100003562 Onn 10.1 Android 11 (Bootloader Unlock, Magisk Root) - Walmart Onn Tablets General

Hey folks I spent some time working on this yesterday (dumping Rom, Patching etc) so I thought I'd share. I am including the files I used to get this work.
This is for 100003562 Walmart Onn Tablet
I can't comment on other Onn models because I don't have any.
If your tablet goes into meltdown mode, I'm not responsible. I'm sharing the process that worked for me.
*These files are from:
*Android 11, Security Update 5AUG21 --> They probably won't work with any other version so I can't answer questions related to using them for that.
I don't recommend you try these on any other model unless you do it at you own risk.
*Strangely enough, this update doesn't have any of the Walmart apps installed or the bottom button on the taskbar. It asks if you want to install them when you are setting up the tablet*
I chose no.
Steps:
1. Enable USB Debugging, (while in Dev Options go to OEM Unlocking a tick that, (don't know if 100% necessary but I did it in my process)
and fire up a CMD or Powershell Window.
2. ADB:
adb devices (to make sure you are connected)
adb reboot bootloader
~boots to bootloader~
3. FASTBOOT
fastboot devices (to make sure you are connected)
(WARNING: the next command will factory reset the tablet)
fastboot flashing unlock
(follow volume key prompt to unlock and then device will reboot and bootloader is unlocked.)
You will see "orange state" as it boots if it worked properly. I don't have any interest in removing this message so you'll have to go elsewhere if you do.
4. Repeat steps 1-2 and get back into bootloader.
FASTBOOT:
fastboot devices
fastboot flash vbmeta <path to vbmeta.img>
fastboot flash boot <path to migisk patched.img>
fastboot reboot
5. Done
Notes:
I use Magisk Manager to do a direct install patch after I get root. (also don't know if 100% necessary, but it makes me feel better)
I'm including the stock boot.img in case you want to create your own patch with Magisk Manager. I used 24.1 (24100)
I'll answer what I can if you run into issues.
Cheers!

Reserved.

hey i was actually just about to go into the rabbit hole of pulling the boot.img, then i saw this. my tablet is stuck on the 5jan21 patch and wont update. could you tell me how you dumped the rom? also did you have to modify the vbmeta file? thanks

Mayday_Channel said:
hey i was actually just about to go into the rabbit hole of pulling the boot.img, then i saw this. my tablet is stuck on the 5jan21 patch and wont update. could you tell me how you dumped the rom? also did you have to modify the vbmeta file? thanks
Click to expand...
Click to collapse
i used sp flash and wwr. you can prob pull the boot.img pretty easily, but if you tried to take an OTA and it got corrupted, that might not work anyway. the vbmeta an empty one. this boot.img is from the most up to date ota which i got yesterday. i ordered a refurb version of this tablet and started messing with it yesterday. i have a copy of the full ROM dump as well. let me know if you need pieces and I can get them to you. you might be able to flash a few of the partitions and get it running again. can you get into fastboot?

which sp flash version? im on the latest 5.2152, every time i try to dump the full rom, it hangs on 0% readback. same with trying the boot.img. what was the full rom length, just to confirm? i got 0x750000000 from wwr

Mayday_Channel said:
which sp flash version? im on the latest 5.2152, every time i try to dump the full rom, it hangs on 0% readback. same with trying the boot.img. what was the full rom length, just to confirm? i got 0x750000000 from wwr
Click to expand...
Click to collapse
I used 5.1524. i had this issue as well and had to update the com port drivers. i used Iobit driver booster for this and it found the right driver. and yes thats the correct length for the one i dumped. i have the full thing on mega if you just want to flash it with sp flash tool.

that would be very nice. please post. thank you

Mayday_Channel said:
that would be very nice. please post. thank you
Click to expand...
Click to collapse
File folder on MEGA
mega.nz

goldensun1893 said:
File folder on MEGA
mega.nz
Click to expand...
Click to collapse
i got rid of userdata and cache to shrink it some.

thanks man

Mayday_Channel said:
thanks man
Click to expand...
Click to collapse
let me know how it works

could i please get the cache & userdata partitions? id like to keep a complete rom for archive. it seems to have flashed ok, but it broke wifi and its still stuck on january 5 patch. oh well, thats why i have 2 of these

ill drop them on there. be warned the userdata.img is something like 28GB. If you have the NV RAM Warning: ERR 0x10, there are a few tuts on here to fix that. Its common with SP Flash and MTK chips.

I think I figured out why it doesn't work. Spft isn't flashing super.img. even if I edit the scatter file to add super.img. I'll do some more trouble shooting at lunch

alright lets goooo. fixed it. just needed to change a few things in the scatter file and change the vbmeta files to img. next ill start experimenting on patching lk.bin to remove the ORANGE STATE text. thanks for the rom dump

NICE! I took a leap of faith and did this on my Oct 5th 2021 Security update build and it appears to have worked and Im rooted with magisk!!! I added a few additional steps to your commands just in case
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot erase cache
fastboot flash boot magisk_patched-24100_w97F6.img
fastboot reboot
I found a USB ADB fastboot driver that was signed and worked on my windows 10 x64 system but I had to go through the "Have Disk" manual driver install and installed even though it wasnt supposedly designed for my hardware. So insane the hoops to do this...
MT65XX-USB-VCOM-drivers\MT65XX USB VCOM drivers\Google_USB_Driver_rev4
Had trouble updating to Magisk to 24.3 however, not sure what pitfall I hit.
Wondering if I should be happy with root or try and flash TWRP and try a different ROM.

Iam in need of some help i am not sure if i have to install something to the tablet or pc but when i do the command "fastboot flashing devices" on my tablet just says on the bottom left =>FASTBOOT mode... and it doesnt change and on my pc it says <waiting for device> idk what am doing wrong can someone help me

beachmiles said:
NICE! I took a leap of faith and did this on my Oct 5th 2021 Security update build and it appears to have worked and Im rooted with magisk!!! I added a few additional steps to your commands just in case
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot erase cache
fastboot flash boot magisk_patched-24100_w97F6.img
fastboot reboot
I found a USB ADB fastboot driver that was signed and worked on my windows 10 x64 system but I had to go through the "Have Disk" manual driver install and installed even though it wasnt supposedly designed for my hardware. So insane the hoops to do this...
MT65XX-USB-VCOM-drivers\MT65XX USB VCOM drivers\Google_USB_Driver_rev4
Had trouble updating to Magisk to 24.3 however, not sure what pitfall I hit.
Wondering if I should be happy with root or try and flash TWRP and try a different ROM.
Click to expand...
Click to collapse
Followed the same steps and managed to get it working on my tablet that was on the same secpatch. However I also ran into an issue updating magisk. It acts like it worked fine and then when it reboots it asks to patch again.

Had to patch boot file manually and flash via fastboot. Still get an annoying popup when opening magisk but it's now updated to the latest 25.0.
To update run the following:
Root using ops method
Start your device and make sure that everything is rooted and working
adb reboot bootloader
fastboot flash boot [PATH TO MAGISK PATCHED 25000]
fastboot reboot
Tested on Oct521 SecPatch on a devices already rooted with OPs method. Do this at your own risk. Make backups, etc etc.​

hi nice work. sorry for my english. but i have a problem on mi onn tablet 1000035652 android 11. i try to root whit our method on fastboot no problem the tablet is unlock a message appears of the erase all data if unlock bootloader and press up volume then restart tablet so configure again and proced to fourt 4 point to flash vbdata and boot and in fastboot window okay flash then reboot and the tablet power on to the config screen then appear a message of controller apps stop then reboot and reboot infinite loop and i try to lock bootloader gain or reflash boot.img stock but no solution and i search for a alast update.zip or way to reinstal stock firmware can anyone help me ?

Related

Root & TWRP!

Note: I am no expert at this. I used this to get TWRP and root, but it there is no guarentee it won't brick your phone. Only do this if you know what your doing. Before you start you must have an unlocked bootloader, which will delete all your data. Here's the instructions (If you need help, feel free to post a comment):
Download Magisk's installer zip on your phone from https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 (Google Pay only works with Magisk v19.0+)
Download arter97's kernel .img to your PC. This kernel currently is the only reliable way to get TWRP. https://forum.xda-developers.com/razer-phone-2/development/arter97-kernel-razer-phone-2-t3914996
Reboot your phone into bootloader mode (Turn off then back on while holding vol down).
Make sure your phone is recognized by Windows before proceeding. Follow this guide to setup the proper drivers and fastboot.
Flash arter97's kernel by running
Code:
fastboot flash boot arter97-kernel-*.img
If you run into any issues, then you will probably need to specify the slot to flash. Reboot back into your system.
Turn on Android Debugging and run
Code:
adb shell getprop ro.boot.slot_suffix
and make note if the output is _a or _b
Reboot back into bootloader
If _a use
Code:
fastboot flash boot_a arter97-kernel-*.img
if _b use
Code:
fastboot flash boot_b arter97-kernel-*.img
Reboot to recovery (either through bootloader mode or hold vol up while rebooting).
Install the Magisk .zip from TWRP.
Be amazed by the possibilities.
Old instructions (Should always work to get root):
Download the factory image from here: https://developer.razer.com/razer-phone-dev-tools/
Extract and copy the boot.img file to your device
Download and install Magisk Manager. If you have an SD card make sure it's installed on your internal storage, not the SD card.
Tap install, select Patch Boot Image File, and select the boot.img (If using the default file manager click the overflow menu and show internal storage)
Copy the patched_boot.img back over to your PC
Flash the patched_boot.img to your device via fastboot (Turn off then back on while holding vol down) and run
Code:
fastboot flash boot patched_boot.img
.
If you run into any issues, then you will need to specify the slot to flash.
Turn on Android Debugging and run
Code:
adb shell getprop ro.boot.slot_suffix
and make note if the output is _a or _b
Reboot back into bootloader
If _a use
Code:
fastboot flash boot_a patched_boot.img
if _b use
Code:
fastboot flash boot_b patched_boot.img
Reboot, and open up magisk manager to confirm everything is working. After an OTA update you may have to re-apply due to it using a different slot.
Note: the phone wasn't properly recognized by my computer when in bootloader mode so I had to install the Google adb drivers and manually set the driver used to Google Bootloader Interface (or something like that)
I found you needed to specify boot_a or boot_b specifically as the bootloader tended to mess up the suffix(it tried "bootb_b"????). So I had to first run "fastboot getvar all" to check the current slot.
I also found the commands are executed much more reliably if you enter the command first and press enter so fastboot goes into the "waiting for device" state and then boot into the bootloader and afterwards plug in the cable so fastboot executes the command as soon as it connects.
figured itd be as easy as that. this will be my first up to date device in years, att sending it to me in the mail. should get it by the 6th . but glad to see theres root! hopefully lineage to follow <3
Twiggy000b said:
figured itd be as easy as that. this will be my first up to date device in years, att sending it to me in the mail. should get it by the 6th . but glad to see theres root! hopefully lineage to follow <3
Click to expand...
Click to collapse
I know the feeling, my last device was the Nexus 5
my last "decent" device was the essential phone. then i went to the xperia xa2 ultra, then the iphone 6 then.... zte quest. -.-
CurtisMJ said:
I found you needed to specify boot_a or boot_b specifically as the bootloader tended to mess up the suffix(it tried "bootb_b"????). So I had to first run "fastboot getvar all" to check the current slot.
I also found the commands are executed much more reliably if you enter the command first and press enter so fastboot goes into the "waiting for device" state and then boot into the bootloader and afterwards plug in the cable so fastboot executes the command as soon as it connects.
Click to expand...
Click to collapse
Lol, bootb_b:laugh:. For me at least it worked fine without specifying the slot, though I may change the instructions to specify the slot
CalebQ42 said:
With the release of the factory images we can achieve root via Magisk boot image patching. Note: I am no expert at this. I used this to achieve root, but it there is no guarentee it won't brick your phone. Only do this if you know what your doing. Before you start you must have an unlocked bootloader. Here's the instructions (If you need help, feel free to post a comment):
Download the factory image from here: https://developer.razer.com/razer-phone-dev-tools/
Extract and copy the boot.img file to your device
Download and install Magisk Manager. If you have an SD card make sure it's installed on your internal storage, not the SD card.
Tap install, select Patch Boot Image File, and select the boot.img (If using the default file manager click the overflow menu and show internal storage)
Copy the patched_boot.img back over to your PC
Flash the patched_boot.img to your device via fastboot (Turn off then back on while holding vol down and run `fastboot flash boot patched_boot.img`.
Reboot, and open up magisk manager to confirm everything is working.
Note: the phone wasn't properly recognized by my computer so I had to install the Google adb drivers and manually set the driver to Google Bootloader interface (or something like that)
I also tried to install some Android Pie GSIs, but none of them worked.
Click to expand...
Click to collapse
Does this destroy all data? Do I need to unlock bootloader? Does it matter where I place the boot.img on my device?
CalebQ42 said:
Lol, bootb_b:laugh:. For me at least it worked fine without specifying the slot, though I may change the instructions to specify the slot
Click to expand...
Click to collapse
Interesting. The bootloader isn't exactly what I'd call a masterpiece of coding (weird cause I still maintain the ROM is excellent) so it might have just been a momentary glitch.
---------- Post added at 10:54 PM ---------- Previous post was at 10:53 PM ----------
ctakah27 said:
Does this destroy all data? Do I need to unlock bootloader? Does it matter where I place the boot.img on my device?
Click to expand...
Click to collapse
Yes, yes and not really (you get a file chooser so you just need to locate it)
I updated the post a bit with instructions on how to flash to a specific slot.
Tonight I'm going to try compiling TWRP for the first time ever (unless someone beats me to in). Wish me luck!
CalebQ42 said:
I updated the post a bit with instructions on how to flash to a specific slot.
Tonight I'm going to try compiling TWRP for the first time ever (unless someone beats me to in). Wish me luck!
Click to expand...
Click to collapse
Good luck it's a easier process compare to years ago. I would do it but I have no need for root or custom recovery. If you fail on the TWRP I will do it in time for people.
Is this working on the AT&T version of this phone? Or would you need to flash the global firmware in order for this to work? Looking to upgrade to this phone and I want to be sure I can get root. The rest looks to be coming fairly quickly.
CalebQ42 said:
I updated the post a bit with instructions on how to flash to a specific slot.
Tonight I'm going to try compiling TWRP for the first time ever (unless someone beats me to in). Wish me luck!
Click to expand...
Click to collapse
jonchance_84 said:
Is this working on the AT&T version of this phone? Or would you need to flash the global firmware in order for this to work? Looking to upgrade to this phone and I want to be sure I can get root. The rest looks to be coming fairly quickly.
Click to expand...
Click to collapse
They have the image for AT&T
EAIaIQobChMIwYzbk7j_3gIVRZRpCh0RMwdoEAEYASAAEgLPifD_BwE
Warrior1988 said:
They have the image for AT&T
EAIaIQobChMIwYzbk7j_3gIVRZRpCh0RMwdoEAEYASAAEgLPifD_BwE
Click to expand...
Click to collapse
I see the separate firmware. I'm only asking because of past shadyness from AT&T trying to tell manufacturers what to do. Years ago on my Xperia x10, if on AT&T firmware, you needed to flash the global generic firmware to get around their crap.
CalebQ42 said:
With the release of the factory images we can achieve root via Magisk boot image patching. Note: I am no expert at this. I used this to achieve root, but it there is no guarentee it won't brick your phone. Only do this if you know what your doing. Before you start you must have an unlocked bootloader, which will delete all your data. Here's the instructions (If you need help, feel free to post a comment):
Download the factory image from here: https://developer.razer.com/razer-phone-dev-tools/
Extract and copy the boot.img file to your device
Download and install Magisk Manager. If you have an SD card make sure it's installed on your internal storage, not the SD card.
Tap install, select Patch Boot Image File, and select the boot.img (If using the default file manager click the overflow menu and show internal storage)
Copy the patched_boot.img back over to your PC
Flash the patched_boot.img to your device via fastboot (Turn off then back on while holding vol down) and run
Code:
fastboot flash boot patched_boot.img
.
If you run into any issues, then you will need to specify the slot to flash.
Turn on Android Debugging and run
Code:
adb shell getprop ro.boot.slot_suffix
and make note if the output is _a or _b
Reboot back into bootloader
If _a use
Code:
fastboot flash boot_a patched_boot.img
if _b use
Code:
fastboot flash boot_b patched_boot.img
Reboot, and open up magisk manager to confirm everything is working. After an OTA update you may have to re-apply due to it using a different slot.
Note: the phone wasn't properly recognized by my computer so I had to install the Google adb drivers and manually set the driver to Google Bootloader interface (or something like that)
I also tried to install some Android Pie GSIs, but none of them worked.
Click to expand...
Click to collapse
Would this procedure be the same as far as mac/win?
I understand all of that, I am simply asking if someone has tried this with the AT&T variant yet. I want to know before I go order this phone.
I love a rooted phone, but as far as I know, if you unlock the bootloader, Netflix will no longer work in HD mode. To me, this is a deal-breaker. If anyone knows about a work-around, I'd love to know.
Razer phone 2 root
so im kinda new to rooting this type of phone and to the android boot scheme in general. i have a razer phone 2 and have attempted (febaly) to root it using this meathod. after installing the google adb drivers i was unable to see the device from my pc when it was in fastboot and unable to send commands, after installing the drivers again with windows update it ran even though no device was detected with this message
">fastboot flash boot patched_boot.img
Sending 'boot_b' (19268 KB) OKAY [ 0.523s]
Writing 'boot_b' OKAY [ 0.179s]
Finished. Total time: 0.718s"
it then blackscreened, i then tried a factory reset from recovery, and it is now in a bootloop... any advice?
update: no longer in boot loop but now is full blackscreen after a glitchy install screen
andy1011 said:
so im kinda new to rooting this type of phone and to the android boot scheme in general. i have a razer phone 2 and have attempted (febaly) to root it using this meathod. after installing the google adb drivers i was unable to see the device from my pc when it was in fastboot and unable to send commands, after installing the drivers again with windows update it ran even though no device was detected with this message
">fastboot flash boot patched_boot.img
Sending 'boot_b' (19268 KB) OKAY [ 0.523s]
Writing 'boot_b' OKAY [ 0.179s]
Finished. Total time: 0.718s"
it then blackscreened, i then tried a factory reset from recovery, and it is now in a bootloop... any advice?
update: no longer in boot loop but now is full blackscreen after a glitchy install screen
Click to expand...
Click to collapse
Since it's already wiped the easiest way to fix it is to probably flash the full factory image. Did you happen to update to the MR2 update prior to following this guide? Doing this on MR2 will soft brick. Not entirely sure in what way, but I assume it would be similar to what you experienced. If you were still on MR0 you can actually just fastboot flash the original kernel image to fix it. I just finished rooting MR2 so I'll post that next
CurtisMJ said:
Since it's already wiped the easiest way to fix it is to probably flash the full factory image. Did you happen to update to the MR2 update prior to following this guide? Doing this on MR2 will soft brick. Not entirely sure in what way, but I assume it would be similar to what you experienced. If you were still on MR0 you can actually just fastboot flash the original kernel image to fix it. I just finished rooting MR2 so I'll post that next
Click to expand...
Click to collapse
this is what im trying to do. however i have no way of flashing to the device as adb is unable to see the device.
andy1011 said:
this is what im trying to do. however i have no way of flashing to the device as adb is unable to see the device.
Click to expand...
Click to collapse
Adb and fastboot are separate things. You should only need download mode and fastboot. What are you trying to use ADB for? If in doubt, the guide on Razer's website should be quite sufficient
EDIT: You can get to download mode by holding Vol Down and Power Button while the device is off. You can force reboot by holding down power for approx 15s as well

[Root][Oreo][Guide] How to flash and root G5 with (opt. remove encryption)

Hello guys,
after testing around for days i thought it might be helpfull to post the honestly pretty easy procedure to install stock Oreo, root it and remove encryption if needed.
Disclaimer:
I am not responsible for bricked devices, dead SD-cards, lost data, etc.
Back up your data, app settings, be sure you remember your passwords, your device will be empty!​
Edit: It seems, theres a bug that, if you read this post on XDA labs, won't show you everything, it seems like it randomly skips some parts.
What you need:
Unlocked Bootloader
Motorola USB drivers
15 sec adb and fastboot uploaded by myself since the original links aren't working anymore https://multifilemirror.com/hgxxyrfyd7rx.
I originally got them from here (you may have to go into your device manager and select the adb drivers for your phone f.e. when you want to use adb push in recovery, see original xda site).
This will also install the google drivers.
TWRP 32bit (v.3.2.3-0)
TWRP 64bit (v.3.2.1-0)
Disable Dm-Verity & ForceEncrypt from here
Magisk and MagiskManager. Newest should probably work, i used Magisk-18.0 and MagiskManager-6.1.0
Most recent Oreo firmware (edit 08.19)
(I used this Oreo firmware found in this post)
Steps:
Be sure you backed up your data and app settings, your pictures, downloads, etc. It will all be lost!
Please read all steps before you begin.
Extract the firmware into your adb folder (where you installed adb, should contain 4 files), copy both twrp (32 & 64 bit) in there, too.
Boot into bootloader (hold power+vol down) and open a terminal inside your adb folder (shift+rightclick) and type in
Code:
fastboot flash recovery name_of_twrp64bit_file.img
Boot into recovery (select recovery with vol buttons, then press power) and make a backup of EFS partition and persist folder (use file manager under advanced) and make another backup of system, boot and data and save both backups and persist to your SD-card or better your computer, too.
reboot into bootloader and check if your bootloader version is B.8.31 or above.
If it is B.8.31 or above DON'T FLASH BOOTLOADER!!! Because if you flash bootloader of the same version or below, it would hardbrick your device!
That also means if you f.e. want to downgrade to Nougat, just ignore following lines:
Code:
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
Also, unless youre sure your persist is absolutly ok (check here), please also omit the following lines:
Code:
fastboot erase modemst1
fastboot erase modemst2
They would reset your IMEI and usually it gets restored from your persist, but only if its not buggy.
Even if your persist is fine, as far as i know theres no harm in not using this commands (my persist is fine and i didnt use them).
Now paste following commands in your command promt in adb, in case you are BELOW B.8.31, add the bootloader commands from above between the first and second line:
Code:
fastboot oem fb_mode_set
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash dsp adspso.bin
fastboot flash oem oem.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase userdata
fastboot erase customize
fastboot erase clogo
fastboot oem fb_mode_clear
fastboot reboot
Please make sure that it really flashed all sparsechunk 0-8.
Let your phone reboot itself after installation is done, then return to bootloader and flash twrp 64bit:
Code:
fastboot flash recovery name_of_twrp64bit_file.img
Boot into recovery, since your device is encrypted it will ask for a password, click cancel, then go to WIPE and click on FORMAT DATA and confirm with yes.
This will remove the encryption of your data partition.
Go back to twrp main page and click on REBOOT then RECOVERY.
Once back in twrp, either copy Disable Disable_Dm-Verity_ForceEncrypt.zip and Magisk-18.zip and MagiskManager-6.1.apk to your SD-card or use
Code:
adb push name_of_file /external_sd
or
adb push name_of_file /sdcard
to copy the files to your SD-card (external_sd) or Internal-Storage (sdcard). For this you may have to manually configure your adb drivers in device manager, see here under Notes.
In twrp go now to INSTALL and flash "disable-dm-verity&encrypt" an then REBOOT and SYSTEM.
Return to recovery and flash "Magisk-18.0.zip", wipe Cache/Dalvik at the end and reboot System
Once System has rebooted, install MagiskManager-6.1.0.apk from your SD-card.
MagiskManager should say that Magisk is installed and in settings under security, your phone should be decrypted.
Note: MagiskManager will only show full information when it has internet access, all you see without is if Magisk is installed.
If you want to encrypt your device again, do it but flash twrp 32bit, too, if it asks for a password, it should be your usual password which you also have to enter on every boot.
Some explanation:
Why twrp 64bit?
Because twrp 32bit is able to bypass encryption, however, it causes some problems:
In fact, probably every twrp without the bypass encryption feature would work f.e. older 32bit version 3.1.0. but 64bit offers some features as EFS backup.
If you flash 32bit directly it can bypass the standard encryption but formatting data fails every time when you booted System previously.
When you reboot recovery and format data again it works, but it needs to fail first, just rebooting into recovery 2 times doesnt work.
I dont know what would happen if you (after using your phone normally) reboot recovery and f.e. want to do a backup from data, though im sure i testet it out, but i probably forgot.
You need it later when you want to encrypt your phone again, for me it didnt decrypt data after i reencrypted my phone using my password.
Why reboot System between flashing Disable-encryption and Magisk?
If you do not, you get heavy lags in the first 2 minutes after rebooting System, MagiskManager will say that Magisk isnt installed and then your phone will crash and reboot. But after that 2. reboot everything works fine again, Magisk is back, no lags.
I remembered this post from Johny Cipeli, between flashing no-verity and magisk he wrote to reboot, so i tried and it worked without lags and crash.
You don't need to remove encryption:
You can root your phone without flashing Disable_dm-verity_and_force-encrypt, use then twrp 32bit, dont format data, just flash magisk.
I can say that it should work, because that was one of my first attempts (and it worked for me), however i didnt write down what i was doing so i cant tell you step by step.
Additional:
In case you're searching Viper4Arise for Oreo, the Aroma installer won't work, use the Magisk module and install in MagiskManager. You can download it here from Zackptg5
If youre also annoyed by that One-Nav vibration, you can try using ExKernelManager app and activate the powersave mode. Although i think its officially not for G5, the app works, maybe that only refers to the Kernel and not to the app.
I tried Flyhigh Kernel, it didnt boot after flashing it, if you know a working Kernel for G5 which can disable One-Nav vibration, please write an answer.
My device:
Rooted Stock Oreo 8.1.0: OPP28.85-16
Bootloader: B.8.31
Model: XT1676 reteu
Stock Kernel
Thanks to:
Snoop05 for 15 sec adb and fastboot.
TheFixItMan for twrp.
Zackptg5 for "Universal DM-Verity, ForceEncrypt, Disk Quota Disablers".
topjohnwu for Magisk.
freeZbies for Official Oreo 8.1.0 OPP28.85-16 Fastboot Firmware.
Wolfcity, woozie.2007 and TheFixItMan for answering many of my questions!
- reserved -
ok friend, thank you for this. I think you dont need to flash twrp 64, i only flash official twrp 32, which indeed doesnt have the option for backup persist, but only efs. Maybe is someone else that will try your method to decrypt, I will try next time when I flash the stock, maybe to the next patch update. Good luck and A happy new year !!!
---------- Post added at 01:31 AM ---------- Previous post was at 01:26 AM ----------
LE: You cant root without format data partition, because flashing twrp, when twrp decrypt data you cant see anything on data partition, so you need to format it even if dont need to decrypt the phone
Nice guide @G5-User7080 .
For me everything seems to be correct, I can´t say anything device specific as I own a potter but there shouldn´t be big differences.
There´s one sentence I´m not sure about:
G5-User7080 said:
Because if you flash bootloader of the same version or below, it would hardbrick your device!
That also means if you f.e. want to downgrade to Nougat, just ignore following lines.....
Click to expand...
Click to collapse
It´s clear that downgrading the bootloader can hardbrick your device but why should there be any risk in flashing the same bootloader?
If I flash the fastboot firmware I´m on shouldn´t it be ok? Where did you get that information from?
I´m about to do that on a device of a friend of mine , he is rooted on 7.0 and wants to go the way to flash the firmware he´s on and after that take the OTA up to Oreo.
He could flash the Oreo firmware directly but he prefers to use the firmware from which he knows it´s working and is the correct one.
Very careful guy.
Edit: I just recognized that the part you called steps incl.the part I quoted isn't visible in XDA Labs, I'm only able to see it in mobile browser. Also some download links aren't there, on XDA Labs there is only the one for the 64bit recovery visible, not the one for 32bit. Maybe it's some kind of format problem, bb codes or else.
Some screenshots from XDA Labs and Chrome mobile to show the differences.
Wolfcity said:
It´s clear that downgrading the bootloader can hardbrick your device but why should there be any risk in flashing the same bootloader?
If I flash the fastboot firmware I´m on shouldn´t it be ok? Where did you get that information from?
Click to expand...
Click to collapse
I read this more then one time, although i could just find one source for now: "Flashing bootloader of equal or minor version will hardbrick your device" from Oreo Fastboot firmware.
I dont know why flashing bootloader of the same version would do lead to a hardbrick, but didnt want to try it out myself, also i see no problem in not flashing the bootloader when you already have the same version.
Wolfcity said:
Edit: I just recognized that the part you called steps incl.the part I quoted isn't visible in XDA Labs, I'm only able to see it in mobile browser. Also some download links aren't there, on XDA Labs there is only the one for the 64bit recovery visible, not the one for 32bit. Maybe it's some kind of format problem, bb codes or else.
Click to expand...
Click to collapse
Thats weird, i dont have XDA labs (thats the mobile app, right?), i wrote it on XDA desktop version and only used the size, code, color and list tags, hmm maybe it has problems with the sorted list, for every other part i used the unsorted ones with dots instead of numbers.
Quick test:
Test One:
this is made
in an unordered
list, using
list tags
Test Two:
this is now made
in an ordered list
counting from one to four
using list=1 tags
Can you read both lists with each four points?
And thanks for mentioning the bootloader thing,.. i realized i forgot to paste the lines in to flash bootloader in case you are below b8.31 ehee..
Wolfcity said:
Some screenshots from XDA Labs and Chrome mobile to show the differences.
Click to expand...
Click to collapse
wtf, it just skips random parts ?!!!
I have no idea what could cause this.. ill better add a note at the beginning of the post...wow
To flash the same vers of bootloader is not a problem, only the below one will hardbrick the phone
G5-User7080 said:
wtf, it just skips random parts ?!!!
I have no idea what could cause this.. ill better add a note at the beginning of the post...wow
Click to expand...
Click to collapse
Your lists are both readable.
I took a look at the BB codes as it's known that some of them are not working on XDA Labs like SIZE or HIGHLIGHT. In that case the BB codes are shown in the text but there's nothing missing.
Maybe it has something to do with the use of
[*] in your text?
Edit: Have you changed something in your text now? It seems to be complete on XDA Labs now too...
Wolfcity said:
Your lists are both readable.
I took a look at the BB codes as it's known that some of them are not working on XDA Labs like SIZE or HIGHLIGHT. In that case the BB codes are shown in the text but there's nothing missing.
Maybe it has something to do with the use of
[*] in your text?
Edit: Have you changed something in your text now? It seems to be complete on XDA Labs now too...
Click to expand...
Click to collapse
the [*] just create new lines for a list, and yes, i edited it two times, first, i added that one should use the bootloader commands in case of being below b831 and then i added the info about missing things on xda labs, but i didnt change anything on the lists itself,...

(GUIDE) Root Onn 8 Gen 2 100011885

Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
LaikaXv1 said:
Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Click to expand...
Click to collapse
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
I'm glad to see that there is finally a root solution for this device. I have 2 Onn 8 first gen, Android 9 tablets and I use the Magisk module: Universal SafetyNet Fix to
pass.
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Let us all know if this works. I work in a Walmart electronics department and have not bought one of the 2nd gen devices because I had assumed that it could not be rooted. I am temped just for a new challenge, even though I really don't need a new device.
Have you been able to create a backup of the stock rom? Is it flashed with spflashtool like the older device?
Thanks
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
Ah, I didn't hit reply. Oops!
I'm not new to XDA persay, but I'm not usually the one making guides and actually saying things haha.
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Boox17 said:
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Click to expand...
Click to collapse
It sounds like maybe you did not unlock the bootloader first?
martyfender said:
It sounds like maybe you did not unlock the bootloader first?
Click to expand...
Click to collapse
Yeah exactly what it was
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
I'm stuck in a boot loop. Does this work with a 100011885 that has Android 11 or did I just brick it cause I didn't pay attention.
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
bowb said:
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
Click to expand...
Click to collapse
Did you get this working?
Valiante said:
Did you get this working?
Click to expand...
Click to collapse
No.
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
did you happen to upload this image yet? if so, got a link?
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
pj_dev said:
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
Click to expand...
Click to collapse
Unfortunately, the numbers are important. Are you able to get to fastbootd? If you can get to fastbootd, I would recommend trying to change to boot slot. Newer androids actually have two boot partitions for updating purposes. You can check which boot partition you're using with `fastboot getvar current-slot` which should return "a" or "b". Then do `fastboot set-active x` and replace x with whichever slot is NOT active as determined by the previous command. If the other boot slot is still intact, this would hopefully result in a bootable device. I haven't tried this myself, but this is what I would try if I were in your situation.
If this doesn't work, I would try flashing stock with sp flash tool, which doesn't need fastboot if you can't access that. It's a leaked mediatek tool, so there isn't an official site to get it from unfortunately. I got it from here: https://androidmtk.com/smart-phone-flash-tool but use your discretion. And get v5, because that's what most of the guides use. Then you can try flashing the 3561 stock firmware here: https://forum.xda-developers.com/t/stock-stock-backups-images-otas.3998227/post-82619259
If you can get it to boot at this point and want to de-walmart it, I would recommend just flashing a GSI rather than messing around with the stock rom. You can find the GSI's here: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list
LaikaXv1 said:
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
Click to expand...
Click to collapse
Lol, remember those copy-pasted guides where they provide the wrong TWRP images and it messes up the device
So the 8" Onn actually has a boot-ramdisk it appears. On the 7" Onn Surf (100005206), there is no boot-ramdisk, so the alternative is patching a recovery.img and allowing Magisk to hijack the /recovery partition. The only drawback is, anytime you need to reboot, using hardware keys as though booting into recovery is necessary.
inzane105 said:
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
Click to expand...
Click to collapse
I'm in a similar situation, my friend got an RCA Atlas 10 Pro-S from Goodwill for $1. It had an FRP lock on it though, and we ultimately managed to get to the home screen by enabling TalkBack and watching the support video to open the browser. Then, we installed Lawnchair to access the home screen. The settings app worked, but Developer Options would not open.
GetDroidTips has published a software called Miracle Box, claiming that it can unlock MediaTek bootloaders, as well as bypass FRP. However, a VirusTotal scan indicates that it is likely malware. I tried running it in a virtual machine and it asked if I wanted to run a process impersonating "svchost.exe" as Administrator. I airgapped the virtual machine, and Miracle Box said it needed Internet access for licensing, however GetDroidTips said it was free. I suspect that this was a fake software crack.
I am aware of a program called SP Flash Tool, but that won't work because I am on Linux, and not Windows. I doubt it would work under WINE, as it requires special device-specific drivers that also only work on Windows. I have a spare Lenovo IdeaPad 110-15ACL, however I don't have the drivers needed to set up Windows 7 on it. I could, of course, use Windows 10, but I have heard it is bad for flashing, and it is very slow anyway. (I did, however, buy an SSD for it, perhaps this will speed it up enough to be somewhat usable?)
I also found an open-source MediaTek exploit script called MTKTools. It did not work, and it told me to hold all hardware buttons before plugging the device in. It still did not detect the tablet. It told me that I could also short TP1 to ground, however I could not find Test Point 1 on the tablet's motherboard.
There are no custom recoveries or FRP unlocking guides for this device, likely because it's an obscure Android 7.1 tablet from back in 2014. I wouldnt be able to flash them anyway as the bootloader is locked. It has 2 GB of RAM and the processor cores are Cortex-A35s so I'm not sure that this is worth unlocking. On the other hand, it costs over $100 from Walmart.
I am worried that the device was stolen, as it had a password, and once I reset it from Recovery mode, it had an FRP lock. If it is indeed stolen, I can't return it, due to the "as is" nature of Goodwill, and besides, I have disassembled it several times as well. Should I be concerned about the ethical implications of unlocking this device?
Does this work on Android 11? I have the Onn. 100011885 model, according to my settings app.

Custom Rom / rooting Options vor TB-125FU (Lenovo Tab M10 Plus 3rd Gen)

Hey everyone,
I've been looking for options to Install a custom Rom or root since I bought the Tablet several month ago. It seems like there are some options for the Full Hd Version, but I have a hard time finding anything useful for the 125FU. Are there any recommendations like compatible GSI roms or TWRP/magisk?
Thanks in advance for your help!
You should just be able to install matiek form my understanding
I need some information, too. Bootloader unlock is different. Device doesn't respond to bootloader commands with Minimal ADB Fastboot 1.4.3.
holmesmalone said:
I need some information, too. Bootloader unlock is different. Device doesn't respond to bootloader commands with Minimal ADB Fastboot 1.4.3.
Click to expand...
Click to collapse
I just got an tb125fu
Bootloader unlock was no problem, maybe it works for you now with the latest versions?
art99 said:
I just got an tb125fu
Bootloader unlock was no problem, maybe it works for you now with the latest versions?
Click to expand...
Click to collapse
The issue I had, and resolved, was the lack of the latest fastboot drivers. Gained root with Magisk successfully.
holmesmalone said:
The issue I had, and resolved, was the lack of the latest fastboot drivers. Gained root with Magisk successfully.
Click to expand...
Click to collapse
I installed corvus os gsi on it. i have no custom recovery.
peteonu said:
I installed corvus os gsi on it. i have no custom recovery.
Click to expand...
Click to collapse
TWRP is convenient, but not absolutely necessary. Would like a Lineage rom though.
holmesmalone said:
TWRP is convenient, but not absolutely necessary. Would like a Lineage rom though.
Click to expand...
Click to collapse
Agreed. I've been looking into compiling TWRP myself but this is all new to me. The only device with TWRP with this chipset is the Redmi 9. I've compared both boot.img's and they are both setup differently. If I had more knowledge ont he subject I could easily achieve this I believe.
If I have time I'll compare Gen 2 vs Gen 3 boot.img's, that may help understand the folder and file structure better.
holmesmalone said:
The issue I had, and resolved, was the lack of the latest fastboot drivers. Gained root with Magisk successfully.
Click to expand...
Click to collapse
What process did you use with magisk to gain root after bootloader unlock? was it as simple as installing magisk manager and flashing root through the manager?
Thanks
el7145 said:
What process did you use with magisk to gain root after bootloader unlock? was it as simple as installing magisk manager and flashing root through the manager?
Thanks
Click to expand...
Click to collapse
The same process worked for me.
holmesmalone said:
The same process worked for me.
Click to expand...
Click to collapse
How did you obtain the boot.img to patch??? I cant find the stock firmware anywhere, and im not clear on pulling the stock boot.img (getting permission denied errors when attempting via adb)
el7145 said:
How did you obtain the boot.img to patch??? I cant find the stock firmware anywhere, and im not clear on pulling the stock boot.img (getting permission denied errors when attempting via adb)
Click to expand...
Click to collapse
Select and download your preferred rom. Then unzip the rom and in the unzipped folder select the boot.img file and use it.
With some devices and roms, under some circumstances, the vbmeta.img file can and should be used. If I can recall correctly, Magisk will specify.
holmesmalone said:
Select and download your preferred rom. Then unzip the rom and in the unzipped folder select the boot.img file and use it.
With some devices and roms, under some circumstances, the vbmeta.img file can and should be used. If I can recall correctly, Magisk will specify.
Click to expand...
Click to collapse
ok, so ur just pulling the boot img from one of the GSI roms...im just trying to pull the stock boot img...do you happen to know where one can download the stock firmware for this device, this is my 1st lenovo tablet
el7145 said:
ok, so ur just pulling the boot img from one of the GSI roms...im just trying to pull the stock boot img...do you happen to know where one can download the stock firmware for this device, this is my 1st lenovo tablet
Click to expand...
Click to collapse
LMSA. https://pcsupport.lenovo.com/us/en/downloads/ds101291-rescue-and-smart-assistant-lmsa
Use this tool. Install and explore the file and folder structure it creates. Interrupt the process before it flashes your tablet for it will erase the files you need from your computer if you don't. Use trial and error here.
Since the original question was about root, Ill keep this going
I was able to download the most recent ROM from Lenovo rescue which was super simple, it downloads the ROM first and wont start the flash till you click the button. I did retrieve the stock boot.img, patched it, and flashed it, rebooted and had root. Heres where the many hours of fun started...I realized my wifi wasnt working (good sign something was messed up during flash). I realize the ROM downloaded from the Lenovo Rescue was newer then my old ROM. So I had flashed the newer boot.img over the old ROM (not good). I went back to Lenovo rescue to actually make use of the rescue and flash a full ROM. After completion I became stuck in fastboot mode. I could boot to recovery but not system and every restart or shutdown and restart would go straight to fastboot.
I did try to manually flash the ROM using what i thought was the right files and order (using flashinfo.txt as the order and MT6768_Android_scatter.txt for the partition names for each image). Everything flashed successfully, but upon reboot I was still stuck in fastboot mode. I tried everything I could think of and even ran the Lenovo Rescue a few times.
After many hours, I came across this command for fastboot..."fastboot set_active a" which finally allowed me to boot into system. I assume this tablet uses the A/B slot partitions, but I think they only make use of the A for boot? Thats my thought
So next is too try to patch the correct disc.img for my current rom (which is the latest from Lenovo Rescue) and flash again making sure to flash to the boot_a partition and hopefully everything goes like it should
Hopefully that command helps someone save many hours if they find themselves stuck in fastboot mode while rooting and/or flashing.
el7145 said:
Since the original question was about root, Ill keep this going
I was able to download the most recent ROM from Lenovo rescue which was super simple, it downloads the ROM first and wont start the flash till you click the button. I did retrieve the stock boot.img, patched it, and flashed it, rebooted and had root. Heres where the many hours of fun started...I realized my wifi wasnt working (good sign something was messed up during flash). I realize the ROM downloaded from the Lenovo Rescue was newer then my old ROM. So I had flashed the newer boot.img over the old ROM (not good). I went back to Lenovo rescue to actually make use of the rescue and flash a full ROM. After completion I became stuck in fastboot mode. I could boot to recovery but not system and every restart or shutdown and restart would go straight to fastboot.
I did try to manually flash the ROM using what i thought was the right files and order (using flashinfo.txt as the order and MT6768_Android_scatter.txt for the partition names for each image). Everything flashed successfully, but upon reboot I was still stuck in fastboot mode. I tried everything I could think of and even ran the Lenovo Rescue a few times.
After many hours, I came across this command for fastboot..."fastboot set_active a" which finally allowed me to boot into system. I assume this tablet uses the A/B slot partitions, but I think they only make use of the A for boot? Thats my thought
So next is too try to patch the correct disc.img for my current rom (which is the latest from Lenovo Rescue) and flash again making sure to flash to the boot_a partition and hopefully everything goes like it should
Hopefully that command helps someone save many hours if they find themselves stuck in fastboot mode while rooting and/or flashing.
Click to expand...
Click to collapse
I'm trying to solve the fastboot issue but I can't find fastboot drivers for the tablet. Have any suggestions?
Siege9929 said:
I'm trying to solve the fastboot issue but I can't find fastboot drivers for the tablet. Have any suggestions?
Click to expand...
Click to collapse
im assuming in device manager, you have a yellow exclamation by "Android"? you need the mediatek drivers.
Go here https://developer.android.com/studio/run/oem-usb
scroll down, dont make the misake of clicking on "Lenovo", you are clicking on the section labeled "MTK" download the zip, go to device manager and manually update the driver, once updated fastboot should work
at cmd run "fastboot devices" to make sure your device is recognized
el7145 said:
im assuming in device manager, you have a yellow exclamation by "Android"? you need the mediatek drivers.
Go here https://developer.android.com/studio/run/oem-usb
scroll down, dont make the misake of clicking on "Lenovo", you are clicking on the section labeled "MTK" download the zip, go to device manager and manually update the driver, once updated fastboot should work
at cmd run "fastboot devices" to make sure your device is recognized
Click to expand...
Click to collapse
Manually selecting the "Android Bootloader" driver fixed it. Thanks!
I just got my TB125FU to replace my 7-year-old Google Pixel C on its last legs.
Its Hardware ID is USB\VID_0E8D&PID_201C&REV_0100
I found a pack of Mediatek drivers here.
It's a bloated pack, so I extracted just the files needed for the TB125FU and attached to this post.
Once installed, my tablet appeared with a "fastboot devices" command.
I have also had good luck with the latest firmware for Motorola/Lenovo devices here.
hugehead83 said:
I have also had good luck with the latest firmware for Motorola/Lenovo devices here.
Click to expand...
Click to collapse
just an fyi: thats not the most recent firmware, the lenovo rescue tool had the latest, which at the moment for my device a few days ago was TB125FU_S000118_220927_ROW

MSM and "the current image have been destroyed and can not boot"

Hey,
so yesterday I tried to install TWRP recovery.
While trying I assume that I hard bricked the phone and got the message that the current image has been destroyed and cant boot.
I've tried using MSM but the device wasnt recognized, I installed the qualcomm usb drivers and it worked for some time but still wasnt recognized in MSM.
Now I have the problem that when I plug it in, it only shows the above mentiond message. When I shut it off and press vol +/- it then goes into fastboot but cycles through it and is still only shown as android device in the device manager.
I'm using the usb 2.0 and original OP cable. Build number was IN2023...c.36, A12 and OOS12
ADB does not work, fastboot commands still work while it is in the fastboot cycle.
Does someone have any solutions for that?
Thanks
How did you "install" twrp?
via fastboot? or through booted twrp? Because from what i read, twrp or orangefox likes to patch boot image instead of flashing recovery partition.
So my suggestion is to flash via fastboot original boot.img and recovery.img
I watched a tutorial for that. I tried to get it running through fastboot but as I mentioned it didnt work out that well.
Do you know where I can get the original boot.img and recovery.img? I found other versions but not the one that I had
w4rdl0rd said:
I watched a tutorial for that. I tried to get it running through fastboot but as I mentioned it didnt work out that well.
Do you know where I can get the original boot.img and recovery.img? I found other versions but not the one that I had
Click to expand...
Click to collapse
You need to download EU OOS12 C36 FULL Package (i found it in this forum here), extract it via payload dumper and after that you will have every .img which is used to flash. Then you will need to go to folder where you have fastboot.exe, click shift+right mouse button and click open command prompt here.
Next: fastboot commands.
First (it's optional, but you will know that your device is "connected" via fastboot)
fastboot devices
you should have output, and if it's that then:
fastboot flash boot <drag boot.img file>
by dragging file, system automatically fill location of this boot file, next
fastboot flash recovery <drag recovery.img file>
and then
fastboot reboot
If you have questions, then ask
Thank you, it finally works
ShadoV90 said:
You need to download EU OOS12 C36 FULL Package (i found it in this forum here), extract it via payload dumper and after that you will have every .img which is used to flash. Then you will need to go to folder where you have fastboot.exe, click shift+right mouse button and click open command prompt here.
Next: fastboot commands.
First (it's optional, but you will know that your device is "connected" via fastboot)
fastboot devices
you should have output, and if it's that then:
fastboot flash boot <drag boot.img file>
by dragging file, system automatically fill location of this boot file, next
fastboot flash recovery <drag recovery.img file>
and then
fastboot reboot
If you have questions, then ask
Click to expand...
Click to collapse
I'm now somehow stuck in recovery. So after I select the language I get the message "system error, after select language, please select Online update". When I try to format data I'm getting back to recovery. Maybe you can tell me how to proceed since I don't really know what to search for
w4rdl0rd said:
I'm now somehow stuck in recovery. So after I select the language I get the message "system error, after select language, please select Online update". When I try to format data I'm getting back to recovery. Maybe you can tell me how to proceed since I don't really know what to search for
Click to expand...
Click to collapse
Wait... system can't boot up?
ShadoV90 said:
Wait... system can't boot up?
Click to expand...
Click to collapse
yeah, it goes always back to recovery
Hmm... Then i'm afraid that MSM is now your only option. Sincerely, i never used that, so i found thread with guide how to do it.
Look please here, read carefully, and i hope you will be able to recovery your device.
I guess it will rollback your system to OOS11.
PS. Give feedback if it was succesfull (or not).
Right now I tried to do again the steps you mentioned. When I dragged the boot file into command prompt I got the message that the .img file is damaged. Maybe that is the reason for not booting up. When I first did it I also received the message but after dragging it a second time over it was still installed.
I also tried downloading the firmware from the op website, extracting everything via the payload dumper and installing everything as you mentioned. Like that I was stuck in fastboot.
Thanks for your help, maybe it will work
w4rdl0rd said:
Right now I tried to do again the steps you mentioned. When I dragged the boot file into command prompt I got the message that the .img file is damaged. Maybe that is the reason for not booting up. When I first did it I also received the message but after dragging it a second time over it was still installed.
I also tried downloading the firmware from the op website, extracting everything via the payload dumper and installing everything as you mentioned. Like that I was stuck in fastboot.
Thanks for your help, maybe it will work
Click to expand...
Click to collapse
I hope it will work.
BTW, next time when you will try recovery like twrp or orangefox, don't flash it but boot it via fastboot.
fastboot boot <drag file of twrp/orangefox>
If it will work, and everything will work, then use fastboot flash recovery <drag file of twrp/orangefox>
Don't flash it via twrp/orangefox, because like i said, it will probably try to patch boot partition and in result boot will be unusable.
thanks for the advice, I'll try it next time or when I get it running again
w4rdl0rd said:
thanks for the advice, I'll try it next time or when I get it running again
Click to expand...
Click to collapse
I have one more idea. I thought about changing active slots in fastboot. Normally on inactive slot is fully working rom before update to c36. With proper boot etc. So when you change active slot, you should have fully working ROM. Problem is that you must figure out which slot is your active now.
Normally this command is fastboot getvar all and it should show you wall of text and information (bootloader) current_slot: a (or b)
then you can switch active slots (if you see other slot is bootable).
There are two methods:
1. Checking active slots and if current active slot is A then in fastboot type this
fastboot set_active b otherwise fastboot set_active a
2. Idk if it will work here, but there is a command fastboot set_active other which just switch active slot no matter what it was earlier.
But sincerely idk what will happen if you will switch to unpopulated slot. I think if you upgrade your phone normally or didn't erase this inactive slot, it should be populated with previous version of ROM.
When i installed OOS12 and due to destroying my boot image i switched slots i was able to run A11 xD
ShadoV90 said:
I have one more idea. I thought about changing active slots in fastboot. Normally on inactive slot is fully working rom before update to c36. With proper boot etc. So when you change active slot, you should have fully working ROM. Problem is that you must figure out which slot is your active now.
Normally this command is fastboot getvar all and it should show you wall of text and information (bootloader) current_slot: a (or b)
then you can switch active slots (if you see other slot is bootable).
There are two methods:
1. Checking active slots and if current active slot is A then in fastboot type this
fastboot set_active b otherwise fastboot set_active a
2. Idk if it will work here, but there is a command fastboot set_active other which just switch active slot no matter what it was earlier.
But sincerely idk what will happen if you will switch to unpopulated slot. I think if you upgrade your phone normally or didn't erase this inactive slot, it should be populated with previous version of ROM.
When i installed OOS12 and due to destroying my boot image i switched slots i was able to run A11 xD
Click to expand...
Click to collapse
I tried/am trying to get MSM working. It connected now in edl, in MSM it still freezes. No matter what I do it has the status "waiting for communication".
If I remember correctly then there was somethin with ..._b. But since I've closed the command prompt I can't look it up anymore.
I'll try to change slots and let you know if there will be a result.
With MSM there is one problem. After succesful operation your phone will be locked. I mean bootloader will be locked.
I did as you wrote...it works fine now. I think. There is still A12 and OOS12 installed but it is lagging a bit.
I attached a screenshot of the terminal with the slots. Does having switched them pose some problem? Do I have to switch them back?
Just check if you have an update. If you have, then install it via system update. For now, you have working system. Now you have much more possibilities to use. Like if you don't have update you can apply manually one which you downloaded. In system ofc.
There are no updates, there is the most recent version installed.
Thank you for the help in solving it
w4rdl0rd said:
There are no updates, there is the most recent version installed.
Thank you for the help in solving it
Click to expand...
Click to collapse
So, this is C36 installed?
yeah there is c36 installed

Categories

Resources