Related
Intro
This is a guide for people who want to make some modifications to config files, or other files, on System partition but do not want to root their phone or install custom recovery in order to keep OTAs and some apps, which don't play nicely with rooted phones, working. Examples of those config mods could be changing DPI or changing volume levels etc, which you would only do once and forget about it.
While root allows you to do those kinds of changes from within android, this methods would require a PC.
If you are familiar with temporary booting into a custom recovery, skip to step 5.
The usual i am not responsible for any of your actions / bricked phones disclaimer applies.
Prerequisites
- A working adb / fastboot environment. Please use Android SDK, if you installed your adb and fastboot using other tools, things might not work, so please just install SDK, install Google USB Driver from SDK manager, install Platform-Tools from SDK manager (should be installed by default) and then add your sdk platform-tools path to your PATH environment variable to have it available in cmd in every path.
- Unlocked bootloader
- TWRP image for you phone (.img) https://twrp.me/devices/huaweinexus6p.html
Follow the [GUIDE] Unlock/Root/Flash for Nexus 6P for that.
Instructions
Here is an example of modifying DPI. I prefer build.prop method of modifying DPI because using the adb wm density command usually caused some issues for me, but modifying via build.prop didn't.
1 - With you phone ON, connect it to the PC and make sure adb is working by running
Code:
adb devices
and making sure that device is listed
2 - Reboot into bootloader. and make sure fastboot is good to go too. Run commands one at a time:
Code:
adb reboot bootloader
fastboot devices
3 - Place your TWRP image file in some easily accessible folder, for the sake of this example i will use C:\Mods.
4 - Temporary boot into TWRP (we are not flashing it here at all).
Code:
fastboot boot c:\Mods\twrp-2.8.7.0-angler.img
Here is where things may not work. If you don't see your phone boot into TWRP then either your adb / fastboot environment not setup correctly (installed via a tool instead of SDK) or your img file is corrupt.
One thing that works for me when TWRP refuses to boot is to restart cmd and issue the command again this closes and reopens adb/fastboot daemon.
5 - Once TWRP is up on your phone it may display a warning saying "TWRP has detected an unmounted system partition". Swipe to allow modifications at the bottom. This screen may not come up at all.
6 - Go to Mount >>> Tick System >>> Make sure "Only Mount System Read Only" is unticked >>> Press Back button
7 - Back on your PC check if your device is listed
Code:
adb devices
8 - Pull the file you need to modify from system partition to your PC. Please note the direction of the slashes:
Code:
adb pull /system/build.prop c:/Mods
9 - Now you should see build.prop in your c:\Mods folder. Use Notepad++ or something like that to edit the file. Find the line with lcd_density= and change it's value to whatever you need and save the file.
10 - Push the file back to your phone:
Code:
adb push c:/Mods/build.prop /system
11 - Reboot
Code:
adb reboot
12 - Profit.
Hope this will help anyone who is looking to do some mods without installing custom recovery and rooting your phone.
Cheers.
Would this work for adding the tethering bypass line in the build prop?
Yes it will. What's the line again I was looking for it the other day and couldn't find it...
Works are per OP's original post, tested and boosted the headphone volume without a problem.
Headphone path is /system/etc/mixer_paths.xml
So as per OP's example to pull: adb pull /system/etc/mixer_paths.xml c:/Mods
push: adb push c:/Mods/mixer_paths.xml /system/etc
I'm using the OP's "Mods" folder to demonstrate the file path but this may vary on your PC.
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
skrowl said:
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
Click to expand...
Click to collapse
You can certainly push the files to system partition and they will retain there after reboot. So if you know which files have to be pushed for SuperSU then give that a go. It shouldn't break anything.
I haven't tried pushing SuperSU files to system partition before so I can't guarantee that OTAs will work after this. The only way to find out is to try it i guess...
Can you run nandroids?
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
NCguy said:
Can you run nandroids?
Click to expand...
Click to collapse
Im not sure what you mean?
rohit25 said:
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
Click to expand...
Click to collapse
If it's on the system partition then I yes you can.
locolbd said:
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
Click to expand...
Click to collapse
I've never had a problem with changing DPI using this method on a nexus phone if that helps.
denk said:
Im not sure what you mean?
Click to expand...
Click to collapse
Can you run nandroids backups from TWRP by just booting into it?
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
I got this too when I flashed MOAB via adb sideload. I'm just wondering if the same warning appears with the adb push method. Also, the file's permissions don't need to be set after adb push?
My main concern is if Android Pay still works with the red triangle warning. Anyone?
FYI Flashing back to stock is no issue for me.
NCguy said:
Can you run nandroids backups from TWRP by just booting into it?
Click to expand...
Click to collapse
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
Thanks for trying it out! Sometimes OTA notifications take a little while to come up after reboot. But based on the warning Im afraid that they might be disabled now. It looks like it runs some sort of a check on the system partition to verify its legitimacy. So modifying files would be fine on it using this method but looks like adding them won't work.
TWRP just released their recovery with decryption support so you can just follow the standard procedure or just temporary booting into TWRP and rooting from there which works as well.
denk said:
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
Click to expand...
Click to collapse
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
NCguy said:
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
Click to expand...
Click to collapse
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
denk said:
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
Click to expand...
Click to collapse
Thanks a lot for that. I didn't unlock the bootloader. Ugh. Time to start over. To me nandroids alone make it worth the effort.
I have been experimenting with flashing, etc. and somehow the lockscreen were corrupted and the pattern I was using was not longer valid. I had the fingerprint already setup so I could enter using the rear sensor, but having a corrupted lockscreen is annoying. THis method requires TWRP custom recovery. It is compatible with locked bootloaders and doesn't modify the stock boot or system. It is also compatible with all the AAXON 7 models.
If you have the stock ROM and need TWRP and ADB interface:
A. Setup ADB interface in your PC and device drivers. and connect your terminal to the PC.
B. Setup axon7tool in your computer. Enter into EDL mode by running the command "adb reboot edl" in the command prompt. The terminal will seen to be off.
C. Disable the antivirus and then backup your recovery image using axon7tool running "axon7tool -r recovery". Save the created file in a safe place.
D. Flash tenfar's signed TWRP as a new recovery using axon7tool. It will reboot to system again.
E. Open the command prompt and run:
Code:
adb devices
adb reboot recovery
1. In TWRP , and with the ADB interface properly installed run these the commands from your computer:
Code:
adb devices
adb shell mv /data/system/locksettings.db locksettings.db.old
adb reboot
Now the system will allow you to pass lockscreen without security. In that case you do not need to apply the rest of the steps. Should you continue experimenting issues with the lockscreen, then you should apply the full procedure. Just add the following 2 steps:
2. Open the command prompt and run:
Code:
adb devices
adb reboot recovery
3. When TWRP had fully loaded, run in the command prompt the following commands:
Code:
adb devices
adb shell mv /data/system/gatekeeper.pattern.key gatekeeper.pattern.key.old
adb shell mv /data/system/locksettings.db locksettings.db.old
adb shell mv /data/system/gatekeeper.password.key gatekeeper.password.key.old
adb shell mv /data/system/locksettings.db-shm locksettings.db-shm.old
adb shell mv /data/system/locksettings.db-wal locksettings.db-wal.old
adb reboot
If you want to restore the stock recovery, you just need to rename the recovery-backup.bin file created in step C back to recovery.bin and run the command "axon7tool -w recovery". after that you can enable your antivirus software again. axon7tool can't connect with some antivirus software. I will be editing this OP with links to the procedures required for each step. All of them are in this forums.
Enjoy
@Oki
To fix either " Wrong Pattern " , " Wrong Pin " users only need to delete " /data/system/locksettings.db " from either Terminal/File Explorer with root or TWRP File explorer then Reboot and you'll be good to go .
DrakenFX said:
@Oki
To fix either " Wrong Pattern " , " Wrong Pin " users only need to delete " /data/system/locksettings.db " from either Terminal/File Explorer with root or TWRP File explorer then Reboot and you'll be good to go .
Click to expand...
Click to collapse
Sure! but this guide is intended for people with the stock, unrooted, blocked bootloader who want to remain with a pure stock experience. Usually people without experience rooting devices. This is why I will edit the guide to add all the details to every step.
Could I do this with a pin as well? I restored a backup and it corrupted my password and I have to use the fingerprint on the back to get in.
twilighttony said:
Could I do this with a pin as well? I restored a backup and it corrupted my password and I have to use the fingerprint on the back to get in.
Click to expand...
Click to collapse
Yes, the procedure deletes everything. If you have problems just do the same also with:
gatekeeper.password.key
locksettings.db-shm
locksettings.db-wal
I have updated the OP just to describe the full procedure.
I had this problem earlier today of having the PIN corrupted, but I have it set to require the pin on the first boot.
I fixed it by removing all files ending in ".key" in /system. Not really sure how this compares to removing locksettings.db. Afterward, I put my password back using Google's device manager.
Of course, I am rooted with twrp, so this comes after setting that up.
Masterjuggler said:
I had this problem earlier today of having the PIN corrupted, but I have it set to require the pin on the first boot.
I fixed it by removing all files ending in ".key" in /system. Not really sure how this compares to removing locksettings.db. Afterward, I put my password back using Google's device manager.
Of course, I am rooted with twrp, so this comes after setting that up.
Click to expand...
Click to collapse
The problem of this method is that it only works if the bootloader is unlocked and the phone has the No-verify patch installed.
When you say "No-verify patch," are you talking about removing Google license verification from apps (via an app such as lucky-patcher for instance)? AFAIK that is on a per-app basis and wouldn't affect something like the lockscreen password.
So if the phone has those prerequisites (unlocked, No-verify, TWRP), is there a difference between removing the ".key" files and the locksettings.db? I am not entirely sure what the different files contain, and don't seem to be able to find this information through Google, though I may just not be searching the right set of keywords.
Masterjuggler said:
When you say "No-verify patch," are you talking about removing Google license verification from apps (via an app such as lucky-patcher for instance)? AFAIK that is on a per-app basis and wouldn't affect something like the lockscreen password.
So if the phone has those prerequisites (unlocked, No-verify, TWRP), is there a difference between removing the ".key" files and the locksettings.db? I am not entirely sure what the different files contain, and don't seem to be able to find this information through Google, though I may just not be searching the right set of keywords.
Click to expand...
Click to collapse
No-Verify is an additional security system implementend in the kernel. When No-Verify is active, it checks for the signature of the system partition. If the system was modified, then the system won't boot. This is why after unlocking the bootloader you have to apply No-Verify Patch or any package with the integrated patch such as SuperSU. As you can see, it has nothing to do with the app signature or the lockscreen at all.
The method presented in the OP is valid for most Android phones, and the only prerequisite is to have TWRP installed. It is safe and a lot more recommended than patching the system partition. Patching system or kernel should always be your last resort. usually deleting locksettings.db is enough, and it is a general method that works for almost any locking method.
On B25 and have followed all instructions. Seems this method no longer works :/
- Simple and safe installer;
- Installs stock and offers to install Customization Package (optional);
- Can be used to flash other ROMs that use "flash_rom.sh";
- Can be used to fix bricked devices with unlocked bootloader.
DISCLAIMER: You are using the provided files by your own risk, although I have tested the installation I am not responsible for any damage or data lost if you decide to use them.
Click to expand...
Click to collapse
Compatible with macOS/Linux (tested on High Sierra and Ubuntu 16.04) or Windows. Requires unlocked bootloader!
The script will check for requirements, and will only continue if everything is fine. If you are on Windows, make sure the drivers are working correctly before starting: open Device Manager and put watch in fastboot mode then check if it is detected correctly, or you can use the provided "checkdrivers_win.cmd" to do this and check if watch's bootloader is unlocked. If you get any errors then probably drivers aren't installed properly, and you should fix this before starting.
PS: If you are on Windows, make sure fastboot driver is working properly using the directions above. If the driver seems to be installed correctly (no question mark on the device) then try disabling or uninstalling your antivirus temporary. Avast is known to cause problems with USB drivers.
Current version installs firmware 2.6.2.0 (WOS2 = Watch OS 2.0) on Pace, and can be used to fix a bricked watch, simply put it in fastboot mode manually *before* starting the script. Make sure you try to do this with a Pace watch or provide the correct ROM in the "rom" folder, otherwise it will brick your device.
PS: During the ROM installation, when watch is in Recovery Mode, it will display a triangle with an exclamation mark and the text "no command", it's expected! Simply follow the instructions provided by the script.
- How to run on Linux
Go to the folder with the uncompressed files in terminal and run "sudo bash amazeflash.command" (Linux requires root access to fastboot), then follow instructions.
- How to run on macOS
Go to the folder with the uncompressed files in Terminal and run "bash amazeflash.command", or simply double-click "amazeflash.command" then follow instructions. PS: Decompress the 7z file with Keka or TheUnarchiver to preserve file permissions.
- How to run on Windows
Go to the folder with the uncompressed files in command prompt and run "amazeflash_win.cmd" or simply double-click "amazeflash_win.cmd" (you may not see the file extension in some cases), then follow instructions.
Use the same procedure if you want to run the custom package installation script after you successfully flashed the ROM, it will prompt to install modded files or revert to stock versions. Be aware the reverting to stock version may not work if you want to apply OTA to update later, it's recommended that you flash stock version again and don't apply the Customization Package.
For more info, please refer to the included "readme.txt" file.
Some remarks:
- Customization Package includes WearSettings, NewWearSport and HuamiWatchFaces with improved support and voice prompts in English.
- If watch is *not* on firmware 2.x yet (it means *any* 1.x firmware) then probably you want to do a factory reset first and then use the installer (it works even if watch shows QR code).
- If watch already have firmware 2.x, then no need to factory reset first a priori...
- On stock ROM in English, the "About" section in Settings causes it to crash, it works in Chinese and if the Customization Package is installed.
- After a Factory Reset, language will revert to Chinese, you can set it back to English with these adb commands (you can use copy and paste, a Windows batch script is provided too):
Code:
adb wait-for-device
adb shell setprop persist.sys.language en
adb shell setprop persist.sys.country US
adb reboot
You can buy me a coffee or cheesecake (please, no beers ), Paypal address for donations: lfomartins[at]aim.com
Or most common cryptocoins here: https://freewallet.org/id/87331be5
PS: there is no fee free option to transfer money to my country, you must use "pay for goods and services". But don't worry, you will only be charged for the amount you send. Thanks!
This was only possible because of the modded recovery image provided by @Neuer_User:
https://forum.xda-developers.com/smartwatch/amazfit/tutorial-unbrick-huami-amazfit-t3547300
In the above post you can find details on how to put Pace or Stratos manually in fastboot mode. It's tricky and very hard to do, but it works.
*************************
Latest Version v1.2 - firmware 2.6.2.0
- Installer will NOT run anymore if root is detected (this can happen if watch has other custom ROMs) and only install via fastboot/recovery (safer).
- amazefls.log now won't be erased every time you run the installer script, but store all flash history for debugging.
Download link:
https://mega.nz/#!9OJ0mIqA!QgnX9f675VbZI9ECx__ScnHtgHTAdRa1fldWtZdVR9U
SHA1SUM: E941FD472C626872707C06065177DC728BA64FB6
*************************
Old versions
v1.1 - * Link removed, please use v1.2 *
SHA1SUM: 0CB3FB554A397B53C1E739586E98C2FF8C1FCE0C
- Updated to firmware 2.6.2.0
- Updated support for EN
Firmware Changelog (translated using Google Translator)
- Added World Cup event reminder function, need to upgrade to the latest mobile phone App, and set a reminder in the live World Cup page
- Added virtual rabbit mode to support running, indoor running, outdoor riding, cross-country running, open in Sports Settings > Motion Control
- Added Heart Rate Interval to Reserve Heart Rate Mode, App> My> My Info> Heart Rate Interval Settings
- Added data items such as sectioning speed and section speed to support running, trail running, walking, outdoor cycling and other sports
- Occurrence of abnormal heart rate output after optimising Bluetooth heartbeat disconnection
- Repair the lock screen second hand display of the third party dial
- Fixed several bugs
Thanks to @Saratoga79 for sharing the system dump! You rock, dude!
v1.01 - * Link removed, please use v1.2 *
SHA1SUM: 47D0777F599586A63D293E592B6770D7FE77982A
- Fixed AmazeCustom installer for both Win and Mac when run separately;
- Moved all scripts to main folder for easier access and simplified maintenance;
- Moved all Windows binaries to pgm folder to simplify future updates;
- Added Windows script to set language to EN (needed after a factory reset/unpair).
v1.0 - * Link removed, please use v1.2 *
SHA1SUM: 64205E4D683B388E8C087FCF49B20FE6FDEA8235
- Initial Release
Thanks to @ingraynieris and @chincheang for testing and @1immortal for support.
Manual Installation
Requirements
- Pace watch (A1602 or A1612);
- Unlocked booloader (unlockamazfit.com - read carefully the warning, doing this will void watch's warranty!);
- adb, fastboot and drivers installed correctly;
- 40% battery or more, read English and pay attention!
******************************************
DISCLAIMER: You are using the provided guide by your own risk, although I have tested the commands I am not responsible for any damage or data lost if you decide to use it.
******************************************
This is an installation guide, if you have never used adb or fastboot, then please don't try to do this. Commands should be typed in terminal/prompt/whatever you use to do adb commands.
In the end of this guide, you should have a watch with stock WOS2, so OTAs should work. Do not modify any system files if you want to apply future OTA updates, not even get root access, it may break stock updates.
Unpack the compressed 7zip file from the link at some place you have at least 1GB of free space and adb/fastboot access, then change to this directory to begin. Commands below are for Windows, macOS and Linux users should change the backslash ('\') to normal slash ('/'), hit ENTER/RETURN after each line (duh!).
If you are trying to fix a bricked devices, make sure it's in fastboot mode and that the computer detects the device, then start from step #3.
1. Connect the watch to computer using USB cable, then:
Code:
adb devices
2. If you see your device listed, type:
Code:
adb shell reboot bootloader
3. Check if device is recognized correctly (on Windows, open Device Manager and check if you see a device in fastboot mode or similar), then type:
Code:
fastboot getvar all
4. If you see "unlocked: yes", you can continue. Reboot into temporary root/Recovery:
Code:
fastboot boot Amazfit-mod-recovery.img
5. Watch should show a triangle with an exclamation mark, it's in Recovey mode and it's normal, do not panic! Then make sure you have root now:
Code:
adb root
6. Then push files to watch:
Code:
adb push rom\boot.img /data/media/0/
adb push rom\md5s.txt /data/media/0/
adb push rom\system.img /data/media/0/
adb push rom\flash_rom.sh /data/media/0/
If it fails, try:
Code:
adb push rom\boot.img /sdcard/
adb push rom\md5s.txt /sdcard/
adb push rom\system.img /sdcard/
adb push rom\flash_rom.sh /sdcard/
7. Take a deep breath and then (after the first command, you should see a "#" only, indicating root prompt):
Code:
adb shell
cd /data/media/0
sh flash_rom.sh
or use "cd /sdcard" if you have copied the files to this directory instead.
8. Wait until it says "Finished", then type:
Code:
reboot
9. To set English language after booting (stock CN WOS2 has some bugs, i.e. About in settings crash, some watchfaces show Chinese names when screen is locked, etc):
Code:
adb wait-for-device
adb shell setprop persist.sys.language en
adb shell setprop persist.sys.country US
adb reboot
Thanks for your rom, have seen it on fb to great work!
Verstuurd vanaf mijn ONEPLUS A5000 met Tapatalk
Thank you for your great work!
Is it possible to install custom GPS.conf files? Will it break OTA updates?
xaametz said:
Thank you for your great work!
Is it possible to install custom GPS.conf files? Will it break OTA updates?
Click to expand...
Click to collapse
You're welcome. I am glad you like it.
Yes, you can install a custom gps.conf the same way you do with any other ROM (root, remount, push, fix permissions, reboot), but my personal experience is that GPS is much better on 2.6.1.0, no need to change anything. I cannot guarantee it will not break OTA, may or may not work as it's not a file that is used in stock firmware, but any modification to /system can cause problems. Anyway, with AmazeROM you can always flash stock later if you need it for future updates.
lfom said:
You're welcome. I am glad you like it.
Yes, you can install a custom gps.conf the same way you do with any other ROM (root, remount, push, fix permissions, reboot), but my personal experience is that GPS is much better on 2.6.1.0, no need to change anything. I cannot guarantee it will not break OTA, may or may not work as it's not a file that is used in stock firmware, but any modification to /system can cause problems. Anyway, with AmazeROM you can always flash stock later if you need it for future updates.
Click to expand...
Click to collapse
Thank you. I'll try it without custom config.
Enviado desde mi STF-L09 mediante Tapatalk
Hi,
Minor problem with the script that installs the customised apk's: You seem to have forgotten to replace "adb" with "$adbcmd" and "fastboot" with "$fbcmd".
Thanks for all the effort you have put into the scripts!
R.
Eeg.
superbert1969 said:
Hi,
Minor problem with the script that installs the customised apk's: You seem to have forgotten to replace "adb" with "$adbcmd" and "fastboot" with "$fbcmd".
Thanks for all the effort you have put into the scripts!
R.
Eeg.
Click to expand...
Click to collapse
True, thanks for reporting. There is a problem in the Windows installer as well, it doesn't work if you run it without command line arguments, it will be fixed in the next release.
I just made some quick an dirty adaptations in order to get the custom script running. Unfortunately, I'm now stuck with an unwilling fastboot (maybe it's because I'm still on "El Capitan" --> I'm considering upgrading, but first have to make a recent backup).
Though-luck for now, I'm stuck with a watch that has some Chinese notifications (at least for the time being).
superbert1969 said:
I just made some quick an dirty adaptations in order to get the custom script running. Unfortunately, I'm now stuck with an unwilling fastboot (maybe it's because I'm still on "El Capitan" --> I'm considering upgrading, but first have to make a recent backup).
Though-luck for now, I'm stuck with a watch that has some Chinese notifications (at least for the time being).
Click to expand...
Click to collapse
I have updated the installers, please check them. I am sorry for the trouble.
Hi,
You don't have to excuse yourself at all...
I just tried the new version, and it works perfectly fine now (even on my Mac).
I really appreciate the effort you're putting into AmazeROM
@lfom: HELP!
Unfortunately this installer crashs my Pace.
In the past I have used PACEfied and PACEficator custom ROM and the installers works always perfect.
But this one fails in some steps but continues and ends with an "ok" and now I see only the "A" logo before the boot animation.
Attached the whole CMD output.
I hope the Pace is not bricked. ADB devices shows the Pace, but no other commands (e.g. "fastboot reboot bootloader") are working.
Got the same problem, it crashed my PACE too, was running PACEficator Project before, now it keep having luncher has stopped error.
Installer stopped on fastboot and unable to boot to recovery anymore
fastboot boot Amazfit-mod-recovery.img
downloading 'boot.img'...
FAILED (remote: ED: The command is not allowed.)
finished. total time: 0.012s
Edit: after search the forums, I unpair and re-pair my PACE and the watch is working now. however, I am not sure should I still install this ROM on my watch anymore.
@Diginix @thomsontam Did you check you have an unlocked bootloader? If yes, you should be able to put watch in fastboot mode and flash the ROM again. It seems that the installer detected root and went ahead with the installation, but the watch crashed and it did not finish. If it's locked and you have a valid serial number, you should be able to unlock it using the same code as before. If not, please contact me via Telegram: http://t.me/lfomartins
@lfom
I had an unlocked bootloader until PACEficator 2.6.0.12. I didn't checked it after update to PACEficator 2.6.1.0
Root was definitely existing and working.
I have my serial nr. and the unlock code.
But what commands should I try now?
This doesn't work:
adb shell reboot bootloader
- exec '/system/bin/sh' failed: No such file or directory (2) -
using port=5555
Click to expand...
Click to collapse
My backlight is always on and shows the Amazfit "A". I hope the battery is charging.
@Diginix You have broken file system. You should be able to put the watch in fastboot manually. It is very hard to achieve but it works. Then check if bootloader is unlocked and try to flash it again. If you have problems, contact me on Telegram.
I have no Telegram and need ready for use commands please.
Your checkdrivers_win.cmd doesn't provide any hope.
btw: adb+fastboot was proper installed and works in the past perfect with the installer of other custom roms.
Edit: I will try this steps.
Edit2: My Pace can't be turn off as in the youtube video is shown. It always shows the "A" and backlight is on.
As it seems fastboot isn't reachable. But I will try some different delays at pressing the button and plugin it on PC.
@Diginix checkdrivers_win.cmd is useless now with a bricked device. You can turn the watch off by pressing and holding the button. Keep the watch connected to the computer and then press button again to turn it on, then count up to 4 (more or less) after the screen goes on again and release the button. If you see the battery icon you have released the button too early, if you see the A logo then you released too late. You have to release at the exact time to show the screen with Fastboot and ForceErase, then press button briefly once to enter fastboot. Keep the watch connected to the computer all the time, it's easier this way.
Now I'm in fastboot!
But "fastboot devices" doesn't prompt any device.
What to do with your ROM files?
Hi!
I installed and I'm using adb and fastboot on Mac, it works perfectly adb, but with fastboot it does not detect the clock. But if I try on my OnePlus 6, I detect both adb and fastboot the Mac. How can I do? Thank you
None of this is my work and all recognition goes to the awesome developers that made this possible, I will link their guides in here with some minor notes for newbies like me that may had some issues trying to unlock and root the Fire Stick (FS) 4K
DISCLAIMER: BE WARNED THAT YOU HAVE TO OPEN YOUR FIRE STICK AND IT WILL VOID YOUR WARRANTY, THIS IS NOT FOR THE FAINT OF HEART AND NEITHER THE DEVELOPERS OR MYSELF ARE RESPONSIBLE IF YOU BRICK YOUR DEVICE OR VOID YOUR WARRANTY
Ok, now let's begin:
UPDATE: Per Sus_i, this makes perfect sense:
"Since the exploit can't be patched, it's in my opinion the best to do the setup at the beginning, pair the remote, then update to the latest over fireOS. That way you avoid a pending update nag setup screen after doing the exploit. Then enable ADB and unknown sources. After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen)."
First very important, I wish I would have known this before but make sure you have a Laptop and a Monitor to Connect the FS to, so basically the USB Power cable from the FS connect it to your laptop and connect the HDMI portion to a monitor or TV
I also strongly recommend to have your FS deregistered before continuing as this will prevent your FS from automatically updating after rooting
In order to unlock the bootloader follow "THIS GUIDE"
I made a quick video on how to open your device and how to Short it using Aluminum Foil:
https://www.youtube.com/watch?v=h4I6ifBLWJ4
Process is pretty self explanitory, make a USB ISO from the image provided on that thread, boot into it and open terminal, make sure you put the file he provides on a RW location, my mistake was that I put it inside a RO folder and it would not load the script, so I mounted the kamakiri-mantis-v1.2.zip unto the /mnt directory of the usb and I was able to run the script successfully, make sure to run the commands quickly as the first time that I it finished the ./bootrom-step.sh script and I left it sitting for 10 minutes to grab a bite, I couldn't run the second script and had to start all over. After the second ./fastboot-step.sh script, your device will be on the TWRP recovery, now on the same terminal page or a new one enter these commands:
Code:
adb devices
adb shell
exit
You should see your device's serial number from the first command with "device" to the right of it and the second command will basically put you inside the device's directory assuming you have established a successful connection. The last command just put you back to your starting point, now open the firefox browser on the FireOS USB and navigate to the URL below
Download the Pre-Rooted Image from "HERE" This image contains Magisk already so you don't have to worry about installing it separately, the image is larger than the available partition on this USB so this is a good time to either get a second USB or if you want to download the file to your local hdd and pull them from there its up to you, then run these commands:
Code:
adb push <your download location you decided earlier here>/mantis-6.2.6.8-rooted_r1.zip / sdcard/
adb reboot recovery
adb shell
twrp install /sdcard/mantis-6.2.6.8-rooted_r1.zip
twrp wipe cache
twrp wipe dalvik
reboot -p
This basically installs the pre-rooted image to your device, after the last command, you should see on your monitor the Fire Stick Reboot and boot to the Amazon GUI Splash Screen, now very important if you followed my previous instructions of deregistering your device before performing all these steps, it should bring you up to the Amazon Initial Setup Screen, now what you want to do is do the following commands before continuing on terminal:
Code:
adb devices *you should see something your screen where the FS is connected to, click accept or enter can't remember*
Now it should show you in terminal your serial number and "device" next to it, meaning you can run adb commands in which you will run the following to disable OTA updates:
Code:
adb shell
su *after this command you should see something again on your screen, click the check the box "Always Remember" and click ok" *
if "su" was successful, you should see something like this:
mantis:/ $ su
mantis:/ # *the hash means you're running as root, if you don't have a "#" you are not running as root"
Than continue with these commands and should get the following results:
pm disable com.amazon.tv.forcedotaupdater.v2
***Package com.amazon.tv.forcedotaupdater.v2 new state: disabled***
pm disable com.amazon.device.software.ota
***Package om.amazon.device.software.ota new state: disabled***
pm disable com.amazon.device.software.ota.override
***Package com.amazon.device.software.ota.override new state: disabled***
After running all these commands exit adb and continue with the normal Amazon Setup including adding your amazon account. After you get to the screen where you can see all the apps, open a new web page browser in firefox and download "This Add-On" , this one is less than 200MB so it should fit on the Fire OS USB, so I would download it and copy it to /mnt for ease of access, go back to terminal and type this:
Code:
adb devices
adb push <your download location you decided earlier here>/AFTV-MM-1.7-6.2.6.8.zip/ sdcard/
adb reboot recovery *it will boot into TWRP*
adb shell
twrp install /sdcard/AFTV-MM-1.7-6.2.6.8.zip
twrp wipe cache
twrp wipe dalvik
reboot -p
Your device will reboot and if everything went smoothly, you should have a rooted amazon fire stick 4k, Congrats :good:
Nice guide
Here are a few thoughts from me...
It's important to use the latest kamakiri. The mentioned prerooted 6.2.6.5 is probably a downgrade. A few sticks needs an update of the TZ in order to play prime video. The TZ update is only in the v1.2 Kamakiri or in the 6.2.6.6 prerooted.
Edit: S̵i̵n̵c̵e̵ ̵t̵h̵e̵ ̵e̵x̵p̵l̵o̵i̵t̵ ̵c̵a̵n̵'̵t̵ ̵b̵e̵ ̵p̵a̵t̵c̵h̵e̵d̵,̵ ̵i̵t̵'̵s̵ ̵i̵n̵ ̵m̵y̵ ̵o̵p̵i̵n̵i̵o̵n̵ ̵t̵h̵e̵ ̵b̵e̵s̵t̵ ̵t̵o̵ ̵d̵o̵ ̵t̵h̵e̵ ̵s̵e̵t̵u̵p̵ ̵a̵t̵ ̵t̵h̵e̵ ̵b̵e̵g̵i̵n̵n̵i̵n̵g̵,̵ ̵p̵a̵i̵r̵ ̵t̵h̵e̵ ̵r̵e̵m̵o̵t̵e̵,̵ ̵t̵h̵e̵n̵ ̵u̵p̵d̵a̵t̵e̵ ̵t̵o̵ ̵t̵h̵e̵ ̵l̵a̵t̵e̵s̵t̵ ̵o̵v̵e̵r̵ ̵f̵i̵r̵e̵O̵S̵.̵ ̵T̵h̵a̵t̵ ̵w̵a̵y̵ ̵y̵o̵u̵ ̵a̵v̵o̵i̵d̵ ̵a̵ ̵p̵e̵n̵d̵i̵n̵g̵ ̵u̵p̵d̵a̵t̵e̵ ̵n̵a̵g̵ ̵s̵e̵t̵u̵p̵ ̵s̵c̵r̵e̵e̵n̵ ̵a̵f̵t̵e̵r̵ ̵d̵o̵i̵n̵g̵ ̵t̵h̵e̵ ̵e̵x̵p̵l̵o̵i̵t̵.̵ ̵T̵h̵e̵n̵ ̵e̵n̵a̵b̵l̵e̵ ̵A̵D̵B̵ ̵a̵n̵d̵ ̵u̵n̵k̵n̵o̵w̵n̵ ̵s̵o̵u̵r̵c̵e̵s̵.̵ ̵ After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen).
Edit: Update: meanwhile, the fix for the mentioned 'contact manufacturer' error is known...
Take a look here and here.
Edit/Update: Due to efuses (blocking the bootrom access), it isn't recommended to do any update infront of the unlock...
Sus_i said:
Nice guide
Here are a few thoughts from me...
It's important to use the latest kamakiri. The mentioned prerooted 6.2.6.5 is probably a downgrade. A few sticks needs an update of the TZ in order to play prime video. The TZ update is only in the v1.2 Kamakiri or in the 6.2.6.6 prerooted.
Since the exploit can't be patched, it's in my opinion the best to do the setup at the beginning, pair the remote, then update to the latest over fireOS. That way you avoid a pending update nag setup screen after doing the exploit. Then enable ADB and unknown sources. After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen).
Click to expand...
Click to collapse
Ops Typo let me edit it, I meant to put 6.2.6.8 on the command lol, and aaaa I see I didn't know the exploit couldn't be patched great info, so than yes I will revise my instructions thank so much
UPDATE: I just checked my FS and I'm on 6.2.6.8v1 and didn't receive contact the manufacturer, is it because I sideloaded the manager app after?
nandroidint said:
UPDATE: I just checked my FS and I'm on 6.2.6.8v1 and didn't receive contact the manufacturer, is it because I sideloaded the manager app after?
Click to expand...
Click to collapse
No. If I remember correct, it has something to do with flashing, i.e. the vendor partition wasn't flashed propperly.
Maybe you flashed not the prerooted!? With the Kamakiri TWRP version is flashing full ota update packages (renamed to zip) also possible... and in the prerooted thread is such a full 6.2.6.8 ota linked.
Edit: Could be that this error is prime video related, idk. rbox said he looks into it soon...
Just for clarification: The prerooted rom is a perfect thing since years.
My suggestion 'avoid any rom flashing' from my last post is just an attempt to keep it simple for beginners.
By the way, if the stick gets all updates in front of the unlock, it makes no sense to update it after the unlock again (unless addon.d support is needed).
I hope that has become clear I very much appreciate all the prerooted stuff
thanx for the tut nandroidint this is exactly what I needed, I wasn't sure how to do the shorting so the video helped out a lot now I'm ready to do this. But I'm sorta a noob when it comes to android so I got few questions tho, 1) what are the main benefits in rooting the fIrestick 4K 2) are there different roms to install? 3) are there root only .apks? 4)also one main thing I would like to be able to do is spoofing the Mac address any idea if that's possible?
5)Oh and lastly what OTB cable do you recommend? sorry for all the questions ?
'std::bad_alloc'
After running the adb push of the manthis.zip Im getting terminate called after throwing an instance of 'std::bad_alloc'.... What Im I doing wrong?
i gave root can i remove amazon services
i dont want google launcher jsut remove services
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable ?
Can I please get some support guys ? previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Hello, after root i got massage on screen
: android system
There is na internal problem with Your device. Contact Your manufacturer for detalis.
And when im trying to register in Amazon it bringing me back to pairing screen, farest i can go it is wifi connection.
Did i brick my Stick?
davinci2798 said:
Hello, after root i got massage on screen
: android system
There is na internal problem with Your device. Contact Your manufacturer for detalis.
And when im trying to register in Amazon it bringing me back to pairing screen, farest i can go it is wifi connection.
Did i brick my Stick?
Click to expand...
Click to collapse
Did you deregister before rooting like the tut says? This is why I’ve been hesitant on rooting because of the lack of support on this forum
Yep, it was new Stick, out from box. Not registered at all. I managed massage, but still comminng to pairing screen.
itsyaboy said:
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable
Can I please get some support guys previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Click to expand...
Click to collapse
You can use adoptable storage on 4K stick with Add-Ons installed and activated AFTV-XM Xposed Module. It brings adoptable storage support to Settings UI.
tsynik said:
You can use adoptable storage on 4K stick with Add-Ons installed and activated AFTV-XM Xposed Module. It brings adoptable storage support to Settings UI.
Click to expand...
Click to collapse
Nice! That’s awesome thanx for the info and reply.
davinci2798 said:
Yep, it was new Stick, out from box. Not registered at all. I managed massage, but still comminng to pairing screen.
Click to expand...
Click to collapse
Hey so have you figured out what was the problem yet? If so could u explain how you managed to fix it? I’m going to root sometime this week and would hate to run into this issue.
USB drive for storage
itsyaboy said:
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable
Can I please get some support guys previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Click to expand...
Click to collapse
Yes, You can use a USB drive for App loading and Movie storage.
See Troypoint.com for good video.
I suggest a single USB OTG Cable and a USB HUB for your drive.
Then you can add a Keyboard and Mouse which make it MUCH easier to type commands.
Good Luck
How might one do this on a Mac?
Thanks
gogorman said:
How might one do this on a Mac?
Thanks
Click to expand...
Click to collapse
Do what? The only thing u can do on the MacOS is to create the bootable iso usb, you can follow these steps to do so https://www.google.com/amp/s/www.le...-on-an-apple-mac-os-x-from-an-iso?hs_amp=true
After your create the bootable usb just reboot and hold down option and select the bootable usb, once in open up Firefox and download the kamakiri-mantis-v1 and open a terminal window and change the directory to where u have the kamakiri folder, in terminal type cd then just drop in the kamakiri and hit enter. From there u can just follow the tut, FYI the bootable usb you create is a Linux OS so that’s how you can do it on a Mac, you just can’t do the rooting on MacOS, just clarifying Incase that was your question.
Sorry I haven't rooted phones in a while and am trying to root my fire stick 4k. Can we get some pictures tutorial pretty please
Sent from my ONEPLUS A5010 using Tapatalk
Step by step instructions would be great?
chinkster said:
Sorry I haven't rooted phones in a while and am trying to root my fire stick 4k. Can we get some pictures tutorial pretty please
Sent from my ONEPLUS A5010 using Tapatalk
Click to expand...
Click to collapse
I would love that too, I have rooted with Unix before but that was on a Drone(Solo).
I understand about creating a bootable USB drive and booting my PC/Mac by changing the bios to boot first off the USB as step 1.
Step 2 is loading software onto the USB while booted under Unix/Linux???
Step 3 How do you then connect to the firestick?
When do you plug the firestick into the tv and when do you short out the jumper??
I know to some of you these sound very basic but it would be helpful for those of us just learning this environment.
Thanks in advance...
RPM99 said:
I would love that too, I have rooted with Unix before but that was on a Drone(Solo).
I understand about creating a bootable USB drive and booting my PC/Mac by changing the bios to boot first off the USB as step 1.
Step 2 is loading software onto the USB while booted under Unix/Linux???
Step 3 How do you then connect to the firestick?
When do you plug the firestick into the tv and when do you short out the jumper??
I know to some of you these sound very basic but it would be helpful for those of us just learning this environment.
Thanks in advance...
Click to expand...
Click to collapse
The link he provided explains all that https://forum.xda-developers.com/fire-tv/orig-development/unlock-fire-tv-stick-4k-mantis-t3978459 all except for when to connect to the tv, but I assume it’s after running the kamakiri script, btw it’s not software, you just download the kamakiri mantis while in the Linux usb os, open a terminal and change the directory of the terminal to the kamakiri folder in order to run the ./bootrom-step.sh and ./fastboot-step.sh commands
Edit: just follow the main guide from the link above then read this guide after, that’s the best way to understand it.
Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users
foosoomin said:
Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users
Click to expand...
Click to collapse
Reply from a noob,
If you are trying to flash to a secure boot device, you can bypass it using a repo in github as bypass DA, I had one mtk device and it has secure boot. When I use sp flash tool, it throw me download agent error, So by using that bypass python script from github allowed me to flash partitions like recovery, boot etc in write memory option.
In my oneplus 3T, for decrypting and disabling dm_verity, I formatted user in fastboot mode and flashed supersu, which disabled dm_verity. If you have kernel source available, then you can modify it and recompile your own,
or try flashing patched boot image by magisk but while patching uncheck dm_verity things.
Thank you,
Github link: https://github.com/MTK-bypass/exploits_collection
Which function can i use the phone with locked bootloader with root access ?
Disable dmverify or disable android verified boot ?
As I know verified or secure boot wont effect, My op3T have secured boot enabled, but it didnt gave me any problem. I have installed twrp and boot loader unlocked.
But dm_verity acted like a hell, If I flash twrp, it causes bootloop for 10second and automatically reverted to stock recovery and behaves like nothing happened. try disable dm_verity with magisk, Iam noob, so know only this much.
Thank you
foosoomin said:
Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users
Click to expand...
Click to collapse
1. DM-Verity ( VB 1.0 ) verifies /system and /vendor - it was introduced with Android 4.4, modified with Android 7
2. Android Verified Boot ( VB 2.0 aka AVB ) additionally verifies /boot - it was introduced with Android 8, works on Project Treble enabled devices
Both are running a hash on the memory blocks mentioned of your device to ensure the integrity of your software and help prevent rootkits and the like.
If you disable VB 1.0 and/or VB 2.0 your Android device becomes vulnerable to malware of any type: IMO only those do it who do not care about the built-in protection.
@jwoegerbauer ,
Thank you for your posting.
I have a question
1) How do i gain access to root my global variant Huawei Mate 40 Pro smartphone without unlocking bootloader ?
2) Below video, does this method work ?
3) I also attached my phone boot.img file, i noticed Huawei changed a lot of coding
Android is rooted if SU ( read: Switch User ) binary is present ( may be elsewhere ) in Android. Hence all you have to do is to push a CPU-conformat SU-binary to Android's /data/local/tmp directory and make it executable:
Code:
adb devices
adb push <FULL-PATH-TO-SU-BINARY-ON-COMPUTER> /data/local/tmp
adb shell "chmod 0755 /data/local/tmp/su"
A compilation of SU-binaries for ARM and Intel devices you can fetch here:
SU
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com
@jwoegerbauer ,
Based on your posting....
1) How do i know, where my binary is present ?
2) I have never gain root access on my phone before.....can you enlighten me ? Never do this before
3) in your code, are you saying
adb devices ( i know about this )
adb push C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU.zip /data/local/tmp is it this way ?
Erm, can you provide a bit of guidance ? i have never root smartphone before
The SU.zip contains 4 SU-binaries. Hence you
1. have to extract the CPU-conformant SU-binary contained therein, and then
2. have to push this SU onto Android as previously shown
deleted
I found some files inside the following folders
C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\32
libsupol.so
su
supolicy
C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64
libsupol.so
su
supolicy
which file should i push ?
i think i found a basic tutorial here
https://pocketables.com/2011/06/adb-basics-for-htc-evo-users.html
ADB push <source destination here> – Let's say you have a file called C:MY ROMSPC36IMG.zip and you want to push it to the root of the SD Card so you can flash it later. The command to type would be adb push "c: my romsPC36IMG.zip" /sdcard/.
That means to say, i have to paste the following to push the zip file
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU.zip" /data/local/tmp
Am i correct @jwoegerbauer
As I can see you, for whatever reason, aren't willing to carefully read my posts.
Accidental click reply, post removed
There are 4 SU-binaries files.
So, which SU file should I flash ?
Hmmm, I am a newbie, sorry.
Check your phone's CPU architecture: it's either 32-bit or 64-bit. If you got it then push the SU contained in appropriate subfolder of folder named ARM.
@jwoegerbauer,
I understood what you mean now.
My phone CPU architecture is 64 bit version.......
Saw the SU file too, about 106KB file size
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\SU" /data/local/tmp
Is my above stated path correct now ?
foosoomin said:
@jwoegerbauer,
I understood what you mean now.
My phone CPU architecture is 64 bit version.......
Saw the SU file too, about 106KB file size
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\SU" /data/local/tmp
Is my above stated path correct now ?
Click to expand...
Click to collapse
Looks correct.
Haha, i copied the path in ADB
HWNOH:/ $ adb push"C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\su" /data/local/tmp
Thereafter, i install root checker app, to verify root status ?
just to verify @jwoegerbauer ,
this process will not unlock the bootloader, right ?
because my Huawei Mate 40 Pro developer menu, it does not have the "Enable OEM unlock" at all....this portion is missing in my phone
See attached JPG file