(WIP) Magisk/Root installation - Google Pixel 2 XL Guides, News, & Discussion

So this morning, we finally got our hands on some factory images. That is the good news. The bad news is that so far I am unable to get Magisk to work. Anyone else get it to work yet?
Here is what I have done:
1) Download the latest (5.4) magisk manager apk [Thread | Direct Link]
2) Set the update channel to both stable (14.0) and beta (14.3)
3) Choose install from stock boot img (with and without keep dm-verity and force encryption)
4) Copy the patched boot img from your phone:
Code:
adb pull /sdcard/MagiskManager/patched_boot.img .
4) Flash the modified boot.img in fastboot
Code:
fastboot flash boot patched_boot.img
Results:
1) With 14.0, the system boots up fine, but magisk isn't installed
2) With 14.3, I get bootloops, and have to reflash the stock boot.img in order to get it to boot.
Might be worth noting that the patched boot img is significantly smaller than the original one (about 25mb vs 40mb)

I tried the same thing with 14.3 only and it says it patches the boot.img that I pulled from the image. I then reboot and I am not rooted. Is there suppose to be an option to patch the second slot?

Once you patch the stock boot.img it should tell you where it placed the patched img. For me it was /sdcard/MagiskManager/patched_boot.img
You need to pull that img file, reboot to bootloader and fastboot flash that.

skaforey said:
Once you patch the stock boot.img it should tell you where it placed the patched img. For me it was /sdcard/MagiskManager/patched_boot.img
You need to pull that img file, reboot to bootloader and fastboot flash that.
Click to expand...
Click to collapse
Ok, I see you have to manually apply the patched boot img. This is my first Pixel, came from a 6P where I just used twrp to install magisk. Guess we need to wait for a newer Magisk.

stevetrooper said:
Ok, I see you have to manually apply the patched boot img. This is my first Pixel, came from a 6P where I just used twrp to install magisk. Guess we need to wait for a newer Magisk.
Click to expand...
Click to collapse
Can you try flashing the patched boot.img? If you get into a bootloop, simply hold power and volume down to get back into bootloader mode and reflash the stock boot img

skaforey said:
Can you try flashing the patched boot.img? If you get into a bootloop, simply hold power and volume down to get back into bootloader mode and reflash the stock boot img
Click to expand...
Click to collapse
My PC is at home, will have to try later tonight. I suspect that it will boot loop like yours, since the patched img is only 25 megs and the original was 40.

Try the app One Click Auto Brick. ?

I tried it and it did the same bootlooping you described.

Were you guys able to flash the factory image and get it to boot past the google screen?

I've been through the same process. I manually flashed the patched_boot.img and got stuck in a bootloop. Had to flash the factory boot to get back up and going. @topjohnwu do you have any insight on this?

Just wondering, have you run
Code:
fastboot flashing unlock_critical
? Just saw it in this post: https://forum.xda-developers.com/showpost.php?p=74271129&postcount=6

gakio12 said:
Just wondering, have you run
Code:
fastboot flashing unlock_critical
? Just saw it in this post: https://forum.xda-developers.com/showpost.php?p=74271129&postcount=6
Click to expand...
Click to collapse
This might pertain to flashing an updated bootloader. The boot image flashed fine, just bootlooped, so I don't think that's the problem.

teshxx said:
Were you guys able to flash the factory image and get it to boot past the google screen?
Click to expand...
Click to collapse
I had to re-extract the boot.img from the factory image and flash it manually again to get it to boot. A flash-all did not seem to get it.
Code:
Fastboot flash boot boot.img

I dont have my 2XL yet, but I grabbed the factory image and yanked the boot out of it then used Magisk Manager on my MXPE to patch the img. I've unpacked both images to compare them and it's definitely patching it and the patched one doesn't seem to be missing anything so I'm fairly certain the size difference is due to the patched image not being padded to the 40MB size of the boot partition. So probably not something to worry about.
It looks like my device will be here wednesday. If nobody else has cracked this case by then I'll start poking around. If anyone else is poking around and looking for ideas. I would start by unpacking and repacking the normal boot.img and flashing it just to make sure it boots. Assuming it does then modify the default.prop on the patched_boot.img to enable insecure adb during boot so that adb logcat can be run while it's booting and maybe get an idea of what's going on.

The only problem I see with your process is patching it in another device will likely cause problems because it was patched using the wrong vendor image.

northmendo said:
The only problem I see with your process is patching it in another device will likely cause problems because it was patched using the wrong vendor image.
Click to expand...
Click to collapse
Oh yeah, I wouldn't try to flash what I made from another device. I mainly wanted to see what, if anything magisk manager would do with it. If someone wants to upload a patched_boot.img they made on their 2XL so I can look into it when I get home from work tomorrow that would be appreciated.
Maybe I'll get lucky and get mine tomorrow.

I can do that. I'll create one first thing in the morning.

What's the best way to look at the contents of the img files? Preferably on Windows

update:
I mounted both the stock boot.img file and patched boot.img files and it does appear that changes are being made.
Here are the files that are different between the 2:
Code:
ramdisk/init
The patched boot img contains additional files that seem normal:
Code:
ramdisk/overlay/sbin/magisk (binary file)
ramdisk/overlay/init.magisk.rc
In addition, I found the backup of the main init file that was changed in ramdisk/.backup/init
Here are the contents of the init.magisk.rc file
Code:
# Triggers
on post-fs
start logd
start magisk_daemon
wait /dev/.magisk.unblock 5
rm /dev/.magisk.unblock
start magisk_pfs
wait /dev/.magisk.unblock 10
on post-fs-data
load_persist_props
rm /dev/.magisk.unblock
start magisk_pfsd
wait /dev/.magisk.unblock 10
# Services
# Self recoverable service
service magisk_daemon /sbin/magisk --daemon
user root
seclabel u:r:su:s0
# launch post-fs script
service magisk_pfs /sbin/magisk --post-fs
user root
seclabel u:r:su:s0
oneshot
# launch post-fs-data script
service magisk_pfsd /sbin/magisk --post-fs-data
user root
seclabel u:r:su:s0
oneshot
# launch late_start script
service magisk_service /sbin/magisk --service
class late_start
user root
seclabel u:r:su:s0
oneshot
# STOCKSHA1=6d4d920f9d0b6eee52de8a95614a9884ef80d732
Not sure if this is useful to anyone, but maybe it will be.
One thing I noticed was the the . rc file contained references to /dev/.magisk and /sbin/magisk but I do not see those files in the patched boot img (only in the overlay folder, and maybe that's all that's needed, I don't know nearly enough about this to say for sure).
But, perhaps that's part of the problem?

Could the title of this thread be changed? Very clearly not a guide or even a WIP.. It's a question/discussion on what might work to get Magisk working.

Related

Help with bootloop

Hi,
I did search, but I didn't find any solution to the issue. I got the Nexus 6P 64 GB.
I unlocked my bootloader using the 6p Multitool. Thereafter I used my normal method of fastboot (Minimal ADB) to flash the boot.img from this thread http://forum.xda-developers.com/apps/supersu/wip-android-6-0-marshmellow-t3219344.
After that I flashed TWRP. Basically I followed the instructions here: http://forum.xda-developers.com/nexus-6p/general/guides-how-to-guides-beginners-t3206928.
But my phone is not booting up.
It gives me this error:
Your device software cannot be checked for corruption. Please lock the bootloader."
But I tried that and it doesn't work. I tried from fastboot restoring to factory, but get the same message.
Please help me!
Did you check the enable oem unlocking in developer settings?
Sent from my Nexus 6P using Tapatalk
Yes. As I said, I achieved the unlock. Now I just can't get back into my phone or recovery or anything other than fastboot (where it says unlock)
isn't "Your device software cannot be checked for corruption. Please lock the bootloader." the new msg on boot when you are unlocked, and you have to wait ~10 secs before it startup ?
After that, I'm stuck on the Google screen. It just goes on and on. Left it for over 20 minutes at one point and it didn't get past it.
Edit: The multicolored animated google screen. The animation just keeps going and going.
Del.
Your issue might be due to the encryption of the phone. Take a look at this thread: http://forum.xda-developers.com/nex...recovery-twrp-2-8-7-0-touch-recovery-t3234976
From this thread:
NOTE: Decrypting data is not supported yet. The Nexus 6P will normally attempt to encrypt the device automatically on first boot. To use TWRP as you normally would, you will have to format data and install a slightly modified boot image with forceencrypt disabled. My Nexus 6P should arrive tomorrow and I will start working on decrypt once I get my hands on it.
Team Win Recovery Project 2.x, or twrp2 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.
Read through that thread. Part of the issue is that I don't know which variant (MDA89D & MDB08K) I have, or how to find that out seeing as I can't boot into the phone.
If I have the variant I may be able to fix this through the unified toolkit (though I'm not sure of that)
Did you ever fix this?
Try flashing the factory image and starting from scratch. You must have messed up somewhere. Re-download the boot.img from Chainfire's thread, maybe that was corrupt or something.
1. Download the MDB08K factory image (it's not a variant, it's a Marshmallow update) and unzip it.
2. Download the MDB08K boot.zip from Chainfire's modified boot.img thread
3. Download latest SuperSU beta zip
Wipe phone in TWRP, to include format data.
In bootloader, fastboot flash MDB08K
fastboot flash modified boot.img (from zip)
In TWRP, ADB sideload SuperSU
Reboot and it should perform normally.
kibmikey1 said:
1. Download the MDB08K factory image (it's not a variant, it's a Marshmallow update) and unzip it.
2. Download the MDB08K boot.zip from Chainfire's modified boot.img thread
3. Download latest SuperSU beta zip
Wipe phone in TWRP, to include format data.
In bootloader, fastboot flash MDB08K
fastboot flash modified boot.img (from zip)
In TWRP, ADB sideload SuperSU
Reboot and it should perform normally.
Click to expand...
Click to collapse
Thank you for your reply, but I can't get into TWRP either!! Any way for me to restore to factory or do the repairs from in flashboot without the restore?
I ran into the same issue last night trying to install TWRP. I'm still not sure how to get around it but I did get my phone back. you should be able to get to the bootloader (hold the power button until phone turns off, then hold vol up+vol down+power) once there use ADB fastboot to go back to stock.
this link will walk you through what you need. follow step 7.
http://forum.xda-developers.com/nexus-6p/general/guides-how-to-guides-beginners-t3206928
here it is as well:
How To Flash The Factory Images (And Return To Stock)
Prerequisites: unlocked bootloader (section 1).
Download the appropriate factory images for your model here.
Unzip the angler-xxxxxx-factory-xxxxxxxx (x's replace variables) into a directory on your PC (for this guide we'll use C:\angler\).
Once unzipped you should have a folder named angler-xxxxxx (x's replace variables). Open it and move the following files to a new directory named C:\angler\images\:
bootloader-angler-angler-01.31.img
radio-angler-angler-01.29.img
(Please note that radio and bootloader naming changes from build to build so the filenames and below commands will change with them)
Within C:\angler\angler-xxxxxx\ you'll see another zip archive named image-angler-xxxxxx, unzip the contents of that zip into the C:\angler\images\ folder we created before. Now within C:\angler\images\ you should have the following files:
android-info.txt
boot.img
bootloader-angler-angler-01.31.img
cache.img
radio-angler-angler-01.29.img
recovery.img
system.img
userdata.img
vendor.img
Boot into the bootloader and connect your phone to your PC via usb cable.
Open a command prompt from within your fastboot folder (navigate to where you have fastboot.exe located on your PC, shift + right click anywhere within that folder, select open command prompt here), enter these commands to flash:
Code:
fastboot flash bootloader C:\angler\images\bootloader-angler-angler-01.31.img
fastboot reboot-bootloader
fastboot flash radio C:\angler\images\radio-angler-m8994f-2.6.28.0.65.img
fastboot reboot-bootloader
fastboot flash boot C:\angler\images\boot.img
fastboot erase cache
fastboot flash cache C:\angler\images\cache.img
fastboot flash recovery C:\angler\images\recovery.img
fastboot flash system C:\angler\images\system.img
fastboot flash userdata C:\angler\images\userdata.img
fastboot flash vendor C:\angler\images\vendor.img
Thank you. I was eventually able to do tysonwald's suggestion. First I didn't know what my version was, so I couldn't.
At some point I was able to get into the phone with constant gapp errors, check it.
Now my phone is unlocked and rooted. But when I go to settings to security (and when I tried to set up my fingerprint) settings crashes. Any ideas?
There was still some issue. I wiped the phone with the above method again, did NOT set up twrp/root, and everything works. It was something about the custom boot image I guess. Any advice if I want to try to set it up again?
Problem solved. Needed to update to newer image before doing everything. Issue resolve from Heisenberg's thread. Thank you all!
I had the same damn issue last night. Thise bootleg instructions had me flashing build k boot.img on build D. Maybe i wasnt paying attention lol!
I have a very similar problem, I flashed the k boot img. and now I'm stuck in an endless bootloop any idea?
TeriusPR said:
I have a very similar problem, I flashed the k boot img. and now I'm stuck in an endless bootloop any idea?
Click to expand...
Click to collapse
Read thru this guide and follow the instructions to the T. http://forum.xda-developers.com/nexus-6p/general/guides-how-to-guides-beginners-t3206928
I had a similar issue just now where my phone got stuck at the TWRP logo. Selecting the reboot option in download mode refused to remove it. I had to follow step 10 to get my phone back to stock. I'm afraid to try this again now
Is there anyway to know which version do i need to download? i bought the phone already bricked and i am trying to bring it back to life

Deodexed system 34.0.A.2.292 & 34.0.A.2.301

Hi All,
I've deodexed the systems from 34.0.A.2.292 and 34.0.A.2.301.
How to use:
1. download zip
2. flash with flashfire or custom recovery
3. enjoy
Download links:
F5121_34.0.A.2.292_Deodexed.zip
F5121_34.0.A.2.301_Deodexed.zip
nice work bro
Pandemic said:
nice work bro
Click to expand...
Click to collapse
we need a kernel with recovery or at least sony init, so we can use recovery on its proper partition..
kick-start development on X/suzu ...
ive compiled a boot img from .292 copyleft sources and added ramdisk/twrp..
https://drive.google.com/open?id=0B2Ayh5ZFCqa8RVI1cHJwYk5BeE0
if someone with a unlocked bootloader could try, it would be great.
infected_ said:
we need a kernel with recovery or at least sony init, so we can use recovery on its proper partition..
kick-start development on X/suzu ...
ive compiled a boot img from .292 copyleft sources and added ramdisk/twrp..
https://drive.google.com/open?id=0B2Ayh5ZFCqa8RVI1cHJwYk5BeE0
if someone with a unlocked bootloader could try, it would be great.
Click to expand...
Click to collapse
i flashed it on my german .292, and its booting.
but im not sure how to enter twrp?
adb reboot recovery results in a 'melting' sony screen and after some second the phone reboots into system.
mstrack said:
i flashed it on my german .292, and its booting.
but im not sure how to enter twrp?
adb reboot recovery results in a 'melting' sony screen and after some second the phone reboots into system.
Click to expand...
Click to collapse
did you flashed a twrp recovery on the recovery partition?
try this one:
https://drive.google.com/file/d/0B2Ayh5ZFCqa8UkxzYnhIazlZenM/view?usp=sharing
and try enter recovery again with that kernel/boot img above.
infected_ said:
did you flashed a twrp recovery on the recovery partition?
try this one:
https://drive.google.com/file/d/0B2Ayh5ZFCqa8UkxzYnhIazlZenM/view?usp=sharing
and try enter recovery again with that kernel/boot img above.
Click to expand...
Click to collapse
so, flashed it, reboot, lands in twrp.
asks for encryption password but doesnt accept my pwd.
edit: doesnt boot into system, only in twrp
edit2: i have to flash the recovery via flashtool -> flash kernel ? or did i something wrong?
hell...i miss my nexus...
mstrack said:
so, flashed it, reboot, lands in twrp.
asks for encryption password but doesnt accept my pwd.
edit: doesnt boot into system, only in twrp
edit2: i have to flash the recovery via flashtool -> flash kernel ? or did i something wrong?
hell...i miss my nexus...
Click to expand...
Click to collapse
You can press cancel when twrp asks for password. It will bring you to the main menu, but a lot of stuff isnt working yet. Currently there is no working twrp yet for our xperia X, follow this thread for more info: http://forum.xda-developers.com/xperia-x/development/root-xperia-x-34-0-2-292-modified-t3449708
edit: did you flash it with flashtool or adb?
kistigun said:
You can press cancel when twrp asks for password. It will bring you to the main menu, but a lot of stuff isnt working yet. Currently there is no working twrp yet for our xperia X, follow this thread for more info: http://forum.xda-developers.com/xperia-x/development/root-xperia-x-34-0-2-292-modified-t3449708
Click to expand...
Click to collapse
yes, got it, thx.
edit: i used flashtool
kistigun said:
You can press cancel when twrp asks for password. It will bring you to the main menu, but a lot of stuff isnt working yet. Currently there is no working twrp yet for our xperia X, follow this thread for more info: http://forum.xda-developers.com/xperia-x/development/root-xperia-x-34-0-2-292-modified-t3449708
edit: did you flash it with flashtool or adb?
Click to expand...
Click to collapse
the person who gave me that recovery, ill assure you that is working... it came from one member of omni core dev's, which owns a suzu...
you dont have access to the rest of the twrp options, cause of the encryption.
remember the first time you booted up your X on stock? it asked to encrypt/set a password on the device because if it got stolen or lost, etc...
fastboot erase boot, fastboot erase system && fastboot erase userdata should get rid of the encryption and you can try twrp.
all this is helpless ofc unless we can get a stock boot image working with sony init, so we can enter recovery when flashed on recovery partition.
if you hotboot the twrp it works right? so it is working.
infected_ said:
the person who gave me that recovery, ill assure you that is working... it came from one member of omni core dev's, which owns a suzu...
you dont have access to the rest of the twrp options, cause of the encryption.
remember the first time you booted up your X on stock? it asked to encrypt/set a password on the device because if it got stolen or lost, etc...
fastboot erase boot, fastboot erase system && fastboot erase userdata should get rid of the encryption and you can try twrp.
all this is helpless ofc unless we can get a stock boot image working with sony init, so we can enter recovery when flashed on recovery partition.
if you hotboot the twrp it works right? ok then.
Click to expand...
Click to collapse
Thanks for the tip will try it out tonight and report back!
kistigun said:
Thanks for the tip will try it out tonight and report back!
Click to expand...
Click to collapse
try ramdisk of the recovery also. extract it and try to add it to your .292 boot.img
infected_ said:
try ramdisk of the recovery also. extract it and try to add it to your .292 boot.img
Click to expand...
Click to collapse
will do, just wondering: what files/folders of the ramdisk are needed for TWRP? I ask because I use a kernel with allready a modified ramdisk(DM-verity/Sony RIC/DRM-fix/SU?busyBox) so I want to know what files need to be replaced to implements TWRP
infected_ said:
the person who gave me that recovery, ill assure you that is working... it came from one member of omni core dev's, which owns a suzu...
you dont have access to the rest of the twrp options, cause of the encryption.
remember the first time you booted up your X on stock? it asked to encrypt/set a password on the device because if it got stolen or lost, etc...
fastboot erase boot, fastboot erase system && fastboot erase userdata should get rid of the encryption and you can try twrp.
all this is helpless ofc unless we can get a stock boot image working with sony init, so we can enter recovery when flashed on recovery partition.
if you hotboot the twrp it works right? so it is working.
Click to expand...
Click to collapse
So when i try to hotboot the f5121_recovery.img for the first time it flashes the image, after that it boots but it gets stuck on a black screen. I did a hard reset and flashed the image with adb and tried to reboot to recovery but it just rebooted. After that i tried again to hotboot the recovery image and after this it finally booted into TWRP. indeed it's asking for password
Will i loose my system and userdata when i use fastboot erase boot, fastboot erase system && fastboot erase userdata?
kistigun said:
So when i try to hotboot the f5121_recovery.img for the first time it flashes the image, after that it boots but it gets stuck on a black screen. I did a hard reset and flashed the image with adb and tried to reboot to recovery but it just rebooted. After that i tried again to hotboot the recovery image and after this it finally booted into TWRP. indeed it's asking for password
Will i loose my system and userdata when i use fastboot erase boot, fastboot erase system && fastboot erase userdata?
Click to expand...
Click to collapse
yes, it will all be wiped.
you can also try adding sony init to your ramdisk. you just need to extract it from boot.img, add the sony init files, rename a file and make a symlink, repack again to boot.img
ill provide the files in a minute.
edit:
after extracting contents of ramdisk, rename "init" to "init.real", and place the files on the root of the extracted ramdisk dir.
symlink is already created, pointing at /sbin/init_sony
https://drive.google.com/open?id=0B2Ayh5ZFCqa8N3pIQjZMY0ZzdU0
infected_ said:
yes, it will all be wiped.
you can also try adding sony init to your ramdisk. you just need to extract it from boot.img, add the sony init files, rename a file and make a symlink, repack again to boot.img
ill provide the files in a minute.
edit:
after extracting contents of ramdisk, rename "init" to "init.real", and place the files on the root of the extracted ramdisk dir.
symlink is already created, pointing at /sbin/init_sony
https://drive.google.com/open?id=0B2Ayh5ZFCqa8N3pIQjZMY0ZzdU0
Click to expand...
Click to collapse
cant extract the init file, getting an error(cant create a symbolic link: access denied)
Edit: hmm just discovered that the tool i was using for unpaking & repacking boot.img isn't working.... Need to find a new tool first, anyone got a good suggestion?
kistigun said:
cant extract the init file, getting an error(cant create a symbolic link: access denied)
Edit: hmm just discovered that the tool i was using for unpaking & repacking boot.img isn't working.... Need to find a new tool first, anyone got a good suggestion?
Click to expand...
Click to collapse
delete the symlink and recreate it:
ln -s /sbin/init_sony init
infected_ said:
delete the symlink and recreate it:
ln -s /sbin/init_sony init
Click to expand...
Click to collapse
Sorry it took me a while, had to set-up a new linux enviorment. Repacked kernel, it boots but sony init still doesnt work
Hy can i install the deodexed System as a regual normal System?
I mean if i break my System does IT work as a normal "Rom"
KOALAaufPILLEN said:
Hy can i install the deodexed System as a regual normal System?
I mean if i break my System does IT work as a normal "Rom"
Click to expand...
Click to collapse
No, it only flashes the deodexed files so it does not contain a ´full rom´
Could you make a full rom ? Cause right now i must use aosp rom but there are some features missing like sony themes and others

[Guide][Root] Magisk without TWRP on Android P

Via Magisk Manager:
This method does not need root, and also does not require a custom recovery.
However, you MUST have a stock boot image dump beforehand, and you also have to be able to flash the patched boot image, either through fastboot mode
REQUIREMENTS -
1 - Setup adb and fastboot on your PC.
2- Stock boot image (boot.img) of your device (extract file from factory image android P)
3 - Last Magisk Manager (v 5.8.3)
4 - Active Internet connection
5 - Active mind and patience.
6 - Devices must is unlock bl.
This Boot-Image is for boot android P PPR1.180610.009:
https://drive.google.com/open?id=166pE9aMk-jqns3JM74enFhsaDY6-c3yJ
Magisk Manager
https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
==================================================
Step 1: Patching the stock boot.img
1- Copy the stock boot.img of your device to your phone's internal storage.
2- Install the latest Magisk Manager
3- Launch Magisk Manager app
4- If prompted to install Magisk, select NO THANKS
5- If you're planning to flash the patched boot image,For normal users leave it as the default .img
6-Press Setting>Update Channel>Beta
7- Press Install > Install > Patch Boot Image File, and select your stock boot image file
Navigate to the location of the stock boot.img you copied earlier on, then Select it
8- Magisk Manager should begin downloading the magisk zip file used for patching
9- Once download is complete, MagiskManager will automatically patch the boot file and store it under SDcard/MagiskManager/patched_boot.img
Step 2: Flashing the patched boot.img
1- Copy the patched_boot.img from your phone's internal storage to folder adb or platform-tools on PC (directory>SDcard/MagiskManager/patched_boot.img)
2- You could also use Fastboot to flash the patched_boot.img or boot.img (if you've renamed then the command must reflect the file name) as outlined below
How to Flash patched_boot.img using Fastboot
1- Setup adb and fastboot on your PC.
2- Unlock the phone's Bootloader (if its not unlocked)
3-Re-enable USB debugging on the phone
4- Connect the phone to the PC via USB cord
5- Boot into fastboot mode.
code
-adb reboot bootloader
6- Flash the patched_boot and reboot by typing in the commands below into adb CMD prompt window and hitting Enter after each line -
Quote:
Code:
fastboot devices
fastboot flash boot patched_boot.img
fastboot reboot
-Verify root using Root Checker
Try at your own Risk
CREDITS
@topjohnwu (Magisk)
Sadly goes into a bootloop for me - no idea why though
This worked for me. I had magisk installed and took the pie update. No more root. D/l the factory image and extracted the boot image to the files folder...pissmeoff they changed the name of the icon... and magisk patched the image and saved it in its folder. Found the file, moved it to the laptop then flashed it.
reawo said:
Sadly goes into a bootloop for me - no idea why though
Click to expand...
Click to collapse
I think you made a mistake.
I always did that method pre Pie and it always worked but now I end up in a bootloop and I did everything according to guide
reawo said:
I always did that method pre Pie and it always worked but now I end up in a bootloop and I did everything according to guide
Click to expand...
Click to collapse
I think you use my file(boot.img) for patch_boot.img from magisk manager.
I think you must check your build number devices.
You must use file boot.img from your factory image for root.
9.0.0 (PPR1.180610.009, Aug 2018) >This is version for my devices
9.0.0 (PPR1.180610.011, Aug 2018, Telstra) >?
hey mate thanks for the input, I got a normal non testra (whatever that is) taimen - tried your boot.img and before that I tried the one from the factory image, both result in a boot loop.
I went through all stages of the Android p beta and in the end, to try solve this, I also non wipe flashed the factory image all to get the same result
could you sent me a drive Link to the patched version of yours or something?
reawo said:
hey mate thanks for the input, I got a normal non testra (whatever that is) taimen - tried your boot.img and before that I tried the one from the factory image, both result in a boot loop.
I went through all stages of the Android p beta and in the end, to try solve this, I also non wipe flashed the factory image all to get the same result
could you sent me a drive Link to the patched version of yours or something?
Click to expand...
Click to collapse
This is file patch_boot.img from my devices.
https://drive.google.com/open?id=1nVEpoGam-VY1YT3GBbG6HNfhnT2NqRin
newyesor said:
This is file patch_boot.img from my devices.
https://drive.google.com/open?id=1nVEpoGam-VY1YT3GBbG6HNfhnT2NqRin
Click to expand...
Click to collapse
Also doesnt work, i thought so - didnt do anything different than when it worked - no idea why it doesn't though
Is there a way to see or read out any protocols regarding this?
I receive also a bootloop and I didnt make any mistake. I also used this method pre Pie, I read that alot of users have problems with rooting Pie atm, even with TWRP
reawo said:
Also doesnt work, i thought so - didnt do anything different than when it worked - no idea why it doesn't though
Is there a way to see or read out any protocols regarding this?
Click to expand...
Click to collapse
You use adb last version for flash patch_boot.img ?
I think you should flash factory image new again and factory reset your devices.
You are use stock kernel or other kernel on your devices.
newyesor said:
You use adb last version for flash patch_boot.img ?
I think you should flash factory image new again and factory reset your devices.
You are use stock kernel or other kernel on your devices.
Click to expand...
Click to collapse
I downloaded all the latest adb and fastboot. Never touched kernel or did custom recovery, always used the magisk method since i am on a pixel device. i also got the issue that my pc doesnt recognize my pixel from time to time, you think i should do a complete wipe?
I don't sure.
You are use platfrom-tool from sdk lastversion?(for flash via fastboot mode)
@reawo
I think you should flash factory image new again and factory reset your devices.
Step 1: Patching the stock boot.img
1- Copy the stock boot.img of your device to your phone's internal storage.
2- Install the latest Magisk Manager
3- Launch Magisk Manager app
4- If prompted to install Magisk, select NO THANKS
5- If you're planning to flash the patched boot image,For normal users leave it as the default .img
6-Press Setting>Update Channel>Beta ,and close this app.****
7- Open app again and Press Install > Install > Patch Boot Image File, and select your stock boot image file
Navigate to the location of the stock boot.img you copied earlier on, then Select it
8- Magisk Manager should begin downloading the magisk zip file used for patching (This process is not failed)***
9- Once download is complete, MagiskManager will automatically patch the boot file and store it under SDcard/MagiskManager/patched_boot.img
Step 2: Flashing the patched boot.img
1- Copy the patched_boot.img from your phone's internal storage to folder adb or platform-tools on PC (directory>SDcard/MagiskManager/patched_boot.img)
2- You could also use Fastboot to flash the patched_boot.img or boot.img (if you've renamed then the command must reflect the file name) as outlined below
How to Flash patched_boot.img using Fastboot
1- Setup adb and fastboot on your PC.
2- Unlock the phone's Bootloader (if its not unlocked)
3-Re-enable USB debugging on the phone
4- Connect the phone to the PC via USB cord
5- Boot into fastboot mode.
code
-adb reboot bootloader
6- Flash the patched_boot and reboot by typing in the commands below into adb CMD prompt window and hitting Enter after each line -
Quote:
Code:
fastboot devices
fastboot flash boot patched_boot.img
fastboot reboot
-Verify root using Root Checker
Try at your own Risk
Will work on the verizon variant (bootloader locked)?
sabi95190 said:
Will work on the verizon variant (bootloader locked)?
Click to expand...
Click to collapse
Nope. If it were that easy for bootloader locked Verizon phones, it would have been done months ago.
What happens if you lock the bootloader after all of this?
DarkSilentSC said:
What happens if you lock the bootloader after all of this?
Click to expand...
Click to collapse
You'll wipe the phone, lose root, and be stock.
DarkSilentSC said:
What happens if you lock the bootloader after all of this?
Click to expand...
Click to collapse
When still rooted and modified? You might very well brick it. Relocking while modified is borderline insanity.
TonikJDK said:
When still rooted and modified? You might very well brick it. Relocking while modified is borderline insanity.
Click to expand...
Click to collapse
"Borderline"???? More like certifiably insane! ?

[Tutorial] Camera2api ( Gcam ) Without ROOT

I dont take responsibility for possible damages!​'
1. When you unlock the bootloader, all your data will be erased!
2. When you try to lock the bootloader, your data will be erased and you will lose the API.
3. YOU CAN RECEIVE OTA UPDATES WITH THE BOOTLOADER UNLOCKED!​
Download the tool: https://forum.xda-developers.com/mi-a2/how-to/mi-a2-toolkit-unlock-bootloader-root-t3834585
1. Unlock the bootloader (I will not go into detail, the tool is intuitive, follow the tool's instructions!.)
2. Start your phone and enable USB debugging.
3. Put your cellphone in Fastboot.
4. In the tool, use option 4 (This will not install TWRP, just start) (follow the tool's instructions!)
5. When entering TWRP, if prompted, check "Keep system read only".
6. Open in the tool folder "Open CMD here"
7. Run the command: adb shell
8. Now enter the following command: "setprop persist.camera.HAL3.enabled 1" without quotation marks, and enter. - This command enables the required core API for GCAM.
9. Now type "exit" to exit adb.
10. Go back to the phone, in TWRP -> Reboot -> System -> Do Not Install
Ready.
I did this tutorial quickly. Any questions, use the comments!
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
kaiwanted said:
Just a note. That tool is working with August security patch, but a lot of us received already September Security patch. And how do you know that we will receive OTA. Did you test by yourself? And btw, looks very easy and clear explained. For now I will wait for stable patch from Xiaomi, and updated Tool from the link you recomended. Thank you.
Click to expand...
Click to collapse
The tool just has the August picture. But the functions used for the gcam works in the September patch.
Yes. I have.
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
asuturo said:
when i want to launch the TWRP, my device already plugged in and in fastboot mode, but it says "could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode". How to fix this? tks
Click to expand...
Click to collapse
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Rafaelboxer said:
I'm stuck at this too, i got the september update, already unlocked the bootloader but still can't install the twrp
"could not detect the active partition used, please ensure your phone is plugged in and in fastbook mode"
Click to expand...
Click to collapse
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
This command should tell you which slot is active:
fastboot getvar current-slot
ki69 said:
I think the September update change the active partition from A to B ( the August is A). Thats why it doesn´t work.
I´m also with September Update, and camera2api is the only thing i want to enable on Mi a2 ( don´t want to root and lose OTA) until a relliable TWRP is relleased.
Click to expand...
Click to collapse
I got the september boot.img from another topic and rooted
Still no working solution for the ones that have setember update, and don´t want to root or use magisk??? I think the problem is that TWRP does not work with september update. Any easy way to downgrade to August again??
I'm thinking of installing Camera2API/GCamera, but I wonder if it's worth it. What are the real benefits? Does this make the camera compatible with more applications (eg Snapchat), avoiding them from making a screen of the camera ?
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
ricardohnn said:
Hey guys i have some doubts.
I saw many threads saying to flash twrp into a partition (A or B) but i don't get why we have to flash it... So can someone clarify for me some stuff?
1 - fastboot boot twrp.img
I don't recall where the persist properties are stored but i believe it's not a partition that the OEM or google will constantly modify, right? So why making changes to the persist props in TWRP doesn't make it persist when booting into system? Is it possible to make it store it not temp?
Why there are people saying that flashing TWRP into, eg. part A, and booting into it, and then changing to part B, is working to enable the camera2 API? This should be the same as fastboot boot TWRP and then reboot it.
Click to expand...
Click to collapse
If you did a search on that 'persist' command, you'd find that it does persist, to many of the tables that type of information is stored in. It does not change the info in the properties file in 'System'. It does change the 'Data' partition, but that's okay, as there's only 1 of those (used no matters which slot boots up). The reason for booting on the non-active partition is a twrp / dual slot phone type of thing. I know it works as I've done it, but the 'setprop persist' changes the one and only Data partition, which both slots use, that's why it works.
ricardohnn said:
2 - As far as i remember, su permissions might be allowed in boot.img (.props file), so i thought that magisk patched image would have some su privilegies, but after booting from a patched image, su doesn't return anything. Does anyone knows what is the patched image from magisk? I heard about an app showing up after booting, so the patch is just a runnable with root?
Click to expand...
Click to collapse
I thought the patched image would have some su capabilities also, but it doesn't. It only installs the Magisk stub, which you can further install magisk from. Magisk is a great and sophisticated app. Has numerous Magisk modules which do a wide variety of things. But if you don't need any of those things, and don't need root, it's pretty over the top for just setting the cam2api, imho.
ricardohnn said:
3 - I also saw many threads changing sys build.prop directly. Horrible choice, but, does anyone knows if it possible to have a build.prop in OEM partition? From what i know, the build.prop will be concat. from all the folders related to the booting process. Has anyone tried to throw a build.prop into OEM with the persist enable? I believe that, since the folder is related to OEM only, and since we have no OEM making apps or whatever in an Android One phone, i think it is more safe than other partitions
Click to expand...
Click to collapse
If you change 'System' directly you will not get any OTA updates, so yer right, don't change that. There's no need to consider changing it anywhere else, as the 'setprop persist etc' command populates all the tables for you. 'System' is not affected and OTA updates will continue. There's no removing Magisk, restoring boot image, reinstalling etc etc etc.
One thing I would warn others about, using the various 'Tools'. You don't know what commands they are running, so you can't be sure what they will do. I say that because one of the tools I recently downloaded and went through and found the commands in it. The first thing it did after booting TWRP was to mount 'System' as Read / Write!! Why does that matter? From what I've read, doing that stops OTA from happening. Just mounting it R/W will change the date stamp on it concerning modifications, and that's all the OTA needs to know to say 'it's been modified'.
good luck, cheers
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
ricardohnn said:
Agree with the data persist, but why do you need to flash into the different partition and not only boot from it?
I don't disagree that it will work, i just want to know why not boot from fastboot directly instead of flashing into one of the backup partition. I know that fastboot boot command triggers different code than usual flow. But not that i remember that it would affect something.
Getprop | grep camera would return if enabled right? Or nope?
Click to expand...
Click to collapse
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
AsItLies said:
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
Click to expand...
Click to collapse
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
minnuss said:
I did manage to boot the last version of TWRP only first time, every other time ended in bootloops.
And I can sorry say that ADB did not work in booted TWRP, adb did not recognized the phone, so no commands could be typed.
For me, it is easier to flash patched_boot.img and install root temporarily, and then when job is done with activating camera2, uninstall root.
But hey, there are two easy ways, and everyone can choose which one is best suitable for them to try.
It would be of course easiest to just boot TWRP and enable camera2, but it doesn't work for now.
Click to expand...
Click to collapse
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
About the setprop, even after the reboot isn't returning the prop, so that's why i am not sure if it is actually keeping it after twrp boot.
About the AB partition... well...
it's more or less like this...
let's say some simple partition scheme....
Preloader
Boot
System
Vendor
ODM
Data
So the phone will probably have many boot images type... like the usual boot.img or recovery.img (before treble) etc.
The boot.img will have the kernel image bla bla bla... since this is a google update, i believe that the AB partition procedures starts here (meaning all the relevant code of checking whether is A or B)
Google wanted to make things faster for the OEM (Samsung, LG etc) so they wanted to separate their ****s from google's one.
So (if things didn't change) you will have the following partitions now (actually i am not sure if they kept the system AB, but i believe so, since it seems to be working in other phones like that )
BootA
BootB
SystemA
SystemB
VendorA
VendorB
OEMA
OEMB
Data
So let's say google wants to update some security patches, from kernel til android, it will have to update boot and system. So in a OTA (changes if it is a google phone or a branded phone) before treble, it would update like... download the image containing boot and system into cache partition or data partition (depending the OTA size), after the download the update manager apk would set as a update booting and reboot your phone. Once booted, the phone would copy the partitions to the correct place (not being detailed) and rereboot. After the rereboot, if everything went normal, it would delete the downloaded image from your data/cache partition.
Now it's different like... instead of sending the update to the data partition and copying. It has a flag to set whether you are in A or B partition.
If you are (for eg.) in A partition, it will download the OTA to the B partition. (consider that in an untouched phone, A and B would have identical copies). So after downloading it, the flag is set to the B partition and reboot the phone. When booting, this time, it will not follow the A booting flow, like...
Before the update booting process would be
BootA
SystemA
VendorA
ODMA
Data
After the update the boot process will be
BootB
SystemB
VendorB
ODMB
Data
But i didn't update the vendor or ODM... why not keep in A? Because it's too hard to manage it.
So if anything fails in this update, it can easily go back into A booting process (which means you have a backup of your old boot).
Since system is too big, i am not sure if the system AB exists (it would just take up too much space... but anyway...).
It is also not a way to prevent bootloop, it is related to update. If an update fails (say, the image is corrupted or has no signature etc) the boot will change back, but if the update is "correct" it will boot as it should, even if the image is bad.
So again... when we do the fastboot boot boot.img, we are copying this boot into some cache or data to boot up, instead of our original boot. When we reboot, it will use the original boot. So, is there a difference from using twrp flashed and booted?
I know that fastboot boot will trigger different booting process (meaning signatures verifying etc) but don't think that it will not mount a partition or something...
Well... anyway... so after the reboot, when you setprop in TWRP, the getprop returned the prop correctly? I recall something about getprop not returning the prop but camera2 was enabled anyway with the setprop... well... can you just confirm one thing for me?
The steps you used was... fastboot flash patchboot and then reboot into twrp and then reboot back to usual partition.
You didn't do fastboot boot patched boot -> twrp -> reboot
Right?
---------- Post added at 09:44 AM ---------- Previous post was at 09:42 AM ----------
AsItLies said:
Yes, just 'booting' twrp has been problems for everyone, "that" doesn't work (not just now, but probably never).
But, following the Guide I wrote, and 'flashing it' does work. Right Now.
Click to expand...
Click to collapse
Oh didn't see this one. OK...
Damn... hmm... strange... well thanks anyway...
---------- Post added at 09:50 AM ---------- Previous post was at 09:44 AM ----------
AsItLies said:
The dual partition thing is new to everyone, I only understand bits and pieces, like everyone. But we do know there's no more 'recovery' partition, like we use to know. And we also know the way the dual works is that when an update occurs, if the device then try's to boot it and fails, it will automagically switch to the previous partition and boot it. Pretty sure we also know that booting and flashing are different with dual slot devices, but I'm not 100% sure how different.
I've tried booting twrp and just ended in bootloops. And that may be because of diff versions of TWRP, or it may be because of basic code all TWRP's have, not sure. But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images.
I do know for sure I didn't want to brick my phone (duh). So when I found a Magisk install guide, mentioned in my Guide thread, they used TWRP to install it. It sounded like an authoritative guide to me, re the part of getting TWRP to work. So I used that just to be able to run the setprop commands. Worked perfectly. Having to use the other (non active) partition **may** have something to do with avoiding triggering any automatic code to switch partitions unnecessarily, not sure, but not going to experiment any further to find out
Again, do some research on that setprop command, one of the things you'll find is that it doesn't populate all the appropriate tables until 'after' the device has been rebooted. So doing a getprop directly after doing the setprop won't work, not until it's been rebooted.
cheers
Click to expand...
Click to collapse
Oh by the way, i saw one part
"But TWRP is a recovery, not a boot image with the proper kernel, like the patched boot images. "
I think this is wrong (at least if TWRP team didn't change stuff), but all images are bootable images... (by all images i mean... boot.img recovery.img Flashing.img).
I once thought that they used a common kernel image, but in fact, all the booting process image has the kernel image copied (literally) to prevent brick. So even with a corrupted boot img, you still can boot into recovery or into download mode.
So that's why TWRP must have a kernel.
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
AsItLies said:
@ricardohnn, you seem hell bent on getting twrp to boot. Good luck. Let me know how that works out for you. In the meantime I'll be enjoying my cam2api working
cheers
Click to expand...
Click to collapse
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
ricardohnn said:
Actually TWRP boots fine with fastboot boot...
ADB runs smooth, but it just won't keep.
But you've made me envy LOL
I will think about flashing... later...
Click to expand...
Click to collapse
What version of TWRP did you use, there is now two versions, I used last one, from a few days ago, and in first try I did manage to boot from fastboot, not flash it, but ADB did not worked.
So, if adb did work for you, maybe it was earlier version ?
Anyway, as you say, it is not permanent setprop, maybe because the twrp is not stable one, or maybe it needs to be flashed to work, not just booted.
I personally do not have doubts that this tutorial works, I just did not want to flash twrp. :good:

[Guide] Enable ADB on the stock OxygenOS recovery

Since we don't have TWRP yet for our 8T, having ADB enabled on the stock recovery can be really helpful if you are unlocked and rooted.
For example, removing problematic magisk modules.
I tried to install the EdExposed module and ended with a boot loop. To get back I had to flash the stock boot.img again and reconfigure all my modules again.
Having ADB enabled in OOS recovery will let us delete the problematic module at /data/adb/modules without having to delete the working modules.
Credit goes to @s3axel for the Post in Oneplus 8 forums
Quoting the procedure to create the modified recovery.img :
s3axel said:
Description of the method to modify recovery by yourself:
Prerequisites:
Android Image Kitchen (credit to osm0sis for providing this tool)
the original recovery image file (henceforth called "recovery.img"). You can extract this yourself from an update zip file by unpacking "payload.bin" and then use a tool like payload_dumper (credit to vm03 for providing this) to extract the recovery.img file
Now do the following:
unpack image with Image Kitchen --> this will create a "ramdisk" and a "Split_img" directory with the unpacked content within
navigate into the "ramdisk" folder and use a text editor (on windows preferably Notepad++) to edit the file "prop.default"
look for entry "ro.adb.secure" and change entry value from "1" to "0". Note this entry can occur multiple times (I noticed twice), change each --> this will prevent adb from asking for authorization (the recovery does not provide such a dialogue)
look for entry "ro.debuggable" and change this from "0" to "1" --> this actually enables ADB
look for entry "ro.secure" and change this from "1" to "0" --> may be unnecessary but I wanted to avoid brick in case a modified recovery would result in such a behavior
save textfile
repack the image with Android Image Kitchen and voila:
you have a new modified recovery image you can flash
Click to expand...
Click to collapse
Installation Procedure:
s3axel said:
Prerequisites:
Oneplus 8T
unlocked bootloader
access to fastboot on the phone
adb and fastboot
Installation:
Reboot the phone to fastboot, then flash the recovery from fastboot with the command
Code:
fastboot flash recovery <filename>
(with <filename> being the name of the recovery in the format of "recovery.img" you wish to flash)
Uninstall:
Same as installation, but flash the original stock recovery instead.
Usage:
Boot up recovery, enter the encryption key if the file system is encrypted. Then connect the phone to a PC and you are ready to go with adb. E.g. by using
Code:
adb shell
to open a shell and access the file system. Magisk modules are located in /data/adb/modules, deleting the corresponding directory there will remove the module in question.
Step-by-step this would be:
Code:
cd /data/adb/modules
to change to the Magisk modules directory
Code:
ls
to list the content of this directory, each module has its own directory, usually with a well-recognizable name
Code:
rm -r <directory>
to delete the directory in question. Tip: in console TAB-autocomplete works
Notes of caution:
ADB security is disabled as I could not get the recovery to allow for authorizing a connected computer. As a consequence, any computer connected is automatically authorized in ADB, although with an encrypted filesystem at least no data is accessible without the key.
with direct ADB access to your file system you can easily wreck you phone requiring a factory reset or even reinstallation of the OS from fastboot - please be careful about what you are doing
Credits: Thanks to osm0sis for Android kitchen and all great developers for the Oneplus devices.
Click to expand...
Click to collapse
Pre-patched files for the lazy (upto 11.0.4.5):
To find your model and build:
Code:
adb shell getprop ro.product.model
KB2001
adb shell getprop ro.build.version.ota
OnePlus8TOxygen_15.I.16_GLO_0160_2010150110
KB2000 / KB05?? - Chinese Variant
11.0.1.2 Hydrogen_15.H.16_OTA_0160_all_2010150101_4101
STOCK recovery.img
adb patched recovery
KB2001 / KB05DA - Indian Variant
11.0.1.2 - OnePlus8TOxygen_15.I.16_GLO_0160_2010150110
STOCK recovery.img
adb patched recovery
11.0.2.3 - OnePlus8TOxygen_15.I.17_OTA_0170_all_2010240047
STOCK recovery.img
adb patched recovery
11.0.3.4 - OnePlus8TOxygen_15.I.18_OTA_0180_all_2011010208
STOCK recovery.img
adb patched recovery
11.0.4.5 - OnePlus8TOxygen_15.I.19_OTA_0190_all_2011101438_3032f.zip
STOCK recovery.img
adb patched recovery
KB2003 / KB05BA - EU Variant
11.0.1.2 - OnePlus8TOxygen_15.E.17_GLO_0170_2010150108
STOCK recovery.img
adb patched recovery
11.0.2.3 - OnePlus8TOxygen_15.E.18_OTA_0180_all_2010240038
STOCK recovery.img
adb patched recovery
11.0.3.4 - OnePlus8TOxygen_15.E.19_OTA_0190_all_2011010157
STOCK recovery.img
adb patched recovery
11.0.4.5 - OnePlus8TOxygen_15.E.20_OTA_0200_all_2011101442_ed5dc.zip
STOCK recovery.img
adb patched recovery
KB2005 / KB05AA - International Variant thanks to @card13
https://drive.google.com/drive/folders/1-i4P8sWPfyqwgYvBsKWAAftQW7m66Z70?usp=sharing
KB2007 / KB05CB - T-Mobile Variant
¯\_(ツ)_/¯
Code:
❯ adb devices
List of devices attached
75317573 recovery
❯ adb shell
# df
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 3648448 40396 3608052 2% /
tmpfs 3837328 1160 3836168 1% /dev
tmpfs 3837328 0 3837328 0% /mnt
tmpfs 3837328 0 3837328 0% /apex
tmpfs 3837328 4 3837324 1% /linkerconfig
tmpfs 3837328 24 3837304 1% /tmp
/dev/block/sda11 491464 140484 350980 29% /mnt/vendor/op2
/dev/block/sda20 11760 164 11596 2% /metadata
/dev/block/dm-3 1516540 1511956 4584 100% /vendor
/dev/block/sda2 27632 10452 17180 38% /mnt/vendor/persist
/dev/block/dm-7 110397292 6627020 103770272 7% /data
I will edit this post over time with few notes/misc stuff.
For some reason, the only way we can boot into the recovery is to perform a fastboot flash.
Fastboot boot recovery.img does not seem to work and I have no idea why. (Even on stock recovery.img!!)
It just ends up in a black screen.
If someone could explain why it'll be great, cuz if we can just temporarily boot into the patched recovery, we can pull the boot.img files and provide root for all the variants of the 8T without waiting for a full OTA, with the below method:
Next, there *might* be a way to root other variants of 8T which do not have the full OTA zips
WARNING: I am NOT responsible if this does not work. you have been advised! This can render your recovery partition unusable until OnePlus releases full OTA ZIPs for all variants of the 8T!
Unlike boot.img, I was actually successful in flashing the EU KB2003 recovery.img on my Indian variant KB2001. running OOS 11.0.1.2.KB05DA
So I tried to flash the adb-patched recovery.img from the EU OTA into my Indian 8T and I was able to enter the adb shell as root!
Now I can easily get the image of all the partitions as well. Here's a snippet from my PC:
Code:
~/oss_stuff/Android-Image-Kitchen
❯ adb devices
List of devices attached
75317573 recovery
~/oss_stuff/Android-Image-Kitchen
❯ adb shell
# ls -al /dev/block/bootdevice/by-name/boo*
lrwxrwxrwx 1 root root 16 1970-01-03 04:30 /dev/block/bootdevice/by-name/boot_a -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 1970-01-03 04:30 /dev/block/bootdevice/by-name/boot_b -> /dev/block/sde35
Copy the active slot (b in my case) as boot.img to sdcard and reboot:
Code:
# dd if=/dev/block/bootdevice/by-name/boot_b of=/data/media/0/boot.img
196608+0 records in
196608+0 records out
100663296 bytes (96 M) copied, 0.247740 s, 388 M/s
# reboot
I am already rooted, so I am expecting magisk manager to detect a magisk patched bootimage.
And it did. Screenshot attached.
Again I AM NOT 100% SURE IF ALL THE VARIANTS CAN FLASH THE SAME RECOVERY.IMG.
Since there is no full OTA Available, if the patched recovery does not work you will have to wait for the full ZIP to be released to restore your recovery. You have been warned!
DroidFreak32 said:
I will edit this post over time with few notes/misc stuff.
For some reason, the only way we can boot into the recovery is to perform a fastboot flash.
Fastboot boot recovery.img does not seem to work and I have no idea why. (Even on stock recovery.img!!)
It just ends up in a black screen....
Click to expand...
Click to collapse
Sadly I have no real explanation either, but I had the same effect during my testing - I assumed it's related to some mechanism around the encryption of the partitions.
Cheers & thanks for continuing this for the 8T !
Sorry but I want to ask a noob question: can I use this method to adb sideload a FULL OTA zip via this recovery as currently when I'm trying to switch to EU OOS from IN OOS, the local upgrader says that I can't install an older version of OOS
dijia1124 said:
Sorry but I want to ask a noob question: can I use this method to adb sideload a FULL OTA zip via this recovery as currently when I'm trying to switch to EU OOS from IN OOS, the local upgrader says that I can't install an older version of OOS
Click to expand...
Click to collapse
No I don't think this recovery allows flashing in the first place.
DroidFreak32 said:
No I don't think this recovery allows flashing in the first place.
Click to expand...
Click to collapse
Well, first of all, nice of you to post this for everybody. I had did this following the same tutorial, my first day I received my phone itself, and I also encountered the same issue of unable to boot recovery img.
Btw, you are right. OnePlus disabled adb sideload in their A/B devices. I researched extensively and couldn't find a way to re-enable it.
Well, even if it was present, it will only allow zips with signed keys from OP to be flashed, so not a replacement for TWRP anyway.
As for flashing OP updates and other custom roms, you can use fastbootd.
@theincognito Did you ever figure out the reason why they disabled ADB and ADB Sideloading? And do you know if OnePlus has a workaround (new protocol or command to accomplish the same effect)?
card13 said:
@theincognito Did you ever figure out the reason why they disabled ADB and ADB Sideloading? And do you know if OnePlus has a workaround (new protocol or command to accomplish the same effect)?
Click to expand...
Click to collapse
First of all, ADB was there to facilitate ADB sideloading. Once sideloading went away, they removed ADB entirely.
As for removing sideloading, as far as I can understand, it started when they switched to A/B partition for their phones, because by default, A/B devices don't have a dedicated recovery partition(like Pixel/Android One phones). So they removed it.
However, from OnePlus 8, OnePlus brought back the dedicated recovery partition while still using A/B. So, now, if they want, they could bring back the sideloading, imo.
As for workaround, there are only 2 options: TWRP (or any custom recovery) and fastbootd.
You can flash stock roms via fastbootd, but that involves extracting the zip via payload and flashing the images individually. As for custom roms, from fastbootd, you can use "fastboot update <rom.zip>". As simple as that.
@theincognito Thank you for the info it is very, very informative and gives me a lot of ideas of what to try next!
@DroidFreak32 I uploaded all my Recovery files to my GDrive, along with all my rooting files. https://drive.google.com/drive/folders/1-i4P8sWPfyqwgYvBsKWAAftQW7m66Z70?usp=sharing
Hace latest ota 11.0.3.4 BA recovery modified and recovery stock?
---------- Post added at 01:23 AM ---------- Previous post was at 01:22 AM ----------
card13 said:
@theincognito Thank you for the info it is very, very informative and gives me a lot of ideas of what to try next!
@DroidFreak32 I uploaded all my Recovery files to my GDrive, along with all my rooting files. https://drive.google.com/drive/folders/1-i4P8sWPfyqwgYvBsKWAAftQW7m66Z70?usp=sharing
Click to expand...
Click to collapse
Have latest ota 11.0.3.4 BA recovery modified and recovery stock?
hmm. seems, they changed something with the adb rights in 11.0.3.4.
ls /data is also permitted.
(edit: i used adb-recovery to delete a magisk module previous on 11.0.2.3)
ChillDuder said:
hmm. seems, they changed something with the adb rights in 11.0.3.4.
ls /data is also permitted.
(edit: i used adb-recovery to delete a magisk module previous on 11.0.2.3)
Click to expand...
Click to collapse
It's working fine here
What's your 8t model?
Also updated the op with links for patched recovery from 11.0.3.4
DroidFreak32 said:
It's working fine here
What's your 8t model?
Also updated the op with links for patched recovery from 11.0.3.4
Click to expand...
Click to collapse
KB2003
Thank you. I'll flash again later. Maybe i did something wrong in the prop file.
if your device been rooted and grant su for adb shell, you can also use CMD to enter commands "
>adb shell
$su
#magisk --remove-modules
"to remove all modules and reboot;
others,you had to flash the stock boot.img again
hanajoruno said:
if your device been rooted and grant su for adb shell, you can also use CMD to enter commands "
>adb shell
$su
#magisk --remove-modules
"to remove all modules and reboot;
others,you had to flash the stock boot.img again
Click to expand...
Click to collapse
su in adb shell dont worked for me (su binary isnt installed from magisk)
but for whatever reason, i have to reboot normaly, and via advanced poweroff menu directly to recovery. then it worked flawless. weird. previous i reboot to fastboot and from there to recovery. seems that this maybe is a differnce.
Thank you! Thank you so much. I tried a risky module and it crashed my phone. I was so scared as I had a lot of important data which I didn't backup. I followed your guide and I was able to remove the module and boot properly. I just can't thank you enough. You saved my life.
@liver20 No I am still on 11.0.1.2 since I haven't had time this week (life loves to get in the way) to unroot -> Apply Incremental OTA update file -> re-root.
I'm getting the black screen even after flashing the recovery. I can get into adb but have no way of decrypting? I am not able to enter my pattern. Am I missing something here?
xDanVitox said:
I'm getting the black screen even after flashing the recovery. I can get into adb but have no way of decrypting? I am not able to enter my pattern. Am I missing something here?
Click to expand...
Click to collapse
What's your oos build and 8t variant?
Have you tried manualy patching the recovery image yourself from your oos build instead of using the patched images by me?
DroidFreak32 said:
What's your oos build and 8t variant?
Have you tried manualy patching the recovery image yourself from your oos build instead of using the patched images by me?
Click to expand...
Click to collapse
I'm on 11.0.4.5 - KB2005
I did, yes. I used the broken TWRP to pull the recovery off of my phone and patched that. I tried using the one from unpacked kebab image as well. Tried booting and flashing and both give the same result. They both "work" but result in blank screen. Flashing back my backup original copy from my phone returns normal function.
Am I supposed to be seeing my pattern input the same as stock?
And thanks for the response!

Categories

Resources