Database Users

FAILED (remote: Command not allowed)

Hello,
I'm pretty new to rooting Sony devices and I can't seem to install custom roms on my Xperia Z2 using fastboot. My bootloader is unlocked (i've checked several times), USB debugging is checked and it believe my drivers are properly installed (fastboot devices cmd recognizes my device) but when i try to run "fastboot flash zip rom.zip" i get this annoying FAILED (remote: Command not allowed) message. I've looked through several threads but I can find any solution that applies to my case.
Any ideas would be welcome.
Thanks

I called Sony. Their official story is they do not support unlocking their own phones.
I asked her why, she said we just dont support unlocking the bootloader on some phones.
Im going to go break this phone and never recommend or buy sony products ever again

What exactly are you trying to flash?
Fastboot doesn't flash .zip files (I think). Whatever you are trying to flash must be extracted from the .zip file, then flashed via fastboot.
If you are trying to flash a custom kernel, you must have the boot.img file extracted from the .zip file in the same folder as the adb_fastboot folder, then hold in Shift then right-click and select, 'Open command window here' then type in cmd, 'fastboot flash boot boot.img'.
Once it says, 'Waiting for device', hold in the volume-up button on the phone and insert the USB cable into the phone.
Hope this helps.

I'm trying to flash android lollipop. I've tried extracting the boot.img flash it and then try to boot on recovery. A few times nothing happened and I couldn't force restore even using adb. Other times I just got stuck on the splash screen or in a loop reboot.
From what I've found online you can flash with flashboot using "flashboot flash zip Rom.zip" it starts transferring the room but it immediately does to the failed remote command not allowed error.
Sent from my D6503 using XDA Free mobile app

Where did you find that this command works for Xperia devices? I don't say that it can't work, but I see it for the first time (reading XDA for several years). All ROMs which I flashed were via flashtool or recovery, never through fastboot.
The best solution is to follow installation instruction of the given ROM.

RoamenCota
As far as I know most brands don't really support development but have you tried this the Sony Boot loader unlocking website?
_mysiak_
As for the cmd I found it online but I think it was an HTC forum. I guess it might not work in Xperia devices. I'm able to flash with flashtool but so far I've only managed to brick the phone.
Sent from my D6503 using XDA Free mobile app

Which ROM exactly are you trying to flash and what steps have you done?

_mysiak_ said:
Which ROM exactly are you trying to flash and what steps have you done?
Click to expand...
Click to collapse
I've tried flashing the [ROM][WIP]AOSP 5.0 Beta v2.0 from krabappel and the [ROM][SIRIUS][LP][5.0.1][SM-4.9] CyanogenMod 12 Unofficial [NIGHTLY BUILDS] from infected_ (sorry i'm not allowed to post links). As for the first one the process seems a bit more complex since there is a v2 plus an OTA to install. I've tried the second one first with flashboot but it didn't really work. With flash tool i've ended up bricking the phone.

CM is usually flashed via recovery (CWM, TWRP,..) - download ZIP, put it on SD card, boot into recovery, flash from there, reboot. Flashtool or fastboot should not be required. I would advise you to continue in ROM specific topics about any special installation steps/instructions.

_mysiak_ said:
CM is usually flashed via recovery (CWM, TWRP,..) - download ZIP, put it on SD card, boot into recovery, flash from there, reboot. Flashtool or fastboot should not be required. I would advise you to continue in ROM specific topics about any special installation steps/instructions.
Click to expand...
Click to collapse
For some reason that rom isn't able to be installed in TWRP recover. There's some install error may due to the fact that's a beta and not completely stable. If it doesn't work i'll just wait for a more stable version.
Just curious, even if it's a zip file, if I extract the complete package to the fastboot/adb folder and run "fastboot flash boot boot.img" there's no reason not to work right?

amrcardoso said:
For some reason that rom isn't able to be installed in TWRP recover. There's some install error may due to the fact that's a beta and not completely stable. If it doesn't work i'll just wait for a more stable version.
Just curious, even if it's a zip file, if I extract the complete package to the fastboot/adb folder and run "fastboot flash boot boot.img" there's no reason not to work right?
Click to expand...
Click to collapse
I don't think that it's worth the effort to flash those ROMs, unless you are really curious. Otherwise you should stick to verified and fully working ROMs.
It depends what you expect from that command. It will work, but it'll flash only kernel. System and other partitions remain untouched. Most probably you'll get bootloop with such combination.

_mysiak_ said:
I don't think that it's worth the effort to flash those ROMs, unless you are really curious. Otherwise you should stick to verified and fully working ROMs.
It depends what you expect from that command. It will work, but it'll flash only kernel. System and other partitions remain untouched. Most probably you'll get bootloop with such combination.
Click to expand...
Click to collapse
I'll probably stick with the zip flashing via recovery. But what step am I missing to flash a rom thorugh fastboot?

That most probably it's not possible to flash ROM via fastboot on Xperia devices. You have to use flashtool for FTF files and recovery for custom ROMs. Fastboot is used to flash kernel only.

_mysiak_ said:
That most probably it's not possible to flash ROM via fastboot on Xperia devices. You have to use flashtool for FTF files and recovery for custom ROMs. Fastboot is used to flash kernel only.
Click to expand...
Click to collapse
I have been able to flash the stock FTF but never a ROM using flashtool. Maybe that's why.
Thanks

[X01BD] Can't install TWRP after unlocking with Official UnlockTool

Hi guys,
I am using Zenfone Max Pro M2. I wanted to install a custom rom and I tried to unlock bootloader but I unlocked it through official unlocktool. Now I can't flash anything or send any command through fastboot, whenever I do then it restarts the device.
When I try to keep the fastboot command running and then connect phone - it throws errors like "Fail - Too many links", "Fail - Write to device fail (No such file or directory)" or "Fail- Unknown command".
I tried unlocking bootloader with the unofficial way provided in https://forum.xda-developers.com/max-pro-m2/how-to/unlook-bootloader-root-asus-zenfone-max-t3885457
but it isn't working either, any fastboot command is rebooting the device although bootloader is unlocked.
How do I fix this?
EDIT: Things I have tried:
- Changing USB Cable and Port
- Reinstalling ADB and device driver
- Reunlocking bootloader from UnlockTool (don't know why I did that again)
- Unofficial way to unlock bootloader
None of it helped.
Thanks

Mr147 said:
Hi guys,
I am using Zenfone Max Pro M2. I wanted to install a custom rom and I tried to unlock bootloader but I unlocked it through official unlocktool. Now I can't flash anything or send any command through fastboot, whenever I do then it restarts the device.
When I try to keep the fastboot command running and then connect phone - it throws errors like "Fail - Too many links", "Fail - Write to device fail (No such file or directory)" or "Fail- Unknown command".
I tried unlocking bootloader with the unofficial way provided in https://forum.xda-developers.com/max-pro-m2/how-to/unlook-bootloader-root-asus-zenfone-max-t3885457
but it isn't working either, any fastboot command is rebooting the device although bootloader is unlocked.
How do I fix this?
EDIT: Things I have tried:
- Changing USB Cable and Port
- Reinstalling ADB and device driver
- Reunlocking bootloader from UnlockTool (don't know why I did that again)
- Unofficial way to unlock bootloader
None of it helped.
Thanks
Click to expand...
Click to collapse
Guys, no one to help or assist?

Mr147 said:
Guys, no one to help or assist?
Click to expand...
Click to collapse
Did u try running the command at the adb folder?shift+right click in adb folder?
Is Usb debugging enabled in developer options?

X10MINISTER said:
Did u try running the command at the adb folder?shift+right click in adb folder?
Is Usb debugging enabled in developer options?
Click to expand...
Click to collapse
Yes, everything done.
Still no success.

Mr147 said:
Yes, everything done.
Still no success.
Click to expand...
Click to collapse
Did ur unlocking bootloader succeed?

Did you try relocking the bootloader ?
1) Try relocking the bootloader using the methods described here :
https://forum.xda-developers.com/max-pro-m2/how-to/unroot-relock-bootloader-max-pro-m2-t3885870
See if it successfully relocks...
If it does, then next time unlock using the unofficial method only...
2) If not then maybe try contacting ASUS... Tweet them on Twitter... Companies usually respond very fast on Twitter, since their reputations are at stake...
3) All else fails then try rooting it using something like Kingroot... Once rooted, flash TWRP Recovery using Flashify... then flash any custom ROM u want...
I hope your problem gets solved... Next time be a little more cautious when taking such a risky step... See what are all the options you have before jumping into something...

X10MINISTER said:
Did ur unlocking bootloader succeed?
Click to expand...
Click to collapse
I guess it did because when I reboot it I get that bootloader unlocked splash screen.

Tyakrish said:
Did you try relocking the bootloader ?
1) Try relocking the bootloader using the methods described here :
https://forum.xda-developers.com/max-pro-m2/how-to/unroot-relock-bootloader-max-pro-m2-t3885870
See if it successfully relocks...
If it does, then next time unlock using the unofficial method only...
2) If not then maybe try contacting ASUS... Tweet them on Twitter... Companies usually respond very fast on Twitter, since their reputations are at stake...
3) All else fails then try rooting it using something like Kingroot... Once rooted, flash TWRP Recovery using Flashify... then flash any custom ROM u want...
I hope your problem gets solved... Next time be a little more cautious when taking such a risky step... See what are all the options you have before jumping into something...
Click to expand...
Click to collapse
Tried everything except 2, none worked. I'll drop them a query over twitter like you say, let's see what their reply is.
I am on stock recovery, non working bootloader but unlocked, and stock rom unrooted.
I think Pie update may give some insight on fixing this.

Mr147 said:
I guess it did because when I reboot it I get that bootloader unlocked splash screen.
Click to expand...
Click to collapse
I see.. did u've try using another laptop/pc? Sometimes antivirus blocking the tools that are needed for unlocking bootloader..

X10MINISTER said:
I see.. did u've try using another laptop/pc? Sometimes antivirus blocking the tools that are needed for unlocking bootloader..
Click to expand...
Click to collapse
I unlocked using official bootloader apk provided by asus. Now I have encrypted phone which isn't decrypting and can't flash twrp.

Mr147 said:
I unlocked using official bootloader apk provided by asus. Now I have encrypted phone which isn't decrypting and can't flash twrp.
Click to expand...
Click to collapse
Hey you said phone is encrypted ? Maybe this might work :
1) Download and install the latest Magisk Manager apk
2) Extract boot.img from stock firmware
3) Put boot.img in your internal storage and open magisk app.
4) Click on install and select patch boot Image.
5) Select stock boot.img file placed in phone memory.
6) Magisk will automatically patch the stock Image and this patched image can be installed using fastboot using this command:
fastboot flash boot patched_boot.img
This will root your phone. After that you can install Flashify to flash TWRP or PBRP
Note:
- This method is highly experimental... There are 50% chances of bootloop. I would not have recommended this method, but situation seems to demand it.
- Your data will most probably be formatted, so keep a backup.
- If it falls in a bootloop, then you need to flash original stock firmware to restore your phone.
Credits: @#ArtFuL
Who came up with this method, but removed it from the main guide, because of being experimental... (I guess)

Mr147 said:
I unlocked using official bootloader apk provided by asus. Now I have encrypted phone which isn't decrypting and can't flash twrp.
Click to expand...
Click to collapse
After going through the errors, I strongly believe that the problem is with your drivers. If reinstalling doesn't works, try a different pc. If your pc detects your device on MTP or your are able to perform adb operations without any hassle, it's not the problem with your phone.
You can decrypt the device only after flashing custom recovery.
---------- Post added at 09:35 PM ---------- Previous post was at 09:31 PM ----------
Tyakrish said:
Hey you said phone is encrypted ? Maybe this might work :
1) Download and install the latest Magisk Manager apk
2) Extract boot.img from stock firmware
3) Put boot.img in your internal storage and open magisk app.
4) Click on install and select patch boot Image.
5) Select stock boot.img file placed in phone memory.
6) Magisk will automatically patch the stock Image and this patched image can be installed using fastboot using this command:
fastboot flash boot patched_boot.img
This will root your phone. After that you can install Flashify to flash TWRP or PBRP
Note:
- This method is highly experimental... There are 50% chances of bootloop. I would not have recommended this method, but situation seems to demand it.
- Your data will most probably be formatted, so keep a backup.
- If it falls in a bootloop, then you need to flash original stock firmware to restore your phone.
Credits: @#ArtFuL
Who came up with this method, but removed it from the main guide, because of being experimental... (I guess)
Click to expand...
Click to collapse
Yes this method is highly experimental. Also in this situation, he cannot use any fastboot commands. So this method won't work

#ArtFuL said:
After going through the errors, I strongly believe that the problem is with your drivers. If reinstalling doesn't works, try a different pc. If your pc detects your device on MTP or your are able to perform adb operations without any hassle, it's not the problem with your phone.
You can decrypt the device only after flashing custom recovery.
---------- Post added at 09:35 PM ---------- Previous post was at 09:31 PM ----------
Yes this method is highly experimental. Also in this situation, he cannot use any fastboot commands. So this method won't work
Click to expand...
Click to collapse
This method didn't work, as fastboot isn't accepting any command. I tried giving command before connecting phone and then connecting, it gives me error of "File size is more than max allowed".

So is it done?

Mr147 said:
This method didn't work, as fastboot isn't accepting any command. I tried giving command before connecting phone and then connecting, it gives me error of "File size is more than max allowed".
Click to expand...
Click to collapse
See I recommend please use Linux (Manjaro or Ubuntu) , Windows will have driver issues forever and ever

had same issue after fota update UL-ASUS_X01BD-WW-15.2016
Tyakrish said:
Hey you said phone is encrypted ? Maybe this might work :
1) Download and install the latest Magisk Manager apk
2) Extract boot.img from stock firmware
3) Put boot.img in your internal storage and open magisk app.
4) Click on install and select patch boot Image.
5) Select stock boot.img file placed in phone memory.
6) Magisk will automatically patch the stock Image and this patched image can be installed using fastboot using this command:
fastboot flash boot patched_boot.img
This will root your phone. After that you can install Flashify to flash TWRP or PBRP
Thanks , this method work me. had same issue after fota update UL-ASUS_X01BD-WW-15.2016.1902.192-user
Click to expand...
Click to collapse

I've the same problem too. Let me know if you've configure it out. Thanks.

Okay @Mr147, I've fix this. I checked Windows Update and there was a pending ASUS driver update. I downloaded it and now I can use the fastboot commands.

Anyone that can fix this problem? I also experience this.

Mr147 said:
Hi guys,
I am using Zenfone Max Pro M2. I wanted to install a custom rom and I tried to unlock bootloader but I unlocked it through official unlocktool. Now I can't flash anything or send any command through fastboot, whenever I do then it restarts the device.
When I try to keep the fastboot command running and then connect phone - it throws errors like "Fail - Too many links", "Fail - Write to device fail (No such file or directory)" or "Fail- Unknown command".
I tried unlocking bootloader with the unofficial way provided in https://forum.xda-developers.com/max-pro-m2/how-to/unlook-bootloader-root-asus-zenfone-max-t3885457
but it isn't working either, any fastboot command is rebooting the device although bootloader is unlocked.
How do I fix this?
EDIT: Things I have tried:
- Changing USB Cable and Port
- Reinstalling ADB and device driver
- Reunlocking bootloader from UnlockTool (don't know why I did that again)
- Unofficial way to unlock bootloader
None of it helped.
Thanks
Click to expand...
Click to collapse
I suggest to Unlock with unofficial step, or read the post https://www.blocknesia.com/2019/04/unlock-bootloader-dan-install-twrp-asus-zenfone-max-pro-m2.html

[RECOVERY] TWRP for Onn Android Tablets (unofficial) - 2019-11-30

TWRP Custom Recovery for the Onn Android Tablet series​
This is the first fully-featured custom recovery for Walmart's MediaTek-based Onn tablets: ONA19TB002, ONA19TB003 and ONA19TB007. TWRP needs no introduction. If you have come here, you probably have some idea of what it is and what it's used for. This TWRP build does not need the bootloader unlocked or VBMeta verification disabled, although it's recommended that you at least unlock the bootloader.
DISCLAIMER
Everything described in this thread is done at your own risk. No one else will be responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.
FEATURES
Decrypted data partition
All USB modes functional: MTP, ADB, Mass Storage, OTG, Charging
Fast boot time
Adoptable storage mounting
Firmware image backup and restore
Works under locked bootloader
Android 9 build fits within the 16MB recovery partition -- no compromises or partition resizing necessary
INSTALLATION METHOD 1
Download the recovery to your PC and unzip the image
Unlock the bootloader (skip if you have already done this)
Enable OEM Unlock in Developer Options in Android Settings
Boot into fastboot mode either by holding vol. up+power to power it on and selecting "Fastboot mode", or by running the 'adb reboot bootloader' command from within Android.
Install fastboot and appropriate drivers on your PC if you have not set those up
Unlock the bootloader with the command
Code:
fastboot flashing unlock
...and follow the instructions on the screen. This will wipe your data.
Flash the custom recovery with
Code:
fastboot flash recovery twrp-3.3.1-ONA19TB002.img
(use the right file name path for your device)
Reboot to recovery with
Code:
fastboot oem reboot-recovery
INSTALLATION METHOD 2
This assumes you are familiar with SP Flash Tool or can figure it out on your own
Download the recovery to your PC and unzip the image
Get the appropriate scatter file for your device. The scatter file may be found in the device's firmware under /system/data/misc.
Set up SPFT Download tab as Download Only. Load your scatter file.
Under the recovery line, double-click Location and open your TWRP image.
Click Download and connect your powered-off tablet to your PC. SPFT will automatically flash the recovery to the emmc and disconnect when finished.
INSTALLATION METHOD 3
Head over to Amazing Temp Root for MediaTek ARMv8, read the requirements and directions, and grab the latest mtk-su.
Open a root shell with mtk-su
Flash the (unzipped) recovery with the command:
Code:
dd bs=1048576 if=twrp-3.3.1-0-ONA19TB002.img of=/dev/block/by-name/recovery
(replace the if= file name with your appropriate recovery image path)
Exit root shell
START RECOVERY
Three methods:
On a powered off tablet, hold Vol. up+power for about 3 seconds. In the menu that appears, select "Recovery mode"
With Android ADB, use the command 'adb reboot recovery'
From Android root shell, use the command 'reboot recovery' or just use any root app with OS reboot features
NOTES
Kind of important: Make a backup of your Crypto Footer as soon as you can. This is the encryption key to your data partition. When accessed from TWRP, this key can get "upgraded" so that you will get locked out of Android. TWRP uses a hacky workaround that saves and restores the original footer on every /data decrypt. But that method is not what I would call 100% reliable.
Make sure you have a backup of the untouched stock system and vendor images. There are no official firmware packages available to download.
Only mount system/vendor partitions in read/write mode if you have unlocked the bootloader. It is recommended to choose to leave system read-only at the startup prompt unless you have a specific reason to modify it. If the bootloader is locked, then dm-verity is enforced.* So merely mounting it once in r/w will cause a boot loop.
It's currently not possible to install incremental OTA updates using this TWRP. Use the stock recovery to update the FW. That will only work if you have never mounted system/vendor in write mode.
DOWNLOAD (Nov. 30, 2019)
Current version: 3.3.1-1
ONA19TB002 - Onn 8" model
ONA19TB003 - Onn 10.1" model
ONA19TB007 - Onn 10.1" w/keyboard model
Source code
ONA19TB002 | ONA19TB003 | ONA19TB007
ACKNOWLEDGEMENTS
The team behind TWRP & OmniROM
@tek3195 for testing and feedback on the 8" model

Please post feedback since these are still pretty new and not exhaustively tested. Let me know if I should port it to other models in the series.

Reserved also

grabbing this one too cuz why not

Very nice! I'll download and test the 003 one soon.
I also have a 007 model to experiment with.
I tried about a dozen times to build TWRP and failed miserably LOL. Closest I got was one that would boot but the rotation was all messed up, USB wouldn't work, didn't mount some partitions... Yeah, it was a hot mess.
Do you happen to have sources available?

Hi @NFSP G35,
I'll have the source code soon. Most of the tricks involved patching bootable/recovery. So I need to commit those changes and include the proper patch set from my tree....

Amazing!! Gonna install and test 8" right now.

Has anyone tried a GSI on these tablets yet?

MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I do know @tek3195 , the Onn 8 thread starter, has tried many of them as well as others here, somewhere on that thread he listed his tests and opinion of several of them.
I'm pretty sure others on that thread have also tried GSI's.

MishaalRahman said:
Has anyone tried a GSI on these tablets yet?
Click to expand...
Click to collapse
I did try both Phhuson vanilla and also Liquid Remix (I'm keeping this one for now). I didn't flash them through twrp, but using fastboot via bootloader.

WoW! AwEsOmE! I cannot wait to try this! THANK YOU!!!!!!

Hey,
This is a neat thing to see for the Onn tablets. I have a question though. I own a device based on the mt8163, and am trying to help people with another device I don't own (the powkiddy x18 which also uses the mt8163). One of the things I wanted to do was to make a custom rom for the x18, since it's stock firmware is horrible. And of course, one of the first steps to custom roms is twrp. So I have a question for you that I hope you can answer for me. How did you make this build of twrp? I have seen no device trees for this device so I was kinda curious. If you can help me in any way, I'd be so grateful, and I'm sure the other people with the x18 would be grateful for help.

@diplomatic
Is there a different procedure for installing TWRP on a locked bootloader?
I can confirm that using SP Flash to load your TWRP.img will produce a bootloop when installing to a device with the BL locked. Reflashing the original recovery.img makes the problem go away. You mentioned in the OP that this TWRP will work on a locked BL so I thought I would share my case study with you in following the procedure you defined.
MY SINCERE GRATITUDE FOR YOUR EFFORTS IN PORTING THIS TO THE ONN!

You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...

diplomatic said:
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
Click to expand...
Click to collapse
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
At one time I did run with the bootloader unlocked (with --disable-verification on stock vbmeta) and I ran Phusson's AOSP, Liquid Remix and Bliss. I found there was no benefit to me in running the other mods so I reverted back to stock courtesy of @CaffeinePizza and the bootloader re-locked to get rid of that annoying 5 second orange state.
In each instance, I always used SP Flash tools to load all .img files. I only used fastboot to install magisk_patched.img onto the stock installation. Unlocking the bootloader erases all data and I did not feel like reinstalling everything again, so I figured I would try to install TWRP per your instruction to see if it would work while the BL was still locked... Restoring the original recovery got rid of the bootloop. I do want to try your TWRP so I will try it with BL unlocked when I get some free time to do so.

Spatry said:
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.
Click to expand...
Click to collapse
This sounds like you might have flashed a wrong/corrupt image to recovery. It may have to do with AVB checks rather than bootloader lock. But those conditions might be interdependent somehow so I can't tell you for sure. The fact that you are able to boot a patched image on a locked BL says it doesn't care too much about verification. I can tell you for sure that any recovery image must have avb metadata, not necessarily the required hash, for both Android and recovery to boot. Can you try to unzip the image file and flash it over again?

Hmm, the situation with the bootloader lock sounds eerily similar to the Nabi SE. The latter also had a similar implementation where there's not much in the way of locking things down, other than an (easily circumvented) SP Flash Tool signature check and different preloader keys. And here's the real kicker: the nearly-identical Fisher Price Nabi also ran on the MT8163, so it makes me wonder if it's possible to boot Pie on it, or perhaps a GSI assuming that Treble can be tacked onto it.
Also, do you have the source repo to this TWRP port of yours?

If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.

diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Where do I find crypto footer to backup

diplomatic said:
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now.
Click to expand...
Click to collapse
Kinda cool without the ads isn't it. I know I sent one about a week ago or so. I think everybody ought to send you one, you deserve it. THANKS and AWESOME work.

(GUIDE) Root Onn 8 Gen 2 100011885

Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.

Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something

LaikaXv1 said:
Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Click to expand...
Click to collapse
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
I'm glad to see that there is finally a root solution for this device. I have 2 Onn 8 first gen, Android 9 tablets and I use the Magisk module: Universal SafetyNet Fix to
pass.
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Let us all know if this works. I work in a Walmart electronics department and have not bought one of the 2nd gen devices because I had assumed that it could not be rooted. I am temped just for a new challenge, even though I really don't need a new device.
Have you been able to create a backup of the stock rom? Is it flashed with spflashtool like the older device?
Thanks

I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!

LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
Ah, I didn't hit reply. Oops!
I'm not new to XDA persay, but I'm not usually the one making guides and actually saying things haha.

Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)

Boox17 said:
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Click to expand...
Click to collapse
It sounds like maybe you did not unlock the bootloader first?

martyfender said:
It sounds like maybe you did not unlock the bootloader first?
Click to expand...
Click to collapse
Yeah exactly what it was

I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30

I'm stuck in a boot loop. Does this work with a 100011885 that has Android 11 or did I just brick it cause I didn't pay attention.

I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img

bowb said:
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
Click to expand...
Click to collapse
Did you get this working?

Valiante said:
Did you get this working?
Click to expand...
Click to collapse
No.

LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
did you happen to upload this image yet? if so, got a link?

I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?

pj_dev said:
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
Click to expand...
Click to collapse
Unfortunately, the numbers are important. Are you able to get to fastbootd? If you can get to fastbootd, I would recommend trying to change to boot slot. Newer androids actually have two boot partitions for updating purposes. You can check which boot partition you're using with `fastboot getvar current-slot` which should return "a" or "b". Then do `fastboot set-active x` and replace x with whichever slot is NOT active as determined by the previous command. If the other boot slot is still intact, this would hopefully result in a bootable device. I haven't tried this myself, but this is what I would try if I were in your situation.
If this doesn't work, I would try flashing stock with sp flash tool, which doesn't need fastboot if you can't access that. It's a leaked mediatek tool, so there isn't an official site to get it from unfortunately. I got it from here: https://androidmtk.com/smart-phone-flash-tool but use your discretion. And get v5, because that's what most of the guides use. Then you can try flashing the 3561 stock firmware here: https://forum.xda-developers.com/t/stock-stock-backups-images-otas.3998227/post-82619259
If you can get it to boot at this point and want to de-walmart it, I would recommend just flashing a GSI rather than messing around with the stock rom. You can find the GSI's here: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list

LaikaXv1 said:
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
Click to expand...
Click to collapse
Lol, remember those copy-pasted guides where they provide the wrong TWRP images and it messes up the device

So the 8" Onn actually has a boot-ramdisk it appears. On the 7" Onn Surf (100005206), there is no boot-ramdisk, so the alternative is patching a recovery.img and allowing Magisk to hijack the /recovery partition. The only drawback is, anytime you need to reboot, using hardware keys as though booting into recovery is necessary.

inzane105 said:
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
Click to expand...
Click to collapse
I'm in a similar situation, my friend got an RCA Atlas 10 Pro-S from Goodwill for $1. It had an FRP lock on it though, and we ultimately managed to get to the home screen by enabling TalkBack and watching the support video to open the browser. Then, we installed Lawnchair to access the home screen. The settings app worked, but Developer Options would not open.
GetDroidTips has published a software called Miracle Box, claiming that it can unlock MediaTek bootloaders, as well as bypass FRP. However, a VirusTotal scan indicates that it is likely malware. I tried running it in a virtual machine and it asked if I wanted to run a process impersonating "svchost.exe" as Administrator. I airgapped the virtual machine, and Miracle Box said it needed Internet access for licensing, however GetDroidTips said it was free. I suspect that this was a fake software crack.
I am aware of a program called SP Flash Tool, but that won't work because I am on Linux, and not Windows. I doubt it would work under WINE, as it requires special device-specific drivers that also only work on Windows. I have a spare Lenovo IdeaPad 110-15ACL, however I don't have the drivers needed to set up Windows 7 on it. I could, of course, use Windows 10, but I have heard it is bad for flashing, and it is very slow anyway. (I did, however, buy an SSD for it, perhaps this will speed it up enough to be somewhat usable?)
I also found an open-source MediaTek exploit script called MTKTools. It did not work, and it told me to hold all hardware buttons before plugging the device in. It still did not detect the tablet. It told me that I could also short TP1 to ground, however I could not find Test Point 1 on the tablet's motherboard.
There are no custom recoveries or FRP unlocking guides for this device, likely because it's an obscure Android 7.1 tablet from back in 2014. I wouldnt be able to flash them anyway as the bootloader is locked. It has 2 GB of RAM and the processor cores are Cortex-A35s so I'm not sure that this is worth unlocking. On the other hand, it costs over $100 from Walmart.
I am worried that the device was stolen, as it had a password, and once I reset it from Recovery mode, it had an FRP lock. If it is indeed stolen, I can't return it, due to the "as is" nature of Goodwill, and besides, I have disassembled it several times as well. Should I be concerned about the ethical implications of unlocking this device?

Does this work on Android 11? I have the Onn. 100011885 model, according to my settings app.

100003562 Onn 10.1 Android 11 (Bootloader Unlock, Magisk Root)

Hey folks I spent some time working on this yesterday (dumping Rom, Patching etc) so I thought I'd share. I am including the files I used to get this work.
This is for 100003562 Walmart Onn Tablet
I can't comment on other Onn models because I don't have any.
If your tablet goes into meltdown mode, I'm not responsible. I'm sharing the process that worked for me.
*These files are from:
*Android 11, Security Update 5AUG21 --> They probably won't work with any other version so I can't answer questions related to using them for that.
I don't recommend you try these on any other model unless you do it at you own risk.
*Strangely enough, this update doesn't have any of the Walmart apps installed or the bottom button on the taskbar. It asks if you want to install them when you are setting up the tablet*
I chose no.
Steps:
1. Enable USB Debugging, (while in Dev Options go to OEM Unlocking a tick that, (don't know if 100% necessary but I did it in my process)
and fire up a CMD or Powershell Window.
2. ADB:
adb devices (to make sure you are connected)
adb reboot bootloader
~boots to bootloader~
3. FASTBOOT
fastboot devices (to make sure you are connected)
(WARNING: the next command will factory reset the tablet)
fastboot flashing unlock
(follow volume key prompt to unlock and then device will reboot and bootloader is unlocked.)
You will see "orange state" as it boots if it worked properly. I don't have any interest in removing this message so you'll have to go elsewhere if you do.
4. Repeat steps 1-2 and get back into bootloader.
FASTBOOT:
fastboot devices
fastboot flash vbmeta <path to vbmeta.img>
fastboot flash boot <path to migisk patched.img>
fastboot reboot
5. Done
Notes:
I use Magisk Manager to do a direct install patch after I get root. (also don't know if 100% necessary, but it makes me feel better)
I'm including the stock boot.img in case you want to create your own patch with Magisk Manager. I used 24.1 (24100)
I'll answer what I can if you run into issues.
Cheers!

Reserved.

hey i was actually just about to go into the rabbit hole of pulling the boot.img, then i saw this. my tablet is stuck on the 5jan21 patch and wont update. could you tell me how you dumped the rom? also did you have to modify the vbmeta file? thanks

Mayday_Channel said:
hey i was actually just about to go into the rabbit hole of pulling the boot.img, then i saw this. my tablet is stuck on the 5jan21 patch and wont update. could you tell me how you dumped the rom? also did you have to modify the vbmeta file? thanks
Click to expand...
Click to collapse
i used sp flash and wwr. you can prob pull the boot.img pretty easily, but if you tried to take an OTA and it got corrupted, that might not work anyway. the vbmeta an empty one. this boot.img is from the most up to date ota which i got yesterday. i ordered a refurb version of this tablet and started messing with it yesterday. i have a copy of the full ROM dump as well. let me know if you need pieces and I can get them to you. you might be able to flash a few of the partitions and get it running again. can you get into fastboot?

which sp flash version? im on the latest 5.2152, every time i try to dump the full rom, it hangs on 0% readback. same with trying the boot.img. what was the full rom length, just to confirm? i got 0x750000000 from wwr

Mayday_Channel said:
which sp flash version? im on the latest 5.2152, every time i try to dump the full rom, it hangs on 0% readback. same with trying the boot.img. what was the full rom length, just to confirm? i got 0x750000000 from wwr
Click to expand...
Click to collapse
I used 5.1524. i had this issue as well and had to update the com port drivers. i used Iobit driver booster for this and it found the right driver. and yes thats the correct length for the one i dumped. i have the full thing on mega if you just want to flash it with sp flash tool.

that would be very nice. please post. thank you

Mayday_Channel said:
that would be very nice. please post. thank you
Click to expand...
Click to collapse
File folder on MEGA
mega.nz

goldensun1893 said:
File folder on MEGA
mega.nz
Click to expand...
Click to collapse
i got rid of userdata and cache to shrink it some.

thanks man

Mayday_Channel said:
thanks man
Click to expand...
Click to collapse
let me know how it works

could i please get the cache & userdata partitions? id like to keep a complete rom for archive. it seems to have flashed ok, but it broke wifi and its still stuck on january 5 patch. oh well, thats why i have 2 of these

ill drop them on there. be warned the userdata.img is something like 28GB. If you have the NV RAM Warning: ERR 0x10, there are a few tuts on here to fix that. Its common with SP Flash and MTK chips.

I think I figured out why it doesn't work. Spft isn't flashing super.img. even if I edit the scatter file to add super.img. I'll do some more trouble shooting at lunch

alright lets goooo. fixed it. just needed to change a few things in the scatter file and change the vbmeta files to img. next ill start experimenting on patching lk.bin to remove the ORANGE STATE text. thanks for the rom dump

NICE! I took a leap of faith and did this on my Oct 5th 2021 Security update build and it appears to have worked and Im rooted with magisk!!! I added a few additional steps to your commands just in case
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot erase cache
fastboot flash boot magisk_patched-24100_w97F6.img
fastboot reboot
I found a USB ADB fastboot driver that was signed and worked on my windows 10 x64 system but I had to go through the "Have Disk" manual driver install and installed even though it wasnt supposedly designed for my hardware. So insane the hoops to do this...
MT65XX-USB-VCOM-drivers\MT65XX USB VCOM drivers\Google_USB_Driver_rev4
Had trouble updating to Magisk to 24.3 however, not sure what pitfall I hit.
Wondering if I should be happy with root or try and flash TWRP and try a different ROM.

Iam in need of some help i am not sure if i have to install something to the tablet or pc but when i do the command "fastboot flashing devices" on my tablet just says on the bottom left =>FASTBOOT mode... and it doesnt change and on my pc it says <waiting for device> idk what am doing wrong can someone help me

beachmiles said:
NICE! I took a leap of faith and did this on my Oct 5th 2021 Security update build and it appears to have worked and Im rooted with magisk!!! I added a few additional steps to your commands just in case
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot erase cache
fastboot flash boot magisk_patched-24100_w97F6.img
fastboot reboot
I found a USB ADB fastboot driver that was signed and worked on my windows 10 x64 system but I had to go through the "Have Disk" manual driver install and installed even though it wasnt supposedly designed for my hardware. So insane the hoops to do this...
MT65XX-USB-VCOM-drivers\MT65XX USB VCOM drivers\Google_USB_Driver_rev4
Had trouble updating to Magisk to 24.3 however, not sure what pitfall I hit.
Wondering if I should be happy with root or try and flash TWRP and try a different ROM.
Click to expand...
Click to collapse
Followed the same steps and managed to get it working on my tablet that was on the same secpatch. However I also ran into an issue updating magisk. It acts like it worked fine and then when it reboots it asks to patch again.

Had to patch boot file manually and flash via fastboot. Still get an annoying popup when opening magisk but it's now updated to the latest 25.0.
To update run the following:
Root using ops method
Start your device and make sure that everything is rooted and working
adb reboot bootloader
fastboot flash boot [PATH TO MAGISK PATCHED 25000]
fastboot reboot
Tested on Oct521 SecPatch on a devices already rooted with OPs method. Do this at your own risk. Make backups, etc etc.​

hi nice work. sorry for my english. but i have a problem on mi onn tablet 1000035652 android 11. i try to root whit our method on fastboot no problem the tablet is unlock a message appears of the erase all data if unlock bootloader and press up volume then restart tablet so configure again and proced to fourt 4 point to flash vbdata and boot and in fastboot window okay flash then reboot and the tablet power on to the config screen then appear a message of controller apps stop then reboot and reboot infinite loop and i try to lock bootloader gain or reflash boot.img stock but no solution and i search for a alast update.zip or way to reinstal stock firmware can anyone help me ?