-Off or Super CID or sim Unlock it just fails at the final stage
Ideas anyone

What radio are you on, you have to have a certain radio to exploit with.

hacktrix2006 said:
What radio are you on, you have to have a certain radio to exploit with.
Click to expand...
Click to collapse
HI
Radio is show as 26.14.04.28_M
Cheers

[URGENT REQUEST] i9300i USERS it will just take few minutes of your time

hi guys
as you all know that some of the devices (i9300i) are hard bricked by flashing indian 4.4.4 so to unbrick we need a debrick.img which you guys can help us get by flashing this file https://copy.com/1ggUuyIqHUrF it will create a debrick.img into your sd card which you can upload and share
source http://forum.xda-developers.com/show....php?t=2439367
OR
Use this procedure to create the image
Enable USB Debugging.
Open cmd and navigate to your adb folder.
Run adb shell
Now type 'SU' to enable superuser, your may have to grant access to ADB from a popup screen of your phone's superuser app
next copy and paste the following code and change the phone model to your phone i.e. dd if=/dev/block/mmcblk0 of=/sdcard/debrickI710-16GB.img bs=1M count=128
dd if=/dev/block/mmcblk0 of=/sdcard/debrick[phonemodel-memorysize].img bs=1M count=128
6. Now type Exit on cmd and then use following the command to copy this image to your adb folder
adb pull /sdcard/debrick[phonemodel-memorysize].img
7. upload the image and share its link here.
[B]It will just take few minutes further you can compress the file (zip or rar) to reduce its size so that it can be upload easily.[/B]
Thanks in advance

:crying: i need it plz else my device will be useless

cmon guys it will not take more than 5 min plz help if it works ill make a thread about how to unbrick a hard bricked neo

I Hope it can helps you ...
I just run it on GT-i9300i ( Brazilian ) with Lastest HongKong 4.4.4 firmware + root and TWRP 2.7.0.1
Just tell me if you need anything else my friend.
PHP:
https://mega.co.nz/#!DVcSTA7R!0D0ah1pSaJzORvU95on2eyPxkE_866M2Ea0NmngPQX4

ygor.almeida said:
I Hope it can helps you ...
I just run it on GT-i9300i ( Brazilian ) with Lastest HongKong 4.4.4 firmware + root and TWRP 2.7.0.1
Just tell me if you need anything else my friend.
PHP:
https://mega.co.nz/#!DVcSTA7R!0D0ah1pSaJzORvU95on2eyPxkE_866M2Ea0NmngPQX4
Click to expand...
Click to collapse
thank u soooo much bro i just successfully un brick my device tomorrow i will make a thread again thanks for ur time and million thanks to u :laugh:

Hi, I've used your CWM script but it doesn't have created the ZIP file with the debrick image.
I've searched it on all memories (also the system folder) but nothing. I've a GTI9301I ITV Firmware UANI1
I've tried also the adb shell and when i type adb pull /sdcard/debrick[phonemodel-memorysize].img it show me no devices (but it's enabled and the phone receive correctly commands)

[how to]disable remaining write protection on m9 after s off

this thread is for m9 it will NOT work on m7,m8,or any older devices(or anything other than HTC)
again,dont do this on anything other than m9. any posts stating "i bricked my whatever" will be directed back here,to this first bit of information.
you may or may not be aware that m9 has some write protections still in place,even after s off. these write protections keep us from doing things like changing our "tampered" flag with a simple adb command.
this thread will let you disable the remaining wp. be careful what you do after doing this. your s off phone will let you brick itself,if you tell it to.
credits
*beaups,for lots of things, from schooling me on echo comand protocol to providing help and support,and for all he does for the htc and android community. and most of all,for disclosing the location of this flag and letting me bring it to you.
-strace for originally discovering the location of the lock status flag(check out this thread for more info) wich started off my love for chasing such things.
-Zanzibar for testing on sprint
-bschram for testing on vzw
the usual disclaimers:
-i have tested this on my device,but use this info at your own risk. if it melts your phone into an aluminum gooey mess,crashes your pc,or causes any other issues,its not my fault.
prerequisites:
-you must be S-OFF
-you must have superuser installed
-you must have adb and fastboot,and working drivers(if required) installed on your machine
IF you are an advanced user with adb/fastboot set up and some basic knowledge of the cmd window,you can skip to #2
1)set up adb(windows 7 and older)
-download this file
-install drivers: if you have htc sync installed,you should allready have drivers. if not,you can install htc sync,or install these modified htc drivers from revolutionary (driver mirror)
-unzip your miniadb_v1031.zip file. this is native funtionality in windows 7. you otherwise may need a utility such as "7-zip" to extract,or unzip it. place the unzipped folder onto the root of your C drive on your PC. root means the top level,not inside any folders. so just copy and paste,or drag and drop the folder onto C with everything else that is there. you may want to rename it to "miniadb_m7" since youll be putting some device specific files in here.
-open a command window. on windows 7,click the start bubble in the lower left and type "command" in the search box. xp i believe is similar or the same. doing this should open a small black command window.
-change to your miniadb_m7 directory. type the following at the prompt in your cmd window:
cd c:\miniadb_m7
your command promt should change to "c:miniadb_m7>" provided you: 1)unzipped the miniadb_v1031 zip file,and 2)put the folder on your c drive,and 3)entered the name of the folder correctly ("miniadb_m7" in this case)
-now make sure usb debugging is checked in developer options(you will need to turn it on first),and plug your phone into your PC with a usb cable
-make sure your phone is being recognized- type:
adb devices
if your drivers are installed correctly,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,then enter this command:
adb reboot bootloader
this should take your phone to the "fastboot" screen,wich is white with colored letters. this is one mode of your bootloaders interactive modes. at the top youll see fastboot devices as confirmation youre in fastboot.
now enter:
fastboot devices
again,this should return your phones serial number. you should hear the "found device" noises when you plug your phone in. if it starts installing drivers,wait for it to finish before typing the adb devices command.
if you get your serial number back,you can enter the following to boot back to the phones OS:
fastboot reboot
and now,youve installed adb/fastboot and tested youre phones drivers. if at either spot,you have trouble and dont get your serial number back,there is some sort of connection issue. use these steps to troubleshoot:
troubleshooting connectivity issues:
-try a reboot of the PC
-try different usb cables and ports
-dont use a usb hub
-dont use usb 3.0
-make sure nothing capable of comunicating with the phone is enabled and running. htc sync,pdanet,easy tether,and even itunes have all been known to cause issues.
-windows 8 has been known to have issues. try a windows 7 or older machine
failing the above,
-i use these drivers for fastboot and adb(donwload and run as admin): http://downloads.unrevoked.com/HTCDriver3.0.0.007.exe (mirror)
failing that,try manually updating the drivers in the following manner:
-put the phone in fastboot mode(select fastboot from the hboot menu)
-open device manager on the PC
-plug in phone,watch for it to pop up in device manager.
-update drivers with device manager,pointing the wizard to the extracted
driver download folder from above
note that you can check the connectivity of the phone,and make sure drivers are working by in the following manner:
-open cmd window. change to directory containing adb/fastboot utilities
-adb with the phone in the booted OS,usb debug enabled,enter:
adb devices in a cmd window
-fastboot with phone in fastboot,enter:
fastboot devices in cmd window
in either case,a properly connected phone with working drivers installed should report back the phones serial number.
Click to expand...
Click to collapse
this process,in your cmd window,should look something like this:
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>[COLOR="red"]cd c:\miniadb_m7[/COLOR]
c:\miniadb_m7>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
FAxxxxxxxxxx device
c:\miniadb_m7>[COLOR="red"]adb reboot bootloader[/COLOR]
c:\miniadb_m7>[COLOR="red"]fastboot devices[/COLOR]
FAxxxxxxxxxx fastboot
c:\miniadb_m7>[COLOR="red"]fastboot reboot[/COLOR]
rebooting...
finished. total time: 0.037s
c:\miniadb_m7>
2)disable write protections
in cmd enter:
adb shell
su (if needed to get a # prompt)
echo -ne '\x04' | dd of=/dev/block/mmcblk0p32 bs=1 seek=4126
exit
exit (if needed to get back to a normal prompt)
adb reboot
congratulations,your wp have been disabled!

restore software status original
after doing the above,you can return to software status original
*reboot phone
Enter:
adb shell
su (if needed to get a # prompt)
echo -ne '\x00' | dd of=/dev/block/mmcblk0p8 bs=1 seek=4228100
boot to bootloader and verify software status original

mine tooo!

one more

Thanks @scotty1223,
This worked perfect on my Sprint M9.
Great work!
P.S. FIRST!

Hmm, this didn't seem to work on mine and I tried it twice, rebooting each time.

Worked great on my Verizon M9 as well.
Thanks @scotty1223 and @beaups!

Worked as expected. Didn't have any doubt.
Thank you @scotty1223 and @beaups od course.
BTW, I was already "official" by your previous method, so didn't try that part.

iElvis said:
Hmm, this didn't seem to work on mine and I tried it twice, rebooting each time.
Click to expand...
Click to collapse
What is failing? What variant do you have?you are s off and in a root shell,correct? Dump p32 and pm me a link
Assuming you're having trouble with software status,I'll need to look at p8 as well.
Sent from my Nexus 9

Worked on my T-Mobile M9 also

Ok... so just to be sure, does restoring official status this way means I can download and apply OTA without having to flash back to stock and with keeping root on ?

scotty1223 said:
What is failing? What variant do you have?you are s off and in a root shell,correct? Dump p32 and pm me a link
Assuming you're having trouble with software status,I'll need to look at p8 as well.
Click to expand...
Click to collapse
Nothing failed per se, the root shell commands seemed to work and gave no errors. But when I rebooted, the software status was still "modified."
I'm on an AT&T M9 with 2.10 firmware and the ElementalX beta kernel.
What's the best way to dump those partitions? I'm not sure what file type to use.

iElvis said:
Nothing failed per se, the root shell commands seemed to work and gave no errors. But when I rebooted, the software status was still "modified."
I'm on an AT&T M9 with 2.10 firmware and the ElementalX beta kernel.
What's the best way to dump those partitions? I'm not sure what file type to use.
Click to expand...
Click to collapse
If it don't work on att then I guess Dev edition is a no no

Worked like a charm on my att device thanks scotty
Sent from my SM-T230NU using Tapatalk

Oum said:
Ok... so just to be sure, does restoring official status this way means I can download and apply OTA without having to flash back to stock and with keeping root on ?
Click to expand...
Click to collapse
No. But if you're s-off why are you messing around with waiting for OTA's?

jollywhitefoot said:
No. But if you're s-off why are you messing around with waiting for OTA's?
Click to expand...
Click to collapse
yep... actually after getting official status, flashing stock twrp backup, stock recovery, re-locking the bootloader (LOCK flag)... OTA would still not apply... soooo... yep, I just flashed Maximus' firmware and AHRD and now I'm fine ^^
--- I have just read that maybe it was because my sdcard is 64gb, shouldn't be more than 32... maybe I'll try another day...

Any solution for security warning on download mode after 2.10 or 2.8 base firmware update ?

iElvis said:
Nothing failed per se, the root shell commands seemed to work and gave no errors. But when I rebooted, the software status was still "modified."
I'm on an AT&T M9 with 2.10 firmware and the ElementalX beta kernel.
What's the best way to dump those partitions? I'm not sure what file type to use.
Click to expand...
Click to collapse
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
dd if=/dev/block/mmcblk0p32 of=/sdcard/mmcblk0p32
youll find them on internal storage.upload them and pm me a link. you likely have gibberish at the flag location,or your flag is one spot over from the usual(seen this one other time)
ghosttown242 said:
If it don't work on att then I guess Dev edition is a no no
Click to expand...
Click to collapse
it should. if not,see above
coolberry said:
Any solution for security warning on download mode after 2.10 or 2.8 base firmware update ?
Click to expand...
Click to collapse
havent heard anything about this. please provide more info

scotty1223 said:
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
dd if=/dev/block/mmcblk0p32 of=/sdcard/mmcblk0p32
youll find them on internal storage.upload them and pm me a link. you likely have gibberish at the flag location,or your flag is one spot over from the usual(seen this one other time)
it should. if not,see above
havent heard anything about this. please provide more info
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

scotty1223 said:
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
dd if=/dev/block/mmcblk0p32 of=/sdcard/mmcblk0p32
youll find them on internal storage.upload them and pm me a link. you likely have gibberish at the flag location,or your flag is one spot over from the usual(seen this one other time)
Click to expand...
Click to collapse
Done.
Sent from my HTC One M9 using Tapatalk

[EXPERIMENTAL] Full ADB Root, System RW, and DM-VERITY Off for ALL G5's!!!

UPDATE Thanks to @thjubeck for testing this, it seems that this userdebug kernel actually works on all devices running antirollback v0 and running Marshmallow! I only have the Sprint variant, so be careful!!! Enjoy root guys
A bit of a disclaimer is that this is root through adb. dm-verity is off and system is rw, so you can install apps as root, get a hotspot hack to work, and anything through a shell but I am having trouble installing SuperSU. Please try yourself though as I am probably doing something wrong! If there are any bugs you have found please post them, as this phone is my backup and not my daily driver.
So okay, here is the guide:
PLEASE MAKE SURE YOU HAVE A WAY TO GO BACK INCASE THINGS GO WRONG. DO NOT ATTEMPT TO ROOT THIS WITHOUT HAVING A KDZ/TOT FOR YOUR DEVICE THAT YOU KNOW YOU CAN FLASH BACK TO. I AM NOT RESPONSIBLE FOR THINGS GOING WRONG.
Here is the fix for LGUP
1. Download this zip
2. Install Terminal Emulator from the Play Store
(This is modified from the V20 bootloader unlock, HUGE thanks to all of those devs for sharing their dirtysanta code with me and allowing me to modify it!)
3. Copy all the files from inside the "dirtysanta-boot" and paste it into your active ADB directory
4. Plug your device into the computer and verify ADB is working. Then;
On Windows, double-click "RUNMEFIRST.bat, DO NOT CLOSE THE LOG WINDOW THAT OPENS, then double-click "Step1.bat"
On Linux/MacOS ("#" Signifies a comment below)
Code:
./RUNMEFIRST.sh
# OR
bash ./RUNMEFIRST.sh
Open a Separate Terminal next to the RUNMEFIRST terminal, then type:
Code:
./Step1.sh
# OR
bash ./Step1.sh
(When you run The sh or Bat files there may be a Permission denied error on 2 files: Flatland and Flatland64. This is normal and nothing to worry about.)
5. Wait for a shell prompt, then type (or copy):
Code:
run-as con
chmod 0777 /storage/emulated/0/*
6. Open Up Terminal Emulator on your phone
Type:
Code:
id
Check if context is "Untrusted_app". If it is then we're good to go!
7. Type into Terminal Emulator:
Code:
applypatch /system/bin/atd /storage/emulated/0/dirtysanta
8. Watch the RUNMEFIRST dialog for when it tells you to run Step2 (we don't have a step 2)
9. Reboot the phone into recovery mode and wipe data again
BOOM! Now the you have a userdebug kernel running on a userdebug system Time to turn off dm-verity, otherwise you will have a red triangle on reboot (Your device is corrupt. It cannot be trusted and may not boot) and cannot edit /system.
1. Finish setting up the phone and enable USB Debugging in developer options (you should know how to do this)
2. Plug the phone into your computer, and run these commands
Code:
adb root
adb disable-verity
3. Reboot the phone
4. Run
Code:
adb root
adb shell
mount -o rw,remount,rw /system
Bam. Enjoy your FULL UNLIMITED root shell with system set to rw and dm-verity off!!! Just make sure to type "adb root" before "adb shell"
If you ever want to go back, just flash your stock TOT/KDZ with UPPERCUT and you'll be all good!
BUY ME A PIZZA FOR THE HARD WORK: BTC 197ct1uti4zutJu76bYAW51H8NZ6zXeoEV PayPal: [email protected]
THANKS:
@tungkick for the userdebug boot and helping me with the ZV4 TOTs
@autoprime for UPPERCUT
@me2151 @glitschi667 @EMSpilot @elliwigy for their AMAZING work on the V20 and sharing their code!

I'm using a H850, but still - thanks for your work!

Thanks for the amazing work while almost every one lose the hope .
Allow me to ask about the other versions H860 in my case .
Any chance to modified your files to make it work ?
If you need a testing phone to try figure it out Pm me .
Again thanks for this great job

I'm a Canadian H831 owner. Just wanted to post to say great work so far and if you get SuperSU or another SU app installed, enjoy the $850 bounty.

I think I also found an unlimited hotspot hack, so there's that too!

You're doing God's work, sir. :good:
I wish I had that variant... you'be renewed my hope though.
I have a Canadian H831 [Telus], how much of an undertaking is it to rejigger your method for it?

Delete

Honestly Annoying said:
I think I also found an unlimited hotspot hack, so there's that too!
Click to expand...
Click to collapse
Care to share this info?
Sent from my LGE LG-H830 using XDA Labs

Honestly Annoying said:
Hello everyone, finally the moment you've all been waiting for! I know that a certain user who will not be named has been spreading false information about our root progress, so I am taking it upon myself to release what I personally have gotten to work
A bit of a disclaimer is that this is root through adb. dm-verity is off and system is rw, so you can install apps as root, get a hotspot hack to work, and anything through a shell but I am having trouble installing SuperSU. Please try yourself though as I am probably doing something wrong!
So okay, here is the guide:
ONLY FOR SPRINT USERS ON ZV4. YOU WILL HAVE TO WIPE YOUR DEVICE AND THIS IS YOUR WARNING HERE. DEVICE MAY BE UNSTABLE AS IT IS A USERDEBUG BUILD. THIS IS YOUR WARNING
1. Download these files here and unzip them to desktop https://drive.google.com/open?id=0B2OlLU7vg4YzLWdQYW8tWkxTbFU
2. Set up LGUP from Autoprime's guide here http://forum.xda-developers.com/lg-g5/development/uppercut-lgup-loader-g5-variants-t3511295
3. Make sure you have working ADB set up on your computer
3. Put device in download mode and plug in to computer
4. Flash LS992ZV4_04.userdebug.tot as UPGRADE
5. Boot phone into recovery mode and wipe data
6. After phone is finished setting up, install Terminal Emulator from the Play Store
(This is copied from the V20 bootloader unlock, HUGE thanks to all of those devs for sharing their dirtysanta code with me and allowing me to modify it!)
7. Copy all the files from inside the "dirtysanta-boot" and paste it into your active ADB directory
8. Plug your device into the computer and verify ADB is working. Then;
On Windows, double-click "RUNMEFIRST.bat, DO NOT CLOSE THE LOG WINDOW THAT OPENS, then double-click "Step1.bat"
On Linux/MacOS ("#" Signifies a comment below)
Code:
./RUNMEFIRST.sh
# OR
bash ./RUNMEFIRST.sh
Open a Separate Terminal next to the RUNMEFIRST terminal, then type:
Code:
./Step1.sh
# OR
bash ./Step1.sh
(When you run The sh or Bat files there may be a Permission denied error on 2 files: Flatland and Flatland64. This is normal and nothing to worry about.)
9. Wait for a shell prompt, then type (or copy):
Code:
run-as con
chmod 0777 /storage/emulated/0/*
10. Open Up Terminal Emulator on your phone
Type:
Code:
id
Check if context is "Untrusted_app". If it is then we're good to go!
11. Type into Terminal Emulator:
Code:
applypatch /system/bin/atd /storage/emulated/0/dirtysanta
12. Watch the RUNMEFIRST dialog for when it tells you to run Step2 (we don't have a step 2)
13. Reboot the phone into recovery mode and wipe data again
BOOM! Now the you have a userdebug kernel running on a userdebug system Time to turn off dm-verity
1. Finish setting up the phone and enable USB Debugging in developer options (you should know how to do this)
2. Plug the phone into your computer, and run these commands
Code:
adb root
adb disable-verity
3. Reboot the phone
4. Run
Code:
adb root
adb shell
mount -o rw,remount,rw /system
Bam. Enjoy your FULL UNLIMITED root shell with system set to rw and dm-verity off!!! Just make sure to type "adb root" before "adb shell"
If you ever want to go back, just flash the LS992ZV4_04.tot with UPPERCUT and you'll be all good!
BUY ME A PIZZA FOR THE HARD WORK: BTC 197ct1uti4zutJu76bYAW51H8NZ6zXeoEV (sorry, no PayPal :/)
THANKS:
@tungkick for the userdebug boot and helping me with the ZV4 TOTs
@autoprime for UPPERCUT
@me2151 @glitschi667 @EMSpilot @elliwigy for their AMAZING work on the V20 and sharing their code!
@schiziodd for showing how to hex edit TOT
Click to expand...
Click to collapse
Hello, I am working on the root for the Verizon V10 and I came across this today. I was wondering how you made the userdebug.tot because I know this will work on it, Dirty Santa works up to the same point as you, so i'm wondering if I could do this and maybe even get supersu to work. Thank you

@Honestly Annoying could it be possible for you to "spoof" the firmware info and change the variant (LS992ZV4) to other locked g5 (such as the h831 h860..) so we can try to flash it via uppercut and see how much it's broken ?

Update: Now works on all devices running antirollback v0!!!!

Honestly Annoying said:
Update: Now works on all devices running antirollback v0!!!!
Click to expand...
Click to collapse
Will this work on Canadian variant? How do we know what version of antirollback we have?

mapleleafs89 said:
Will this work on Canadian variant? What is antirollback v0?
Click to expand...
Click to collapse
I am not sure how to check the antirollback version on on actual phone, you would need @autoprime for that.
Antirollback is basically exactly what it sounds like: It is part of each update that disallows users to rollback to previous versions of their software. This is built off of the first version of antirollback (v0) for the G5, so it will only work on phones with that version. You can test it out yourself, as it won't do any permanent damage, but just make sure you have a working TOT/KDZ to go back on.

*#546368#*850# (hiden menu)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

BrunoSlivar said:
*#546368#*850# (hiden menu)
Click to expand...
Click to collapse
I enter this in the dialer and call, it says USSD code running but then throws an error "Connection problem or invalid MMI code."

BrunoSlivar said:
*#546368#*850# (hiden menu)
Click to expand...
Click to collapse
Thanks for that!

mapleleafs89 said:
I enter this in the dialer and call, it says USSD code running but then throws an error "Connection problem or invalid MMI code."
Click to expand...
Click to collapse
Change the "850" to your model number. Such as "830" for T-Mobile or "992" for Sprint

Aha! 831 Canadian variant running Marshmallow. Almost upgraded to nougat but then saw this thread thankfully, I guess I will hold off if this means it increases my chances of getting root

For those interested, I can confirm that every h831 firmware up to nougat has a rollback count of 0, and from @autoprime :
H850 and H860 are fuse 00 and Sprint ZV3/4 are fuse 00.
Click to expand...
Click to collapse
Anything higher than ZV4 is 01 or higher.
Click to expand...
Click to collapse

I don't know what I missed, but now I get Your device is corrupt. It cannot be trusted and will not boot . I'mma try to flash back my system and try it again.
H860 with Nougat and anti-rollback version 0
P.S : I can't enter recovery or download mode ... how much I'm I screwed ? It just keeps rebooting

[GUIDE][ROOT][Moto G6 Play][JETER] TWRP, Root, and Magisk installation OLD guide

The guide below is depreceatred and should NOT be used.
Please use the guide in this thread instead. - https://forum.xda-developers.com/g6-play/how-to/guide-t3929928
Code:
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards, fires, rigged elections,
* thermonuclear war, or you getting fired because the alarms failed and you could not call in.
Please
* Ensure you have an advanced understanding of this device before flashing it! YOU are choosing to make these modifications or your own free will.
*/
This has been confirmed to work on:
XT1922-3 Model
XT1922-4 Model
XT1922-5 Brazilian Model
XT1922-7 Boost Mobile variant of this device with the code name JETER with Android 8.0.0 Build OCP27.91-23
XT1922-9 Model
Links to all boot images have been removed at the request of Motorola.
If you have done an OTA for your Device these boot.img's may not work for your device. We will need a newer boot.img to patch.
Please make backups using TWRP. Right now there is no ROM from moto for these devices that I've found. So proceed with caution.
Just make sure to download the correct boot.img for your device.
If you have another model please follow the first few steps to grab the stock boot.img and post it here and I can patch it.
The steps listed in this process WILL wipe your userdata. If you have anything you need to save back it up first.
Prerequisites:
Unlocked bootloader.
ADB/Fastboot installed on your machine ( https://developer.android.com/studio/releases/platform-tools ) If you have issues with commands make sure you have a current build of ADB and fastboot.
Step 1.) Download _ this TWRP image to the ADB/Fastboot folder on your computer.
Step 2.) Reboot to your bootloader. You can do this by turning on your device and holding power and both volume buttons at the same time.
Step 3.) Once the device reboots to the bootloader type the following from your computer with your phone connected via USB.
Code:
fastboot boot moto-g6-play-jeter-patched-twrp.img
Step 4.) Once TWRP boots from your computer type (it may take a bit to boot because it is trying to decrypt your userdata, but it will fail and prompt for a password. Just click cancel):
Code:
adb pull /dev/block/platform/soc/7824900.sdhci/by-name/boot stockboot.img
adb pull /dev/block/platform/soc/7824900.sdhci/by-name/recovery stockrecovery.img
This will backup your stock boot and recovery images if you to revert to stock later.
Step 5.) Now type:
Code:
adb reboot bootloader
Step 6.) Download either XT1922-9_no_dm-verity_boot.img or XT1922-7_no_dm-verity_boot.img or XT1922-5_no_dm-verity_boot.img or XT1922-4_no_dm-verity_boot.img or XT1922-3_no_dm-verity_boot.img patched dm-verity boot image depending on which device you have and download it into the ADB/Fastboot folder on your computer.
Step 7.) Run the following command from your computer to install the relevant boot image to your device.
Code:
fastboot flash boot XT1922-9_no_dm-verity_boot.img
OR
Code:
fastboot flash boot XT1922-7_no_dm-verity_boot.img
OR
Code:
fastboot flash boot XT1922-5_no_dm-verity_boot.img
OR
Code:
fastboot flash boot XT1922-4_no_dm-verity_boot.img
OR
Code:
fastboot flash boot XT1922-3_no_dm-verity_boot.img
Step 8.) Run the following command from your computer to install the TWRP image to your device.
Code:
fastboot flash recovery moto-g6-play-jeter-patched-twrp.img
Step 9.) Use the volume keys on the device to select boot to recovery and TWRP will boot up again. When it prompts for a decryption password select cancel again.
Step 10.) From your computer type the following into your command prompt/terminal from your adb/fastboot folder:
Code:
adb shell mount -o,rw /dev/block/platform/soc/7824900.sdhci/by-name/vendor /vendor
Step 11.) Download this patched fstab.qcom boot image into the ADB/Fastboot folder on your PC.
Step 12.) Run the following command from command prompt/terminal on your computer:
Code:
adb push fstab.qcom /vendor/etc/fstab.qcom
Step 13.) Next click the "Wipe" button in TWRP and slide "Swipe to Factory Reset" THIS WILL WIPE YOUR DATA ON YOUR PHONE. Ensure you have backup.
Step 14.) Download the Magisk zip file https://github.com/topjohnwu/Magisk/releases/ to your ADB/Fastboot folder.
Step 15.) Run the following command to push the boot image to your device
Code:
adb push Magisk-vXXX.zip /tmp
This will push the Magisk-vXXX.zip to your /tmp folder
Step 16.) Flash Magisk-v16.4.zip from TWRP using the install option and navigate to the /tmp folder to select it and install it.
Step 17.) Reboot your device
Step 18.) It will say N/A in the top corner of your device for a few seconds. Then it will boot the the Motorola boot screen and you can setup your device as a new phone.
Step 19.) Verify Magisk Manager is installed and the root functionality works.
Step 20.) ???
Step 21.) Profit
Credits:
CodyF86 and his Moto E5 thread for clues as to what it would take to turn off DM-Verity

Reserved

1st....
Thanks for your guide!

i can confirm this works perfectly on my boost model if you do everything exactly as the tutorial say. will be posting screenshots once i re download xda labs on phone. using computer as i type this
---------- Post added at 01:40 AM ---------- Previous post was at 01:00 AM ----------
alright so until this thread is able to work on the app i cant post screenshots but magisk safety net protection works. my kernel adiutor settings stuck on boot. the only things thats not working is being able to uninstall some bloatware and useless system apps. o theres no device encryption on boot anymore which is nice.

Hi @kwiksi1ver,
Thank you for your guide! :highfive:
However, I recomend to do one of these two things:
- Option 1: Add to your guide a link for download the original "boot.img" and "recovery.img". This is required for restoring the original state of the device in case of some error.
- Option 2: Instead of directly "flash" the "recovery.img" in the step 3, you can recommend to use a simple "boot". This doesn't replace the recovery and it's more safe. Then you can instruct to the user to make a backup of his stock boot & recovery partitions. See my guide about G6+: https://forum.xda-developers.com/moto-g6/how-to/moto-g6-root-guide-start-pro-users-t3795197
If you do it, then some users can rollback when some trouble appear. For example, someone here: https://forum.xda-developers.com/showpost.php?p=76789160&postcount=27 needs your help (I have a G6+, so I can't help him).
Regards. :angel:

Sweat
So here is confirming. This works 100% alas i can only confirm the boost version as well.
THANK YOU

I Can confirm this works on the boost mobile variant of the jeter if you follow every step exactly. Magisk works, and safety net is good, and magisk hide works tried Pokemon go and it was successful. Modules I used on my Moto g4 play work on my g6 play. Only thing I've noticed is the bloatware and certain system apps ( like Facebook) refuse to be uninstalled. Screenshots provided. Kernel aduitor settings also stayed when I used the apply on boot option

manos78 said:
Hi @kwiksi1ver,
Thank you for your guide! :highfive:
However, I recomend to do one of these two things:
- Option 1: Add to your guide a link for download the original "boot.img" and "recovery.img". This is required for restoring the original state of the device in case of some error.
- Option 2: Instead of directly "flash" the "recovery.img" in the step 3, you can recommend to use a simple "boot". This doesn't replace the recovery and it's more safe. Then you can instruct to the user to make a backup of his stock boot & recovery partitions. See my guide about G6+: https://forum.xda-developers.com/moto-g6/how-to/moto-g6-root-guide-start-pro-users-t3795197
If you do it, then some users can rollback when some trouble appear. For example, someone here: https://forum.xda-developers.com/showpost.php?p=76789160&postcount=27 needs your help (I have a G6+, so I can't help him).
Regards. :angel:
Click to expand...
Click to collapse
Cheers. I've added the stock files to the second post in the thread and I'll see what I can do about updating with the fastboot boot twrp.img steps and have the user backup their stuff first.
I wish I could help the user your referenced too, but they have different device. They have a G6, I have a G6 Play, and you have a G6+.
ninjakira said:
Only thing I've noticed is the bloatware and certain system apps ( like Facebook) refuse to be uninstalled.
Click to expand...
Click to collapse
You can run "adb shell" then "su" then type "pm disable com.facebook.system", "pm disable com.facebook.katana", "pm disable com.facebook.appmanager", "pm disable com.ironsource.appcloud.oobe", "pm disable com.lookout" etc which will disable the apps.
Alternatively you could use a file manager with root access and delete the various files and reboot. Make sure to keep a backup just in case you need them:
/oem/app/FcbkAppManagerSprint/FcbkAppManagerSprint.apk
/oem/app/FacebookStubSprint/FacebookStubSprint.apk
/oem/priv-app/FcbkInstallerSprint/FcbkInstallerSprint.apk
/oem/priv-app/LookoutSprint/LookoutSprint.apk
/data/app/com.ironsource.appcloud.oobe-mMdx9tUtxjFcQlRhjRmqrQ==/base.apk

kwiksi1ver said:
Cheers. I've added the stock files to the second post in the thread and I'll see what I can do about updating with the fastboot boot twrp.img steps and have the user backup their stuff first.
I wish I could help the user your referenced too, but they have different device. They have a G6, I have a G6 Play, and you have a G6+.
You can run "adb shell" then "su" then type "pm disable com.facebook.system", "pm disable com.facebook.katana", "pm disable com.facebook.appmanager", "pm disable com.ironsource.appcloud.oobe", "pm disable com.lookout" etc which will disable the apps.
Alternatively you could use a file manager with root access and delete the various files and reboot. Make sure to keep a backup just in case you need them:
/oem/app/FcbkAppManagerSprint/FcbkAppManagerSprint.apk
/oem/app/FacebookStubSprint/FacebookStubSprint.apk
/oem/priv-app/FcbkInstallerSprint/FcbkInstallerSprint.apk
/oem/priv-app/LookoutSprint/LookoutSprint.apk
/data/app/com.ironsource.appcloud.oobe-mMdx9tUtxjFcQlRhjRmqrQ==/base.apk
Click to expand...
Click to collapse
I just mainly want to remove Facebook as a system app and remove it's automatic updates and just reinstall it on play store as a regular app lol. I did try a couple root uninstallers and the failed to remove anything from the system. Also used a file manager with root and the results were the samr. The phone automatically resets when there's an attempt at removing system apps. I'll try to get a logcat for ya

I removed it all without any tools except for adb and it doesn't come back. Here is the code I used.
Code:
adb shell
su
cp -r /oem/app/FcbkAppManagerSprint /sdcard
cp -r /oem/app/FacebookStubSprint /sdcard
cp -r /oem/priv-app/FcbkInstallerSprint /sdcard
cp -r /oem/priv-app/LookoutSprint /sdcard
cp -r /data/app/com.ironsource.appcloud.oobe-mMdx9tUtxjFcQlRhjRmqrQ==/base.apk /sdcard
mount -o rw,remount /oem
mount -o rw,remount /data
mount -o rw,remount /system
rm -rf /oem/app/FcbkAppManagerSprint
rm -rf /oem/app/FacebookStubSprint
rm -rf /oem/priv-app/FcbkInstallerSprint
rm -rf /oem/priv-app/LookoutSprint
rm -rf /data/app/com.ironsource.appcloud.oobe-mMdx9tUtxjFcQlRhjRmqrQ==
reboot
If you run all of those command it will backup your annoying APK's to the /sdcard folder if you need them later and then delete the originals and then it reboots your device.
The ironsource appcloud apk is the thing that reinstalls the Sprint bloatware apps over and over again, so removing or disabling that is key to keeping the crap gone.

Will rooting Boost mobile variant unlock the phone ?

piesladowy said:
Will rooting Boost mobile variant unlock the phone ?
Click to expand...
Click to collapse
No it does not sim unlock the phone. Sprint/boost will unlock your sim provided you are with them for a year with the same device

XT1922-5
Hi Guys. I've tried use this procedure on XT1922-5 (Brazilian varianty) however, how I imaginated, it did not work. After the Step 18 my phone stay freez on Motorola boot screen (freezed in M). After that I did a full restore to stock and now phone is ok.
Some one her that have this same Moto g 6 Play variant (XT1922-5) could help me to create a recovery + root process too?
Best regards, GESATEC

Stock Firmware file?
Does any one have a stock frimware file for the
JETER??
I have a 100% stock JETER
If some one can help me I'll post the frimware file ones I get it

FizzyAps said:
Does any one have a stock frimware file for the
JETER??
I have a 100% stock JETER
If some one can help me I'll post the frimware file ones I get it
Click to expand...
Click to collapse
Hi,I believe that there is another Topic with JETER rom:
https://forum.xda-developers.com/moto-g6/development/firmware-stock-moto-g6-play-aljeter-t3792868
Please, check If your stock file os different before post

GESATEC said:
Hi,I believe that there is another Topic with JETER rom:
https://forum.xda-developers.com/moto-g6/development/firmware-stock-moto-g6-play-aljeter-t3792868
Please, check If your stock file os different before post
Click to expand...
Click to collapse
that's got the unlocked model not sprint/boost

JETER
FizzyAps said:
that's got the unlocked model not sprint/boost
Click to expand...
Click to collapse
Ok, I understood . I would lik JETER rom too.
Can u put files on Google Drive?

GESATEC said:
Hi Guys. I've tried use this procedure on XT1922-5 (Brazilian varianty) however, how I imaginated, it did not work. After the Step 18 my phone stay freez on Motorola boot screen (freezed in M). After that I did a full restore to stock and now phone is ok.
Some one her that have this same Moto g 6 Play variant (XT1922-5) could help me to create a recovery + root process too?
Best regards, GESATEC
Click to expand...
Click to collapse
Hi, can you post your stockboot.img file that you backed up during step 4? I can modify that and then I see if we can make it work for the XT1922-5 as well.

kwiksi1ver said:
Hi, can you post your stockboot.img file that you backed up during step 4? I can modify that and then I see if we can make it work for the XT1922-5 as well.
Click to expand...
Click to collapse
Manu thanks. Let me arrive at my home and I'll post it

ninjakira said:
No it does not sim unlock the phone. Sprint/boost will unlock your sim provided you are with them for a year with the same device
Click to expand...
Click to collapse
If you managed to get the boost version onto sprint, in theory it should be eligible for a sim unlock w/50 days of service.