How To Guide Rooting Stock Firmware W/ Magisk

How To Guide Rooting Stock Firmware W/ Magisk - OnePlus Nord N200 5G

Once you have your bootloader unlocked (See edale1's post), you can get started!
Disclaimer:
Code:
* I'm not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed (like it did for me...).
* YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.
* Your warranty will be void if you tamper with any part of your device / software.
You first need to acquire a copy of your boot image. If you don't have the stock firmware package, you can extract it by following the steps in my previous post here: https://forum.xda-developers.com/t/...n-gaining-root-access-without-magisk.4321559/
For reference, Here's the stock boot image for DE2118 on build 11.0.1.5.DE18CB, as well as the already Magisk patched version. This has only been tested using the T-Mobile variant of the device. You're welcome to give it a try, but please report your result in the comments section along with your device model number.
If you decide to attempt the patched version, skip to step 5.
1. Get the latest magisk apk from https://github.com/topjohnwu/Magisk/releases
2. Install the apk on your device.
3.
Code:
adb push boot_stock.img /storage/emulated/0/Download/
3. Open the magisk app on your phone, select the boot image from your Download folder, and patch the image.
4. Now run
Code:
adb pull /storage/emulated/0/Download/name_of_patched_boot
. This will store the new boot image to your PC's currentl directory.
5. Reboot to fastboot by running
Code:
adb reboot bootloader
6. Now temporarily boot from the patched boot image FIRST to ensure your device still boots by running
Code:
fastboot boot name_of_patched_boot
.
7. Once your device boots, open the Magisk app to check that magisk has been installed successfully.
8. Reboot to fastboot again by running
Code:
adb reboot bootloader
9. Run
Code:
fastboot getvar current-slot
to get your current active partition slot. If it's A, then run
Code:
fastboot flash boot_a name_of_patched_boot
. If it's B, run
Code:
fastboot flash boot_b name_of_patched_boot
10. Run
Code:
fastboot reboot
to get back to the system

All I can say is wow.............

EnumC said:
Once you have your bootloader unlocked (See edale1's post), you can get started!
Disclaimer:
Code:
* I'm not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed (like it did for me...).
* YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.
* Your warranty will be void if you tamper with any part of your device / software.
You first need to acquire a copy of your boot image. If you don't have the stock firmware package, you can extract it by following the steps in my previous post here: https://forum.xda-developers.com/t/...n-gaining-root-access-without-magisk.4321559/
For reference, Here's the stock boot image for DE2118 on build 11.0.1.5.DE18CB, as well as the already Magisk patched version. This has only been tested using the T-Mobile variant of the device. You're welcome to give it a try, but please report your result in the comments section along with your device model number.
If you decide to attempt the patched version, skip to step 5.
1. Get the latest magisk apk from https://github.com/topjohnwu/Magisk/releases
2. Install the apk on your device.
3.
Code:
adb push boot_stock.img /storage/emulated/0/Download/
3. Open the magisk app on your phone, select the boot image from your Download folder, and patch the image.
4. Now run
Code:
adb pull /storage/emulated/0/Download/name_of_patched_boot
. This will store the new boot image to your PC's currentl directory.
5. Reboot to fastboot by running
Code:
adb reboot bootloader
6. Now temporarily boot from the patched boot image FIRST to ensure your device still boots by running
Code:
fastboot boot name_of_patched_boot
.
7. Once your device boots, open the Magisk app to check that magisk has been installed successfully.
8. Reboot to fastboot again by running
Code:
adb reboot bootloader
9. Run
Code:
fastboot getvar current-slot
to get your current active partition slot. If it's A, then run
Code:
fastboot flash boot_a name_of_patched_boot
. If it's B, run
Code:
fastboot flash boot_b name_of_patched_boot
10. Run
Code:
fastboot reboot
to get back to the system
Click to expand...
Click to collapse
Thank you!

Thank you! Have been waiting for it since June 25!

Nice!
So we pretty much just have to wait for a TWRP release and the stock ROM now, right?

edale1 said:
Nice!
So we pretty much just have to wait for a TWRP release and the stock ROM now, right?
Click to expand...
Click to collapse
Stock ROM is uploading, and it should be up on the previous thread shortly (at least the T-Mobile ROM).

PopCaps1996 said:
thank you so much! i was able to flash magisk patched boot.img after booting patched img trough twrp to make it worked on my metropcs variant! i am now rooted on stock rom with latest updates!
Click to expand...
Click to collapse
You have TWRP working on the N200?

edale1 said:
You have TWRP working on the N200?
Click to expand...
Click to collapse
No! I'm sorry I have both OnePlus n200 an n10 metro. I'm getting confused between the 2 lol

edale1 said:
You have TWRP working on the N200?
Click to expand...
Click to collapse
I'm working on this also, but still running into roadblocks. Got a majority of the core features working, including booting to TWRP and most of the mounting points. But userdata decryption is still not working. If anyone knows about the flags needed in BoardConfig and recovery.fstab to mount userdata with encryption, please PM.
Code:
[ 208.269528] [19700113_12:54:27.554867]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269535] [19700113_12:54:27.554876]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.269702] [19700113_12:54:27.555042]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.269705] [19700113_12:54:27.555046]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
[ 208.269928] [19700113_12:54:27.555269]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269932] [19700113_12:54:27.555273]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.270096] [19700113_12:54:27.555437]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.270100] [19700113_12:54:27.555441]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
recovery.fstab
Code:
/data f2fs /dev/block/bootdevice/by-name/userdata flags=display="Data";fileencryption=ice:aes-256-cts;wrappedkey;keydirectory=/metadata/vold/metadata_encryption
BoardConfig.mk
Code:
PLATFORM_SECURITY_PATCH := 2099-12-31
VENDOR_SECURITY_PATCH := 2099-12-31
TW_INCLUDE_CRYPTO := true
TW_INCLUDE_CRYPTO_FBE := true
TW_INCLUDE_FBE_METADATA_DECRYPT := true
BOARD_USES_METADATA_PARTITION := true

On step 6, just go to magisk manager and direct install. And there is no need to specify a slot when flashing with fastboot.

EnumC said:
I'm working on this also, but still running into roadblocks. Got a majority of the core features working, including booting to TWRP and most of the mounting points. But userdata decryption is still not working. If anyone knows about the flags needed in BoardConfig and recovery.fstab to mount userdata with encryption, please PM.
Code:
[ 208.269528] [19700113_12:54:27.554867]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269535] [19700113_12:54:27.554876]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.269702] [19700113_12:54:27.555042]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.269705] [19700113_12:54:27.555046]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
[ 208.269928] [19700113_12:54:27.555269]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269932] [19700113_12:54:27.555273]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.270096] [19700113_12:54:27.555437]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.270100] [19700113_12:54:27.555441]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
recovery.fstab
Code:
/data f2fs /dev/block/bootdevice/by-name/userdata flags=display="Data";fileencryption=ice:aes-256-cts;wrappedkey;keydirectory=/metadata/vold/metadata_encryption
BoardConfig.mk
Code:
PLATFORM_SECURITY_PATCH := 2099-12-31
VENDOR_SECURITY_PATCH := 2099-12-31
TW_INCLUDE_CRYPTO := true
TW_INCLUDE_CRYPTO_FBE := true
TW_INCLUDE_FBE_METADATA_DECRYPT := true
BOARD_USES_METADATA_PARTITION := true
Click to expand...
Click to collapse
Seeing the same on 8/Pro, but haven't found a solution. Bigbiff tried spent some time trying to fix but no luck.
Honestly I don't know more than that. If you haven't already you can join twrp zulip and ask there

EnumC said:
I'm working on this also, but still running into roadblocks. Got a majority of the core features working, including booting to TWRP and most of the mounting points. But userdata decryption is still not working. If anyone knows about the flags needed in BoardConfig and recovery.fstab to mount userdata with encryption, please PM.
Code:
[ 208.269528] [19700113_12:54:27.554867]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269535] [19700113_12:54:27.554876]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.269702] [19700113_12:54:27.555042]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.269705] [19700113_12:54:27.555046]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
[ 208.269928] [19700113_12:54:27.555269]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x6421a6eb)
[ 208.269932] [19700113_12:54:27.555273]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 1th superblock
[ 208.270096] [19700113_12:54:27.555437]@6 F2FS-fs (sda16): Magic Mismatch, valid(0xf2f52010) - read(0x8dc24167)
[ 208.270100] [19700113_12:54:27.555441]@6 F2FS-fs (sda16): Can't find valid F2FS filesystem in 2th superblock
recovery.fstab
Code:
/data f2fs /dev/block/bootdevice/by-name/userdata flags=display="Data";fileencryption=ice:aes-256-cts;wrappedkey;keydirectory=/metadata/vold/metadata_encryption
BoardConfig.mk
Code:
PLATFORM_SECURITY_PATCH := 2099-12-31
VENDOR_SECURITY_PATCH := 2099-12-31
TW_INCLUDE_CRYPTO := true
TW_INCLUDE_CRYPTO_FBE := true
TW_INCLUDE_FBE_METADATA_DECRYPT := true
BOARD_USES_METADATA_PARTITION := true
Click to expand...
Click to collapse
According to @theincognito as far as with how the Oneplus8 was released... the 8 and 8 pro uses ICE encryption and 8t and later use aes-256. Perhaps something similar with the OnePlus Nord N200 Tmobile Variant where the encryption algo was slightly changed? maybe you can MSG @theincognito and perhaps maybe he can shed some insight as to his findings with Oneplus encryption regarding helpful insights to recovery dev build for OnePlus device recovery

AiM2LeaRn said:
According to @theincognito as far as with how the Oneplus8 was released... the 8 and 8 pro uses ICE encryption and 8t and later use aes-256. Perhaps something similar with the OnePlus Nord N200 Tmobile Variant where the encryption algo was slightly changed? maybe you can MSG @theincognito and perhaps maybe he can shed some insight as to his findings with Oneplus encryption regarding helpful insights to recovery dev build for OnePlus device recovery
Click to expand...
Click to collapse
The issue is even with the original config from stock recovery.fstab:
Code:
/dev/block/bootdevice/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inlinecrypt,reserve_root=32768,resgid=1065,fsync_mode=nobarrier latemount,wait,check,formattable,fileencryption=aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized+wrappedkey_v0,keydirectory=/metadata/vold/metadata_encryption,metadata_encryption=aes-256-xts:wrappedkey_v0,quota,reservedsize=128M,sysfs_path=/sys/devices/platform/soc/1d84000.ufshc
It still exhibits the same issue. And it looks like he also used the stock fstab entry. I'm looking through some of the chat history for OP 8T/9R and see if I can pick up anything atm.

BOOM!
All we need is system dump and snatch boot.
I'll do it once I got home even I can do it with other rooted phone with adb host installed

For the FBE decryption issues, have you tried looking at the TWRP device tree for the Nord N10? I see a bunch of extra files related to decryption which could help.

The way I flash patched boot is just
Code:
fastboot flash boot
Press space once, and drag and drop patched boot onto command window, and press enter

lzgmc said:
For the FBE decryption issues, have you tried looking at the TWRP device tree for the Nord N10? I see a bunch of extra files related to decryption which could help.
Click to expand...
Click to collapse
Thanks for including a link. Yes, I'm currently attempting to integrate the same common device tree that repo also has. Got the scripts running without critical issues & made sure all the FBE binaries' dynamically linked libraries are included. TWRP still not decrypting properly and fails very early:
Code:
I:Unable to decrypt metadata encryption
I:FBE setup failed. Trying FDE...DEBUG:PrepDecrypt::Running PrepDecrypt script for TWRP...
E:fde::get_crypt_ftr_and_key::Unexpected value for crypto key location:
E:Error getting crypt footer and key
...
I:PrepDecrypt::File Based Encryption (FBE) is present.
DEBUG:PrepDecrypt::SDK version: 30
DEBUG:PrepDecrypt::DEFAULTPROP variable set to prop.default.
DEBUG:PrepDecrypt::A/B device detected! Finding current boot slot...
DEBUG:PrepDecrypt::Current boot slot: _b
DEBUG:PrepDecrypt::No recovery partition found.
I:PrepDecrypt::SETPATCH=true
DEBUG:PrepDecrypt::Build tree is Oreo or above. Proceed with setting props...
DEBUG:PrepDecrypt::Temporary vendor folder created at /v.
DEBUG:PrepDecrypt::vendor mounted at /v.
DEBUG:PrepDecrypt::Vendor Build.prop exists! Reading vendor properties from build.prop...
DEBUG:PrepDecrypt::Current vendor Android SDK version: 30
DEBUG:PrepDecrypt::Current vendor is Oreo or above. Proceed with setting vendor security patch level...
DEBUG:PrepDecrypt::Resetprop binary not found. Falling back to setprop.
DEBUG:PrepDecrypt::Current Vendor Security Patch Level:
E:PrepDecrypt::setprop failed. Vendor Security Patch Level unchanged.
DEBUG:PrepDecrypt::prop.default update successful! ro.vendor.build.security_patch=2021-07-01
DEBUG:PrepDecrypt::Temporary system folder created at /s.
DEBUG:PrepDecrypt::system mounted at /s.
I:Can't probe device /dev/block/sda16
I:Unable to mount '/data'

Lossyx said:
On step 6, just go to magisk manager and direct install. And there is no need to specify a slot when flashing with fastboot.
Click to expand...
Click to collapse
This! Much easier:
1. flashboot boot [patchedbootfilename.bin]
2. Once booted, go to Magisk and do Direct Install.
3. Done.

Related

[DEV] Custom MTD Partitions for the N1

With the advent of Blackrose custom HBOOT which gives us S-OFF, we can now resize the MTD partitions of our N1. This method is the one used by lbcoder in the Desire thread where you patch the recovery and boot in order to pass modified MTD partition information which supersedes the one provided by the SPL. Using this, I've managed to increase my userdata partition by ~50 MB by taking ~50 MB from the cache partition.
These instructions are for advanced users only. This will involve hex calculations and command line instructions that are not for the faint of heart. I don't believe it's dangerous though so anyone could still try since I will try to make these instructions as detailed as I possibly can.
What you need:
N1 with Blackrose HBOOT (I'm not sure this is needed though after I read more in-depth about the patch)
hex calculator (or a pencil & paper if you want to do it manually)
adb
fastboot
unpack-bootimg.pl
mkbootimg
recovery.img <- in my case I used ClockWorkMod 5.0.2 from here
boot.img <- taken from CM zip (in my case my KANG)
Partition Layout:
0x000003ee0000-0x000003fc0000 : "misc"
0x000004240000-0x000004640000 : "recovery"
0x000004640000-0x0000049c0000 : "boot"
0x0000049c0000-0x00000dac0000 : "system"
0x00000dac0000-0x0000139c0000 : "cache"
0x0000139c0000-0x00001fe00000 : "userdata"
Partition Sizes in Hex:
0x0000000e0000 : "misc"
0x000000400000 : "recovery"
0x000000380000 : "boot"
0x000009100000 : "system"
0x000005f00000 : "cache"
0x00000c440000 : "userdata"
Step-by-step Instructions:
A>Backup your current system: (OPTIONAL)
*I'm assuming you're using CWM 5.0.2 for the backup step since I tried using 3.X and the restore didn't work
1.) Boot your N1 into recovery using either adb reboot recovery or through the bootloader
2.) Backup your current system (I'm going to assume you know how to use your recovery for this)
B>Calculate new MTD parameter values:
*For this example I'm going to transfer ~50MB of cache space to my userdata partition:
1.) Since I know the cache partition is ~100MB in size, I'll just divide the hex size in 2:
0x5f00000 / 2 = 0x2f80000 <= this will be our new cache size
**Note that there is a minimum of 0x20000 (128k) for a partition and the size must be divisible by it which is why I'm playing safe and just dividing the original number in order to get an easier value for this example.
2.) Add the new cache partition size to the original cache partition starting address to get the new starting address of the userdata partition:
0xdac0000 + 0x2f80000 = 0x10a40000 <= this will be the new starting address for userdata
3.) Get the new userdata size by subtracting the new starting address of userdata with the ending address:
0x1fe00000 - 0x10a40000 = 0xf3c0000 <= this will be the new userdata size
C>Create a new recovery.img file which uses the new values:
1.) Breakdown the recovery.img file into it's kernel and ramdisk components using unpack-bootimg.pl:
.\unpack-bootimg.pl recovery.img
*This will yield 2 files and 1 directory. You can delete the directory since we only need the files.
2.) Rename the kernel from the recovery.img-kernel.gz made from unpack-bootimg.pl to recovery.img-kernel.
3.) Create the recovery-new.img file using mkbootimg with the new MTD command embedded:
mkbootimg --cmdline 'no_console_suspend=1 console=null mtdparts=msm_nand:[email protected](misc),[email protected](recovery),[email protected](boot),[email protected](system),[email protected](cache),[email protected](userdata)' --kernel recovery.img-kernel --ramdisk recovery.img-ramdisk.cpio.gz -o recovery-new.img --base 0x20000000
*Note that the values for cache starting address, userdata starting address and userdata size have been changed to the newly calculated values in the previous step.
**This will yield recovery-new.img which will be used in the next steps.
D>Create a new boot.img file which uses the new values:
1.) Breakdown the boot.img file into it's kernel and ramdisk components using unpack-bootimg.pl:
.\unpack-bootimg.pl boot.img
*This will yield 2 files and 1 directory. You can delete the directory since we only need the files.
2.) Rename the kernel from the boot.img-kernel.gz made from unpack-bootimg.pl to boot.img-kernel.
3.) Create the boot-new.img file using mkbootimg with the new MTD command embedded:
mkbootimg --cmdline 'no_console_suspend=1 wire.search_count=5 mtdparts=msm_nand:[email protected](misc),[email protected](recovery),[email protected](boot),[email protected](system),[email protected](cache),[email protected](userdata)' --kernel boot.img-kernel --ramdisk boot.img-ramdisk.cpio.gz -o boot-new.img --base 0x20000000
*Note that the values for cache starting address, userdata starting address and userdata size have been changed to the newly calculated values in the previous step.
**This will yield boot-new.img which will be used in the next steps.
E>Flash the recovery-new.img:
1.) Boot into bootloader and use fastboot command to flash the new recovery:
fastboot flash recovery recovery-new.img
F>Make system operational:
1.) Boot into recovery mode.
2.) Erase everything (factory reset)
3.) Either:
- Flash the ROM you took the original boot.img from OR
- Restore the backup you made previously (this only works (or has been tested) on CWM 5.0.2)
4.) DO NOT REBOOT YET!!!
G>Flash modified boot.img:
1.) Use adb to reboot to bootloader directly from recovery: (this is for safety since if you boot from an unmodified boot.img you'll have to start from F again.
adb reboot bootloader
2.) Use fastboot to flash the new boot image:
fastboot flash boot boot-new.img
3.) You may restart normally.
For those who've read this far, everything above has been rendered obsolete! Here's an editor for the SPL itself for the partition sizes:
http://intersectraven.euroskank.com/tools/SPLHexEditor.exe
*Instructions are in dla5244's thread 2nd post.
Try it at your own risk though!
Credits:
dla5244 - for bringing S-OFF to our N1 even after a looong time since its release
Firerat - for the original patch idea
Lbcoder - for coming up with the idea in the Desire thread

Reserved!
(I'm learning to reserve now... )

2 Questions:
Is the userdata space where downloaded apps go?
why didn't you choose any other partition to transfer empty space from?

drzplaya1121 said:
2 Questions:
Is the userdata space where downloaded apps go?
why didn't you choose any other partition to transfer empty space from?
Click to expand...
Click to collapse
1.) Yes.
2.) This is a sample. If you want to transfer from system or to system from cache, this example will show you how to do so.

thank U. Now I have no need to buy a new phone because of constantly running out of memory

Does it mean that every time I flash a new kernel, the whole effort will go waste?
Also, can I use the same procedure for Amon RA recovery??

rjmohit said:
Does it mean that every time I flash a new rom (which obviously has a different boot.img), the whole effort will go waste?
Also, can I use the same procedure for Amon RA recovery??
Click to expand...
Click to collapse
For that you need to do only steps D, F and G. If you flash only a kernel which uses koush's anykernel updater, you don't need to do anything.

intersectRaven said:
For that you need to do only steps D, F and G. If you flash only a kernel which uses koush's anykernel updater, you don't need to do anything.
Click to expand...
Click to collapse
Thanks.
One more silly question
Will the following procedure work.
1. Flash any ROM.
2. Then flash the modified boot.img (which may not belong to that ROM).
3. Then optionally flash the desired kernel.

rjmohit said:
Thanks.
One more silly question
Will the following procedure work.
1. Flash any ROM.
2. Then flash the modified boot.img (which may not belong to that ROM).
3. Then optionally flash the desired kernel.
Click to expand...
Click to collapse
Yeah. That would work since you're replacing the kernel anyways. What's important is that the kernel is compatible with the ROM.

Well done IR cannot wait to resize my data partition..

Okay, I extracted the recovery.img file, now when I try to extract recovery.img-kernel.gz, it gives the following error: not in gzip format. Exactly same happens for boot.img. I tried extracting it with different extractors on windows and ubuntu, nothing worked. Pls help.

I don't like using MTD because over time you will notice lag. If your already using sd-ext then your data is basically not being used. And I believe that cache never gets past 50% usage. Just putting in my two cents

rjmohit said:
Okay, I extracted the recovery.img file, now when I try to extract recovery.img-kernel.gz, it gives the following error: not in gzip format. Exactly same happens for boot.img. I tried extracting it with different extractors on windows and ubuntu, nothing worked. Pls help.
Click to expand...
Click to collapse
That's odd. In my installation, it worked flawlessly. Were there no errors during the run of unpack?
blahbl4hblah said:
I don't like using MTD because over time you will notice lag. If your already using sd-ext then your data is basically not being used. And I believe that cache never gets past 50% usage. Just putting in my two cents
Click to expand...
Click to collapse

intersectRaven said:
That's odd. In my installation, it worked flawlessly. Were there no errors during the run of unpack?
Click to expand...
Click to collapse
Nope. No errors. :-/

rjmohit said:
Nope. No errors. :-/
Click to expand...
Click to collapse
Found the problem. It seems it was never compressed in the first place. Ark sees this and just copies the file without the .gz extension.
*Instructions edited accordingly.

I may sound a bit noobish, but I'm facing one more hindrance:
How exactly do I run the mkbootimg file in the ubuntu terminal? I mean, can you give me the exact syntax?
I was facing a similar problem with the perl script, but then I found a solution on google, but didnt find anything for the mkbootimg. Can I run it under windows cmd?

rjmohit said:
I may sound a bit noobish, but I'm facing one more hindrance:
How exactly do I run the mkbootimg file in the ubuntu terminal? I mean, can you give me the exact syntax?
I was facing a similar problem with the perl script, but then I found a solution on google, but didnt find anything for the mkbootimg. Can I run it under windows cmd?
Click to expand...
Click to collapse
I already posted the syntax in the instructions. You just need to make sure the mkbootimg file has execute permissions in order for it to run.

Updated OP with SPL editor program.

intersectRaven said:
Updated OP with SPL editor program.
Click to expand...
Click to collapse
I tried your program. Everything worked fine. Just that my /cache now shows 290 MB free, while I had resized it to 20 MB!! Is that a bug? /system & /data show proper sizes though. thanks.

rjmohit said:
I tried your program. Everything worked fine. Just that my /cache now shows 290 MB free, while I had resized it to 20 MB!! Is that a bug? /system & /data show proper sizes though. thanks.
Click to expand...
Click to collapse
Is it the display on the program or display on the Android device when booted?
Wait, I found it. It's a bug. Thanks! I'll edit it when I get home. For now, please double check the values by reopening the made file before flashing. If the values are incorrect, please DON'T FLASH!!!

iplay 7t (sc9832e processor) root / unlock bootloader suggestions

Recently purchased an iplay 7t after reading the xda review. This is replacing an LG v400 tablet that I had rooted. I updated the iplay to build T701_V1.20_20191112, enabled developer options, enabled oem unlock bootloader, found the corresponding firmware pac, installed magisk and used it to patch boot.img. So far so good.
I entered fastboot, then I attempted to flash the modified boot.img and was told:
Code:
target didn't report max-download-size
sending 'boot' (18584 KB)...
OKAY [ 0.593s]
writing 'boot'...
FAILED (remote: Flashing Lock Flag is locked. Please unlock it first!)
finished. total time: 0.608s
I tried various options to unlock the bootloader:
Code:
> fastboot getvar unlocked
unlocked:
finished. total time: -0.000s
> fastboot oem unlock
...
FAILED (remote: unknown cmd.)
finished. total time: -0.000s
> fastboot oem unlock-go
...
FAILED (remote: unknown cmd.)
finished. total time: 0.002s
> fastboot flashing get_unlock_ability
...
FAILED (remote: Not implement.)
finished. total time: -0.000s
> fastboot flashing unlock
...
FAILED (remote: Not implemet.)
finished. total time: -0.000s
> fastboot flashing unlock_critical
...
FAILED (remote: Not implement.)
finished. total time: 0.016s
> fastboot flashing unlock_bootloader
fastboot: usage: unknown 'flashing' command unlock_bootloader
> fastboot flashing unlock_bootloader_nonce
fastboot: usage: unknown 'flashing' command unlock_bootloader_nonce
Okay ... fine. I fired up SPD Research tool and attempted to use it to flash the modified boot.img. It transfers the image and then times out.
As a sanity check I used SPD Research tool to flash the original boot.img and that worked fine.
I'll note the modified image is smaller than the original, however padding the modified image with zeros to the same size didn't seem to help. Using SPD Research tool to flash the padded image still timed out.
I am looking to open a request up on the Alldocube support site (currently their registration form is giving me an error), in the meantime ... suggestions? Has anyone successfully flashed a modified boot.img on this device / rooted this device?

in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.

DR.Doyle said:
in the "developer option" on your phone, you should enable the "allow unlock bootloader" option.
Click to expand...
Click to collapse
Yes ... I have that enabled.

Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.

jwehle said:
Okay I was able to unlock the bootloader by using the procedure documented for the Qin 2 Pro. With the bootloader unlocked on reboot the device notes:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by:
Code:
WARNING: LOCK FLAG IS : UNLOCKED, SKIP VERIFY!!!
Using fastboot I can now reflash the stock vbmeta and the stock recovery without any problems and the stock recovery boots fine.
Also if I re-sign the stock recovery, then I can't flash it (fastboot flash hangs) until I've flashed a modified vbmeta containing the new public key for the re-signed recovery. Meaning flashing vbmeta is "working".
All this seems like I'm on the right track.
However attempting to boot into the re-signed stock recovery results in:
Code:
INFO: LOCK FLAG IS : UNLOCKED!!!
followed by the device hanging (without displaying the WARNING message) so there is still something that's unhappy.
Any thoughts on how to get to the point that I can flash a useable re-signed stock recovery? If I can get that to work, then I should be in good shape to install magisk.
Click to expand...
Click to collapse
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.

wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery.
Click to expand...
Click to collapse
Thanks for supplying the modified PAC and for explaining the changes.
Your PAC seemed to work fine and now that I have a better understanding
of things I should be able build my own PAC when I have a chance.
Your time and effort in explaining things is appreciated.

What's the significance of removing the encryption for the vendor partitions?

jwehle said:
What's the significance of removing the encryption for the vendor partitions?
Click to expand...
Click to collapse
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
fstab.sp9832e_1h10：
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="DarkOrange"]fileencryption[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]fileencryption[/COLOR]=aes-256-xts
---------->
Code:
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,inline_xattr,inline_data wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts,reservedsize=128M
/dev/block/platform/soc/soc:ap-ahb/20600000.sdio/by-name/userdata /data ext4 noatime,nosuid,nodev,nomblk_io_submit,noauto_da_alloc wait,check,[COLOR="darkorange"]encryptable[/COLOR]=aes-256-xts

wangyiling said:
the vendor img in my pac，just use ext4 format.i have use simg2img convert the oringin vendor img to ext4 format,and modify the fstab file in vendor/etc folder.
Click to expand...
Click to collapse
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.

jwehle said:
Actually, I was more curious as to why it was necessary / desirable to remove the encryption from the vendor partitions.
Click to expand...
Click to collapse
Just for twrp to read the data partition, convenient for personal use。

It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Code:
vbmeta
boot
recovery
What was happening is when the system started normally it saw that recovery image had been modified so it checked if the boot image was the factory standard image. Since I hadn't touched the boot image the OS went ahead and attempted to replace the recovery image I flashed with a standard recovery image generated on the fly from the factory standard boot image. This caused a soft-brick when I rebooted into recovery since that recovery image wasn't signed using the public key specified by my replacement vbmeta.
By also flashing a newly signed boot image because the signature is different from what's it knows about the system no longer attempts to use it to refresh the recovery image.
Here's an outline of what I did to successfully root the device:
Use the Qin 2 Pro instructions / tools to unlock the boot loader.
Flash the appropriate factory standard firmware to establish a know starting point. I used iplay7t(T701)-Android9.0-ALLDOCUBE-191112 from the Alldocube web site.
Use SPD Rsearch Tool to extract vbmeta-sign.img, boot.img, and recovery.img.
Use avbtool (with the below patch) to extract the public keys from vbmeta-sign.img like so:
Code:
avbtool info_image --image vbmeta-sign.img.
Use make (with the below makefile) to sign vbmeta, boot, and recovery using a new key.
Flashed vbmeta, boot, and recovery.
Booted into recovery, saw that it worked, and did a factory reset.
Used magisk to patch recovery.img in the normal fashion, signed the patched recovery using the new key, and flashed the patched recovery.
Proceed to finish installing magisk in the normal fashion.
Notes:
rsa4096_vbmeta.pem is the private key mentioned in the Qin 2 Pro article.
The dhtbsign-vbmeta command is basically the dhtb signing python script from Qin 2 Pro article.
Here's the trival patch for avbtool to dump the public keys.
Code:
--- avbtool 2020-02-22 22:11:55.107787032 -0500
+++ avbtool.dumpkeys 2020-02-22 22:15:36.046283077 -0500
@@ -1657,6 +1657,10 @@ class AvbChainPartitionDescriptor(AvbDes
Arguments:
o: The object to write the output to.
"""
+ kfd = open(self.partition_name, "w");
+ kfd.write(self.public_key);
+ kfd.close();
+
o.write(' Chain Partition descriptor:\n')
o.write(' Partition Name: {}\n'.format(self.partition_name))
o.write(' Rollback Index Location: {}\n'.format(
Here's the makefile I used for signing the images.
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: Makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
dhtbsign-vbmeta vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
avbtool add_hash_footer --image recovery-sign.img \
--partition_name recovery --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096

@ jwehle，Very grateful for your detailed sharing

Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.

MissAyako said:
Did you have any trouble getting the tablet to populate the fastboot devices list?
I have USB drivers installed and can view the tablet's internal storage when it's not in fastboot mode. She's plugged directly into the mobo and I've tried two cables.
When in fastboot mode, it comes up in the Windows Device Manager as fastboot Gadget and drivers are apparently not available. I've tried using Zadig to feed it a driver of some kind, but still nothing.
Click to expand...
Click to collapse
Seems the issue was with Windows. I thought I would be able to get the unlock token with Windows and then use WSL to do the rest of the signing, but apparently not.
Luckily I had an old laptop lying around. I threw Linux Mint on it and it worked just fine.
It didn't seem to work just using a live USB; I had to install Linux to the hard disk, but YMMV.

jwehle said:
It looks like the issue on this tablet is similar to what the magisk documentation mentions regarding the new Samsung tablets. Meaning after the bootloader is unlocked when rooting you should flash newly signed versions of the following:
Click to expand...
Click to collapse
This was wonderful, thank you! I've added some of my own notes below as an experience of what I encountered when attempting this process myself (spoiler'd because it is a lot).
I do not have enough post count to add links, but titles to the relevant articles has been added.
Follow steps in Article "Guide: How to Unlock Xiaomi Qin 2 (Pro) and Install Custom ROMs" from step 1 to (and including) step 10 (Unlocking section).
Notes:
- A Linux PC is necessary.
- You'll have to mark the "fastboot" file from the "Android_device_unlock.rar" archive as executable (chmod +x).
- Run the "fastboot" file as root.
- Getting the "SPD Research Tool" to pick up the tablet and not let the tablet try to move to either the charging
screen or the bootlogo is difficult, but do-able. Press and hold Power+Vol_Up and release when Windows does its
USB device detected chime.
- Flashing takes a few minutes (I think around 300 seconds).
- The SPD Research Tool extracts the PAC file contents into a folder. Grab the system images from there.
- The "avbtool" is available to be cloned via git from Google's repo
- The avbtool is a python script that is patched with three lines of code at line 1776:
Code:
kfd = open(self.partition_name, "w");
kfd.write(self.public_key);
kfd.close();
- When you use the patched avbtool on the vbmeta-sign.img file you copied (avbtool info_image --image vbmeta-sign.img)
it will produce several partitions with relative public keys that need to be stored in separate files for the next step.
The contents of the files are simply the public key and the partition name as the file name. Store the files in a folder named "keys".
- When creating the makefile, ensure that proper indentation is used. The code segment below is properly formatted (hopefully). If you get make errors, remove and re-indent the lines.
- If your "rsa4096_vbmeta.pem" keyfile is not placed alongside the makefile, ensure the --key flag points to this file.
- The makefile exists in the same directory as the system images.
- I had to insert local paths to the avbtool, as it was not installed to the system PATH.
- The dhtbsign-vbmeta.py command is located below. Make sure to mark this as executable as well.
Everything else is rather straightforward.
# makefile
Code:
all: boot-sign.img recovery-sign.img vbmeta-sign.img
vbmeta-sign.img: makefile avb4096_pkmd.bin keys/*
avbtool make_vbmeta_image --output vbmeta.img --padding_size 16384 \
--key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:avb4096_pkmd.bin \
--chain_partition system:3:keys/system \
--chain_partition vendor:4:keys/vendor \
--chain_partition product:10:keys/product \
--chain_partition dtbo:9:keys/dtbo \
--chain_partition recovery:2:avb4096_pkmd.bin \
--chain_partition l_modem:5:keys/l_modem \
--chain_partition l_ldsp:6:keys/l_ldsp \
--chain_partition l_gdsp:7:keys/l_gdsp \
--chain_partition pm_sys:8:keys/pm_sys \
--chain_partition dtb:11:keys/dtb
./dhtbsign-vbmeta.py vbmeta.img vbmeta-sign.img
@rm -f vbmeta.img
avb4096_pkmd.bin: avb4096.pem
avbtool extract_public_key --key avb4096.pem --output avb4096_pkmd.bin
avb4096.pem:
openssl genrsa -out avb4096.pem 4096
boot-sign.img: boot.img avb4096.pem
cp boot.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
--partition_name boot --partition_size 36700160 \
--key avb4096.pem --algorithm SHA256_RSA4096
recovery-sign.img: recovery.img avb4096.pem
cp recovery.img recovery-sign.img
# dhtbsign-vbmeta.py file (from "How I Unlocked Xiaomi Qin 2 Pro and Installed Phh GSI")
Code:
#!/usr/bin/env python
import hashlib
import sys
f = open(sys.argv[1], "rb")
b = f.read()
sha = hashlib.sha256(b).digest()
f.close()
f = open("vbmeta_signed.img", "wb")
f.write(b)
f.seek(1048576 - 512)
f.write(b'\x44\x48\x54\x42\x01\x00\x00\x00')
f.write(sha)
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')
f.seek(1048576 - 1)
f.write(b'\x00')
f.close()

wuxianlin has build a twrp device for T701.
i think this will be a help .

Help me
Sir help pliz same problem my device ,same chipset , Symphony i95 ,pliz sir modify my pac file pliz....

wangyiling said:
Dear jwehle:
good job, i have also modify the pac firmware file which based on chinese vesion firmware:T701-1101-vbmetapri-vennofbe-systemnore-recpri01.pac
What's modified:
1.resgin the vbmeta img
2.delete fbe Force encryption in vendor partitions
3.delete the script in system.img to prevent factory recovery restore
4.modify recovery.img to a magisk build-in recovery
please use SPD_Research_Tool to flash the pac,change the android os language from chinese to english ,install magiskmanager app ,and the use adb command (adb reboot recovery)to let tablet reboot to recovery.
after tablet reboot to android os again ,open magiskmanager app,you can see the magisk can get root authority .
how to change language from chinese to english,please see attach png file.
Considering that the Android os you are using is in English version(including Google services),according to the modification points above, you can try to use the vbmeta and recovery (built in magisk) modified by your own signature , and then delete the fbe Force encryption、 recovery restoration in the system and vendor images , then use the SPD_Research_Tool to package the imgs into a pac image, flash the pac image, install the magiskmanager app, and use the adb command to restart the machine into recovery mode, so you can use magisk to get root permissions.
twrp egg:https://mega.nz/#!YZ9VDZbT!1ptlOI6g3FS_ES-cLGhLy9ybGtdHQ8vzVHaasAXglXo
and last thanks PeterCxy on xda 、the other masters sifu on 4pda agian.
Click to expand...
Click to collapse
can i just flash the pac without unlocking the bootloader.
thanks in advances

hidroela said:
can i just flash the pac without unlocking the bootloader.
thanks in advances
Click to expand...
Click to collapse
yes,just falsh pac

wangyiling said:
yes,just falsh pac
Click to expand...
Click to collapse
i did unlocked the bootloader and flash the pac and follow the instructions for magisk to work, but after a third reboot Root was gone.
i don't know what I am missing.

[RECOVERY][DUALBOOT][MAGISK][3.3.1-79][Unified]Unofficial TWRP for OnePlus 7/7 Pro/5G

If you want to make something like this for your device, check out this guide here
Since I no longer have an OP 7 series device, this mod is now deprecated and won't be receiving any more updates. @invernomut0 has made a continuation of this mod using orangefox recovery. Check it out here!
Team Win Recovery Project 3.x, or twrp3 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.
Code:
#include <std_disclaimer.h>
/*
*
* We are not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at us for messing up your device, we will laugh at you.
*
*/
Compatibility
This has only been tested by me on Oxygen OS Stable - Android Q.
Disclaimer
This is a DANGEROUS mod. Anything involving repartitioning is. If you fail to read and bad things happen, that's on you. Although I thoroughly tested this (managed to brick my phone once), there's always the possibility that something could go wrong with the worst case scenario resulting in a brick.
YOU'VE BEEN WARNED - Use at your own risk
What is this?
This is @mauronofrio's TWRP (see official thread here) that's been modified for true dual booting by splitting userdata into a/b slots (also does the same for metadata for encryption support). The installer script repartitions userdata for dualboot or stock based on your input.
Limitations
See the section in the github readme. MAKE SURE YOU READ THIS!
Features:
Same as mauronofrio's TWRP
Can choose between stock layout, a/b userdata, or a/b/c userdata where 'c' is a common data partition that'll show up in both roms - it's quite handy
Option to choose between ext4 and f2fs
Disables verity - fstabs are modified for dual boot and so this is a must unless you choose stock layout in which case it's optional
Option to disable forced encryption
Option to install magisk
Common Data
I recommend the a/b/c layout which includes this common data partition
If you choose a/b/c layout - you'll have a/b userdata, but you'll also get a 3rd userdata partition I call 'Common Data'
The name 'Common Data' gives away its purpose - to store files that you'll access on both slots/roms. So stuff like zips, pictures, music, TWRP backups, etc.
In TWRP, this shows up as another storage option for backup/restore and on your pc as well - your phone will have 'Common Storage' and 'Internal Storage'
In order to be accessible when booted, some parts of the system are modified so that the it'll be accessible WITHOUT root by the following mechanisms:
- The common data partition is mounted to /sdcard/CommonData
- .nomedia file is placed in CommonData so files in it won't be picked up twice if you decide to mount over internal storage as outlined below
- Furthermore, if your use case is like mine where my music files are in common data, you can make 'mounts.txt' file in /datacommon containing a list of every FOLDER to mount directly over top of sdcard. So for example:
/datacommon/Music -> /sdcard/Music
+ This of course mounts over anything there (overwrites it for as long as it's mounted) so make sure that you don't have the same folder in both datacommon and regular data
+ Note that there are 3 exceptions to this folder mounting rule:
1) All - if this is the FIRST line, ALL folders in datacommon will be mounted
2 )Android
3) lost+found
+ The reasoning should be obvious - lost+found isn't something you should need to mess with and Android is for regular data partition only - that's OS specific and should be on separate slots
+ Note that you should have 1 folder listed on every line, for example:
Code:
DCIM
Music
Pictures
ViPER4AndroidFX
Flashing Instructions
You MUST be booted into TWRP already when flashing this zip. You can grab a bootable twrp img from here
Since this modifies data - the zip CANNOT be on sdcard or data at all UNLESS you do not want to repartition/format
- If you flash from data, the zip will copy itself to /tmp and instruct you to flash it from there OR you can just install twrp/magisk/disver-fec
- You could do the above or copy it to a place like /dev or /tmp and flash it from there
- Alternatively, you can adb sideload it
Read through ALL the prompts - there's lots of options
Note that if you change partition layout, THIS WILL WIPE ALL DATA INCLUDING INTERNAL STORAGE
How to Flash Roms - If you're NOT stock layout
Nothing changes here except ONLY FLASH IN TWRP
- Roms always flash to the opposite slot. Keep that in mind and you'll be fine
- So don't take an OTA while booted - boot into twrp, switch slots, reboot into twrp, flash rom
Normal flash procedure:
1) Boot into twrp
2) reboot into twrp selecting slot you do NOT want rom installed to
3) Flash rom
4) Flash this zip
5) Reboot into twrp
6) Flash everything else
Help! I Can't Boot!
Usually this is because you switched roms without formatting data first. This should be flashing 101 but we all forget sometimes. Plus this slot stuff can get confusing
If it only happens with a/b/c and not any other layout, there's a good chance it's selinux related. Try setting selinux to permissive at kernel level with this mod(source here). If this doesn't fix it, it could be because selinux can't be set to enforcing even with the mod depending on the rom
How to Manually Repartition Back to Stock
In the event any step in the repartioning fails, the entire installer aborts. The good news is that this prevents a potential brick. The bad is that you need to manually revert back. See the README on github for the procedure. Note that if the install went fine and you want to switch back to stock later, just flash the installer again and choose stock layout
Download
Source Code
Credits
Mauronofrio
Teamwin
CosmicDan
TopJohnWu

Very ****ing badass. ?

Wow, this is cool. Always wondered if something like this would be possible on AB partitioned devices.
Looking forward to testing it out

Does the dual boot mean I can boot two roms?

jaggillararla said:
Does the dual boot mean I can boot two roms?
Click to expand...
Click to collapse
Ya. You can have a different rom on each slot

Will it impact on my original data partition if I flashed this TWRP.( I means whether my original data being splitted into 2-individual-parition + 1-common-partition and I need to reinstall my data after entering system ?)

Kris Chen said:
Will it impact on my original data partition if I flashed this TWRP.( I means whether my original data being splitted into 2-individual-parition + 1-common-partition and I need to reinstall my data after entering system ?)
Click to expand...
Click to collapse
The installer will tell you if it'll wipe internal storage or not.
Basically, if you choose to change the partition layout, data will all be wiped since it'll be repartitioned. If you choose to keep your partition layout at the beginning of the install, your data will be fine.
You could just use this zip as twrp, magisk, verity/fec modifer/installer to save you the extra steps and keep with stock layout

This is super cool. Will be testing soon. Just to confirm, this means I can have a custom rom on one slot and oxygen os on the other? Also f2fs should work fine with common data right?

f41lbl0g said:
This is super cool. Will be testing soon. Just to confirm, this means I can have a custom rom on one slot and oxygen os on the other? Also f2fs should work fine with common data right?
Click to expand...
Click to collapse
Yup. You can do whatever you want with either slot. This mod formats all data partitions as ext4 since that's what oneplus does. You can always reformat userdata to f2fs in twrp gui later if you want though. Same goes for common data although I don't think there's a gui option for that

How does this zip to allocate the each size of userdata ? Can be customized by ourself or automated by zip itself ?

Kris Chen said:
How does this zip to allocate the each size of userdata ? Can be customized by ourself or automated by zip itself ?
Click to expand...
Click to collapse
From what I see it can not be customized through the flasher (may be possible by editing values in the zip). In case you were wondering the size of the partitions, they are 96.7gb for the common storage and 62.4gb each for the individual storages.

Kris Chen said:
How does this zip to allocate the each size of userdata ? Can be customized by ourself or automated by zip itself ?
Click to expand...
Click to collapse
f41lbl0g said:
From what I see it can not be customized through the flasher (may be possible by editing values in the zip). In case you were wondering the size of the partitions, they are 96.7gb for the common storage and 62.4gb each for the individual storages.
Click to expand...
Click to collapse
It's automated by installer. If you have a 128gb device:
32gb for each userdata slot, commondata gets what's left
256gb device:
Everything's doubled from above

Thank you for this work I have screwed up all of my partitions on my Oneplus and could use a pointer on how to restore all of the correct partitions... :-0
I must have screwed up one of the commands on restoring my original partitions here is what I have now
C:\Users\The Family>adb shell
OnePlus7Pro:/ # sgdisk /dev/block/sda --print
Creating new GPT entries.
Disk /dev/block/sda: 61409280 sectors, 234.3 GiB
Logical sector size: 4096 bytes
Disk identifier (GUID): B0281E2A-8376-4F4B-98C6-BF5221AD8A20
Partition table holds up to 128 entries
First usable sector is 6, last usable sector is 61409274
Partitions will be aligned on 256-sector boundaries
Total free space is 61409269 sectors (234.3 GiB)
Number Start (sector) End (sector) Size Code Name
OnePlus7Pro:/ #
What commands do I need to fix this. I can still get into adb shell
edit: msmtool cannot restore from this because the partitions are not correct from the way it looks when I try it. when in recovery touch does not work.

eyespunker said:
Thank you for this work I have screwed up all of my partitions on my Oneplus and could use a pointer on how to restore all of the correct partitions... :-0
I must have screwed up one of the commands on restoring my original partitions here is what I have now
C:\Users\The Family>adb shell
OnePlus7Pro:/ # sgdisk /dev/block/sda --print
Creating new GPT entries.
Disk /dev/block/sda: 61409280 sectors, 234.3 GiB
Logical sector size: 4096 bytes
Disk identifier (GUID): B0281E2A-8376-4F4B-98C6-BF5221AD8A20
Partition table holds up to 128 entries
First usable sector is 6, last usable sector is 61409274
Partitions will be aligned on 256-sector boundaries
Total free space is 61409269 sectors (234.3 GiB)
Number Start (sector) End (sector) Size Code Name
OnePlus7Pro:/ #
What commands do I need to fix this. I can still get into adb shell
edit: msmtool cannot restore from this because the partitions are not correct from the way it looks when I try it. when in recovery touch does not work.
Click to expand...
Click to collapse
I have the steps outlined here: https://github.com/Zackptg5/TWRP-DualBoot-Guac-Unified/#how-to-manually-repartition-back-to-stock
But what did you do? It looks like you formatted all of /dev/block/sda which is essentially a brick. You are able to restore that with msmtool btw but there will still be some device specific data that is lost and you'll likely need to file warranty claim

Zackptg5 said:
I have the steps outlined here: https://github.com/Zackptg5/TWRP-DualBoot-Guac-Unified/#how-to-manually-repartition-back-to-stock
But what did you do? It looks like you formatted all of /dev/block/sda which is essentially a brick. You are able to restore that with msmtool btw but there will still be some device specific data that is lost and you'll likely need to file warranty claim
Click to expand...
Click to collapse
It was this step that I really messed up
Final step is to format the new userdata partition: mke2fs -t ext4 -b 4096 /dev/block/sda$userdata_num $userdata_size - where userdata_size can be calculated with this shell command: sgdisk /dev/block/sda --print | grep "^ *$userdata_num" | awk '{print $3-$2+1}'
with this step I used the result from sgdisk /dev/block/sda --print | grep "^ *$userdata_num" | awk '{print $3-$2+1}' I do not remember the value into the spot where userdata_size was
It looks like have been able to flash partitions manually in fastboot but the two partitions that are no longer recognized are the system_a and system_b the reason I say that is because vendor and boot flash fine on both a and b partitions. and when I send the commands to flash system a or b the reply is partition not found?! I am not sure if it would fix my problem but if I could get help to restore system partitions maybe I can get this thing to boot up.

eyespunker said:
It was this step that I really messed up
Final step is to format the new userdata partition: mke2fs -t ext4 -b 4096 /dev/block/sda$userdata_num $userdata_size - where userdata_size can be calculated with this shell command: sgdisk /dev/block/sda --print | grep "^ *$userdata_num" | awk '{print $3-$2+1}'
with this step I used the result from sgdisk /dev/block/sda --print | grep "^ *$userdata_num" | awk '{print $3-$2+1}' I do not remember the value into the spot where userdata_size was
It looks like have been able to flash partitions manually in fastboot but the two partitions that are no longer recognized are the system_a and system_b the reason I say that is because vendor and boot flash fine on both a and b partitions. I am not sure if it would fix my problem but if I could get help to restore system partitions maybe I can get this thing to boot up.
Click to expand...
Click to collapse
The formatting steps is how I initially bricked my phone when I was figuring this stuff out - I since fixed that issue and made sure it'd never happen again in the zip :/
Why were you manually restoring? Did the zip cut off with partition error?
You'll need to use msmtool in this case. Even if your partition block is completely toast, it's able to bring it all back. You can grab the latest one from here: https://androidfilehost.com/?w=files&flid=296306
And here's the guide for it: https://forum.xda-developers.com/oneplus-7-pro/how-to/msm-tool-guac-t3934691

Zackptg5 said:
The formatting steps is how I initially bricked my phone when I was figuring this stuff out - I since fixed that issue and made sure it'd never happen again in the zip :/
Why were you manually restoring? Did the zip cut off with partition error?
You'll need to use msmtool in this case. Even if your partition block is completely toast, it's able to bring it all back. You can grab the latest one from here: https://androidfilehost.com/?w=files&flid=296306
And here's the guide for it: https://forum.xda-developers.com/oneplus-7-pro/how-to/msm-tool-guac-t3934691
Click to expand...
Click to collapse
When I run the latest 10.4 global I get "device does not match image" and then under status I loose connection. I have also tried the 10.31 file with no luck either.

eyespunker said:
When I run the latest 10.4 global I get "device does not match image" and then under status I loose connection. I have also tried the 10.31 file with no luck either.
Click to expand...
Click to collapse
In msmtool? Do you have the right variant?
Latest global: https://androidfilehost.com/?fid=4349826312261732245
Latest europe: https://androidfilehost.com/?fid=4349826312261732244
Download mode is really tricky too. It times out after several seconds so you pretty much have to keep holding down the key combo until msmtool picks it up and then you can release them

Zackptg5 said:
In msmtool? Do you have the right variant?
Latest global: https://androidfilehost.com/?fid=4349826312261732245
Latest europe: https://androidfilehost.com/?fid=4349826312261732244
Download mode is really tricky too. It times out after several seconds so you pretty much have to keep holding down the key combo until msmtool picks it up and then you can release them
Click to expand...
Click to collapse
I have now tried the latest two and have come up with the same results on the update when the device param load the result of the last communication is device does not match image.

eyespunker said:
I have now tried the latest two and have come up with the same results on the update when the device param load the result of the last communication is device does not match image.
Click to expand...
Click to collapse
Sounds like you may need to file a warranty claim then :/

Signing release for "fastboot update"?

Device in question, although likely not relevant to the issue I am having: Pixel 2 XL (Taimen). Let me know if there's any info I may have missed sharing that could help solve this.
My overarching goals here are:
1. Build vanilla AOSP "user" variant without root or any other additions
2. Sign the build with my own release keys
3. Be able to git-checkout release tags at a later time, build again, and produce OTA updates for this vanilla AOSP build
So far, I have been able to successfully build the latest release and flash it to my device using:
Code:
fastboot flashall
The device boots and runs as you would expect.
However, that is all using the test-key. I have followed the official documentation for generating release keys:
hxxps://source.android[.]com/devices/tech/ota/sign_builds#release-keys
The same documentation page provides the following listing for generating the release image:
Code:
make dist
./build/make/tools/releasetools/sign_target_files_apks \
-o \ # explained in the next section
--default_key_mappings ~/.android-certs out/dist/*-target_files-*.zip \
signed-target_files.zip
Apparently SignApk.jar doesn't work with password-encrypted keys (it throws an exception then swallows it which causes the whole thing to fail at a later point), and signing the APKs in the target files ZIP fails. Fine, I'm willing to use an unencrypted key for testing this project.
So I successfully get a signed-target_files.zip.
Lastly, the documentation provides the following for producing the release image:
Code:
./build/make/tools/releasetools/img_from_target_files signed-target-files.zip signed-img.zip
This also works successfully (minus the typo with the filename, switching the '_' character for '-'), so I use this to install:
Code:
fastboot update -w signed-img.zip
Then I get symptoms of the problem:
1. Warning that the bootloader is unlocked (fine)
2. White screen with "Google" logo
3. Reboot to bootloader
I never see the "android" splash screen after 2. like when I
Code:
fastboot flashall
to install the test-key version which does work.
So something else that I decided to try was to create an "unsigned-img.zip." I basically used img_from_target_files on the original, unsigned target_files.zip. and did a
Code:
fastboot update -w unsigned-img.zip
. This also booted successfully.
=====================
To recap:
1. Building is successful
2. "fastboot flashall" is successful
3. "fastboot update unsigned-img.zip" is successful
4. "fastboot update signed-img.zip" is NOT successful and always reboots back to the bootloader
Is there something I'm missing with regards to the image signing? If I'm doing this and having this issue on an unmodified AOSP branch, shouldn't everyone else be having these signing issues, as well?
Any help is appreciated.

It worked for me without -w argument:
Code:
fastboot update signed-img.zip

[Recovery] [ANE-LX] Recovery and Erecovery stuck and challanged flashing LOS

Hi there
I had some problems booting into Recovery and ERecovery. It would always stay endless in the Warning screen where it says that the Device is unlocked.
I run into it because of TWRP not Formating Data properly.
https://dl.twrp.me/anne/
twrp-3.5.1_9-0-anne.img14.6M 2021-03-13 15:27:54 ESTtwrp-3.5.0_9-0-anne.img13.2M 2020-12-27 21:03:29 EST
This Versions get stuck at:
Code:
Formatting Data using mkfs.f2fs...
Done
After it beeing stuck I could usually reach erecovery and wipe . But at one point it wouldn't work and I couldn't reacht the two and also couldn't stop the device from endless starting after shutting down.
I tried to flash several images from this one: https://androidhost.ru/1nfK
After flashing odm.img I could access the reflashed Stock Recovery and E-Recovery.
Update: Erasing Data with fastboot also works.
Note: It would show Google instead of Huawei at startup and in fastboot FRP:Unlocked doesn't show anymore after flashing odm.img
Else:To reach erecovery or twrp recovery I retried often to hold power and volume up when the device is turned off. It then vibrates two times when it works. I hat sometimes to try for 10 Minutes to reach one of the to.
I unlocked with PotatoNV. The phone can be opened quite comfortable with a straight package plastic like from a cabel or electric device and a hairdrier.

Update: I can actually not format Data with any of these TWRPs. This was working before flashing the odm or maybe an other image.
twrp-3.5.1_9-0-anne.img14.6M 2021-03-13 15:27:54 ESTtwrp-3.5.0_9-0-anne.img13.2M 2020-12-27 21:03:29 ESTtwrp-3.4.0-1-anne.img13.2M 2020-09-26 14:58:13 EDTtwrp-3.4.0-0-anne.img13.2M 2020-08-21 17:03:57 EDT

I could format with adb shell:
anne:/etc # mkfs.f2fs /dev/block/mmcblk0pXX
F2FS-tools: mkfs.f2fs Ver: 1.10.0 (2018-01-30)
Info: Disable heap-based policy
Info: Debug level = 0
Info: Label =
Info: Trim is enabled
Info: No support kernel version!
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 106086400 (51800 MB)
Info: zone aligned segment0 blkaddr: 512
Info: [/dev/block/mmcblk0p57] Discarding device
Info: Secure Discarded 0 MB
Info: Overprovision ratio = 0.880%
Info: Overprovision segments = 459 (GC reserved = 235)
Info: format successful

benaep said:
I can actually not format Data with any of these TWRPs.
Click to expand...
Click to collapse
Yes, you have installed wrong TWRP (version 3.4.0.x and 3.5.0.x is not fully compatible with our device and it's strongly NOT recommended do 'wipe data' runnig stock ROM , it may brick the phone).
Use recommended TWRP:
Recommended and tested TWRP Recovery
EMUI 8 Stock ROMs: 3.2.1-0 by pretoriano80 (with data decryption on Android 8 ) https://mega.nz/#!Fgd0xa4R!1o5ejzDnkLJLG2tAZG-STtlJ4nnNCHfwwZdOlmOkrVw EMUI 8 Custom ROMs: 3.2.1.0 by Catuva21...
forum.xda-developers.com

-Alf- said:
Yes, you have installed wrong TWRP (version 3.4.0.x and 3.5.0.x is not fully compatible with our device and it's strongly NOT recommended do 'wipe data' runnig stock ROM , it may brick the phone).
Use recommended TWRP:
Recommended and tested TWRP Recovery
EMUI 8 Stock ROMs: 3.2.1-0 by pretoriano80 (with data decryption on Android 8 ) https://mega.nz/#!Fgd0xa4R!1o5ejzDnkLJLG2tAZG-STtlJ4nnNCHfwwZdOlmOkrVw EMUI 8 Custom ROMs: 3.2.1.0 by Catuva21...
forum.xda-developers.com
Click to expand...
Click to collapse
Thanks for the direction Alf. So for the Newest Linage OS build that would be:
Pie Custom ROMs:
3.4.0-0-emui9_eR
MEGA
MEGA provides free cloud storage with convenient and powerful always-on privacy. Claim your free 20GB now
mega.nz
right?

benaep said:
Thanks for the direction Alf. So for the Newest Linage OS build that would be:
Pie Custom ROMs:
3.4.0-0-emui9_eR
MEGA
MEGA provides free cloud storage with convenient and powerful always-on privacy. Claim your free 20GB now
mega.nz
right?
Click to expand...
Click to collapse
If you want to flash LOS from TWRP (idk why, but it's your choice), use 3.2.1 by pretoriano80 (wiping etc.) After installing custom ROM, you can replace 3.2.1. with 3.4.0.0-emui9_eR.

-Alf- said:
If you want to flash LOS from TWRP (idk why, but it's your choice), use 3.2.1 by pretoriano80 (wiping etc.) After installing custom ROM, you can replace 3.2.1. with 3.4.0.0-emui9_eR.
Click to expand...
Click to collapse
Hi Alf
Thanks for the reply. Very gratefull for this. I'm trying since Weeks to get this running.
I just want a phone with minimal Google. I had /e/ but I didn't find a build and back in the days linage would be fine.
You think there is something which makes more sense?

benaep said:
I just want a phone with minimal Google
Click to expand...
Click to collapse
Then install "v" variant , e.g.
LOS 17.1-unoff.
https://sourceforge.net/projects/treblerom/files/LOSQ/2020.10.17/losq-v224-201017-arm64-bvN.img.xz/download
LOS 18.1-unoff.
https://sourceforge.net/projects/treblerom/files/LiR/2021.03.18/lir-v302-210318-arm64-bvZ.img.xz/download
and install opengapps - pico, nano, micro... , what suits you.

-Alf- said:
Then install "v" variant , e.g.
LOS 17.1-unoff.
https://sourceforge.net/projects/treblerom/files/LOSQ/2020.10.17/losq-v224-201017-arm64-bvN.img.xz/download
LOS 18.1-unoff.
https://sourceforge.net/projects/treblerom/files/LiR/2021.03.18/lir-v302-210318-arm64-bvZ.img.xz/download
and install opengapps - pico, nano, micro... , what suits you.
Click to expand...
Click to collapse
Yo Alf
Thanks for the Links to the Image files. I would never have found them myself. I tried now a few hours to make them run.
Formating and Wiping works with 3.2.1 by pretoriano80
I tried both images, but am not shure. I get an invalid zip file error when I copy it on the device. Sideload doesn't work. No connection or Success or Success 00.00 X.
I make it a zip on linux with --> unxz --> img2simg --> Create Zip Directory wit xarchiver.
I tried different combinations of this. First I forgot about simg and just made a zip out of the img.
Code:
/tmp/recovery.log: 1 f...57322 bytes in 0.010s)
~ >>> adb sideload /home/bni/Downloads/losq17.zip
adb: failed to read command: Success
~ >>> adb sideload /home/bni/Downloads/losq17.zip
adb: sideload connection failed: closed
adb: trying pre-KitKat sideload method...
adb: pre-KitKat sideload connection failed: closed
~ >>> adb pull /tmp/recovery.log /home/bni/Downloads/recovery.log
/tmp/recovery.log: 1 f...59228 bytes in 0.007s)
Code:
~ # twrp install /image/LOS17_SIMG.zip
Installing zip file '/image/LOS17_SIMG.zip'
Checking for Digest file...
Skipping Digest check: no Digest file found
Invalid zip file format!
Error installing zip file '/image/LOS17_SIMG.zip'
Done processing script file

benaep said:
I get an invalid zip file error when I copy it on the device.
Click to expand...
Click to collapse
Of course, it is not a flashable .zip file.
You have to install it as image file, unpack .zip package, transfer exctracted .img file to the SD card. In TWRP go to Install , select Install image, choose lineage .img file , mark "system image" and flash.
If you need to do a factory reset , first replace TWRP with stock recovery and perform factory reset in recovery.
Or, flash Lineage.img in fastboot,without TWRP, wipes, errors etc. (make sure to have the stock recovery flash) - https://forum.xda-developers.com/t/losq-lineageos-17-1-18-1-unofficial-gsi.4219291/post-84305543

Better Mobile App

welcome