** DISCLAIMER: I AM NOT A DEV AND THIS IS MY HOBBY. I ASSUME NO RESPONSIBILITY IF THIS BREAKS YOUR DEVICE **The following is tested on model SGP-771. For Wifi-only model the procedure is the same but you should use the files and kernels for the Wifi model. Do not flash the ftf and kernel files intended for the cellular model on a Wifi-only tablet.I am not taking credit for any of the tools and kernels here. They are all developed by others. I am only telling you how to use them.
Credits: @zxz0O0, @AndroPlus, @tobias.waldvogel
0- Prerequisites
You need to have a functioning installation of adb and fastboot tools. You need to have proper Sony drivers installed on your PC to detect your tablet when it is connected to the PC. You should be able to flash an ftf file using flashtool. If any of these sound unfamiliar to you, stop reading, go learn about them, and then come back.
1- How to unlock your bootloader without losing the DRM keys
Sony has designed this tablet such that if you unlock your bootloader you lose your TA partition PERMANENTLY which includes some of the Xperia features and licenses that have to do with image processing etc. forever. You will also no longer receive OTAs. So in theory, without a copy of this TA partition (which is unique to each tablet and cannot be copied over from another tablet) unlocking the bootloader results in an irreversible loss of some of your tablet's features. Relocking the bootloader will not bring them back.
A hack exists that allows you to backup the TA partition before you unlock the bootloader. This backup will make the process completely reversible so if you ever need to send the tablet to Sony for repair or just want to return it to its original state you have a way. Follow these instructions carefully:
1.0- Before you begin keep in mind that this procedure, especially the unlocking step, completely erases your tablet. Disable myXperia and remove your google account before proceeding. The following will likely not work well with encryption.
1.1- Start by clean flashing any 28.0.A.8.260 firmware, For this tutorial I used SGP771_Customized HK_1296-4830_28.0.A.8.260_R10A. You can download it from https://mega.nz/#!YsUWwY5Y!0775_vLpjV9-UkoGjMWP6-Yu8L31LkJVHEyUwA7X9NA. For the wifi only model SGP712 use
https://mega.nz/#!wlIl0JDa!DR0lRL6dDn5Y-K_4768oJnLGWQyrxNV0xLHgKVVesFw (thanks to @kuroneko007)
1.2- Enter service Mode by dialing *#*#7378423#*#* -> Service info -> configuration, and make sure the device is unlockable. (To access service menu on SGP712 (Wi-Fi only model) see: http://forum.xda-developers.com/showpost.php?p=66164176&postcount=5) Also check -> Service Tests -> Security and you will see a bunch of "active" and "OK" attributes. You can take screenshots for your reference.
1.3- Turn on usb debugging mode on your tablet.
1.4- Download iovyroot zip v0.4 or higher from here.
1.5- Unzip this zip file into a folder of your choice and open a command terminal there.
1.6- Connect the tablet which is now in USB debugging mode to your PC and answer yes when it asks to authorize the PC to access the tablet in USB debugging mode. You can check that the PC indeed sees the tablet by running this command
Code:
adb devices
1.7- Run the following command:
Code:
tabackup
1.8- VERY IMPORTANT: Make sure the command completes with no errors. If all goes well you will have a file with a name like TA-07102015.img (the name may be different for you) with a size of 2MB in your folder.
1.9- Save this file in a very safe place. Save it on your hard disk, AND email it to yourself, AND put it on your google drive. If you lose this file you can never reverse the bootloader unlocking process.
1.10- Reboot the device.
1.11- Now you can unlock the bootloader. Follow the instructions at Sony's official website at http://developer.sonymobile.com/unlockbootloader Also save your unlock code that you obtain in this step somewhere. You may need it some day.
1.12- Reboot the device and it will briefly enter recovery and then start the tablet initial setup.
1.13- (Optional) you can easily verify that your bootloader is unlocked by entering the fastboot mode, obtaining any boot image, and running the following command to boot your tablet with that image:
Code:
fastboot boot boot.img
1.14- (Optional) you can see that the DRM keys are erased from your tablet by repeating step 1.2 but this time you will see a bunch of errors under Service Tests -> Security.
1.15- As a side effect of unlocking the bootloader you lose the ability to receive OTA updates. Clean flash a Marshmallow ftf to continue. For this tutorial I used Marshmallow 6.0 SGP771_Customized DE_1295-6955_32.1.A.1.185_R4C (the latest firmware at the time of this writing.)
2- How to emulate DRM keys and/or root after unlocking the bootloader.
A hack exists that can emulate the DRM keys:
2.1- Obtain a kernel boot image. If you want to stick with the stock kernel you need to extract kernel.elf from the ftf that you flashed in step 1.15. If you want a custom kernel you can download one from https://kernel.andro.plus/kitakami.html Note that whatever kernel you are using in this step must match the firmware version currently installed on your system. For this example I downloaded Z4T_SGP771_AndroPlusKernel_v27.zip and extracted the boot.img file from the zip, which matches Marshmallow 32.1.A.1.185.
2.2- Download rootkernel_v4.42_Windows_Linux.zip (or a higher version) from http://forum.xda-developers.com/xperia-z5/development/root-automatic-repack-stock-kernel-dm-t3301605 and unzip it in a folder of your choice.
2.3- Copy the kernel (e.g. boot.img) to this folder. If you want root, place SuperSU 2.71 (or higher) in this folder as well. Make sure the name of the SuperSU zip starts with letters "SuperSU". The latest SuperSU can be obtained from: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133
2.4- Open a command terminal in this folder and run the rootkernel script. Your command should look similar to this:
Code:
rootkernel.cmd boot.img boot-patched.img
When prompted, answer as follows:
- Sony RIC is enabled. Disable? [Y/n] Y
- Install TWRP recovery? [Y/n] N
- Found SuperSU-v2.71-20160331103524.zip. Install? [Y/n] Y (if you want root)
- Install DRM fix? [Y/n] Y (if you want DRM emulation)This will create a new kernel image called boot-patched.img which you will now flash on your tablet.
2.5- Boot the tablet in the fastboot mode and flash your patched image using the following fastboot command:
Code:
fastboot flash boot boot-patched.img
2.6- (Optional) You can reboot the tablet and see that the DRM keys are indeed retrieved by repeating step 1.2. You can also open settings -> display, and look under Image Enhancement. If the DRM emulation is succesfull you will see this but if it hasn't been successful you will see this.
3- How to flash a custom or stock kernel
3.1- Whether you want to use a custom kernel or stock, and whether you have done the DRM patch described above or not, to flash it on your tablet you need to restart the tablet in fastboot mode.
3.2- To flash the kernel use this command:
Code:
fastboot flash boot [I]name_of_your_kernel[/I]
You will replace name_of_your_kernel with whatever your kernel is called (e.g. boot.img, kernel.elf, etc.)
4- How to flash recovery
4.0- To install TWRP recovery you need to flash AndroPlus kernel first (see sections 2.1 and 3).
4.1- Download a TWRP image from the same webpage. For this tutorial I used TWRP-3.0.2-0-20160417.img.
4.2- Reboot into fastboot mode and run this command:
Code:
fastboot flash recovery TWRP-3.0.2-0-20160417.img
4.3- Reboot the tablet. To enter recovery touch the volume keys when the LED turns yellow during the boot splash screen.
5- How to relock bootloader and return it to original factory state
5.0- To relock the bootloader along with restoring the DRM keys the tablet must have unmodified stock firmware.
5.1- Repeat step 1.1
5.2- Repeat steps 1.3, 1.4, and 1.5
5.3- Copy the TA backup image that you had obtained in section 1 in the iovyroot folder and use the tarestore command to flash the TA partition back onto the tablet. The command will look similar to this:
Code:
tarestore TA-07102015.img
Make sure the command completes with no error. If it fails the first time try again. Reboot the tablet. Your bootloader is now locked and your DRM keys restored.
5.4- (Optional) You can verify that you are back to the original locked state by repeating step 1.2.
Reserved
For FAQ, etc.
Thanks for this great guide.
My question is this. Since it would be easier to avoid all this, can this tool help us do it without having to downgrade?
http://www.xda-developers.com/chainfires-flashfire-can-now-create-fastboot-flashable-backups/
I mean would it also backup the DRM keys? Has anyone tried (preferably with a TA backup already in place so that he may not lose the keys in case that this won't work)...
Stevethegreat said:
Thanks for this great guide.
My question is this. Since it would be easier to avoid all this, can this tool help us do it without having to downgrade?
http://www.xda-developers.com/chainfires-flashfire-can-now-create-fastboot-flashable-backups/
I mean would it also backup the DRM keys? Has anyone tried (preferably with a TA backup already in place so that he may not lose the keys in case that this won't work)...
Click to expand...
Click to collapse
No. This tool cannot help you and trust me there is no shortcut to avoid all of this.
Flashfire (the tool you mentioned) only works if you already have root access. There is no root available for this tablet without unlocking the bootloader, and unlocking the bootloader means you lose the TA partition immediately. So by the time you get this tool to work your TA partition will have been long erased.
Hi. Does this solution suit only for people who have not erased drm keys yet and are be able to backup it? For those who lost, no up-to-date solution except for that http://forum.xda-developers.com/xperia-z5/development/sony-credentials-restore-unlocking-t3296383 ?
Correct.
Not understand step:
1.1- Start by clean flashing any 28.0.A.8.260 firmware
without this step temporary root not work...
But how flash firmware if device has still locked bootloader? What tool using for this step?
mrdarek said:
Not understand step:
1.1- Start by clean flashing any 28.0.A.8.260 firmware
without this step temporary root not work...
But how flash firmware if device has still locked bootloader? What tool using for this step?
Click to expand...
Click to collapse
You can download a tool called flashtool from http://www.flashtool.net/index.php and flash an unmodified ftf firmware. Because the firmware is unmodified the bootloader doesn't have to be unlocked. Many tutorials are available on xda and elsewhere about using this tool, which you can find by doing a Google search. As I said in the prerequisite section, "You should be able to flash an ftf file using flashtool. "
anybody successfully tried this guide?
I learned how flash and succesfully do my first flash.
Currently I have problem with iovyroot
It always say
Error: Device not supported
rm: /data/local/tmp/tabackup/TA-*.img: No such file or directory
My current software is:
SGP771_28.0.A.8.251_R15A_UK Generic_1295-4697
and it earlier then december 2015 like need iovyroot
I can't find software *.260 like in guide, I don't know if this created that problem...
Maybe najoor version work because it was "customized" - it mean - with patched kernel. But if locked bootloader allow me flash customized firmware?
mrdarek said:
I learned how flash and succesfully do my first flash.
Currently I have problem with iovyroot
It always say
Error: Device not supported
rm: /data/local/tmp/tabackup/TA-*.img: No such file or directory
My current software is:
SGP771_28.0.A.8.251_R15A_UK Generic_1295-4697
and it earlier then december 2015 like need iovyroot
I can't find software *.260 like in guide, I don't know if this created that problem...
Maybe najoor version work because it was "customized" - it mean - with patched kernel. But if locked bootloader allow me flash customized firmware?
Click to expand...
Click to collapse
As you said it, the problem was that you didn't flash the 260 version, not that it wasn't customized.
If you can't find the right version I upload it and post a link in the OP. It takes a little time so check this thread again in about 5 hours.
I found "260" firmware and magically all start work . I finished all job and have now root and recovery .
It worth add tips about fastboot - you can check connection by command but also you can see - if LED on device is blue - connection in fastboot work (if not - try again)
My last question is about how check that DRM emulation work - under security after phone code is still errors. I 100% patched kernel and flash it properly.
Thanks for tutorial and support
Something just not work... Someone can check sizes ?:
boot.img - original kernel androplus 2.5: 17 756 160
andropatched.img - patched with my drm keys: 17 760 256
keys: 2 097 152
mrdarek said:
I found "260" firmware and magically all start work . I finished all job and have now root and recovery .
It worth add tips about fastboot - you can check connection by command but also you can see - if LED on device is blue - connection in fastboot work (if not - try again)
My last question is about how check that DRM emulation work - under security after phone code is still errors. I 100% patched kernel and flash it properly.
Thanks for tutorial and support
Something just not work... Someone can check sizes ?:
boot.img - original kernel androplus 2.5: 17 756 160
andropatched.img - patched with my drm keys: 17 760 256
keys: 2 097 152
Click to expand...
Click to collapse
The sizes sound about right. What errors are you getting?
You can try to relock the bootloader using the instructions and see if your TA backup works. If that works then we can see why the kernel is patched correctly.
Hi - I succesfully restored bootloader (=locked it, and no errors in service) - so I'm sure - my keys are OK. It was very hard - 3x flash, 3 x try use restore (still was errors), and at last success!!!
Now all procedure again, almost from start - but I also more try if need - I send info tomorrow
---------------------------------------
Hmmm not work... Tested original marsmallow germany kernel and androkernel 2.4. Image test described in step 2.6 fail
Under security is: Blobs : generic error!
HUK: generic error!
Flashed kernels names are properly recognized under settings. root work. I not have idea where is bug. It must be during creating andropatched image - but no errors here:
C:\rootkit>drmonly boot.img andropatched.img TA-07102015.img
- Unpacking kernel
Found android boot image
Kernel version: 3.10.84
- Detected vendor: somc (Sony), device: karin, variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 6.0
- Skipping drmfix. Unsuppported/untested for model karin
- Creating new initramfs
- Creating boot image
- Cleaning up
Done
C:\rootkit>
--------------------Maybe that line is wrong!!!!!!!!
Skipping drmfix. Unsuppported/untested for model karin
but how fix it?
mrdarek said:
Hi - I succesfully restored bootloader (=locked it, and no errors in service) - so I'm sure - my keys are OK. It was very hard - 3x flash, 3 x try use restore (still was errors), and at last success!!!
Now all procedure again, almost from start - but I also more try if need - I send info tomorrow
---------------------------------------
Hmmm not work... Tested original marsmallow germany kernel and androkernel 2.4. Image test described in step 2.6 fail
Under security is: Blobs : generic error!
HUK: generic error!
Flashed kernels names are properly recognized under settings. root work. I not have idea where is bug. It must be during creating andropatched image - but no errors here:
C:\rootkit>drmonly boot.img andropatched.img TA-07102015.img
- Unpacking kernel
Found android boot image
Kernel version: 3.10.84
- Detected vendor: somc (Sony), device: karin, variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 6.0
- Skipping drmfix. Unsuppported/untested for model karin
- Creating new initramfs
- Creating boot image
- Cleaning up
Done
C:\rootkit>
--------------------Maybe that line is wrong!!!!!!!!
Skipping drmfix. Unsuppported/untested for model karin
but how fix it?
Click to expand...
Click to collapse
You need to follow the instructions to the letter:
1- flash the esaxt same firmware that you made the TA backup with.
2- Restore TA backup.
I guarantee you it will work or l will help you debug it.
Not very understand. It was done. TA backup was done with "260" firmware. I'm able lock that firmware again, so it work. but it only lollipop, can't go into marshmallow from it.
Goal is: marshmallow with root twrp and drm. How achieve it?
I see - I have new device version (karin) so (hopefully) temporary this solution not work for me. I can have only marshmallow with root and twrp (no DRM) or marshmallow with DRM (no root and twrp). I must wait as developers support my device, and keep my keys in safe place to that time.
mrdarek said:
Goal is: marshmallow with root twrp and drm. How achieve it?
Click to expand...
Click to collapse
mrdarek said:
Tested original marsmallow germany kernel and androkernel 2.4. Image test described in step 2.6 fail
...
Flashed kernels names are properly recognized under settings. root work. I not have idea where is bug. It must be during creating andropatched image - but no errors here:
...
C:\rootkit>drmonly boot.img andropatched.img TA-07102015.img
...
- Skipping drmfix. Unsuppported/untested for model karin
...
Click to expand...
Click to collapse
OK, I see what is going on.
When I use drmonly script version 4.24 I get the following:
Code:
C:\Users\najoor\Desktop\rootkernel_v4.24_Windows_Linux>drmonly.cmd boot.img test.img TA-07102015.img
- Unpacking kernel
Found android boot image
- Unpacking initramfs
- 64-bit platfrom detected
- Configuring secd
- Configuring wvkbd
- Configuring drmserver
- Creating new initramfs
- Creating boot image
- Cleaning up
Done
But if I use version 4.31:
Code:
C:\Users\shervin\Desktop\working\Download\rootkernel_v4.31_Windows_Linux>drmonly
.cmd boot.img x.img TA-07102015.img
- Unpacking kernel
Found android boot image
Kernel version: 3.10.84
- Detected vendor: somc (Sony), device: karin, variant: row
- Unpacking initramfs
- Detected platform: 64-bit
- Detected Android version: 6.0
- Skipping drmfix. Unsuppported/untested for model karin
- Creating new initramfs
- Creating boot image
- Cleaning up
Done
I have no idea why @tobias.waldvogel decided to remove the support for Tablet Z4 in the latest version of the drmonly script, but I can see that the DRM works fine with the old version.
I do not have persmission from @tobias.waldvogel to post the older version of his script here so you have to ask him to either add support in the new version or give you the older version.
Thanks - so now I see where is problem. I try contact with author.
Heh - I send PM him but it was my fault [added: it not totally fault - Tobias work on new version and soon we should have new working utility for all ]
I'm enough clever to modify script in 5 minutes (it txt ), and enough stupid to flash it immediately. Now I have....
rooted marshmallow with DRM KEY and TWRP - job finished
To finish job I disabled in settings auto-update, because now it start possible
FAILED <remote dtb not found>
Unlocked the bootloader and successfully retrieved TA partion with SGP771_28.0.A.8.260 , installed stock 32.1.A.1.185, tablet runs fine without problems.
Retrieving the boot.img from Z4T_SGP771_AndroPlusKernel_v27 for my SGP771 device and running
Code:
fastboot boot boot.img
gives
downloading 'boot.img' ...
OKAY [ 0.347s]
booting ....
FAILED <remote: dtb not found>
Click to expand...
Click to collapse
This happens even with the 32.1.A.1.185 stock boot.img. Tried on Kubuntu 16.04 and WIN7. Same result. When I flash
the AndroPlusKernel_v27 boot.img,
Code:
fastboot flash boot boot.img
finishes without errors and tablet does not boot any more but -thanks God- fastboot mode still functioning.
I am lost. Can not root my tablet . Any clues?
---------- Post added at 04:14 PM ---------- Previous post was at 03:41 PM ----------
Sorry, correction:
first retrieved TA partion, then unlocked bootloader.
Hybel1507 said:
Unlocked the bootloader and successfully retrieved TA partion with SGP771_28.0.A.8.260 , installed stock 32.1.A.1.185, tablet runs fine without problems.
Retrieving the boot.img from Z4T_SGP771_AndroPlusKernel_v27 for my SGP771 device and running
Code:
fastboot boot boot.img
gives
This happens even with the 32.1.A.1.185 stock boot.img. Tried on Kubuntu 16.04 and WIN7. Same result. When I flash
the AndroPlusKernel_v27 boot.img,
Code:
fastboot flash boot boot.img
finishes without errors and tablet does not boot any more but -thanks God- fastboot mode still functioning.
I am lost. Can not root my tablet . Any clues?
---------- Post added at 04:14 PM ---------- Previous post was at 03:41 PM ----------
Sorry, correction:
first retrieved TA partion, then unlocked bootloader.
Click to expand...
Click to collapse
Please follow the following steps exactly and let me know in what step things fail. If you do not provide detailed information I will not be able to help you.
1- Clean flash a 185 ftf and make sure system boots fine.
2- extract the kernel.elf from the ftf and I use fastboot to see if you can boot using fastboot with this kernel.
3- extract boot.img from AndroPlusKernel_v27 and see if you can use fastboot to boot with this image.
4- use the procedure in the OP to patch AndroPlus kernel and see if you can use fastboot to boot with this image.
5- flash this image using fastboot to see if the system boots fine.
I use Q/A so users can bring up useful info-tech 'live', whatever they found.
After building OOS from github, the fastboot-ed [_debug].img stuck on 'ANDROID' silver bootlogo, with adb log working. In case some want to help debugging, all [_debug].img are uploaded to AFH; the purpose is to provide a clean (1.5GB sparse image) OOSrom without Gapps & Addons, and with minimal patches like MicroG/host/...
Code:
out/target/product/msm8998/msm8998-ota-eng.nn.zip
(& make otapackage always failed.)
Thx to @regalstreak for UltraCAF _repo.
The complete OP5 vendor are zipped; I noticed that vendor on various op5' github were missing (a very) few files; so you can meld with yours: boot in twrp and mount system +mtp for complete extraction https://github.com/OnePlusOSS/android/blob/oneplus/QC8998_N_7.1/pull_library.sh .
Attached op5PARTED.txt for full info on OP5 partitions; abl.elf(edk2) is "auto motive bootloader" ? (like Samsung s8) and differs from emmc_appsboot.mbn (like OP3T 'LittleKernel')
Unbricking : WIP (rawprogram_.xml...)
- uncertified Playstore : clean Playstore.apk's via /Setting /Apps /AppInfo /Storage data &cache + /force stop
- Magisk SafetyNet error : reflash OOS4.5.x.zip+magisk.zip+wipe cache/Dalvik
If you can't correct wrong Playstore and Magisk SafetyNet
http://oxygenos.oneplus.net.s3.amazonaws.com/OP5_recovery.img
0) reflash FIRST official Oneplus5 Recovery : OP5_recovery.img
1_r) check twice that official OP5_recovery.img is effective : boot into recovery and use option reboot to recovery...
2_r) use recovery's option to wipe: all 3 possibilities
3_r) use recovery's option to reboot to bootloader
4_b) fastboot oem lock ...& reboot to bootloader
5_b) fastboot oem unlock ...& reboot to bootloader
6_b) fastboot erase boot + fastboot erase system + fastboot erase userdata + fastboot erase cache
7_b) fastboot boot recovery OP5_recovery.img
8_r) use recovery's option to sideload
9_r) adb sideload official OnePlus5Oxygen'_..._...'.zip
10_r) check that it failed to 0 received data
11_r) use recovery's option to wipe: all 3 possibilities then repeat 8) 9)
11.8_r) use recovery's option to sideload
11.9_r) adb sideload official OnePlus5Oxygen'_..._...'.zip
You should now see working sideload with % ; wait to 100% and reboot to CLEAN OOS
If you want to proceed Magisk SafetyNet ok with certified Playstore, ALWAYS ONLY USE OFFICIAL TWRP.
Nota, for info, rawprogram4.xml, from op3T rescue files (via Qualcomm QFIL), is attached.
CAUTION : always check your IMEI *#06# and backup: modemst1 (/dev/block/sdf1) + modemst2 (/dev/block/sdf2)
Thanks for the steps ! This was a new learning for me
Thanks ! I Will Test.
Notes About Xiaomi Mi Devices:
Some Xiaomi Mi devices have bootloaders that require additional steps to unlock before you are able to flash custom images. This typically involves filling out an application to have your device unlocked.
You will need to follow the steps on Xiaomi's MIUI website in order to unlock your device.
Understand that unlocking your device will wipe all of your personal data, settings, and apps from its memory.
TWRP Install (Requires TWRP 2.8.4 or higher already installed):
Download the latest TWRP image file (.img) from the download link and boot TWRP. Go to install and find and select the Images... button. Browse to the image that you downloaded and select it. Choose recovery and swipe to flash.
Fastboot Install Method (No Root Required):
You will need the platform-tools from the Android SDK on your computer. Find the Android command line tools section on the page linked and install the SDK tools package. From the SDK Manager, download only the platform-tools to get adb and fastboot binaries.
Windows users will need proper drivers installed on their computer. You can try the simple FWUL adb/fastboot ISO or the Naked ADB drivers or the Universal ADB drivers if you don't already have a working driver installed
On your device, go into Settings -> About and find the Build Number and tap on it 7 times to enable developer settings. Press back and go into Developer Options and enable USB debugging. From your computer, open a command prompt and type:
adb reboot bootloader
You should now be in fastboot mode.
Download the correct image file and copy the file into the same folder as your adb and fastboot binaries. Rename the image to twrp.img and type:
fastboot flash recovery twrp.img
fastboot reboot
Note many devices will replace your custom recovery automatically during first boot. To prevent this, use Google to find the proper key combo to enter recovery. After typing fastboot reboot, hold the key combo and boot to TWRP. Once TWRP is booted, TWRP will patch the stock ROM to prevent the stock ROM from replacing TWRP. If you don't follow this step, you will have to repeat the install.
dd Install Method (Requires Root):
Download the latest image file (.img) from the download link above. Place it in the root of your /sdcard folder and rename it to twrp.img. Run the following commands via adb shell or a terminal emulator app:
su
dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
#Download
dl.twrp.me/mido/twrp-3.2.1-0-mido.img
All credit goes to TWRP Devoloper
I am just share the file
abed0203 said:
Notes About Xiaomi Mi Devices:
Some Xiaomi Mi devices have bootloaders that require additional steps to unlock before you are able to flash custom images. This typically involves filling out an application to have your device unlocked.
All credit goes to TWRP Devoloper
I am just share the file
Click to expand...
Click to collapse
Thanks Thanks and once again, Thanks. It works fine with my RN 4 SD!
Please help me how to install twrp and root on redmi note 4x/mido miui 9.5.9.0...help me master...
ungah said:
Please help me how to install twrp and root on redmi note 4x/mido miui 9.5.9.0...help me master...
Click to expand...
Click to collapse
https://forum.xda-developers.com/re...p-step-guide-to-flash-android-n-beta-t3551221
Is it Treble supported?
Rifat Rezwan said:
Is it Treble supported?
Click to expand...
Click to collapse
I think this is a FAQ now. Official TWRP doesn't support Treble. There is a custom Treble version, which you can find a link to on the LOS 15.1 Treble threads.
You can also try OrangeFox TWRP, which supports Treble.
This post is refined version of my Miui forum's post.
Decryption error, unknown baseband, Wifi issues, IMEI NULL after downgrading, custom rom installation or any other messing up?
Then you're at the right place .
NOTE: This guide is only for Snapdragon version. Bootloader unlocked not necessary.
The first thing to address is Decryption error, This is due to Miui default encryption. To recover from this error you have to goto TWRP( You should know bcz Decryption error occurs after installing custom rom and custom rom needs TWRP ) and format data in wipe options.
Now here comes the part to recover imei, efs and baseband
Things you will need
1. Miui 8 marshmallow fastboot romhttp://bigota.d.miui.com/V8.2.3.0.MHOMIDL/kenzo_global_images_V8.2.3.0.MHOMIDL_20170425.0000.00_6.0_global_d25b57383a.tgz
2.MiFlash tool Latesthttp://en.miui.com/thread-345974-1-1.html | Please disable driver signature before installing to install drivers successfully.
4.IMEI repair and EFS recovery tool + adb (attached below)
5.EDL zip (Put rn3 in fastboot and run reboot file from this zip after extraction)( Attached)
6.ZCX TWRP https://www.androidfilehost.com/?fid=24727332921017084
7. Bootloader unlock zip(extract it)https://forum.xda-developers.com/attachment.php?attachmentid=4057737
Unlocking bootloader(Skip if already unlocked)
1. Put rn3 in fastboot then edl.
2. Open miflash tool and browse to the bootloader unlock zip( Select the folder extracted)
3. Now click refresh and flash( If any "non-hlos" error occurs put non-hlos file from "stock fastboot ROM images folder" to unlock zip's images folder.)
Unlock done.
We're now going to flash stock ROM and restore modem and efs files.
1.Extract the fastboot rom (2 times,firstly the tar file and then the file that is in the extracted folder). It is must to extract the rom in root of C drive so that the path of the extracted files do not contain any spaces.
2.Open Miflash tool
3.Put RN3 in fastboot mode
4.Open efs+adb+IMEI folder.
Press shift inside the folder and click open command
window here (adb terminal)
Type
HTML:
fastboot erase modemst1
fastboot erase modemst2
fastboot erase fsg
fastboot flash modemst1 modemst1
fastboot flash modemst2 modemst2
fastboot flash fsg fsg
5.Now browse ROM folder (Present in the location where you have extracted the rom ) from Mi flash tool.
If drivers properly installed Mi flash will recognise the device.
6. Click refresh and then Flash.
Wait for 10-15 mins, miflash will show success. Reboot the device by holding power button.
7. Check device's Imei, baseband and networks.
8. If IMEI is still null follow the guide hereafter else use your device as earlier and rate this post.
IMEI RECOVERY
1.Boot into fastboot
2.Flash ZCX TWRP (Extract the zip and run the batch file named "╡τ─╘PC╢╦╦ó╚δrecovery" or something)
3. If phone doesn't automatically boot to twrp press vol up+power button.
4. If language is chineese, change it to english( a Google search will definitely help you)
5. Now in TWRP goto advance->supersu->install->Reboot.
6.
5.Connect your RN3 to pc and turn on usb debugging, open the adb terminal(use the efs folder)
6.Type the following and accept the permission on the device.
HTML:
adb shell
su
setprop sys.usb.config diag,adb
7. Now the device is in diagnostic mode and made sure it is listed in the device manager as Qualcomm HS-USB Android DIAG 901D, If not update the driver by manually browsing to the ports category of the installed drivers.( Sometimes phone doesn't goto diag mode in miui, the workaround is to install a custom ROM and root it and run the above commands.)
8.Open efs+adb+IMEI folder and run WriteDualIMEI(W+G_eMMC) ..
9.Type Both the IMEI from the box or invoice and click Write
10.It will show Pass .
11.You have successfully flashed the IMEI
12.Reboot and check IMEI(*#06#).
If there are still issues with networks but Imei is ok you need to flash qcn file.
FLASHING QCN FILE
1. Download this QCN ZIP and extract.
2. Download Qualcomm qpst tools.
3. Follow this guide from further steps.
https://www.google.co.in/amp/s/forum.xda-developers.com/redmi-note-3/how-to/guide-qpst-tool-backup-imei-nvram-t3455297/amp/
I'm giving credits to all those people whose work I've consolidated for my post and sincerely thankful for the work done by them. Here are some of them
IMEI+EFS-------http://forum.xda-developers.com/member.php?u=7469310
DualIMEI WRITER-----Archelot http://en.miui.com/space-uid-1597338059.html
ZCX TWRP-----http://www.miui.com/thread-4395191-1-1.html
Hi, I have an OnePlus 8 Pro coming from iOS. I've never had an Android device before except my eReader and I haven't customised that in any way since I just read books on it so I'm a complete noob.
I would like to get myself a minimal installation of Android without any bloat or Google services, instead I want MicroG + Aurora Store and F-Droid.
I have a few ideas on what to do:
Installing some precompiled GSI
Compiling AOSP from source
Compiling GSI from source
I've tried installing precompiled GSI from git hub.c0m/phhusson/treble_experimentations/releases aswell as from Google with the instructions provided here source.and roid.c0m/setup/build/gsi
Code:
Boot to fastboot mode and unlock the bootloader. The devices supporting fastbootd also need to boot into fastbootd by:
$ fastboot reboot fastboot
Disable verify boot (AVB) by flashing vbmeta.img:
$ fastboot --disable-verification flash vbmeta vbmeta.img
Erase and flash the GSI to the system partition:
$ fastboot erase system
$ fastboot flash system system.img
Wipe the user data and clear the data from other necessary partitions (for example, user data and system partitions):
$ fastboot -w
Reboot:
$ fastboot reboot
but I get stuck on the boot screen.
I use arm64 a/b vanilla images. Could anyone share image link + installation instructions if they've gotten it to work? I prefer dumb-proof instructions, especially when my stuff doesn't work.
I haven't tried compiling AOSP because I want some kind of confirmation of it working for other people before I try. I've heard that you just download the source and then add some vendor stuff in the manifest but I rather just use something precompiled first, and then compile something myself after I've tried the DeGoogled experience so I don't end up spending hours on something I don't even like. (Tinkering is fun but getting compilation errors is not).
Just use xXx NoLimits all the crap from Google is turned off, you can disable the lot if you need to. Check in the thread for details.