About disabling dmverity & Android Verified Boot - Android Q&A, Help & Troubleshooting

Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users

foosoomin said:
Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users
Click to expand...
Click to collapse
Reply from a noob,
If you are trying to flash to a secure boot device, you can bypass it using a repo in github as bypass DA, I had one mtk device and it has secure boot. When I use sp flash tool, it throw me download agent error, So by using that bypass python script from github allowed me to flash partitions like recovery, boot etc in write memory option.
In my oneplus 3T, for decrypting and disabling dm_verity, I formatted user in fastboot mode and flashed supersu, which disabled dm_verity. If you have kernel source available, then you can modify it and recompile your own,
or try flashing patched boot image by magisk but while patching uncheck dm_verity things.
Thank you,
Github link: https://github.com/MTK-bypass/exploits_collection

Which function can i use the phone with locked bootloader with root access ?
Disable dmverify or disable android verified boot ?

As I know verified or secure boot wont effect, My op3T have secured boot enabled, but it didnt gave me any problem. I have installed twrp and boot loader unlocked.
But dm_verity acted like a hell, If I flash twrp, it causes bootloop for 10second and automatically reverted to stock recovery and behaves like nothing happened. try disable dm_verity with magisk, Iam noob, so know only this much.
Thank you

foosoomin said:
Hi all,
May i know, what is
1) disable dmverity
2) disable Android Verified Boot
Can anyone explain in layman terms ?
How can it benefit android smartphone users
Click to expand...
Click to collapse
1. DM-Verity ( VB 1.0 ) verifies /system and /vendor - it was introduced with Android 4.4, modified with Android 7
2. Android Verified Boot ( VB 2.0 aka AVB ) additionally verifies /boot - it was introduced with Android 8, works on Project Treble enabled devices
Both are running a hash on the memory blocks mentioned of your device to ensure the integrity of your software and help prevent rootkits and the like.
If you disable VB 1.0 and/or VB 2.0 your Android device becomes vulnerable to malware of any type: IMO only those do it who do not care about the built-in protection.

@jwoegerbauer ,
Thank you for your posting.
I have a question
1) How do i gain access to root my global variant Huawei Mate 40 Pro smartphone without unlocking bootloader ?
2) Below video, does this method work ?
3) I also attached my phone boot.img file, i noticed Huawei changed a lot of coding

Android is rooted if SU ( read: Switch User ) binary is present ( may be elsewhere ) in Android. Hence all you have to do is to push a CPU-conformat SU-binary to Android's /data/local/tmp directory and make it executable:
Code:
adb devices
adb push <FULL-PATH-TO-SU-BINARY-ON-COMPUTER> /data/local/tmp
adb shell "chmod 0755 /data/local/tmp/su"
A compilation of SU-binaries for ARM and Intel devices you can fetch here:
SU
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com

@jwoegerbauer ,
Based on your posting....
1) How do i know, where my binary is present ?
2) I have never gain root access on my phone before.....can you enlighten me ? Never do this before
3) in your code, are you saying
adb devices ( i know about this )
adb push C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU.zip /data/local/tmp is it this way ?
Erm, can you provide a bit of guidance ? i have never root smartphone before

The SU.zip contains 4 SU-binaries. Hence you
1. have to extract the CPU-conformant SU-binary contained therein, and then
2. have to push this SU onto Android as previously shown

deleted

I found some files inside the following folders
C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\32
libsupol.so
su
supolicy
C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64
libsupol.so
su
supolicy
which file should i push ?

i think i found a basic tutorial here
https://pocketables.com/2011/06/adb-basics-for-htc-evo-users.html
ADB push <source destination here> – Let's say you have a file called C:MY ROMSPC36IMG.zip and you want to push it to the root of the SD Card so you can flash it later. The command to type would be adb push "c: my romsPC36IMG.zip" /sdcard/.
That means to say, i have to paste the following to push the zip file
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU.zip" /data/local/tmp
Am i correct @jwoegerbauer

As I can see you, for whatever reason, aren't willing to carefully read my posts.

Accidental click reply, post removed

There are 4 SU-binaries files.
So, which SU file should I flash ?
Hmmm, I am a newbie, sorry.

Check your phone's CPU architecture: it's either 32-bit or 64-bit. If you got it then push the SU contained in appropriate subfolder of folder named ARM.

@jwoegerbauer,
I understood what you mean now.
My phone CPU architecture is 64 bit version.......
Saw the SU file too, about 106KB file size
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\SU" /data/local/tmp
Is my above stated path correct now ?

foosoomin said:
@jwoegerbauer,
I understood what you mean now.
My phone CPU architecture is 64 bit version.......
Saw the SU file too, about 106KB file size
adb push "C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\SU" /data/local/tmp
Is my above stated path correct now ?
Click to expand...
Click to collapse
Looks correct.

Haha, i copied the path in ADB
HWNOH:/ $ adb push"C:\Users\User\Desktop\Huawei Mate 40 Pro GMS\Root file\SU\ARM\64\su" /data/local/tmp
Thereafter, i install root checker app, to verify root status ?

just to verify @jwoegerbauer ,
this process will not unlock the bootloader, right ?
because my Huawei Mate 40 Pro developer menu, it does not have the "Enable OEM unlock" at all....this portion is missing in my phone
See attached JPG file

Related

when a cooked rom??

When will it arrive?for 101 i mean
It won't happen until we get permanant root. No telling when that will happen.
a better question is, when will root be available, doesn't seem we have people with the right skills interested on the 101
Does the rageagainstthemachine root patch not work? Are you able to get to the /data/local directory and place something there that will allow for a flash_image command to be run? Do we know if they have the same type of hardware-level protection like HTC does?
EDIT: Can someone do the following:
1. download the rage zip enclosed, and unzip to it's own directory
2. run the following from your command prompt, assuming you have the Android SDK installed and in the path
adb push root/rageagainstthecage /data/local/tmp
adb shell
chmod 0755 /data/local/tmp/rageagainstthecage
./data/local/tmp/rageagainstthecage
Click to expand...
Click to collapse
It should kick you out and display some messages on the screen...just not errors. Then type:
adb shell
Click to expand...
Click to collapse
You Should see a "#".
If so, then we have temp root and then we should be able to perform some other functions like flash a recovery, etc....
Sent with my fingertips and voice on my Evo
jerdog said:
Does the rageagainstthemachine root patch not work? Are you able to get to the /data/local directory and place something there that will allow for a flash_image command to be run? Do we know if they have the same type of hardware-level protection like HTC does?
EDIT: Can someone do the following:
1. download the rage zip enclosed, and unzip to it's own directory
2. run the following from your command prompt, assuming you have the Android SDK installed and in the path
It should kick you out and display some messages on the screen...just not errors. Then type:
You Should see a "#".
If so, then we have temp root and then we should be able to perform some other functions like flash a recovery, etc....
Sent with my fingertips and voice on my Evo
Click to expand...
Click to collapse
It does not work as of the latest Archos firmware. All the previous firmwares/z4root work fine for temp root. The ADB device part of the Archos just never comes back (doesn't show in device manager for instance). I do not know if this helps, but Archos also has a crippled busybox and it seems furthered crippled as of the last firmware upgrade.
Tsusai said:
It does not work as of the latest Archos firmware. All the previous firmwares/z4root work fine for temp root. The ADB device part of the Archos just never comes back (doesn't show in device manager for instance). I do not know if this helps, but Archos also has a crippled busybox and it seems furthered crippled as of the last firmware upgrade.
Click to expand...
Click to collapse
Maybe have something to do with newer ARM architecture?
Sent with my fingertips and voice on my Evo
Why do you need permanent root?
Archos kindly released SDE which provides a way to install your own builds in dual boot.
Some links for more info:
http://forum.xda-developers.com/showthread.php?t=871335
http://www.openaos.org/
IRC #openaos on freenode
Maurice
The SDE require booting in recovery mode, and people said that it's often not perfect.
A permanent root for main OS would still be very useful, and still allow us to dual boot when we need to..
I think so too. PermaRoot would be very usefull.

No 'su' binary on rooted tablet

Hello:
I'm a buyer of an Iview 760TPC (chinese 1.3Mpx camera version).
The reason I'm writing is because its some days reading and trying things to get everything unlocked, and seems that is really impossible to flash a new firmware or to get root. I'm getting really mad.
- I have managed to get adb recognize the tablet on linux and on windows. Despite of that, I get "adbd cannot run on production builds".
- If I do an 'adb shell', I get a prompt (with no superuser privileges). If I try to 'su', I get a "Passwd:" prompt , so I cannot get a superuser prompt to remount the filesystems, neither push any file to /system.
Browsing, I see there's no 'su' on /system/bin but there's on /system/xbin. Is a read-only filesystem and I cannot push anything.
- I installed root explorer but cannot mount R/W the filesystems.
- Installed Busybox installer. Says that the tablet is rooted, but when I try to install busybox, says that I have not permissions. Same if I try one of the upgrade menus of superuser. There are not privileges.
- I tried many times, to flash a firmware with the livesuit method, but the tablet is not being recognized. When I do the combination to enter the flashing mode, it boots a like a recovery with 4 options:
1) erase user data partition
2) enter adfu
3) upgrade firmware from sdcard
4) exit menu
I'm interested in the 3er option, but I can't find any information of the process itself (where to put the firmware, if its the same img as with the livesuit method, and what name needs to have the file)
There's also an ADFU mode, that I don't understand, but windows recognizes a new device when I enter there (but there's no driver or information I can found). The screen gets like a bit of white color, and the only way to exit from there is to press home+power buttons without the usb cable.
I've tried superoneclick but it doesn't work because there's not 'su' binary. Same happens with the installers of the CWM, not working because there's no 'su' (so I could flash a file with any kind of name)
Any help would be aprecciated. Sorry for my engrish and for asking so much, but I don't know how to proceed ;-)
Thanks
What version of Android is the device running? You could try manually pushing an exploit binary (e.g. zergrush) onto the device and executing to get temp root, at which point you should be able to mount /system as R/W and then push the su binary to /system/bin
The exploit binary to use would depend on the version of Android though. zergrush is for 2.3 I think (maybe 2.3.something). For early versions of ICS (4.0), there is mempodroid (might have spelt that wrong).
EDIT: Also, everything you can do over ADB, you could do by installing SSHDroid on the device and connecting via SSH from a computer.
Thanks a lot for your answer SifJar:
The tablet comes with ICS 4.0.3 and 3.0.8 kernel.
Superoneclick has the psneuter and zergRush exploits(neither of those seem to work for me).
Found this thread:
http://forum.xda-developers.com/showthread.php?t=1461736
Edit: It does not work for me:
./adb shell
[email protected]:/ $ chmod 777 /data/local/mempodroid
[email protected]:/ $ /data/local/mempodroid 0xd9ec 0xaf47 sh
/system/bin/sh: /data/local/mempodroid: not executable: magic 7F45
Thanks
Installed SSHDroid from the Play Store, but does not work either.
I get:
Can't generate RSA keys: sh <stdin>[1]: /data/data/berserker.android.apps.sshdroid/dropbear/dropbearkey: not executable: magic 7F45
Don't really know what else can I do.
Thanks
mempodroid requires a different offset for each device. "0xd9ec 0xaf47 sh" is for the Eee Pad Transformer Prime. You need to get the right offset for your device. You can try this to do that: http://forum.xda-developers.com/showthread.php?t=1612591
EDIT: But it looks like your device may not be able to run standard Android binaries, which would be quite an inconvenience for trying to root it.
SifJar said:
mempodroid requires a different offset for each device. "0xd9ec 0xaf47 sh" is for the Eee Pad Transformer Prime. You need to get the right offset for your device. You can try this to do that: http://forum.xda-developers.com/showthread.php?t=1612591
EDIT: But it looks like your device may not be able to run standard Android binaries, which would be quite an inconvenience for trying to root it.
Click to expand...
Click to collapse
I think I should reflash a new firmware from that recovery that has from factory, but there's no way I can do it. I mean, it is supposed to have an special mode that you enter with a button combination and to flash then with livesuit, but in this chinese clone, does not seem to work that combination of buttons.
From the recovery, ADFU seems to mean Actions Device Firmware Update. There's some information here http://wiki.s1mp3.org/USB_modes
- If I put the device in ADFU mode, windows ask for an USB driver (that I don't have or does not exist either)
- Another thing. There's a flashing from sdcard, that seems to support, but there's no information or manual of where is supposed to put the firmware, the name of the file or if it needs to be zipped (and what file/s inside and names),...
Thanks
It's possible the flashing from sd card supports standard update .ZIPs. You could try this one, it's a ZIP that should work for rooting most Android devices I believe. Superuser.zip
(This is from a topic on the HTC Explorer phone, but there is nothing specific to that phone in the ZIP as far as I know)
EDIT: This ZIP doesn't overwrite the firmware or anything, all it does is add su, busybox and Superuser to the existing /system partition.
EDIT: If selecting the "Update firmware from SD card" option doesn't give the option to browse for a ZIP, rename it to "update.zip" and place it in the root of the card and try again.
SifJar said:
It's possible the flashing from sd card supports standard update .ZIPs. You could try this one, it's a ZIP that should work for rooting most Android devices I believe. Superuser.zip
(This is from a topic on the HTC Explorer phone, but there is nothing specific to that phone in the ZIP as far as I know)
EDIT: This ZIP doesn't overwrite the firmware or anything, all it does is add su, busybox and Superuser to the existing /system partition.
EDIT: If selecting the "Update firmware from SD card" option doesn't give the option to browse for a ZIP, rename it to "update.zip" and place it in the root of the card and try again.
Click to expand...
Click to collapse
Thanks a lot. Does not have a browsing option so I need to know the needed name. Does not seem to work with the update.zip method
Does it try to install update.zip and give an error or does it say there is no update on the SD card?
Also, can you try and extract the su binary you said is in /system/xbin and post it here? There's something I would like to check.
EDIT: From adb shell, type the following, without quotes, "cat /proc/cpuinfo" and post the output here please
EDIT: Another silly suggestion - you could try guessing the password su asks you for. Maybe it's something obvious like "root" or "admin".
SifJar said:
Does it try to install update.zip and give an error or does it say there is no update on the SD card?
Also, can you try and extract the su binary you said is in /system/xbin and post it here? There's something I would like to check.
EDIT: From adb shell, type the following, without quotes, "cat /proc/cpuinfo" and post the output here please
Click to expand...
Click to collapse
Seems that it does not even try to update, no error message, nothing. I tried putting the update.zip in both /sdcard (internal sdcard) and /sd-ext (microsd)
Code:
[email protected]:/ $ cat /proc/cpuinfo
system type : actions-atv5201
processor : 0
cpu model : MIPS 74Kc V5.0 FPU V0.0
BogoMIPS : 719.25
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0460, 0x0868]
ASEs implemented : mips16 dsp
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
I have attached the 'su' binary from /system/xbin
Also:
Code:
$file su
su: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (uses shared libs), with unknown capability 0xf41 = 0x756e6700, with unknown capability 0x70100 = 0x1040000, stripped
But the table description of the manufacturer, says that has an Allwinner A10 (Cortex A8). Does not seem to be true, right?
Thanks
Looks like a MIPS processor then, not an ARM as most android devices have. That explains why exploit don't run and SSH didn't work, both use code compiled for ARM processors. It also means a standard su binary won't work on that device. You'll need one compiled for MIPS.
Does the update from sd card give any sort of error?
No. It does not say anything. I'll try to find the right update.zip for the MIPS architecture. Perhaps it could work.
Edit: Found this https://rapidshare.com/files/2288417520/Superuser-3.0.7-mips32r2-ics_signed.zip , but does not seem that I can flash it from the recovery with the update.zip method
Thanks a lot Sifjar
I'm afraid I'm now out of suggestions. The last piece of advice I can give is try and find an official update for the tablet from the manufacturer and investigate the format of that update, to try and identify how an update should be formatted/named for your device.
Thank you SifJar. You helped me a lot to find what happens with this tablet ;-)
I've read from more people, buying Allwiner A10 tablets on efox, and receiving different ones (lower specs and usually MIPS based). I'd not recommend to buy to this seller because it does not even answer your questions or does give you support.
I'm pretty sure, that could be one of the clones of the Ainol Novo7 Paladin/Basic. I'll try to find it
dreamer_ said:
Thank you SifJar. You helped me a lot to find what happens with this tablet ;-)
I've read from more people, buying Allwiner A10 tablets on efox, and receiving different ones (lower specs and usually MIPS based). I'd not recommend to buy to this seller because it does not even answer your questions or does give you support.
I'm pretty sure, that could be one of the clones of the Ainol Novo7 Paladin/Basic. I'll try to find it
Click to expand...
Click to collapse
Well I believe from a bit of reading about the Ainol tablet you should be able to type "adb remount" and then "adb root" to get root access from adb on that tablet. Then you can push a MIPS su binary to the device and be done with it. But it depends how close a clone it is whether the same will be true for your tablet I guess.
EDIT: Have you found any way to access a fastboot mode? (Possibly the command "adb reboot bootloader" would work) If the bootloader isn't locked, you may be able to extract the system.img, root the img and then flash it back with fastboot. Although that is something I have only heard about, I have no experience in how one would go about rooting the system.img. (Extracting it from the phone and flashing back isn't overly hard).
I have tried both things with no success. The remount, fails and I don't have root access then (and R/O Filesystems)
adb reboot bootloader, just reboots the device
I have found a post from a guy http://tabletrepublic.com/forum/other-tablets/actions-cpu-android-tablet-actions-atm7013-1-3ghz-cpu-2087.html#post20776, that seems to have my same tablet (or both tablets seem to be the same MIPS based).
I still think that could be a novo 7 basic/paladin clone and it does have the same recovery and the DFU mode. I'm downloading the tools and FW from the paladin, but seems to be impossible to find anything more about my tablet.
Thanks
dreamer_ said:
I have tried both things with no success. The remount, fails and I don't have root access then (and R/O Filesystems)
adb reboot bootloader, just reboots the device
I have found a post from a guy http://tabletrepublic.com/forum/oth...ctions-atm7013-1-3ghz-cpu-2087.html#post20776, that seems to have my same tablet (or both tablets seem to be the same MIPS based).
I still think that could be a novo 7 basic/paladin clone and it does have the same recovery and the DFU mode. I'm downloading the tools and FW from the paladin, but seems to be impossible to find anything more about my tablet.
Thanks
Click to expand...
Click to collapse
This is one of the big issues with China based devices. Not only is it have really limited development they tend to use none standard hardware so none of the current things work on it. Then toss in the fact that the hardware is not always what it is said to be.
Sent from my SGH-I897 using Tapatalk 2
The USB drivers for the novo paladin, didn't work for me....If I only could flash a CWM recovery for my tablet, perhaps I could then flash the superuser.zip with the 'su' binary that SifJar said.
zelendel said:
This is one of the big issues with China based devices. Not only is it have really limited development they tend to use none standard hardware so none of the current things work on it. Then toss in the fact that the hardware is not always what it is said to be.
Click to expand...
Click to collapse
Yes...my problem has been mainly that in the efox website, they are basically lying you in the product description, and selling a thing that is not true.
Casually, there's also an IVIEW tablet on the market, exactly like mine, made only for the chinese market (without the IVIEW letters and 1.3mpx camera)...and that was what I thought I bought, a chinese IVEW (and my mistake)
You really need to see the cpuinfo to see that, and not everybody will do it....
Thanks
If you download this: usbview.zip
You can use it to find the vendor ID (app shows it as IdVendor) for your device (put it in the DFU mode thing first), and then you could try using fastboot and specifying the vendor ID with -i argument, it might work without drivers then (not sure if this is right, but I think something similar was done with the Kindle Fire)
just try something like
Code:
fastboot -i 0xFFFF devices
replacing 0xFFFF with the vendor ID from that app, to see if it detects it at all
Thanks. Does not seem to return anything (a return). It works with '-i device' at the end of the line.
Code:
fastboot.exe devices -i 0x10D6
ADB does give me this:
Code:
c:\sonec>ADB\adb.exe devices
List of devices attached
Actions Semi. 23711DF4 device

[GUIDE] Access locked AXON 7: How to clear the lockscreen security settings

I have been experimenting with flashing, etc. and somehow the lockscreen were corrupted and the pattern I was using was not longer valid. I had the fingerprint already setup so I could enter using the rear sensor, but having a corrupted lockscreen is annoying. THis method requires TWRP custom recovery. It is compatible with locked bootloaders and doesn't modify the stock boot or system. It is also compatible with all the AAXON 7 models.
If you have the stock ROM and need TWRP and ADB interface:
A. Setup ADB interface in your PC and device drivers. and connect your terminal to the PC.
B. Setup axon7tool in your computer. Enter into EDL mode by running the command "adb reboot edl" in the command prompt. The terminal will seen to be off.
C. Disable the antivirus and then backup your recovery image using axon7tool running "axon7tool -r recovery". Save the created file in a safe place.
D. Flash tenfar's signed TWRP as a new recovery using axon7tool. It will reboot to system again.
E. Open the command prompt and run:
Code:
adb devices
adb reboot recovery
1. In TWRP , and with the ADB interface properly installed run these the commands from your computer:
Code:
adb devices
adb shell mv /data/system/locksettings.db locksettings.db.old
adb reboot
Now the system will allow you to pass lockscreen without security. In that case you do not need to apply the rest of the steps. Should you continue experimenting issues with the lockscreen, then you should apply the full procedure. Just add the following 2 steps:
2. Open the command prompt and run:
Code:
adb devices
adb reboot recovery
3. When TWRP had fully loaded, run in the command prompt the following commands:
Code:
adb devices
adb shell mv /data/system/gatekeeper.pattern.key gatekeeper.pattern.key.old
adb shell mv /data/system/locksettings.db locksettings.db.old
adb shell mv /data/system/gatekeeper.password.key gatekeeper.password.key.old
adb shell mv /data/system/locksettings.db-shm locksettings.db-shm.old
adb shell mv /data/system/locksettings.db-wal locksettings.db-wal.old
adb reboot
If you want to restore the stock recovery, you just need to rename the recovery-backup.bin file created in step C back to recovery.bin and run the command "axon7tool -w recovery". after that you can enable your antivirus software again. axon7tool can't connect with some antivirus software. I will be editing this OP with links to the procedures required for each step. All of them are in this forums.
Enjoy
@Oki
To fix either " Wrong Pattern " , " Wrong Pin " users only need to delete " /data/system/locksettings.db " from either Terminal/File Explorer with root or TWRP File explorer then Reboot and you'll be good to go .
DrakenFX said:
@Oki
To fix either " Wrong Pattern " , " Wrong Pin " users only need to delete " /data/system/locksettings.db " from either Terminal/File Explorer with root or TWRP File explorer then Reboot and you'll be good to go .
Click to expand...
Click to collapse
Sure! but this guide is intended for people with the stock, unrooted, blocked bootloader who want to remain with a pure stock experience. Usually people without experience rooting devices. This is why I will edit the guide to add all the details to every step.
Could I do this with a pin as well? I restored a backup and it corrupted my password and I have to use the fingerprint on the back to get in.
twilighttony said:
Could I do this with a pin as well? I restored a backup and it corrupted my password and I have to use the fingerprint on the back to get in.
Click to expand...
Click to collapse
Yes, the procedure deletes everything. If you have problems just do the same also with:
gatekeeper.password.key
locksettings.db-shm
locksettings.db-wal
I have updated the OP just to describe the full procedure.
I had this problem earlier today of having the PIN corrupted, but I have it set to require the pin on the first boot.
I fixed it by removing all files ending in ".key" in /system. Not really sure how this compares to removing locksettings.db. Afterward, I put my password back using Google's device manager.
Of course, I am rooted with twrp, so this comes after setting that up.
Masterjuggler said:
I had this problem earlier today of having the PIN corrupted, but I have it set to require the pin on the first boot.
I fixed it by removing all files ending in ".key" in /system. Not really sure how this compares to removing locksettings.db. Afterward, I put my password back using Google's device manager.
Of course, I am rooted with twrp, so this comes after setting that up.
Click to expand...
Click to collapse
The problem of this method is that it only works if the bootloader is unlocked and the phone has the No-verify patch installed.
When you say "No-verify patch," are you talking about removing Google license verification from apps (via an app such as lucky-patcher for instance)? AFAIK that is on a per-app basis and wouldn't affect something like the lockscreen password.
So if the phone has those prerequisites (unlocked, No-verify, TWRP), is there a difference between removing the ".key" files and the locksettings.db? I am not entirely sure what the different files contain, and don't seem to be able to find this information through Google, though I may just not be searching the right set of keywords.
Masterjuggler said:
When you say "No-verify patch," are you talking about removing Google license verification from apps (via an app such as lucky-patcher for instance)? AFAIK that is on a per-app basis and wouldn't affect something like the lockscreen password.
So if the phone has those prerequisites (unlocked, No-verify, TWRP), is there a difference between removing the ".key" files and the locksettings.db? I am not entirely sure what the different files contain, and don't seem to be able to find this information through Google, though I may just not be searching the right set of keywords.
Click to expand...
Click to collapse
No-Verify is an additional security system implementend in the kernel. When No-Verify is active, it checks for the signature of the system partition. If the system was modified, then the system won't boot. This is why after unlocking the bootloader you have to apply No-Verify Patch or any package with the integrated patch such as SuperSU. As you can see, it has nothing to do with the app signature or the lockscreen at all.
The method presented in the OP is valid for most Android phones, and the only prerequisite is to have TWRP installed. It is safe and a lot more recommended than patching the system partition. Patching system or kernel should always be your last resort. usually deleting locksettings.db is enough, and it is a general method that works for almost any locking method.
On B25 and have followed all instructions. Seems this method no longer works :/

Gapps/TWRP/CWM on china tablet

Hello,
I recently got a hand on Yuntab K107, ARM MT8752, Android 5.12 Bootloader unlocked. Everything worked fine until factory reset, after that Google play store and other gapps stopped working (play store checking info, then goes black and freezes for a while).
Tablet is rooted from factory by kingroot, I tried finding TWRP/CWM for this tablet to reflash gapps but I failed. I also tried Magic TWRP installer and MTK droid tools. Magic TWRP installer acts like it's working but no results. MTK droid tools refuses to find my device even if i tried every driver possible and cleared wrong drivers with USBDeview.
I also tried flashing gapps manually thru root explorer by unpacking gapps files and matching system file structure also no luck.
Then I backed up the stock recovery and tried flashing few custom TWRP's that some post suggested may work (you guessed it - it didn't work) It just hangs on the first booting screen then it surrenders after a while and reboots back into android.
Do you know about any TWRP/CWM that might work on this tablet or any other way to repair gapps if recovery is not necessary?
Thanks
I also rooted it with kingroot but havnt any custom recovery but i doing some experiment. Let se what it will result
I should be able to compile TWRP for you
I have one of these K107 tablets but it is running Android 7 and so far I have been unable to root it. Because you guys have root you should be able to download adbd Insecure by chainfire and follow this guide to Fetch the boot.img file by Extracting the boot.img directly from the device:
you will first have to determine the (sadly device-specific) path to the storage device where boot.img's content can be retrieved. I know two methods for this:
ls /dev/block/platform/*/by-name/ (where * covers yet another device-specific folder name, chances are it is the only directory below platform/), the exact name to search is also platform dependent but makes usual sense (some examples: boot, LNX (acronym for "Linux")). The files in this directory are actually symbolic links and some people bother to manually go to the target, but I recommend sticking with the higher level name based path which, while longer, remains less error prone. So you will end-up with a path like /dev/block/platform/sdhci-tegra.3/by-name/LNX.
On some (older?) devices, the right device could be found by investigating the output of cat /proc/mtd. If you see the device mtd2 associated to the "boot" label, then you will use the path /dev/mtd2.
Now:
From the phone's developer menu:
Enable debugging on your phone,
Allow root access to ADB (this step applies to phones running CynogenMod, other devices may require some potentially more complex procedure),
Connect it to your computer (and from there to the VM guest if you are running Android tools from within a virtual machine).
If this is not already done, I recommend to manually start the ADB server on the computer's side, this will allow you to directly validate the RSA key on device's side without affecting the behavior of the following ADB commands:
adb start-server
Then switch ADB in root mode:
adb root
Finally, you should be able to directly extract the boot.img file from the device using such command (the source and destination path and names are given as examples, adapt them to your needs and preferences):
adb pull /dev/block/platform/sdhci-tegra.3/by-name/LNX ./boot.img
The command will copy the whole partition, both used and free space, so don't be surprised that the resulting boot.img file will be larger than the original boot.img file coming with the stock ROM .zip file, the content itself remains similar.
Once the transfer is finished, disconnect the phone and don't forget to disable both debugging and root access from the developer menu.
Then upload the boot.img and I will build TWRP and test it on my tablet for you

Queries related to Rooting

Here are the questions:
• do I need to reboot to bootloader or recovery for flashing twrp? (Bootloader reboot to some Blue screen with download icon and recovery boot is something like 5-6 options)
• do I need to install magisk apk if I want to flash magisk.zip or it will be installed automatically after flashing the zip? And if I install apk before flashing zip, will it cause errors?
• I have correct drivers for my phone but when I type "fastboot devices" (without brackets) and I see <waiting for devices> in adb. But my phone is visible when it is on and using command adb devices. What should I do to see it in fastboot mode?
• will it be ok if I change my phone's api 23 to 25 by editing build.prop in /system after rooting? Will it make Android Oreo apps compatible on my Marshmallow?
• what are chances of bricking my phone and how to avoid it? (Note: I read all instructions multiple times)
• after rooting with magisk, can I use internet banking using Chrome? If not, how can I hide it and will hide work for chrome?
Thanks. Everyone's effort will be appreciated in answering questions.
(sorry for bad English)
If adb devices works as expected, but fastboot devices not then the Fastboot driver used either is a wrong one or the additionally needed Android USB Driver for the device didn't get installed yet.
In Android's build.prop file you can't change API -version but Android's SDK-version ( ro.build.version.sdk ). Changing SDK -version might not be the wisest choice
Even if you change the SDK-version therein from 23 to 25 an app what relies on Android SDK-version 25 may install but never run properly this because the currently installed APIs ( read: binaries & libraries what Android OS is made of ) aren't matching.
Can you please answer rest of my questions?
HKX_Inc. said:
Can you please answer rest of my questions?
Click to expand...
Click to collapse
What I could answer I did.

Categories

Resources