Related
reserved....
Please make a post if you encounter a problem while using BMM
Whirly, just to make sure I'm doing things correctly, to create a virtual system on say system 3. All I have to do in the settings is create, the system, data and cache.img files
In root explorer I go into sdcard-ext and I can see the folder Virtual>System 3>then all the image files inside, then flash the zip yet when I try to boot it gets stuck on booting with the green droid
I'm trying to flash Dwiz ROM that I had working before on my number 1 system, also I unchecked 2nd boot and kexec.
Also I know you haven't got full Razr V yet support so it may just be a bug
Thanks for being so helpful!
complete erase the slot
As most ROM requires clean slot to work, how can we completely erase the slot?
metalhead_rulz said:
As most ROM requires clean slot to work, how can we completely erase the slot?
Click to expand...
Click to collapse
A properly designed ZIP installer should take care of cleaning by itself. In order to start afresh you can destroy old image and create a new one - this is not possible for real partitions. These can be reflashed from FXZ and then "formatted" by removing all files and directories.
will u upgrade bmm to be compatible with cm 10.1 from hashcode? thanks. if yes, will it be possible to install cm 10.1 as stock rom?
For some reason I cant restore any back ups. I have tried both formats and I have been doing the quick backup.
When I restore it goes through the process then finishes with an error "there was an error writing to system" or something similar. I have tried mounting and formatting system etc but no good.
Can someone tell me the best way to take a log so I can better see were it is going wrong.
Cheers
romdroid. said:
will u upgrade bmm to be compatible with cm 10.1 from hashcode? thanks. if yes, will it be possible to install cm 10.1 as stock rom?
Click to expand...
Click to collapse
I believe it was caused by this commit :
https://github.com/STS-Dev-Team/android_system_core/commit/e15eebac61d22edbe8d4aee1e794176acc4cf526
Code:
#ifndef NO_DEVFS_SETUP
mkdir("/dev", 0755);
mkdir("/proc", 0755);
mkdir("/sys", 0755);
mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
mkdir("/dev/pts", 0755);
mkdir("/dev/socket", 0755);
mount("devpts", "/dev/pts", "devpts", 0, NULL);
mount("proc", "/proc", "proc", 0, NULL);
mount("sysfs", "/sys", "sysfs", 0, NULL);
/* indicate that booting is in progress to background fw loaders, etc */
close(open("/dev/.booting", O_WRONLY | O_CREAT, 0000));
/* We must have some place other than / to create the
* device nodes for kmsg and null, otherwise we won't
* be able to remount / read-only later on.
* Now that tmpfs is mounted on /dev, we can actually
* talk to the outside world.
*/
open_devnull_stdio();
klog_init();
#endif
BMM always clean all tmpfs partition before 2nd-init, so that init can do a fresh start.
But since this commit, some devfs is not recreated, thus ROM can't be booted.
If you want to boot newer build, you have to build your own init. (undefine BOARD_USE_NO_DEVFS_SETUP)
or take init binary from 24012013 build. (Not recommended)
Attached is init binary taken from 24012013 build for testing.
Flash this zip after flashing STS CM zip file.
Why we have to skip devfs creation??? anybody????
Should I fix this in BMM boot script???
Help on system 3
Thanks for this great project
Whirleyes I'm having trouble extracting the log from BMM I hit report error but cant see where it is saved.
Anyway I viewed the flash log in recovery mode after doing a backup and got these errors. It sounds like its an issue with the wrong directory being mounted or something.
W: failed to mount /dev/block/mmcblk1p25 (no such file or directory)
No /into/.android_secure found skipping backup of applications on external storage.
I'm assuming this is also why I'm having travel restoring the backups.
Cheers
Sent from my Nexus 7 using Tapatalk 2
I'm not sure if this is caused by BMM, but I'm going to explain, just in case.
It's the second time that I habe a "boot failure flash" problem, as described here
http://forum.xda-developers.com/showthread.php?t=1893347
The first time it happened I was trying to come back from JB kernel, but now I just reboot from a completely working ROM (JellyWiz) and it went to that AP boot failure flash.
It seems like webtop partition gets corrupted or something, because I'm always able to fix it flashing a webtop image, as described here http://forum.xda-developers.com/showthread.php?t=1792955, in "Fastboot for the webtop_signed"
As BMM uses webtop partition, maybe it can be related to the problem...
I'm sorry I don't have more precise or technical information but I don't have much knowledge, also that problem appeared in two different situations, apparently it was not related to a specific situation.
blackhawk_LA said:
I'm not sure if this is caused by BMM, but I'm going to explain, just in case.
It's the second time that I habe a "boot failure flash" problem, as described here
http://forum.xda-developers.com/showthread.php?t=1893347
The first time it happened I was trying to come back from JB kernel, but now I just reboot from a completely working ROM (JellyWiz) and it went to that AP boot failure flash.
It seems like webtop partition gets corrupted or something, because I'm always able to fix it flashing a webtop image, as described here http://forum.xda-developers.com/showthread.php?t=1792955, in "Fastboot for the webtop_signed"
As BMM uses webtop partition, maybe it can be related to the problem...
I'm sorry I don't have more precise or technical information but I don't have much knowledge, also that problem appeared in two different situations, apparently it was not related to a specific situation.
Click to expand...
Click to collapse
Because BMM 0.3.4 format webtop partition without asking cdt for safe region.
It should be no problem with 0A7* bootloader... but not everybody is using it. [Lesson learned]
Here's a bootloader updater tools. (razr_bl_mbm_*.zip)
http://dl.projectlense.com/download.php?file=spyder/razr_bl_mbm_0a77.zip
Thanks! It worked perfectly but I had to copy AdbWinApi.dll to the tools folder. :good:
whirleyes said:
Attached is init binary taken from 24012013 build for testing.
Flash this zip after flashing STS CM zip file.
Why we have to skip devfs creation??? anybody????
Should I fix this in BMM boot script???
Click to expand...
Click to collapse
confirmed as working, also with newer build versions.
thanks whirley! if its not too much hassle for you it would be nice to have it added to bmm, but then again its just flashing one more zip file...doesn't really hurt much
i just think integrating the ability to flash these new roms would take away the one last reason to use ss3 and not bmm^^ so you would probably win over a few more users that are not switching because they want to test the newer cm10.1 roms.
btw whats up with project kaizen? im still interested in checking that out
also i'm glad to see you back on xda!!!
Maybe I'm a stupid boy but it's possible to speak with Hashcode to solve this problem?
hello, I have a problem. When I open my BMM 0.2.6, it said Application Corrupted and It need redownload from Google Play.
And when I want to uninstall it, the installation was unsuccessful. How to uninstall the corrupted BMM?
pseudoheld said:
confirmed as working, also with newer build versions.
thanks whirley! if its not too much hassle for you it would be nice to have it added to bmm, but then again its just flashing one more zip file...doesn't really hurt much
i just think integrating the ability to flash these new roms would take away the one last reason to use ss3 and not bmm^^ so you would probably win over a few more users that are not switching because they want to test the newer cm10.1 roms.
btw whats up with project kaizen? im still interested in checking that out
also i'm glad to see you back on xda!!!
Click to expand...
Click to collapse
thanks, does stock flashing also work?:fingers-crossed:
romdroid. said:
thanks, does stock flashing also work?:fingers-crossed:
Click to expand...
Click to collapse
What do you mean? Flashing to the first (stock) system has always worked on bmm!
txdvil said:
hello, I have a problem. When I open my BMM 0.2.6, it said Application Corrupted and It need redownload from Google Play.
And when I want to uninstall it, the installation was unsuccessful. How to uninstall the corrupted BMM?
Click to expand...
Click to collapse
It's outdated. Just download the latest available version (current is 034).
I want to remove all older BMM file from download server soon.
pseudoheld said:
ss3 and not bmm^^ so you would probably win over a few more users that are not switching because they want to test the newer cm10.1 roms.
Click to expand...
Click to collapse
It's not about lose or win. No benefit at all. I just want something that works for me.
For efficiency, I think I won't add support for CM10.1 (with skip devfs on)
(extra code for ROM detection = extra boot delay)
pseudoheld said:
btw whats up with project kaizen? im still interested in checking that out
Click to expand...
Click to collapse
It's only good for personal use. Don't count on me.
I've noticed using 0.3.4 with bootloader 0A7 that I cannot backup my CID. I did it with terminal emulator. Erase it was possible. Maybe it's not related with hmm, but I've tried many times, also I've installed it a few times to be sure.
It is something that I did wrong?
Also thanks A LOT for this
pseudoheld said:
What do you mean? Flashing to the first (stock) system has always worked on bmm!
Click to expand...
Click to collapse
yes, I was refering to installing cm10.1 to stock system. thanks for the answer :good:
Code:
#include
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, blah, blah, blah, this is dangerous,
* but also recoverable in case something goes wrong, so
* don't be stupid and you'll be good.
*/
Woah, woah, woah. Custom download mode? What are you smoking?
Nothing actually, and yes, this is a custom download mode -- your eyes did not deceive you.
That's kinda cool I guess, but what can it do that mine can't?
Well, I didn't go all crazy with messing with things yet, but at the moment, it has the following extra features over the stock download mode:
- adbd insecure (thanks, @Chainfire) (and yes, I did just say you can now use adb in Download Mode)
- Changed all instances of light blue and bright green to semi-dark purple (it looks better that way in my opinion)
Sounds pretty sweet. Where can I download it from?
You can find the current version here and a listing of all of the versions here.
Pretty nice! How do I install it though?
Please note that this is only for Verizon LG G3 owners that are on KitKat (or use the KitKat bootloader, at least, because this uses BUMP!) and you must be rooted to install it
First off, please note that installing a custom download mode is nowhere near as complicated/dangerous as it sounds. When you are ready, either connect your device to your computer via adb and open an adb shell, or use a terminal emulator app to run the following commands:
Code:
su
dd if="/dev/block/platform/msm_sdcc.1/by-name/laf" of="/sdcard/laf.img"
We just backed up your current download mode (laf) image, so upload that somewhere and keep it safe. Now we are going to install PurpleDL!
If you downloaded the image to your computer, either adb push it to your phone or just drag-and-drop it on to your phone's internal sdcard (there's not actually an sdcard inside your phone, it's just called that. It's your internal storage), and please note where you put it because you will need that for this next step.
Now, in that same adb shell or terminal window, run these commands:
(replacing XXXX.img with the location and name of the image you downloaded)
Code:
dd if="/sdcard/XXXX.img" of="/dev/block/platform/msm_sdcc.1/by-name/laf"
Ta-da! It's installed! That's all there is to it! You can now boot into PurpleDL mode or continue to carry on with your day.
Sweet, how do I use it?
I'll leave you with this (video not by me)
It sucks and I hate you. How do I uninstall this garbage?
Remember that backup I told you to make earlier, in the installation process? Well, you put that on your phone's internal storage and you flash it to your device with:
(assuming the backup is named "laf.img" and is in "/sdcard/")
Code:
dd if="/sdcard/laf.img" of="/dev/block/platform/msm_sdcc.1/by-name/laf"
FAQ
- To be filled out
Changelog
- v1
--- Initial version
Cool stuff to do with PurpleDL
- Custom Error Message (see the last photo here: https://twitter.com/r3pwn/status/587713686401232897)
--- This one is actually kinda fun. It's a "fake" error screen, so nothing is actually wrong with your device when you use this. If you want to mess around with it, read on.
--- So, first off, put your device in "PurpleDL" mode and open an adb shell.
--- Now, type the following:
Code:
wallpaper -framework
1
text
your_message_here
--- When you type your custom message, separate words using hyphens (-) or underscores (_), otherwise, it will not work. This is not something I can fix, as this little utility was made by LG.
Wow, amazing!
There's not lot to it features-wise, but it still sounds awesome!
So what would I use download mode for? Just wondering.
bb12489 said:
So what would I use download mode for? Just wondering.
Click to expand...
Click to collapse
You can use it to go back to stock, flash firmwares, etc and also, there were many many many references to potential bootloader unlock scenarios. However, investigating any of them resulted in a dead end, although I'm sure one of them would work if I tried hard enough.
I have been contemplating adding a new way to flash single partitions and provide a shell scripts for Linux/osx and a batch file for Windows. Before I actually start working on it, is this anything anyone would want?
r3pwn said:
I have been contemplating adding a new way to flash single partitions and provide a shell scripts for Linux/osx and a batch file for Windows. Before I actually start working on it, is this anything anyone would want?
Click to expand...
Click to collapse
I'm interested in something exactly like that if you find the time. Thanks for the custom DL mode.
roirraW "edor" ehT said:
I'm interested in something exactly like that if you find the time. Thanks for the custom DL mode.
Click to expand...
Click to collapse
Okay, it shouldn't be too hard. It'll basically just be a tool to dump/flash partitions and be "wrapped around" adb.
r3pwn said:
Okay, it shouldn't be too hard. It'll basically just be a tool to dump/flash partitions and be "wrapped around" adb.
Click to expand...
Click to collapse
Thanks!
Download Mode
If my download mode is not being recognized by my PC. Will entering into this custom download mode fix that?
Also Flash Tool, Verizon SU and pretty much all tools don't recognize.
calseen said:
If my download mode is not being recognized by my PC. Will entering into this custom download mode fix that?
Also Flash Tool, Verizon SU and pretty much all tools don't recognize.
Click to expand...
Click to collapse
I doubt it, but only trying will tell. Sounds like a driver or Windows problem. Have you tried rebooting the PC after installing the latest Verizon LG drivers with the phone not plugged into it? Have you verified that in Device Manager it doesn't list the phone under the Modem section? It can take up to 10 minutes for Windows the load the driver you had installed, the first time you connect a different device to a different USB 2.0 port, and USB 2.0 is recommended over USB 3.0, and preferably a port that comes directly off the motherboard, and not through a hub.
If the phone isn't listed in the Modem section of Windows' Device Manager, no software looking for Download mode will be able to recognize it.
Intro
This is a guide for people who want to make some modifications to config files, or other files, on System partition but do not want to root their phone or install custom recovery in order to keep OTAs and some apps, which don't play nicely with rooted phones, working. Examples of those config mods could be changing DPI or changing volume levels etc, which you would only do once and forget about it.
While root allows you to do those kinds of changes from within android, this methods would require a PC.
If you are familiar with temporary booting into a custom recovery, skip to step 5.
The usual i am not responsible for any of your actions / bricked phones disclaimer applies.
Prerequisites
- A working adb / fastboot environment. Please use Android SDK, if you installed your adb and fastboot using other tools, things might not work, so please just install SDK, install Google USB Driver from SDK manager, install Platform-Tools from SDK manager (should be installed by default) and then add your sdk platform-tools path to your PATH environment variable to have it available in cmd in every path.
- Unlocked bootloader
- TWRP image for you phone (.img) https://twrp.me/devices/huaweinexus6p.html
Follow the [GUIDE] Unlock/Root/Flash for Nexus 6P for that.
Instructions
Here is an example of modifying DPI. I prefer build.prop method of modifying DPI because using the adb wm density command usually caused some issues for me, but modifying via build.prop didn't.
1 - With you phone ON, connect it to the PC and make sure adb is working by running
Code:
adb devices
and making sure that device is listed
2 - Reboot into bootloader. and make sure fastboot is good to go too. Run commands one at a time:
Code:
adb reboot bootloader
fastboot devices
3 - Place your TWRP image file in some easily accessible folder, for the sake of this example i will use C:\Mods.
4 - Temporary boot into TWRP (we are not flashing it here at all).
Code:
fastboot boot c:\Mods\twrp-2.8.7.0-angler.img
Here is where things may not work. If you don't see your phone boot into TWRP then either your adb / fastboot environment not setup correctly (installed via a tool instead of SDK) or your img file is corrupt.
One thing that works for me when TWRP refuses to boot is to restart cmd and issue the command again this closes and reopens adb/fastboot daemon.
5 - Once TWRP is up on your phone it may display a warning saying "TWRP has detected an unmounted system partition". Swipe to allow modifications at the bottom. This screen may not come up at all.
6 - Go to Mount >>> Tick System >>> Make sure "Only Mount System Read Only" is unticked >>> Press Back button
7 - Back on your PC check if your device is listed
Code:
adb devices
8 - Pull the file you need to modify from system partition to your PC. Please note the direction of the slashes:
Code:
adb pull /system/build.prop c:/Mods
9 - Now you should see build.prop in your c:\Mods folder. Use Notepad++ or something like that to edit the file. Find the line with lcd_density= and change it's value to whatever you need and save the file.
10 - Push the file back to your phone:
Code:
adb push c:/Mods/build.prop /system
11 - Reboot
Code:
adb reboot
12 - Profit.
Hope this will help anyone who is looking to do some mods without installing custom recovery and rooting your phone.
Cheers.
Would this work for adding the tethering bypass line in the build prop?
Yes it will. What's the line again I was looking for it the other day and couldn't find it...
Works are per OP's original post, tested and boosted the headphone volume without a problem.
Headphone path is /system/etc/mixer_paths.xml
So as per OP's example to pull: adb pull /system/etc/mixer_paths.xml c:/Mods
push: adb push c:/Mods/mixer_paths.xml /system/etc
I'm using the OP's "Mods" folder to demonstrate the file path but this may vary on your PC.
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
skrowl said:
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
Click to expand...
Click to collapse
You can certainly push the files to system partition and they will retain there after reboot. So if you know which files have to be pushed for SuperSU then give that a go. It shouldn't break anything.
I haven't tried pushing SuperSU files to system partition before so I can't guarantee that OTAs will work after this. The only way to find out is to try it i guess...
Can you run nandroids?
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
NCguy said:
Can you run nandroids?
Click to expand...
Click to collapse
Im not sure what you mean?
rohit25 said:
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
Click to expand...
Click to collapse
If it's on the system partition then I yes you can.
locolbd said:
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
Click to expand...
Click to collapse
I've never had a problem with changing DPI using this method on a nexus phone if that helps.
denk said:
Im not sure what you mean?
Click to expand...
Click to collapse
Can you run nandroids backups from TWRP by just booting into it?
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
I got this too when I flashed MOAB via adb sideload. I'm just wondering if the same warning appears with the adb push method. Also, the file's permissions don't need to be set after adb push?
My main concern is if Android Pay still works with the red triangle warning. Anyone?
FYI Flashing back to stock is no issue for me.
NCguy said:
Can you run nandroids backups from TWRP by just booting into it?
Click to expand...
Click to collapse
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
Thanks for trying it out! Sometimes OTA notifications take a little while to come up after reboot. But based on the warning Im afraid that they might be disabled now. It looks like it runs some sort of a check on the system partition to verify its legitimacy. So modifying files would be fine on it using this method but looks like adding them won't work.
TWRP just released their recovery with decryption support so you can just follow the standard procedure or just temporary booting into TWRP and rooting from there which works as well.
denk said:
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
Click to expand...
Click to collapse
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
NCguy said:
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
Click to expand...
Click to collapse
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
denk said:
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
Click to expand...
Click to collapse
Thanks a lot for that. I didn't unlock the bootloader. Ugh. Time to start over. To me nandroids alone make it worth the effort.
None of this is my work and all recognition goes to the awesome developers that made this possible, I will link their guides in here with some minor notes for newbies like me that may had some issues trying to unlock and root the Fire Stick (FS) 4K
DISCLAIMER: BE WARNED THAT YOU HAVE TO OPEN YOUR FIRE STICK AND IT WILL VOID YOUR WARRANTY, THIS IS NOT FOR THE FAINT OF HEART AND NEITHER THE DEVELOPERS OR MYSELF ARE RESPONSIBLE IF YOU BRICK YOUR DEVICE OR VOID YOUR WARRANTY
Ok, now let's begin:
UPDATE: Per Sus_i, this makes perfect sense:
"Since the exploit can't be patched, it's in my opinion the best to do the setup at the beginning, pair the remote, then update to the latest over fireOS. That way you avoid a pending update nag setup screen after doing the exploit. Then enable ADB and unknown sources. After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen)."
First very important, I wish I would have known this before but make sure you have a Laptop and a Monitor to Connect the FS to, so basically the USB Power cable from the FS connect it to your laptop and connect the HDMI portion to a monitor or TV
I also strongly recommend to have your FS deregistered before continuing as this will prevent your FS from automatically updating after rooting
In order to unlock the bootloader follow "THIS GUIDE"
I made a quick video on how to open your device and how to Short it using Aluminum Foil:
https://www.youtube.com/watch?v=h4I6ifBLWJ4
Process is pretty self explanitory, make a USB ISO from the image provided on that thread, boot into it and open terminal, make sure you put the file he provides on a RW location, my mistake was that I put it inside a RO folder and it would not load the script, so I mounted the kamakiri-mantis-v1.2.zip unto the /mnt directory of the usb and I was able to run the script successfully, make sure to run the commands quickly as the first time that I it finished the ./bootrom-step.sh script and I left it sitting for 10 minutes to grab a bite, I couldn't run the second script and had to start all over. After the second ./fastboot-step.sh script, your device will be on the TWRP recovery, now on the same terminal page or a new one enter these commands:
Code:
adb devices
adb shell
exit
You should see your device's serial number from the first command with "device" to the right of it and the second command will basically put you inside the device's directory assuming you have established a successful connection. The last command just put you back to your starting point, now open the firefox browser on the FireOS USB and navigate to the URL below
Download the Pre-Rooted Image from "HERE" This image contains Magisk already so you don't have to worry about installing it separately, the image is larger than the available partition on this USB so this is a good time to either get a second USB or if you want to download the file to your local hdd and pull them from there its up to you, then run these commands:
Code:
adb push <your download location you decided earlier here>/mantis-6.2.6.8-rooted_r1.zip / sdcard/
adb reboot recovery
adb shell
twrp install /sdcard/mantis-6.2.6.8-rooted_r1.zip
twrp wipe cache
twrp wipe dalvik
reboot -p
This basically installs the pre-rooted image to your device, after the last command, you should see on your monitor the Fire Stick Reboot and boot to the Amazon GUI Splash Screen, now very important if you followed my previous instructions of deregistering your device before performing all these steps, it should bring you up to the Amazon Initial Setup Screen, now what you want to do is do the following commands before continuing on terminal:
Code:
adb devices *you should see something your screen where the FS is connected to, click accept or enter can't remember*
Now it should show you in terminal your serial number and "device" next to it, meaning you can run adb commands in which you will run the following to disable OTA updates:
Code:
adb shell
su *after this command you should see something again on your screen, click the check the box "Always Remember" and click ok" *
if "su" was successful, you should see something like this:
mantis:/ $ su
mantis:/ # *the hash means you're running as root, if you don't have a "#" you are not running as root"
Than continue with these commands and should get the following results:
pm disable com.amazon.tv.forcedotaupdater.v2
***Package com.amazon.tv.forcedotaupdater.v2 new state: disabled***
pm disable com.amazon.device.software.ota
***Package om.amazon.device.software.ota new state: disabled***
pm disable com.amazon.device.software.ota.override
***Package com.amazon.device.software.ota.override new state: disabled***
After running all these commands exit adb and continue with the normal Amazon Setup including adding your amazon account. After you get to the screen where you can see all the apps, open a new web page browser in firefox and download "This Add-On" , this one is less than 200MB so it should fit on the Fire OS USB, so I would download it and copy it to /mnt for ease of access, go back to terminal and type this:
Code:
adb devices
adb push <your download location you decided earlier here>/AFTV-MM-1.7-6.2.6.8.zip/ sdcard/
adb reboot recovery *it will boot into TWRP*
adb shell
twrp install /sdcard/AFTV-MM-1.7-6.2.6.8.zip
twrp wipe cache
twrp wipe dalvik
reboot -p
Your device will reboot and if everything went smoothly, you should have a rooted amazon fire stick 4k, Congrats :good:
Nice guide
Here are a few thoughts from me...
It's important to use the latest kamakiri. The mentioned prerooted 6.2.6.5 is probably a downgrade. A few sticks needs an update of the TZ in order to play prime video. The TZ update is only in the v1.2 Kamakiri or in the 6.2.6.6 prerooted.
Edit: S̵i̵n̵c̵e̵ ̵t̵h̵e̵ ̵e̵x̵p̵l̵o̵i̵t̵ ̵c̵a̵n̵'̵t̵ ̵b̵e̵ ̵p̵a̵t̵c̵h̵e̵d̵,̵ ̵i̵t̵'̵s̵ ̵i̵n̵ ̵m̵y̵ ̵o̵p̵i̵n̵i̵o̵n̵ ̵t̵h̵e̵ ̵b̵e̵s̵t̵ ̵t̵o̵ ̵d̵o̵ ̵t̵h̵e̵ ̵s̵e̵t̵u̵p̵ ̵a̵t̵ ̵t̵h̵e̵ ̵b̵e̵g̵i̵n̵n̵i̵n̵g̵,̵ ̵p̵a̵i̵r̵ ̵t̵h̵e̵ ̵r̵e̵m̵o̵t̵e̵,̵ ̵t̵h̵e̵n̵ ̵u̵p̵d̵a̵t̵e̵ ̵t̵o̵ ̵t̵h̵e̵ ̵l̵a̵t̵e̵s̵t̵ ̵o̵v̵e̵r̵ ̵f̵i̵r̵e̵O̵S̵.̵ ̵T̵h̵a̵t̵ ̵w̵a̵y̵ ̵y̵o̵u̵ ̵a̵v̵o̵i̵d̵ ̵a̵ ̵p̵e̵n̵d̵i̵n̵g̵ ̵u̵p̵d̵a̵t̵e̵ ̵n̵a̵g̵ ̵s̵e̵t̵u̵p̵ ̵s̵c̵r̵e̵e̵n̵ ̵a̵f̵t̵e̵r̵ ̵d̵o̵i̵n̵g̵ ̵t̵h̵e̵ ̵e̵x̵p̵l̵o̵i̵t̵.̵ ̵T̵h̵e̵n̵ ̵e̵n̵a̵b̵l̵e̵ ̵A̵D̵B̵ ̵a̵n̵d̵ ̵u̵n̵k̵n̵o̵w̵n̵ ̵s̵o̵u̵r̵c̵e̵s̵.̵ ̵ After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen).
Edit: Update: meanwhile, the fix for the mentioned 'contact manufacturer' error is known...
Take a look here and here.
Edit/Update: Due to efuses (blocking the bootrom access), it isn't recommended to do any update infront of the unlock...
Sus_i said:
Nice guide
Here are a few thoughts from me...
It's important to use the latest kamakiri. The mentioned prerooted 6.2.6.5 is probably a downgrade. A few sticks needs an update of the TZ in order to play prime video. The TZ update is only in the v1.2 Kamakiri or in the 6.2.6.6 prerooted.
Since the exploit can't be patched, it's in my opinion the best to do the setup at the beginning, pair the remote, then update to the latest over fireOS. That way you avoid a pending update nag setup screen after doing the exploit. Then enable ADB and unknown sources. After kamakiri I would flash only magisk.zip + sideload the manager app with adb... and avoid any prerooted rom flashing until there is an update to a somewhat higher version (and the current 6.2.6.8v1 has that contact manufacturer error screen).
Click to expand...
Click to collapse
Ops Typo let me edit it, I meant to put 6.2.6.8 on the command lol, and aaaa I see I didn't know the exploit couldn't be patched great info, so than yes I will revise my instructions thank so much
UPDATE: I just checked my FS and I'm on 6.2.6.8v1 and didn't receive contact the manufacturer, is it because I sideloaded the manager app after?
nandroidint said:
UPDATE: I just checked my FS and I'm on 6.2.6.8v1 and didn't receive contact the manufacturer, is it because I sideloaded the manager app after?
Click to expand...
Click to collapse
No. If I remember correct, it has something to do with flashing, i.e. the vendor partition wasn't flashed propperly.
Maybe you flashed not the prerooted!? With the Kamakiri TWRP version is flashing full ota update packages (renamed to zip) also possible... and in the prerooted thread is such a full 6.2.6.8 ota linked.
Edit: Could be that this error is prime video related, idk. rbox said he looks into it soon...
Just for clarification: The prerooted rom is a perfect thing since years.
My suggestion 'avoid any rom flashing' from my last post is just an attempt to keep it simple for beginners.
By the way, if the stick gets all updates in front of the unlock, it makes no sense to update it after the unlock again (unless addon.d support is needed).
I hope that has become clear I very much appreciate all the prerooted stuff
thanx for the tut nandroidint this is exactly what I needed, I wasn't sure how to do the shorting so the video helped out a lot now I'm ready to do this. But I'm sorta a noob when it comes to android so I got few questions tho, 1) what are the main benefits in rooting the fIrestick 4K 2) are there different roms to install? 3) are there root only .apks? 4)also one main thing I would like to be able to do is spoofing the Mac address any idea if that's possible?
5)Oh and lastly what OTB cable do you recommend? sorry for all the questions ?
'std::bad_alloc'
After running the adb push of the manthis.zip Im getting terminate called after throwing an instance of 'std::bad_alloc'.... What Im I doing wrong?
i gave root can i remove amazon services
i dont want google launcher jsut remove services
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable ?
Can I please get some support guys ? previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Hello, after root i got massage on screen
: android system
There is na internal problem with Your device. Contact Your manufacturer for detalis.
And when im trying to register in Amazon it bringing me back to pairing screen, farest i can go it is wifi connection.
Did i brick my Stick?
davinci2798 said:
Hello, after root i got massage on screen
: android system
There is na internal problem with Your device. Contact Your manufacturer for detalis.
And when im trying to register in Amazon it bringing me back to pairing screen, farest i can go it is wifi connection.
Did i brick my Stick?
Click to expand...
Click to collapse
Did you deregister before rooting like the tut says? This is why I’ve been hesitant on rooting because of the lack of support on this forum
Yep, it was new Stick, out from box. Not registered at all. I managed massage, but still comminng to pairing screen.
itsyaboy said:
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable
Can I please get some support guys previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Click to expand...
Click to collapse
You can use adoptable storage on 4K stick with Add-Ons installed and activated AFTV-XM Xposed Module. It brings adoptable storage support to Settings UI.
tsynik said:
You can use adoptable storage on 4K stick with Add-Ons installed and activated AFTV-XM Xposed Module. It brings adoptable storage support to Settings UI.
Click to expand...
Click to collapse
Nice! That’s awesome thanx for the info and reply.
davinci2798 said:
Yep, it was new Stick, out from box. Not registered at all. I managed massage, but still comminng to pairing screen.
Click to expand...
Click to collapse
Hey so have you figured out what was the problem yet? If so could u explain how you managed to fix it? I’m going to root sometime this week and would hate to run into this issue.
USB drive for storage
itsyaboy said:
Sooo there’s no way to expand the storage? Even after rooted? Just bought an otg cable
Can I please get some support guys previous questions I don’t need answered I found someone on twitter who explained a few things but can someone please answer this.
Click to expand...
Click to collapse
Yes, You can use a USB drive for App loading and Movie storage.
See Troypoint.com for good video.
I suggest a single USB OTG Cable and a USB HUB for your drive.
Then you can add a Keyboard and Mouse which make it MUCH easier to type commands.
Good Luck
How might one do this on a Mac?
Thanks
gogorman said:
How might one do this on a Mac?
Thanks
Click to expand...
Click to collapse
Do what? The only thing u can do on the MacOS is to create the bootable iso usb, you can follow these steps to do so https://www.google.com/amp/s/www.le...-on-an-apple-mac-os-x-from-an-iso?hs_amp=true
After your create the bootable usb just reboot and hold down option and select the bootable usb, once in open up Firefox and download the kamakiri-mantis-v1 and open a terminal window and change the directory to where u have the kamakiri folder, in terminal type cd then just drop in the kamakiri and hit enter. From there u can just follow the tut, FYI the bootable usb you create is a Linux OS so that’s how you can do it on a Mac, you just can’t do the rooting on MacOS, just clarifying Incase that was your question.
Sorry I haven't rooted phones in a while and am trying to root my fire stick 4k. Can we get some pictures tutorial pretty please
Sent from my ONEPLUS A5010 using Tapatalk
Step by step instructions would be great?
chinkster said:
Sorry I haven't rooted phones in a while and am trying to root my fire stick 4k. Can we get some pictures tutorial pretty please
Sent from my ONEPLUS A5010 using Tapatalk
Click to expand...
Click to collapse
I would love that too, I have rooted with Unix before but that was on a Drone(Solo).
I understand about creating a bootable USB drive and booting my PC/Mac by changing the bios to boot first off the USB as step 1.
Step 2 is loading software onto the USB while booted under Unix/Linux???
Step 3 How do you then connect to the firestick?
When do you plug the firestick into the tv and when do you short out the jumper??
I know to some of you these sound very basic but it would be helpful for those of us just learning this environment.
Thanks in advance...
RPM99 said:
I would love that too, I have rooted with Unix before but that was on a Drone(Solo).
I understand about creating a bootable USB drive and booting my PC/Mac by changing the bios to boot first off the USB as step 1.
Step 2 is loading software onto the USB while booted under Unix/Linux???
Step 3 How do you then connect to the firestick?
When do you plug the firestick into the tv and when do you short out the jumper??
I know to some of you these sound very basic but it would be helpful for those of us just learning this environment.
Thanks in advance...
Click to expand...
Click to collapse
The link he provided explains all that https://forum.xda-developers.com/fire-tv/orig-development/unlock-fire-tv-stick-4k-mantis-t3978459 all except for when to connect to the tv, but I assume it’s after running the kamakiri script, btw it’s not software, you just download the kamakiri mantis while in the Linux usb os, open a terminal and change the directory of the terminal to the kamakiri folder in order to run the ./bootrom-step.sh and ./fastboot-step.sh commands
Edit: just follow the main guide from the link above then read this guide after, that’s the best way to understand it.
WARNING - THESE TOOLS WRITE TO THE DEVICE PARTITIONS DIRECTLY
If you don't know what that means...
THIS CAN REALLY SCREW UP YOUR ---
I HAVE ONLY TESTED THESE ON THE A2020U (NON-5G) - I CANNOT SAY THEY ARE SAFE ON ANY OTHER VERSION OF THE PHONE (YET)(If you want to test it on a specific model you own, send a PM or post and I can tell you to run a few (safe) things from these tools to make them compatible your phone.)
See my next post down for some more "beginner friendly" general tips and tricks for this phone, including some fixes for common problems and a quick guide for installing Magisk!
If you can't afford to brick your phone, these tools aren't made for you.
There aren't really any protections from doing damage. I made them for myself because doing them on a command line constantly is a pain. I'm just sharing them for two reasons:
1) So myself or other people have tools available to make it easier when advising someone on how to fix their phone.
2) For tinkerers who are okay taking the risk that they'll mess something up.
Thanks to @djkuz / @Unjustified Dev for the EDL tool. These scripts really just expand the use of fh_loader commands in that tool. If you are able to read C++ and want to understand fh_loader I suggest searching on google, the source code is available and from that you can better understand what the tool does / what the command line options do. Feel free to ask here too, I'll do my best to share what I know.
Anyway - below I'll go into plenty of detail of what each "tool" does and some helpful information about using them.
I write in a kind of permanent verbose mode, so if you're impatient and need a TL;DR for these... tough. =)
CURRENT VERSION: Version 1.1d
Changelog:
Version 1.1d:
- Fixed reset scripts
Version 1.1c:
- Fixed a typo in backup_GPT ¯\_(ツ)_/¯
Version 1.1b:
- Fixed errors in GPT_Tools - apparently these existed since v1.0 DO NOT USE PREVIOUS VERSIONS
- Removed the v1.1a download (use 1.1b)
Version 1.1a:
- Added script to find the COM port automatically
- Updated all scripts to use the COM port in the file COMPort (created by the above script)
- Added the missing AB Partition manipulation files (accidentally left out of v1.0)
- Added script to run the phone reset EDL command
- Fixed all the filename inconsistency in the XML files - HOPEFULLY. Please post any errors you find. Unfortunately this will make this version incompatible with v1.0 backups without some work - either rename your backup files to match the new format or use the old XML files included.
-- Especially fixed the XML typo of "uefi_sec.mbn" being backed up from both A and B to the same file (overwriting the A copy with B during an ALL backup).
- Added support for installing firmware packages created for this tool. Put them in the Firmware_Package_Restore directory and use the scripts included with them.
Basic Instructions:
1) Download zip (See attachment at the bottom, or here - Download from AndroidFileHost)
2) Unpack zip
3) Move folder to the root directory, or inside any chain of directories that do NOT have spaces in any of the names
4) Right-click on scripts and select "Run with Powershell" to run
5) If running scripts fails due to permissions, see these instructions: https://superuser.com/questions/106360/how-to-enable-execution-of-powershell-scripts
Make a "Complete Backup" (minus userdata):
1) Run Load Programmer
2) Run "backup_all"
3) Check the backup directory and verify the files were backed up and sizes make sense - a full backup should be 10,387,202,048 bytes / 39 files for the critical files and 1,626,697,728 bytes / 64 files for the non-critical (Don't include the port_trace log file when checking size)
Note: You will see a lot of "warnings" before the files begin to download, the program checking if the files already exist.
How to Use These Tools:
Important:
When the scripts run there will be a lot of information dumped to the console. It's not necessary to read all of that BUT - IF YOU DO NOT SEE THE ASCII ART "DONE" AT THE END of running any of these scripts it is likely the script encountered a serious issue. "WARNING" art is normal for some scripts, but "ERROR" means something went wrong.
None of these find the COM port automatically. It is possible (the EDL tool does) but it's just extra work I'm not paid to do =P
You will need to edit each program and change the variable at the top (usually $COMPort = "6") to whatever port number your phone shows up on.
Sorry that's inconvenient, but it should just be once per script - my port number never changes so it wasn't worth implementing automatic port finding.
This is no longer needed after v1.1a.
1. Load Programmer
This is a simple but extremely important tool! You need to run this before running anything else. This script will open a window that runs a command to open a connection to the phone (when it is in EDL / "9008" mode). The window will stay open until you close it. When working on backups I often need to re-connect the programmer, so this makes that easy - just alt-tab to it and hit enter. If you look at the script, it's fairly straightforward - just read the instructions on the screen after running it. The "secret sauce" for this is really the firehose protocol for our chipset that Unjustified Dev provided in the EDL tool.
2. Backup / Restore:
backup_all: This will backup everything on the phone EXCEPT for the huge userdata partition. It will create a backup in two directories, which I'll explain.."critical" / "non-critical": You can see that I have scripts to run these two "types" of backups. Non-critical DOES NOT MEAN NOT IMPORTANT. It means that it is not critical TO ME to back up those files EVERY time I do a backup, because they rarely change. They're EXTREMELY important to have at least one backup of for your phone. The "critical" backup files are files that change often, although some of them are extreme non-critical (cache for example). Use a different name than "critical" if you like, but the point is that only with BOTH backups run (which is what backup_all does) will you have a complete backup.restore_all: This will restore a full (both critical and non-critical) backup set. The backup files have to be in the "restore_critical" and "restore_non-critical" directories respectively. If you didn't make the backup you're trying to restore with this tool CHECK THE FILENAMES, e.g. if you used Unjustified's EDL tool you have to rename the "abl.elf" file his backup generates to "abl_a.elf" for mine. I put _a and _b on every partition that has an a/b version because I got tired of getting them confused. Of course you can always install a backup to either slot.Files moved to the "restore_" directories won't be changed at all by the restore process so you can cut/paste the files from your backup into the directory instead of copying them.
3. A/B Partition Manipulation
These are no more complicated than the backup/restore tools. But they are written to make manipulations of the A/B partitions easier.My main use for these is when I know I have a good, working ROM setup on slot A, I run A2B copy. Then no matter which slot I end up booting I'm sure it will work. (That is, if you have a working, booting slot, copying all the files from that slot to the other slot using this tool will make both slots the same.)Backup/Copy:run_AB-partition-backup: As it says, it will backup both the A/B partition files - WARNING this is NOT a full backup of the phone.run_AB-partition-swap: This will backup all the A/B partition files, then it will write the B files to A and A to B, effectively swapping the partitions and leaving you with a backup in case it screwed up. This backup is ONLY OF THE A/B FILES.. NOT the whole device!run_A2B-partition-copy (and run_B2A-partition-copy): These will do a backup of both A/B partition files, then write the A partition onto the B partition (A2B) or vice versa (B2A), effectively mirroring that partition.
Write/Restore:All the restore scripts try to find their files in the "restore_Partitions" directory - place the files from one of the backups to be restored there.restore_AB-partition-backup: Restore a backup of both the A and B partition files.restore_A-partition-backup (and B): Restore just the backup of one partition to the same partition it was taken from (A to A and B to B).restore_A2B-partition-backup (and B2A): These write from one partition backup to the other partition as the name suggests.
4. GPT Tools
These are some basic tools to directly interact with the partition tables - these are not going to be of any use to 99% of people, so just ignore them if you don't know what they do.run_fixGPT: This issues the --fixgpt command to each of the LUNs. USE AT YOUR OWN RISK. As I understand it, this will use the onboard device configuration information from each LUN (e.g. logical size) and try to rebuild the GPTs. It's similar to running patch XMLs, it can clean up flashing messes. It isn't magic and won't fix everything.Rarely will anyone need it unless they've been messing around with the flash tools recklessly... I certainly don't know anyone who would do something that dumb backup_GPT: Backup all of the header and footer (main/backup) GPTs for all the partitions (lun 0-5). I am not aware of whether any other models of the phone have more LUNs, so be careful if you're using this on a non A2020U phone.restore_GPT: Simply write an entire GPT backup set (both main and backup 0-5) onto the phone. The backups must be in the restore_GPT folder. This DOES NOT BACKUP before it runs so make sure you did your backup.
6. Set Bootable Partition:
Alright this one is important for everyone. There are two scripts here - one for slot A and one for slot B. These just run a simple command, but they will fix a common problem I (and probably others) have - when the ROM active-slot information does NOT match the partition (hard drive) bootable flag, the phone will bootloop EVEN THOUGH EVERYTHING IS GOOD.So when you flash an EDL backup (depending on which files you flash, I believe this happens because of either the bootloader or the GPT files) there is a chance the backup you're flashing was originally from a different slot than the one you're restoring it to. The config thinks it should be on slot A while the hardware thinks slot B should be booting.This will result in a fast ~3 second bootloop as the two disagree and reset.This tool changes which partition is expecting to boot - "1" for slot A and "2" for slot B.This does NOT change the active slot - the phone will continue to boot the same slot it's trying to boot. You just need to make the partition that it is trying to boot has a bootable flag.AFAIK there is no way to change the active slot (the one XBL (I think) is trying to boot), except through fastboot or when the phone fails to load the OS 8 times in a row (note - if it fail to load the OS - if the phone bootloops before "boot" is called it won't ever switch slots on its own).This was a common cause of fast bootloops for me before I figured this fix out.
It does no harm to try this as you can always switch again. If neither one works for you, then it's something wrong with the files you're flashing. If you know which slot the phone is trying to boot (the one it was on last), run the script that matches that slot.
7. Write "Unlocked" Bootloader and FRP:
Just like the original EDL tool, these very simply overwrite your existing (probably stock) bootloader (abl) files with the fastboot enabled version, and/or your FRP with the "unlocked" flag on (see description below). This will allow you to enter the bootloader menu (Vol+/- on booting) and use fastboot to unlock the bootloader.backup_FRP-and-bootloaders: As it says, this will make backups of both the FRP file and current bootloader files (ABLs).run_all: Literally just runs both of the below scripts *shrug*write_UD-bootloader: This automatically backs up both your existing A/B bootloaders before overwriting them (BOTH) with the unlocked/fastboot bootloader.WARNING - an unfortunate fact is that if you're using the stock ROM and you have this bootloader installed, it borks the USB mode so it's stuck in charge only. There's a way to fix it temporarily, I'll post it in my "tips" thread, but you have to do it every time you boot, very annoying. I can't fix it permanently because I don't know how the bootloader file was built!WARNING 2 - Android 10 will NOT BOOT with this bootloader installed. You can still install it, trying to boot will bootloop, but you can get into the bootloader menu and use fastboot - but there are no recoveries I know of that work with Android 10 right now, so there's very limited use to having fastboot right now. Hopefully we can get a port of TWRP 3.4 going for this phone..write_unlock-frp: This is also in the EDL tool, but maybe poorly explained - the FRP file holds the flag you change in the OS Developer Options to designate "allow bootloader unlock". If you FORGOT to switch that flag on and unlock, as I understand it, you get bootlooped. This can fix that for you without having to go through all the work of undoing that mess.WARNING - I have only tested this with a brand new factory reset OS WITHOUT any fingerprint/code set. It may not work if you set one. I warn against using this if you are not ready to lose your data. It's convenient if you just forgot, but if you set a pattern/fingerprint security and encrypted the filesystem overwriting the FRP might remove your ability to decrypt which would force you to factory reset. Again, I haven't tested it for that so it may work, but be careful.If you already screwed up and ran this to set the flag - the script runs a quick backup of your old FRP just in case. So you can try to restore that FRP and pray lol)
8. Specific Files:
This is just a generic program to backup/write(restore) "specific files".I include a "Reference.XML" which has a full <program> line for every partition you might want to write/read on the phone. To use this, you need to copy the lines from the reference XML into "rawprogram-specific-files.xml" for the files you want to read/write.As an example I already set up "rawprogram-specific-files.xml" with the two lines for "abl_a" and "abl_b" in it. So the script will backup or restore those files (provided you put the abl's you want to restore in the restore_files directory).I personally use this template a lot - I have one for ABLs, one for AOPs, one for BOOTs, and so on. If you are trying to fix a specific file(s) it's convenient.
9. Userdata Backup:
I put this last because, to be honest, I'm not sure how good of an idea including this even is.VERY IMPORTANT - DO NOT USE THIS USERDATA TOOL IF YOUR PHONE IS NOT THE 256GB VERSION!!!!!I will need someone with the 128GB version to send me their GPT files if they want me to make an XML that works for them. Because the userdata size for SURE depends on your phone version.Also, I wrote a script that breaks up the file into download slices (and can be written back to the phone in slices, of course) - one, to see if I could do it and if it would work (it does)... and two, so that in the horrible case that something goes wrong during the... nearly 2hrs of transfer time, for my 256gb image ... that I can at least not have to start all over. If something happens, you should be able to remove the entries in the XML for what you already have and start again.Finally - is it even worth doing? Is backing up the userdata even useful?I don't know yet.For an unecrypted pre-A10 phone I do know it works to fully flash ALL the files on the phone + the userdata all at the same time to return the phone to the exact "state" it was backed up in - all the apps and settings and everything, exactly as they were.But A10 is encryption enabled always, and it uses file encryption which sounds even worse for this idea.. and I don't know if the crypto keys change and when. So flashing an entire encrypted partition might just leave you unable to decrypt all, some, or none and you lose everything.OR it might just work - you throw the whole image on there and the decrypt key is the same, boom, easy backup.If anyone tries it, let me know how it goes (or doesn't). I'll update with any results I find.Update 1: I have confirmed that for the 256gb A2020U backing up the full phone and userdata allows you to restore the phone to that exact state. Doesn't matter if it's encrypted, password set or not, etc. If you backup the entire userdata image and reflash it that is where the phone will be. In most cases you also need all the other partitions too, but if they have not changed they don't have to be reflashed. (I confirmed going from encrypted with password -> encrypted with no password -> back up encrypted with password.. This is on Android 10 with its more complicated encryption).Another nice thing to note - of course the image of the phone will be the size of the partition (ie. 256gb for mine, 128gb for others). But if your phone storage is largely empty, you compress the backup using something like 7z once the image has been backed up. It won't take up so much space then. How much less? My 256gb image compressed is 4.5gb. lol.... it makes sense, the phone is new and there's basically no information on the userdata. Many of the pieces of my userdata backup have the same exacty hashes - meaning they are literally just all 0's... 260gb of zeros. Unfortunately you can't get away with just backing up part of the image as data could be anywhere. And over time as the sectors get written to, it will get more difficult to compress.Anyway, if anyone has a 128GB version they want to donate to science (kidding - I just need backups of the GPT) I can make the XML file to use for backing those up too.
Extra Note: All the programs automatically build a log of the console window, so if something goes by too fast just check the log. The fh_loader also creates a log and dumps it somewhat randomly about... lol.. the filename is port_trace.txt. This tends to get deleted and overwritten easily so if you want to keep it, move it when the script finishes,. it does often contain more information than the console shows - it can be useful understanding what's going on.
Extra Note 2: You'll notice a script "Create Hash List" in practically every directory. That's to strongly hint that using that script is super useful. All the files backed up through these tools, by definition, have the exact same size. If you hash your files though, you can tell if they have changed at all. This is extremely useful in troubleshooting problems.
How to install an EDL firmware package:
Note: This tool is specifically made for the firmware packages I posted. It won't work with any other package (although it can, with a little work).
1. Install the EDL tools
2. Run a backup of your phone! Even if it isn't booting.
3. Download a firmware package from this thread: [ROM][STOCK] Stock Firmware Packages (For Expanded EDL Tools)
4. Unpack the firmware archive into the tool directory "Firmware_Package_Restore"
5. Put phone in EDL mode and run Load Programmer
6. Run whichever "Write Firmware vX to Y.ps1" you want (X = firmware version, Y = A or B partition) (If you don't know which partition is currently booting, just install both.)
7. Wait for the install to finish ("done"), then reset the phone with either the power button or the reset tool
8. You might see a few bootloops and then the phone ask you to do a factory reset / system wipe.
9. Done.
PLEASE POST IN THE FIRMWARE THREAD _NOT HERE_ IF YOU RUN INTO ANY ISSUES!
Enjoy!
Also, while I'm here... some other helpful notes for this phone:
-------------------------------
General Information:
As of right now there are a lot of working options for Android 9 and quickly expanding thanks to work @Unjustified Dev did and work @rafyvitto is continuing to do! Check out some of his sGSI ROMs, lots of options!
Thanks to Unjustified LOS 16 is available for Android 9 also, and is the base install for most ROMs. See his threads for that. I may write up an install guide here that's a little more in depth than his.. not today though.
Upgrading to Android 10 with the bootloader unlocked is possible but requires a workaround:
You must unlock on Android 9 then use recovery to side-load the Android 10 update available from ZTE USA (HERE).
This will remove the fastboot enabled bootloader and requires a complete system wipe.
You will retain bootloader unlock.
Once you have updated to A10 you can run OTA updates to get up to the latest version.
Downsides to A10 include - NO RECOVERY (yet), NO CUSTOM ROMs (yet), and if you flash the fastboot enabled bootloader you CAN use fastboot, but you cannot boot- the phone will be in a bootloop until you restore the stock A10 bootloader.
-------------------------------
Resetting the phone manually:
In EDL Loop - Hold power for 20 seconds
In EDL Not-Looped - Hold power for 5 seconds
In System (booted after ZTE logo) - Hold power for 10 seconds
----------------------------------
Entering Modes:
All of these start by using reset above, THEN the button(s) below - in all except one case (EDL), when the phone resets it will vibrate and then show the blue ZTE logo.
When you feel the vibration you want to immediately release the power button and press the mode buttons.
This can be confusing and tricky - most people say "hold power + button" - that is incorrect. Most cases if you hold any button other than power the phone will not finish resetting until you release that button.
What you want to do is right before or as the phone vibrates, then you hold the button. Once the ZTE screen is up it is probably too late if you missed it. So hold power for your reset and be ready to push the button you want when you feel the vibration.
The one exception - EDL mode. For EDL mode you can (and must) hold the key combo just before/during the restart.
Recovery Mode: Vol+ Button
Factory Test Mode: Vol- Button
Bootloader/Fastboot Mode: Vol+/- Button (both) when phone is NOT plugged into USB (if you are too early pressing the combo, even with the USB unplugged, you will get EDL mode)
Emergency Download Mode: Vol+/- Button (both) when phone IS plugged into USB
--------------------------------
EDL Flash Errors (esp. when EDL looped):
There is NO indication the phone is even ON when you are EDL stuck/looped. Other than when you plug into the computer with the right drivers it shows up as a 9008 device (9008 mode is EDL for Qualcomm).
Even when you can see the phone on your computer, it can often "freeze" in EDL if it is left idle for too long (not connected to and being used by a Sahara programmer).
If you try the EDL tool or another flash tool and they give you errors related to the Sahara programmer not loading or no "hello", do this:
Reset the phone - use a clock to count if you need, has to be accurate since there's no indication of when it resets. Press down Vol+/- and the power button, count to 20sec, then release JUST the power button. Keep holding both of the volumes for another 5 sec, then release them. That will get you back into a fresh EDL. You can watch your Device Manager to see the phone disconnect as an indicator when to let go of the power button. If you mess up the timing, wait a bit before trying again so the phone isn't in the middle of rebooting.
Easiest way to tell if you're in EDL is to watch the Device Manager while you do it. Otherwise there is just a lot of guess work, since there's no logo or vibration when you get it right, phone just appears off.
--------------------------------
USB Mode Stuck After Unlocking:
Something about the fastboot/"unlocked" bootloader causes the USB mode when you boot in the OS to be stuck on "Charge Only" mode.
Luckily I found @meow sir 's comment tucked away in this thread, and he knew a way to fix it (thanks!):
1. Open the phone dialer
2. Dial in "*#*#DEBUG#*#*" (debug = 33284)
(Sometimes takes a little bit to open, but a debugger menu will open)
3. Select the 2nd option for USB
4. Pick the only option - this will unset some strange "testing" mode and you can use MPT again.
Unfortunately this fix doesn't stick, you have to do it every time unless you switch back to the stock ABL. =(
--------------------------------
Installing Magisk, Quick Guide:
- You must have your bootloader unlocked already! This works on both A9 and A10.
1. Use this tool to create a full backup! (backup_all)
2. Go into the "critical" directory created by the backup and find the files for boot_a.img and boot_b.img - rename them to boot_a_bak.img and boot_b_bak.img and keep that window open, need them in a second
2. Boot into the OS. Download the Magisk Manager APK from HERE
3. Copy the APK and both of those boot files to your phone, open a file manager and install the APK
4. Open Magisk Manager and click on "Install" for Magisk (upper right)
5. Select "Patch Boot ROM" (or whatever it says.. something like that..)
6. Navigate to boot_a_bak.img and patch it.
7. Go to your Downloads directory (where Magisk dumps the patched file) and rename it to boot_a_magisk
8. Go back to Magisk and repeat those steps for boot_b
9. Copy the two patched Magisk boot files to your computer, into the folder with your "critical" files backup.
10. Rename the Magisk files to "boot_a.img" and "boot_b.img"
11. Move all the files from the "Backup\backup_all-critical-(...)" directory to the "Restore\restore_critical" directory in my tools
12. Finally, reboot into EDL.. almost there!
13. Run "restore_all-critical" (don't forget to run Load Programmer first..)
14. It will restore all you files, kinda a waste of time - if you know how to use the "Specific Files" tool this is a perfect time to use it to flash JUST the boot files. But anyway - this will get it done.
15. When done flashing, reboot the phone and open Magisk Manager to confirm it is installed!
The Magisk team recommend you DO NOT FLASH your stock boot files back to uninstall it, instead they say you should run their uninstaller.zip. However, I am not sure how to uninstall it if you're on A10 since we don't have a recovery that can flash zips? (Unless the stock recovery works for that, I don't think it would..)
I suspect (but have not tried) that on our phone flashing the boot files back over Magisk will not really be a problem since the recovery and ramdisk are all wrapped up into the boot image. But I don't recommend trying it if you value your data! Fair warning.
---------------------------
Alright that's everything. Good luck!
This will be useful for a lot of folks on here, thanks for taking the time to look for a work around.
rafyvitto said:
This will be useful for a lot of folks on here, thanks for taking the time to look for a work around.
Click to expand...
Click to collapse
Glad to be helpful! Usually I lurk the forums getting information I need to unlock/root/etc lol.. but I saw I actually could contribute something to this forum so hopefully it encourages people to get interested in this phone. It's looking pretty sweet now that I'm not spending days fighting with bootloops!
Indeed,on the note of attracting more users. im going to be releasing something for the pixel lovers very soon ?
Thanks Bob!
I'm on A10 with unlocked bootloader. I made all EDL tool backups when on A9 but these were done before correcting the typos as suggested. So I am not confident of successfully flashing back to A9 (preference).
Therefore I will likely flash the magisk-patched boot files to attempt root and report my experience...
Sent from my ZTE A2020U Pro using Tapatalk
big thx, glad to see some life to this almost dev-dead device
Hey thanks for the post. I'm thinking about buying the phone but have a quick question. Can I update to the latest version of Android 9 before unlocking or will the OTA be Android 10. How would I go about updating to the latest version version of Android 9 and not go to Android 10. Can I download the Android 9 OTA from somewhere and flash that one? Thanks in advance for the help!
Crackass said:
Hey thanks for the post. I'm thinking about buying the phone but have a quick question. Can I update to the latest version of Android 9 before unlocking or will the OTA be Android 10. How would I go about updating to the latest version version of Android 9 and not go to Android 10. Can I download the Android 9 OTA from somewhere and flash that one? Thanks in advance for the help!
Click to expand...
Click to collapse
:good: I think your question borderlines on needing its own thread in the Q&A section but I'll answer you anyway...
Currently as long as you are on A9 when you get the phone you can just do OTA updates from firmware version 1.10 to 1.11 to 1.13 (not sure what android security update that is), after 1.13 it goes to A10.
There is an A10 firmware available from ZTE to SD card sideload. Once installed it has to be updated to the latest A10 via a couple OTA updates.
Going directly from A9 to A10 via OTA goes directly to the latest version.
You cannot flash the A9 OTA... because flashing an OTA is an oxymoron... but I guess you mean can you download the A9 firmware and flash them. The answer is... maybe. ZTE does not offer official downloads any A9 firmware for A2002U (USA version), only A10.
They do offer A9 firmware for A2020G (european) and I think other foreign versions (RU, CN). These cannot be interchanged, if you have the US or EU or CN phone you need to use that firmware... from what I have read. I could be wrong, I don't have those phones.
But there is an unofficial stock A9 firmware for the A2020U here on the forums, uploaded by @rafyvitto . That will get you to.. I forget.. 1.11? That can be flashed using the original EDL tool or, with a little modification, the EDL tools in this thread.
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread. Not sure if it's really necessary, but I have them.. it's just a matter of figuring out hosting them and spending the time to upload them.
bobthenormal said:
:good: I think your question borderlines on needing its own thread in the Q&A section but I'll answer you anyway...
Currently as long as you are on A9 when you get the phone you can just do OTA updates from firmware version 1.10 to 1.11 to 1.13 (not sure what android security update that is), after 1.13 it goes to A10.
There is an A10 firmware available from ZTE to SD card sideload. Once installed it has to be updated to the latest A10 via a couple OTA updates.
Going directly from A9 to A10 via OTA goes directly to the latest version.
You cannot flash the A9 OTA... because flashing an OTA is an oxymoron... but I guess you mean can you download the A9 firmware and flash them. The answer is... maybe. ZTE does not offer official downloads any A9 firmware for A2002U (USA version), only A10.
They do offer A9 firmware for A2020G (european) and I think other foreign versions (RU, CN). These cannot be interchanged, if you have the US or EU or CN phone you need to use that firmware... from what I have read. I could be wrong, I don't have those phones.
But there is an unofficial stock A9 firmware for the A2020U here on the forums, uploaded by @rafyvitto . That will get you to.. I forget.. 1.11? That can be flashed using the original EDL tool or, with a little modification, the EDL tools in this thread.
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread. Not sure if it's really necessary, but I have them.. it's just a matter of figuring out hosting them and spending the time to upload them.
Click to expand...
Click to collapse
Just wanted to chime in, interchanging firmware between each model is possible, you would only need to reflash your model/nonhos/tz partitions to the ones of your variant to have working ril/fod fp/sensors.
Ok Bob I gave it a go and successfully rooted my A2020U running stock A10 v2.09. This is my experience...
Firstly, my A2020U could not connect so I used the @Unjustified Dev Tool ("original tool") to easily determine my com port (i.e. 3). I edited the your scripts accordingly (using Notepad++) and got connected.
I'd rather not fiddle with the hardware buttons to change modes so I used the CLI to "adb reboot edl" to get into EDL mode.
I executed the backup_all.ps1 script.
It echoed several "warnings" indicating that it could not find files. However, the created backup folders did in fact include those files.
I noted that none of the "A" slot files include the "_a" postfix; the "B" slot files did include "_b".
Now I needed to transfer those boot files to my device by first rebooting my device and connecting via MTP.
I noted that the original tool offered a reboot menu option (but sadly only after executing a successful operation). So, not wanting to fiddle, I used the original tool to backup my boot files, then used the menu option to reboot; On my device I then manually selected it to connect via MTP.
After transferring the "boot.img" and "boot_b.img" files to my device, and installing Magisk Manager. I patched them and transferred them back to my PC.
To "flash" (restore) the patched files I decided to cut 'n' paste the two lines regarding them from your Reference.xml file into your rawprogram-specific-files.xml file, replacing your example lines.
I executed your run_write-files.ps1 script and it completed successfully.
Not wanting to fiddle again with the hardware buttons (just so that I can get the reboot option), I backed up the patched files using the original tool and rebooted. Now my device is successfully rooted.
Thank you!
Additional notes and suggestions:
1. Can you please investigate the "false" warnings? See my (redacted) log file attached;
2. It would be great if you could create/duplicate a script within your expanded tool set (or main program) to determine and set the appropriate COMPort (and teach us non-coders the actual commands);
3. Would you also consider investigating and including a reboot device script? (It looks like the original tool calls reset.xml);
4. Note that, at the time of reporting this, the latest versions for the Manager and Magsk are 8.02 (307) and 21.0 (21000) respectively, and that I had to switch the update channel to "beta" for the patched files to pass SafetyNet;
5. Because rooting is a likely use of your tool I am attaching my modified rawprogram-specific-files.xml file which targets the boot files for convenience.
bobthenormal said:
...
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread....
Click to expand...
Click to collapse
If this can help me get my A10 device to a state where I can install a custom recovery and cutom ROMs, I would appreciate it!
eKeith said:
Ok Bob I gave it a go and successfully rooted my A2020U running stock A10 v2.09. This is my experience...
Firstly, my A2020U could not connect so I used the @Unjustified Dev Tool ("original tool") to easily determine my com port (i.e. 3). I edited the your scripts accordingly (using Notepad++) and got connected.
I'd rather not fiddle with the hardware buttons to change modes so I used the CLI to "adb reboot edl" to get into EDL mode.
I executed the backup_all.ps1 script.
It echoed several "warnings" indicating that it could not find files. However, the created backup folders did in fact include those files.
I noted that none of the "A" slot files include the "_a" postfix; the "B" slot files did include "_b".
Now I needed to transfer those boot files to my device by first rebooting my device and connecting via MTP.
I noted that the original tool offered a reboot menu option (but sadly only after executing a successful operation). So, not wanting to fiddle, I used the original tool to backup my boot files, then used the menu option to reboot; On my device I then manually selected it to connect via MTP.
After transferring the "boot.img" and "boot_b.img" files to my device, and installing Magisk Manager. I patched them and transferred them back to my PC.
To "flash" (restore) the patched files I decided to cut 'n' paste the two lines regarding them from your Reference.xml file into your rawprogram-specific-files.xml file, replacing your example lines.
I executed your run_write-files.ps1 script and it completed successfully.
Not wanting to fiddle again with the hardware buttons (just so that I can get the reboot option), I backed up the patched files using the original tool and rebooted. Now my device is successfully rooted.
Thank you!
Additional notes and suggestions:
1. Can you please investigate the "false" warnings? See my (redacted) log file attached;
2. It would be great if you could create/duplicate a script within your expanded tool set (or main program) to determine and set the appropriate COMPort (and teach us non-coders the actual commands);
3. Would you also consider investigating and including a reboot device script? (It looks like the original tool calls reset.xml);
4. Note that, at the time of reporting this, the latest versions for the Manager and Magsk are 8.02 (307) and 21.0 (21000) respectively, and that I had to switch the update channel to "beta" for the patched files to pass SafetyNet;
5. Because rooting is a likely use of your tool I am attaching my modified rawprogram-specific-files.xml file which targets the boot files for convenience.
Click to expand...
Click to collapse
Nice! :good:
For the questions..
0. Thanks for the heads up on filenames! I completely missed that the _a files don't have the labels... As you probably noticed all the files are backed up correctly still (no missing/overwritten files), but I removed the _a from all the A slot files. That was my original "fix", so I guess I started building this package before I got annoyed by not having the _a/_b consistency. I'll update the correct XML file and upload it as a new version.
1. Don't worry about those! They're part of using the fh_loader interface. Warnings are usually just fine, ERRORS are bad. I'll add a note to the post when I get a chance so people don't get scared by that.
It's only when you do a backup the program is really only designed in the "writing" sense, for backups you literally run an identical XML to writing but you send a flag that reverses the process. So it weirdly checks if the files it is going to copy (which of course don't exist) exist, and it throws the standard warning, but then it just creates them (of course).
I can't turn those off without lowering the verbosity setting for that tool. I decided to leave it set to high because if someone has a problem and they post their log file (like so!) it's very useful to troubleshoot.
2. I'll think about it / try. Not very hard to program but a little time consuming.
I'll throw a copy of lsusb.exe in the next version. Windows port of the linux command. People can simply run that on a command prompt and it will list all the active COM ports/devices. If you're not familiar with it - you can also find out by clicking on the windows start bar or pressing the windows key and typing in "Device Manager". In the hardware list there is a category for COM ports where it lists them.
3. Yeah that's very easy I'll put one in the next version as well.
4. Helpful to know. Interesting that you needed beta to pass... I didn't think to mention I use the canary builds (not really recommended... the current one crashes when I try to hide Magisk Manager lol)
5. Thanks! Maybe I should make a directory specific to boot backup/write... but I do think anyone not comfortable doing the change you did might not want to be flashing their boot files anyway haha.. things to consider I guess.
As for getting you back from A10, definitely. I'll figure out how to upload them to one of those file sharing sites in a week or two.
In the mean time, with a backup from this tool you're safe (as far as bricking goes, you'll have to system wipe) to try rafy's EDL backup to revert to A9. I'll find the actual post... I should have been less lazy and linked it in my post lol... HERE - rafyvitto's EDL.
If flashing his backup doesn't boot right away try the tool I included to fix the bootable partition. If it still doesn't work after that (maybe mention here what happened) then just restore your backup.
Do you have the 128gb phone by chance?
Thanks much, especially for your detailed clarifications and convenient link!
I have the 8/256GB (P855A03_NA) model.
PS
I want to spend more time on ensuring I have a complete device backup before nuking with another EDL; will dedicate some time this week...
Sent from my ZTE A2020U Pro using Tapatalk
eKeith said:
Thanks much, especially for your detailed clarifications and convenient link!
I have the 8/256GB (P855A03_NA) model.
PS
I want to spend more time on ensuring I have a complete device backup before nuking with another EDL; will dedicate some time this week...
Sent from my ZTE A2020U Pro using Tapatalk
Click to expand...
Click to collapse
Oh nice, with the 256gb model you're good to use the userdata backup program too. Sounds ideal for you since, like me, you want a really bulletproof backup. If you run a full backup and then run the userdata backup you literally have a "phone state" so you can return your phone back to exactly where it was, not have to wipe system or anything.
Of course I'd hate to be wrong so as usual, do at your own risk! Lol. But I am using that method and it has worked great. The downside being over an hour of waiting for the userdata to download or upload... and having to store 256gb (for long term storage you can compress it down to literally a few gb).
I've been kinda busy, but working on getting some of those things from my last post done hopefully this week.
bobthenormal said:
Oh nice, with the 256gb model you're good to use the userdata backup program too. Sounds ideal for you since, like me, you want a really bulletproof backup. If you run a full backup and then run the userdata backup you literally have a "phone state" so you can return your phone back to exactly where it was, not have to wipe system or anything.
Of course I'd hate to be wrong so as usual, do at your own risk! Lol. But I am using that method and it has worked great. The downside being over an hour of waiting for the userdata to download or upload... and having to store 256gb (for long term storage you can compress it down to literally a few gb).
I've been kinda busy, but working on getting some of those things from my last post done hopefully this week.
Click to expand...
Click to collapse
That's great to know! Your user data backup option has simplified my life.
I will wait for your next revision to do a full backup plus user data before nuking.
I am looking forward to moving on from ZTE's A10 to one of Ray's ROMs...
Sent from my PH-1 using Tapatalk
Updated to 1.1a - kind of had to rush on some things so keep an eye out for mistakes, especially in the XML files, and let me know if you find any.
Should have an 1.09 (A9) firmware package up "Soon(TM)", just have to make the xml files then upload the file somewhere.
EDIT: Already needed to update to 1.1b - I found that the GPT_Tools had a big error that probably was there since 1.0 and no one noticed! Backups of the GPT should now actually work...
Thank you @bobthenormal !
Looking forward to your A9 EDL backup...
Sent from my PH-1 using Tapatalk
eKeith said:
Thank you @bobthenormal !
Looking forward to your A9 EDL backup...
Sent from my PH-1 using Tapatalk
Click to expand...
Click to collapse
It's up -- see the new thread.
I didn't have time to test it so make sure you backup but I'm 99,99% sure it will work. I tested it several times in the past, but to make the firmware package I took out all the (I hope) unnecessary files.
There's one thing I'm not sure of - whether you'll need to use the Fix Bootable tool after installing it. IF you need to, then I believe you will have to install it to partition B and then run fix bootable B. (The 1.10 backup was taken originally from the B partition).
If you find that it works without having to do that, let me know... it may not be necessary if wherever that bootable flag is stored didn't get included in the firmware package.
bobthenormal said:
It's up -- see the new thread.
I didn't have time to test it so make sure you backup but I'm 99,99% sure it will work. I tested it several times in the past, but to make the firmware package I took out all the (I hope) unnecessary files.
There's one thing I'm not sure of - whether you'll need to use the Fix Bootable tool after installing it. IF you need to, then I believe you will have to install it to partition B and then run fix bootable B. (The 1.10 backup was taken originally from the B partition).
If you find that it works without having to do that, let me know... it may not be necessary if wherever that bootable flag is stored didn't get included in the firmware package.
Click to expand...
Click to collapse
Thank you @bobthenormal !
I should be able to give it a go this weekend and inform...
Sent from my PH-1 using Tapatalk