Armor x5 Android 10_Q Mt6765 aka Mt6762 ROOT AT LAST! - Android Q&A, Help & Troubleshooting

This 'tutorial' is a quicky for those yet to figure this fone out.
Well it took a bit time for sure, but this is how it went...
No matter what recovery or magisk I tried, nothing worked, all ulefone images with twrp were 64mb in size, where-as mine was 32mb. Betting the 64mb is a/b partioned like the old ambit 250 modems, where half the non-vol was the first boot, the second half a clone of the first half.
No file for the mt6765 worked. In other words, no twrp. instant bootloop every time.
But then I found the ulefone note9 mt6762 recovery, flashed it, booted into recovery, and had root!
Until I rebooted at least. There was no access to the actual fone system however, for in recovery, system, or / has not been mounted, and if it was, it cold not be written to..
Then I had an idea. I tested the root.img from android kitchen by flashing just that direct to the recovery of the fone, and it not only stuck, I could switch off fone, reboot, and what I call an overlaid file system with root presented itself, and before I knew it I had a fake root that worked.
The problem with this fone is that it actually uses mt6762 for booting, booting into mt6765 style, vice versa does not work. The note9 is a 6762 chipset. 32mb in size.
The root.img from android kitchen, flashed to recovery gives the head start, having magisk installed, but sadley, twrp did not show in recovery using the note9 recovery that has a working twrp, and the android kitchen root.img shows no twrp, being magisk'd!
Unlocked bootloader required.
Boot into fastboot.
fastboot flash vbmeta vblankmeta.img
fastboot flash recovery root.img
boot fone, install magisk manager, superuser and busybox apk's, then root checker pro, test and see, by rebooting, it should keep root if you set su to boot via busybox, AND superuser.
Now if someone wants to make this for this actual fone, with the correct file versions for this fone, I'll post my latest stock recovery, along with the files I used. All files as far as I know came from here, I have done nothing to them.
The actual Files are: Armor x5 Android 10_Q root.zip is actually a 7z file renamed to zip to upload here, i use 7z, and dont install winzip, and the password for both is Re-Kr8, used in order to prevent google tampering.
The zip contains vblankmeta.img and root.img taken from android kitchen, hope they dont mind auld folks like me helping this way...
The origional is recovery from unrooted fone taken from stock firmware, android 10 Q for ulefone armor x5.
Have a nice day.

---

And I found this somewhere so will leave it here for those who want true root on the ulefone device, I'm too sore with slow paralysis to keep working at this...
Android Q system_app writes persist.sys by default. The system property SEliux permission
When debugging Settings.apk by myself.
It was discovered that as a platform system signature application, there was no permission to sign a custom persist.st_nfc_debug system property.
It can be modified to the name beginning with persist.sys.
Although in the end, I said:
persist.st_nfc_debug ubject_r:system_prop:s0
Get it done.
why is that?
This step by step tracks SeLinux permission protection in Android.
The same is because the system authorizes persist.sys. by default and classifies it into system_prop.
alps/system/sepolicy/private/property_contexts
persist.log.tag ubject_r:log_tag_prop:s0
persist.mmc. ubject_r:mmc_prop:s0
persist.netd.stable_secret ubject_r:netd_stable_secret_prop:s0
persist.sys. ubject_r:system_prop:s0
persist.sys.safemode ubject_r:safemode_prop:s0
persist.sys.fflag.override.settings_dynamic_system ubject_r:dynamic_system_prop:s0
So where is system_prop defined?
It belongs to property_type and core_property_type.
alps/system/sepolicy/public/property.te
79 type shell_prop, property_type, core_property_type;
80 type system_boot_reason_prop, property_type;
81 type system_prop, property_type, core_property_type;
82 type system_radio_prop, property_type, core_property_type;
83 type system_trace_prop, property_type;
84 type test_boot_reason_prop, property_type;
Authorization, the last line below, set_prop(system_app, system_prop).
alps/system/sepolicy/private/system_app.te
7 typeattribute system_app coredomain;
8
9 app_domain(system_app)
10 net_domain(system_app)
11 binder_service(system_app)
12
13 # android.ui and system.ui
14 allow system_app rootfs:dir getattr;
15
16 # Read and write /data/data subdirectory.
17 allow system_app system_app_data_file:dir create_dir_perms;
18 allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
33 # Write to properties
34 set_prop(system_app, bluetooth_a2dp_offload_prop)
35 set_prop(system_app, bluetooth_audio_hal_prop)
36 set_prop(system_app, bluetooth_prop)
37 set_prop(system_app, debug_prop)
38 set_prop(system_app, system_prop)
So where is this set_prop sacred?
alps/system/sepolicy/public/te_macros
305 #####################################
306 # set_prop(sourcedomain, targetproperty)
307 # Allows source domain to set the
308 # targetproperty.
309 #
310 define(`set_prop', `
311 unix_socket_connect($1, property, init)
312 allow $1 $2roperty_service set;
313 get_prop($1, $2)
314 ')
315
316 #####################################
317 # get_prop(sourcedomain, targetproperty)
318 # Allows source domain to read the
319 # targetproperty.
320 #
321 define(`get_prop', `
322 allow $1 $2:file { getattr open read map };
323 ')
It is a general method of declaration.
So according to this meaning, you can piece together the following permission statement:
allow system_app system_proproperty_service set;
Use the real phone to enter the mobile phone directory to find and verify is the king:
5032E:/system/etc/selinux # grep -rni "allow system_app system_prop".
./Plat_sepolicy.cil:19108allow system_app system_prop (property_service (set)))
./plat_sepolicy.cil:19109allow system_app system_prop ( file (read getattr map open)))
5032E:/system/etc/selinux #
summary:
Just because the Android compilation system has assigned relevant permissions by default, it can be used directly, and custom ones require additional authorization.
Additional tips:
Before adding the compilation in the alps project, the .te file will be compiled and imported into the cil file.
Android Q currently has cil files:
./vendor/etc/selinux/vendor_sepolicy.cil
./vendor/etc/selinux/plat_pub_versioned.cil
./system/etc/selinux/mapping/27.0.cil
./system/etc/selinux/mapping/29.0.cil
./system/etc/selinux/mapping/26.0.cil
./system/etc/selinux/mapping/28.0.cil
./system/etc/selinux/plat_sepolicy.cil
The property_contexts file will be imported into the plat_property_contexts file.
./system/etc/selinux/plat_property_contexts:61ersist.sys. ubject_r:system_prop:s0
./system/etc/selinux/plat_property_contexts:62ersist.sys.safemode ubject_r:safemode_prop:s0
./system/etc/selinux/plat_property_contexts:63ersist.sys.theme ubject_r:theme_prop:s0
./system/etc/selinux/plat_property_contexts:64ersist.sys.fflag.override.settings_dynamic_system ubject_r:dynamic_system_prop:s0
./system/etc/selinux/plat_property_contexts:66ersist.sys.audit_safemode ubject_r:safemode_prop:s0
./system/etc/selinux/plat_property_contexts:81ersist.sys.boot.reason ubject_r:last_boot_reason_prop:s0
./system/etc/selinux/plat_property_contexts:346ersist.sys.dalvik.vm.lib.2 ubject_r:exported2_system_prop:s0 exact string
./system/etc/selinux/plat_property_contexts:347ersist.sys.media.avsync ubject_r:exported2_system_prop:s0 exact bool
And all the files ending with _contexts in Android Q are:
./vendor/etc/selinux/vndservice_contexts
./vendor/etc/selinux/vendor_file_contexts
./vendor/etc/selinux/vendor_hwservice_contexts
./vendor/etc/selinux/vendor_property_contexts
./vendor/etc/selinux/vendor_seapp_contexts
./system/etc/selinux/plat_file_contexts
./system/etc/selinux/plat_service_contexts
./system/etc/selinux/plat_hwservice_contexts
./system/etc/selinux/plat_seapp_contexts
./system/etc/selinux/plat_property_contexts
./sys/fs/selinux/initial_contexts
The service corresponding to the NFC module is in ./vendor/etc/selinux/vendor_file_contexts:
5032E:/ # cat ./vendor/etc/selinux/vendor_file_contexts | grep nfc
/(vendor|system/vendor)/bin/hw/android\.hardware\[email protected]\.1-service ubject_r:hal_nfc_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\[email protected]\.2-service ubject_r:hal_nfc_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\[email protected]\.0-service ubject_r:hal_nfc_default_exec:s0
/(system\/vendor|vendor)/bin/hw/android\.hardware\[email protected]\.1-service-st ubject_r:hal_nfc_default_exec:s0
/data/nfc_socket(/.*)? ubject_r:nfc_socket:s0
/data/vendor/nfc_socket(/.*)? ubject_r:vendor_nfc_socket:s0
/dev/st21nfc ubject_r:st21nfc_device:s0
5032E:/ #

---

My journey continues taking the untrodden path's...
I have found how to write to /
But I dont know how it's working.
So please read, and help me root this fone properly so I can keep what I found permanent in my fone.
I know some of you will 'see' with eye's to hear...
I need a twrp for my fone.
So I finally managed to get a working boot image created for my fone, with magisk, this is how I did it:
fastboot flashing unlock_critical
pressed + vol
fastboot flash vbmeta vblankmeta.img
fastboot flash recovery note9recovery.img <-for mt6762
fastboot reboot
As soon as the screen turns off. I have to hold + vol to NOT show recovery/fastboot/normal, choose recovery, but by taking this step, the recovery with magisk is already wiped somehow, depends on the version of android 10-Q, Pro, Latest, boots are slightly different.
The Pro variant is the best to work with.
So I rinse and repeat and flash the note9.img, boot into recovery, keeping + vol pressed until AFTER the point where the stock android recovery menu would kick in.
This boots the fone using the note9.img from recovery!
Voila, so I know I'm in, but I know a wonderfull trick most devs dont know.
This fone is unlocked from shop. It is system-as-root, meaning, root is actually pointless!
To prove it, I'll use root commands WITHOUT magisk, or twrp, or su, by giving this example:
adb shell echo "persist.service.adb.enable=1" >> default.prop
'Read only' bull**** pops up, but when doing:
adb -s *************** shell echo "persist.service.adb.enable=1" >> default.prop (* = your device serial number)
Command completes! WITHOUT MOUNTING ANY SYSTEM!
HOwever, attempting to write with magisk, su etc wont ever work, yeah, in an overlay file system, they will, but what of this? Like I've said in other posts, it's all a mirror image, or in todays speak, overlaid, I wrote of this on surfboard hacker, and a few other sites back in docsis 2 days as a security measure to stop us
uncapping lol...
So I initially do:
adb -s *************** shell echo "persist.service.adb.enable=1" >> default.prop
adb -s *************** shell echo "persist.service.debuggable=1" >> default.prop
adb -s *************** shell echo "persist.sys.usb.config=mtp,adb" >> default.prop
adb -s *************** shell echo "persist.service.adb.enable=1" >> /system/build.prop
adb -s *************** shell echo "persist.service.debuggable=1" >> /system/build.prop
adb -s *************** shell echo "persist.sys.usb.config=mtp,adb" >> /system/build.prop
adb -s *************** shell settings put secure install_non_market_apps 1
adb -s *************** shell settings put global adb_enabled 1
adb -s *************** shell settings put global setup_wizard_has_run 1
adb -s *************** shell settings put secure user_setup_complete 1
adb -s *************** shell settings put global activity_starts_logging_enabled 1
adb -s *************** shell settings put global development_settings_enabled 1
adb -s *************** shell settings put secure location_providers_allowed +gps,network
Works wonders huh?
Nah... of course my above commands work, lots of research...
I tried systemrw_1.32 to use any apps etc wanting to write to system, but I noticed while using magisk, some MMblock29 was read only, whereas systemrw_1.32 locked another, making me believe this is actually a pie script, because after testing this, when I rebooted, system was dm-1, not the dm-3 I normally see, and when attempting to system write, No joy, so these two are clashing.
But here's what to watch for: How TO write system is at this point:
I flashed the first mentioned files. Clean slate.
I boot the fone PAST recovery as mentioned, dont go INTO recovery, go PASSED it so fone boots from recovery without reflashing itself with stock, fone starts with a magisk icon on the desktop. kool.
adb shell
su
mount -o remount,rw /
Voila!
Now reboot...
All gone...
Rinse n repeat. Now how to keep this read write access?
1: Magisk in the bootloader will not work will not enable "mount -o remount,rw / " because it's symlinked it's own overlay system.
2: Magisk in the recovery is great to get magisk canary to do your bootloader for you, but the bootloader root will NOT write "mount -o remount,rw / " - only the note9 recovery allows me to "mount -o remount,rw / "
3: The note9 recovery is doing something no other magiskd bootloader or twrp'd recovery can!
4: If you get this, you get me.
Notice none of this is actually about what I need the most?
A twrp recovery 32mb in size, mt6762 or mt6765
Not a magisked boot.img thats supposed to be flashed to recovery..???
Oh and magisk has not done my fone yet, I need to load the note9 recovery just to get what you just read.
When I try magisk on a clean slate, it does nothing.

---

Sussed it... when the fone booted, I had the note9 magisk appear dulled out on my screen.
adb shell
$
su
sits and waits...
update magisk using canary 23 apk, but do nothing else.
adb shell
$
su
mount -o remount,rw /
do whatever.
Let magisk do it's stuff n reboot
mount -o remount,rw / is now impossible.
Get it?
Recovery can access / with rw access! <- VOILA!
Edit:
Oh, and flashing magisk to recovery is causing the bootloops, as is the confusion over why we'd flash a boot to recovery or recovery to boot, me I try anything, and I bet the note9 is the key to the read only fs, in that it still contains everything in 'A' bootloader, not several...

---

I propose a new root tool, called ****root.
Input your serial, in your adb -s *************** then the rooting commands no?
the app will run a script to do what I wrote above I can do.
Only with root commands.
Get to it.

---

Oh, please forgive my serial numbers, but here's the logs:
Rebooting OKAY [ 0.001s]
Finished. Total time: 0.005s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash vbmeta vblankmeta.
img
Sending 'vbmeta' (4 KB) OKAY [ 0.022s]
Writing 'vbmeta' OKAY [ 0.008s]
Finished. Total time: 0.053s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash recovery TWRP-3.4.
0-10-full.img
Sending 'recovery' (32768 KB) OKAY [ 0.807s]
Writing 'recovery' OKAY [ 0.517s]
Finished. Total time: 1.350s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot boot recovery
fastboot: error: cannot load 'recovery': No such file or directory
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot boot TWRP-3.4.0-10-full.
img
Sending 'boot.img' (32768 KB) OKAY [ 0.799s]
Booting OKAY [ 0.213s]
Finished. Total time: 1.073s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb shell
adb.exe: no devices/emulators found
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash vbmeta vblankmeta.
img
Sending 'vbmeta' (4 KB) OKAY [ 0.022s]
Writing 'vbmeta' OKAY [ 0.008s]
Finished. Total time: 0.058s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash boot MyBoot0.img
Sending 'boot' (32768 KB) OKAY [ 0.805s]
Writing 'boot' OKAY [ 0.513s]
Finished. Total time: 1.347s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash recovery MyRecover
y0.img
Sending 'recovery' (32768 KB) OKAY [ 0.803s]
Writing 'recovery' OKAY [ 0.519s]
Finished. Total time: 1.351s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot
Rebooting OKAY [ 0.003s]
Finished. Total time: 0.008s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash boot MyBoot0.img
< waiting for any device >
^C
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb kill-server
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot devices
3082SH1001004262 fastboot
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash super super.img
fastboot: error: cannot load 'super.img': No such file or directory
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash super super.bin
fastboot: error: cannot load 'super.bin': No such file or directory
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash super super.bin
Sending sparse 'super' 1/23 (131068 KB) OKAY [ 4.468s]
Writing 'super' OKAY [ 2.133s]
Sending sparse 'super' 2/23 (130832 KB) OKAY [ 4.300s]
Writing 'super' OKAY [ 2.132s]
Sending sparse 'super' 3/23 (130841 KB) OKAY [ 4.602s]
Writing 'super' OKAY [ 2.251s]
Sending sparse 'super' 4/23 (130572 KB) OKAY [ 4.410s]
Writing 'super' OKAY [ 2.184s]
Sending sparse 'super' 5/23 (131060 KB) OKAY [ 4.109s]
Writing 'super' OKAY [ 2.068s]
Sending sparse 'super' 6/23 (130700 KB) OKAY [ 4.157s]
Writing 'super' OKAY [ 2.053s]
Sending sparse 'super' 7/23 (130881 KB) OKAY [ 4.182s]
Writing 'super' OKAY [ 2.248s]
Sending sparse 'super' 8/23 (130489 KB) OKAY [ 3.941s]
Writing 'super' OKAY [ 2.277s]
Sending sparse 'super' 9/23 (129252 KB) OKAY [ 4.187s]
Writing 'super' OKAY [ 2.855s]
Sending sparse 'super' 10/23 (128853 KB) OKAY [ 4.071s]
Writing 'super' OKAY [ 3.008s]
Sending sparse 'super' 11/23 (131020 KB) OKAY [ 4.032s]
Writing 'super' OKAY [ 2.070s]
Sending sparse 'super' 12/23 (131068 KB) OKAY [ 4.108s]
Writing 'super' OKAY [ 2.069s]
Sending sparse 'super' 13/23 (131068 KB) OKAY [ 4.073s]
Writing 'super' OKAY [ 2.080s]
Sending sparse 'super' 14/23 (131068 KB) OKAY [ 4.066s]
Writing 'super' OKAY [ 2.053s]
Sending sparse 'super' 15/23 (130348 KB) OKAY [ 4.274s]
Writing 'super' OKAY [ 4.725s]
Sending sparse 'super' 16/23 (131032 KB) OKAY [ 4.043s]
Writing 'super' OKAY [ 2.085s]
Sending sparse 'super' 17/23 (130560 KB) OKAY [ 4.186s]
Writing 'super' OKAY [ 2.126s]
Sending sparse 'super' 18/23 (130900 KB) OKAY [ 4.065s]
Writing 'super' OKAY [ 2.107s]
Sending sparse 'super' 19/23 (130493 KB) OKAY [ 4.069s]
Writing 'super' OKAY [ 2.340s]
Sending sparse 'super' 20/23 (121428 KB) OKAY [ 3.900s]
Writing 'super' OKAY [ 1.933s]
Sending sparse 'super' 21/23 (131068 KB) OKAY [ 4.082s]
Writing 'super' OKAY [ 2.164s]
Sending sparse 'super' 22/23 (131068 KB) OKAY [ 4.102s]
Writing 'super' OKAY [ 2.109s]
Sending sparse 'super' 23/23 (40268 KB) OKAY [ 1.320s]
Writing 'super' OKAY [ 0.649s]
Finished. Total time: 145.206s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.005s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot
Rebooting OKAY [ 0.001s]
Finished. Total time: 0.005s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash vbmeta vblankmeta.
img
< waiting for any device >
^C
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb kill-server
cannot connect to daemon at tcp:5037: cannot connect to 127.0.0.1:5037: No conne
ction could be made because the target machine actively refused it. (10061)
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash boot TWRP-3.4.0-10
-full.img
Sending 'boot' (32768 KB) OKAY [ 0.795s]
Writing 'boot' OKAY [ 0.517s]
Finished. Total time: 1.336s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot TWRP-3.4.0-10-ful
l.img
fastboot: usage: unknown reboot target TWRP-3.4.0-10-full.img
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot boot TWRP-3.4.0-10-full.
img
Sending 'boot.img' (32768 KB) OKAY [ 0.784s]
Booting OKAY [ 0.067s]
Finished. Total time: 0.904s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash vbmeta vblankmeta.
img
Sending 'vbmeta' (4 KB) OKAY [ 0.007s]
Writing 'vbmeta' OKAY [ 0.001s]
Finished. Total time: 0.022s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash boot boot.img
Sending 'boot' (32768 KB) OKAY [ 0.791s]
Writing 'boot' OKAY [ 0.514s]
Finished. Total time: 1.321s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash recovery TWRP-3.4.
0-10-full.img
Sending 'recovery' (32768 KB) OKAY [ 0.795s]
Writing 'recovery' OKAY [ 0.510s]
Finished. Total time: 1.322s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.004s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
Armor_X5_Q:/ $ su
/system/bin/sh: su: inaccessible or not found
3082SH1001004262 shell echo "persist.service.adb.enable=1" >> default.prop <
/system/bin/sh: can't create default.prop: Read-only file system
082SH1001004262 shell echo "persist.service.debuggable=1" >> default.prop <
/system/bin/sh: can't create default.prop: Read-only file system
082SH1001004262 shell echo "persist.sys.usb.config=mtp,adb" >> default.prop <
/system/bin/sh: can't create default.prop: Read-only file system
o "persist.service.adb.enable=1" >> /system/build.prop <
/system/bin/sh: can't create /system/build.prop: Read-only file system
o "persist.service.debuggable=1" >> /system/build.prop <
001004/system/bin/sh: can't create /system/build.prop: Read-only file system
262 s1|Armor_X5_Q:/ $ adb -s 3082SH1001004262 shell echo "persist.sys.usb.config
o "persist.sys.usb.config=mtp,adb" >> /system/build.prop <
/system/bin/sh: can't create /system/build.prop: Read-only file system
1|Armor_X5_Q:/ $
1|Armor_X5_Q:/ $
082SH1001004262 shell settings put secure install_non_market_apps 1 <
adb -s 3082SH1001004262 shell settings put global setup_wiz/system/bin/sh: adb:
inaccessible or not found
ard_has_run 1
adb -s 3082SH1001004262 shell settings put secure user_setup_complete 1
adb -s 3082SH10010127|Armor_X5_Q:/ $ adb -s 3082SH1001004262 shell settings put
3082SH1001004262 shell settings put global adb_enabled 1 <
s/system/bin/sh: adb: inaccessible or not found
3082SH1001004262 shell settings put global setup_wizard_has_run 1 <
rt/system/bin/sh: adb: inaccessible or not found
s_logg127|Armor_X5_Q:/ $ adb -s 3082SH1001004262 shell settings put secure user_
3082SH1001004262 shell settings put secure user_setup_complete 1 <
/system/bin/sh: adb: inaccessible or not found
ed 1
adb127|Armor_X5_Q:/ $ adb -s 3082SH1001004262 shell settings put global activity
3082SH1001004262 shell settings put global activity_starts_logging_enabled 1 <
-s 3082SH1001004262 shell settings put sec/system/bin/sh: adb: inaccessible or n
ot found
ure location_providers_allowed +gps,network127|Armor_X5_Q:/ $ adb -s 3082SH10010
3082SH1001004262 shell settings put global development_settings_enabled 1 <
/system/bin/sh: adb: inaccessible or not found
ettings put secure location_providers_allowed +gps,network <
/system/bin/sh: adb: inaccessible or not found
127|Armor_X5_Q:/ $ exit
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb reboot bootloader
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash vbmeta vblankmeta.
img
Sending 'vbmeta' (4 KB) OKAY [ 0.007s]
Writing 'vbmeta' OKAY [ 0.001s]
Finished. Total time: 0.026s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash boot MyBoot0.img
Sending 'boot' (32768 KB) OKAY [ 0.794s]
Writing 'boot' OKAY [ 0.510s]
Finished. Total time: 1.320s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot flash recovery MyRecover
y0.img
Sending 'recovery' (32768 KB) OKAY [ 0.794s]
Writing 'recovery' OKAY [ 0.508s]
Finished. Total time: 1.319s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>fastboot reboot
Rebooting OKAY [ 0.001s]
Finished. Total time: 0.007s
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adadb shell
'adadb' is not recognized as an internal or external command,
operable program or batch file.
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb shell
Armor_X5_Q:/ $ su
^C
130|Armor_X5_Q:/ $ mount -o remount,rw /
mount: '/dev/block/dm-1' not user mountable in fstab
1|Armor_X5_Q:/ $ exit
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb -s 3082SH1001004262 shell ech
o "persist.service.adb.enable=1" >> default.prop
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb -s 3082SH1001004262 shell ech
o "persist.service.debuggable=1" >> default.prop
adb -s 3082SH1001004262 shell echo "persist.sys.usb.config=mtp,adb" >> default.p
rop
adb -s 3082SH1001004262 shell echo "persist.service.adb.enable=1" >> /system/bui
ld.prop
adb -s 3082SH1001004262 shell echo "persist.service.debuggable=1" >> /system/bui
ld.prop
adb -s 3082SH1001004262 shell echo "persist.sys.usb.config=mtp,adb" >> /system/b
uild.prop
adb -s 3082SH1001004262 shell settings put secure install_non_market_apps 1
adb -s 3082SH1001004262 shell settings put global adb_enabled 1
adb -s 3082SH1001004262 shell settings put global setup_wizard_has_run 1
adb -s 3082SH1001004262 shell settings put secure user_setup_complete 1
adb -s 3082SH1001004262 shell settings put global activity_starts_logging_enable
d 1
adb -s 3082SH1001004262 shell settings put global development_settings_enabled 1
adb -s 3082SH1001004262 shell settings put secure location_providers_allowed +gp
s,network
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb install MagiskCanary23.0.apk
Performing Streamed Install
Success
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>for x in / /product /vendor; do m
ount -o remount,rw $x; echo "it works! @ $x">$x/test.txt; cat $x/test.txt; rm $x
/test.txt; done
x was unexpected at this time.
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>adb shell
Armor_X5_Q:/ $ su
"it works! @ $x">$x/test.txt; cat $x/test.txt; rm $x/test.txt; done <
'/dev/block/dm-1' is read-only
/system/bin/sh: can't create //test.txt: Read-only file system
cat: //test.txt: No such file or directory
rm: //test.txt: No such file or directory
'/dev/block/dm-0' is read-only
/system/bin/sh: can't create /product/test.txt: Read-only file system
cat: /product/test.txt: No such file or directory
rm: /product/test.txt: No such file or directory
'/dev/block/dm-2' is read-only
/system/bin/sh: can't create /vendor/test.txt: Read-only file system
cat: /vendor/test.txt: No such file or directory
rm: /vendor/test.txt: No such file or directory
1|Armor_X5_Q:/ #
1|Armor_X5_Q:/ # mount -o remount,rw /
'/dev/block/dm-1' is read-only
Armor_X5_Q:/ #
D:\2022 x86\Adb\platform-tools_r31.0.1-windows>

---

Notice the commands being accepted BEFORE I updated magisk, then what happens?
mount -o remount,rw /
mount: '/dev/block/dm-1' not user mountable in fstab
In effect I need the note9 fstab to enable rw to /
!!!

---

One last thing I forgot to mention, without twrp, forget twrp.
I made a proper boot image for this fone, that also works when booting it from recovery, when booting from recovery, if in select recovery menu, continuing to press + VOL button, while choosing recovery lol...
And the boot image works with stock recovery!
Sadley, no twrp flashing
So how to get the twrp flashables flashable again?

---

The above MyBoot.img gives magisked root access flashed to boot.
fastboot flash vbmeta vblankmeta.img
fastboot flash boot MyBoot1.img
fastboot reboot
As for
mount -o remount,rw /
I gave y'all the answer.

---

Pachacouti said:
One last thing I forgot to mention, without twrp, forget twrp.
I made a proper boot image for this fone, that also works when booting it from recovery, when booting from recovery, if in select recovery menu, continuing to press + VOL button, while choosing recovery lol...
And the boot image works with stock recovery!
Sadley, no twrp flashing
So how to get the twrp flashables flashable again?
Click to expand...
Click to collapse
Sorry for the doubt but is the TWRP Ulefone Note 9 you wrote from this thread?https://forum.xda-developers.com/t/twrp-3-4-0-twrp-for-ulefone-note-9p-helio-p22-mt6762-5.4171433/
You PORTed TWRP img or only flash that img file directly in your device?
If you want I'll compile the TWRP 3.5.2_10 to you. Only send me stock recovery.img & super.img same version from your device.

---

I'll post the ULEFONE note9.img I used to gain access. The thing is, when I use this, system is writable, but obviously I update magisk, and while rebooting after doing the 'live install' of magisk (works fine to patch a boot that fails... )
My process is this, I can patch an origional boot with magisk after flashing note9 to recovery,
I can then flash the patched boot and it works when flashed to boot, and can use origional recovery, but cant flash magisk'd boot from origional un rooted fone, patched by magisk, so the note9 was my 'backdoor' so to speak...
and the systems all over the place lol.. dynamic is a pain, cant even find my sdcard and kali nethunter magisk modules need zips not git lol...
The note9recovery has something to watch for.. using clean slate, when booting the note9recovery, as fone goes into loading (past recovery) and just before fone goes into gui,
when doing "mount -o remount,rw / " system is actually writable, but cuts off adb when gui gives access!
Magisk somehow wrecks the actual mount -o remount,rw / I have when I first boot, afterwards saying dm-1 or 3 is read only.
Anyway, I'v posted my stock boot and recovery too, if I can see twrp in recovery, I'd be delighted, I lost the plot with all this where's my f'n sdcard, damn dynamic partitioning'!
Oh, and I have a problem, 128gig sdcard, fone says not enough space!
MyBoot1.img posted above is the clean slate magisk'd origional boot WITHOUT twrp, and I can use this to flash to recovery afterwards, in order to boot recovery, but have no twrp... so useless really as recovery, so I flash boot MyBoot1.img just to get a magisk to test lol...
Thanks for your time

---

lopestom said:
Sorry for the doubt but is the TWRP Ulefone Note 9 you wrote from this thread?https://forum.xda-developers.com/t/twrp-3-4-0-twrp-for-ulefone-note-9p-helio-p22-mt6762-5.4171433/
You PORTed TWRP img or only flash that img file directly in your device?
If you want I'll compile the TWRP 3.5.2_10 to you. Only send me stock recovery.img & super.img same version from your device.
Click to expand...
Click to collapse
Yes it was this I flashed to recovery, it says mt6762, and this was the key, because up until I flashed this, I was flashing mt6765 as per fones claims it is, and getting nowhere, i'm a only...

---

Soz, posting superimage once zipped...
I may get cut off by my isp, so if its easier for you my firmware is:
P2N2V23A.GQU.Ulefone.EEA.HB.HJ.S8AMABHUYB.0509.V3.01
In the meantime, I noticed when testing twrp ports, a green line flashed just before I get black screen where twrp WOULD show, adb/su works, but no twrp flashing commands, and it crossed my mind I've seen this with the firestick lol, where firesticks were being overlaid with a screen blocking twrp..? No?

---

Pachacouti said:
Yes it was this I flashed to recovery, it says mt6762, and this was the key, because up until I flashed this, I was flashing mt6765 as per fones claims it is, and getting nowhere, i'm a only...
Click to expand...
Click to collapse
Keep calm and let me time to do correct TWRP to you test after. Time now.

---

Thank you...
I think uppin the super mite not go down too well with the ee unlimited broadband business class lol, isp, so if I disappear for a while lol...
Ps, origional super.7z.001 was renamed to zip for my ease

---

Pachacouti said:
Thank you...
I think uppin the super mite not go down too well with the ee unlimited broadband business class lol, isp, so if I disappear for a while lol...
Ps, origional super.7z.001 was renamed to zip for my ease
Click to expand...
Click to collapse
Downloaded recovery.img & super.zip files.
Now I'm creating file test. Maybe 2h after this message.
SYL
Update: Try install recovery.img (TWRP) and if not good so install vbmeta modified.
Spoiler: Install Custom recovery
stock recovery - bootloader => fastboot (not fastbootd)
cmd command:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmetaAndroidSC_mod.img
cmd command:
Code:
fastboot flash recovery recovery.img
cmd command:
Code:
fastboot reboot-recovery
Let me know about.

---

Super! No rush, it's pickled my head enough as it is lol, reading time..

---

Am impressed... I see twrp in recovery at last.. you are a god send for all those armor x5 punters with the 'a' only partition, next time I see you in the street, i'll buy you a pint, but until then a lucky find will seek you out, respect!!
You should post this as a working twrp, since it's not my work, as twrp was what I actually needed to get stuff done, well appreciated, I'll away test it now

---

Pachacouti said:
Am impressed... I see twrp in recovery at last.. you are a god send for all those armor x5 punters with the 'a' only partition, next time I see you in the street, i'll buy you a pint, but until then a lucky find will seek you out, respect!!
You should post this as a working twrp, since it's not my work, as twrp was what I actually needed to get stuff done, well appreciated, I'll away test it now
Click to expand...
Click to collapse
Thanks. Not need more than respect.
I just chose you for the attitude of sharing information and the fact that you needed help to progress. Courage is for the few.
I prefer that you share the TWRP file and instructions yourself. So fastboot/fastbootD; encryption and decryption; installation of zips; backup and restore; internal and external storage; anything else is working??
Yes: Enjoy! No: let me know.

---

lopestom said:
Thanks. Not need more than respect.
I just chose you for the attitude of sharing information and the fact that you needed help to progress. Courage is for the few.
I prefer that you share the TWRP file and instructions yourself. So fastboot/fastbootD; encryption and decryption; installation of zips; backup and restore; internal and external storage; anything else is working??
Yes: Enjoy! No: let me know.
Click to expand...
Click to collapse
Hmm, I learn sumat new every day, thank god aquarius is here lol, anyway, so far, I'm still at some pernikity when it comes to writing system, dm-1 or dm-3 locked, but from what I see and have tested so far, all possibilities using fone before it boot's into gui, system and mnt points work, , my sdcard is very visible at last, and writable, using stock the crappy google file manager would not let me write to sdcard, so you've solved so many headache's in one swoop. I'll write a final tut to show my alternative route's lol, thanks again
Armor x5 Android 10_Q Mt6765 aka Mt6762 ROOT AT LAST!
This 'tutorial' is a quicky for those yet to figure this fone out. Well it took a bit time for sure, but this is how it went... No matter what recovery or magisk I tried, nothing worked, all ulefone images with twrp were 64mb in size, where-as...
forum.xda-developers.com