This guide provides all the steps and patches required to root the Stock system and having Xposed installed while maintaining SafetyNet (Android Pay, Pokemon Go, etc) compatibility. There are some problems of this method that Magisk is supposed to fix, however the latest Magisk v10 is not supporting our stock ROM yet.
The prerequisites of this guide is to have the bootloader unlocked and TWRP recovery.
DOWNLOADS
The recipe require the following ingredients to be downloaded to your internal or external storage:
1. TWRP 3.0.3 (This is the last release at this moment). more info in the Official Thread. Thanks to @jcadduono . TWRP 3.0.2 can't succesfully flash SuperSU 2.79
2. Default Stock ROM for your phone (Required only if you have modified your system or boot partition). You can download them from this thread. Thanks to @DrakenFX . You can alsouse any other custom ROM based on stock such as ZADMix or HelsAx7 SubMix (both tested).
3. SuperSU v2.79. more info in its official thread.
4. SUhide 0.55. More info in its official thread. Thanks to Chainfire.
5. SafetyNet-KCAL Kernel patch, thanks to @jcadduono also for this one!
6. Xposed v86.2 So far only this version is compatible with SUhide.
7. Material Design Xposed Manager app by DVDandroid. More info about this release in its official thread.
8. Root Switch 1.3.3.2 app. Thanks to shakalaca. More info in its official thread.
INSTALLATION
1. Do a backup of your system, I recommend Boot+System+Data partitions. The next steps will modify at least your boot and data partitions, and some Xposed modules will modify also your system partition.
2. If you already have TWRP 3.0.3 then just boot to recovery and proceed to step 3. If you are still using TWRP 3.0.2 please upgrade to the latest TWRP 3.0.3 and reboot to recovery again.
3. I recommend to flash the default Boot and System Partitions and reboot directly to recovery. You can also use any other custom ROM based on the stock ROM such as ZADMix or HelsAx7.
4. All this step must be done without leaving TWRP. Flash SuperSU 2.79 adding also the zips for SUhide 0.55, Xposed v86.2 and the SafetyNet Kernel patch in that order. They must be flashed together. Without leaving TWRP, navigate from the main menu to Advanced > Terminal, introduce the command reboot disemmcwp and the system will reboot by itself once or twice while configuring the settings for SuperSU. Do not be alarmed.
5. Install Xposed Manager and Root Switch apps.
6. Now you have your system fully rooted and you can now install Xposed modules. However you will see the test app SafetyNet Helper reporting a validation failure. Do not worry about it anymore! When you want to initiate a SafetyNet sensitive application (Android Pay or Pokemon Go among others), just open Root Switch and disable root, no need to reboot. SafetyNet will pass and all your apps will work. You can see that Xposed continue working even after disabling root since it was started before. Do not forget to enable root again otherwise new apps requiring root won't load.
Magisk v10+ promises auto root hide per app, but sadly our stock ROM is not yet supported and the method psoposed here requires the user to disable root before loading any SafetyNet protected app.
Enjoy
Reserved for future Magisk guide.
Has anyone managed to get this working on A2017G/B09? I've had a few attempts, forcing systemless SuperSU, but it hangs at the "AXON" boot screen
H0lmEd said:
Has anyone managed to get this working on A2017G/B09? I've had a few attempts, forcing systemless SuperSU, but it hangs at the "AXON" boot screen
Click to expand...
Click to collapse
At what point of the guide is it hanging at the Axon boot screen? after step 4? Have you ensured that the SafetyNet patch is the last thing you flashed before boot?
I just did this on my B29 A2017U phone and it worked perfectly, can switch root on and off with the root switcher and Safetynet passes fully with root set to off.
My previous attempts were all thwarted by the bootloader being unlocked, so that patch to the kernel works great. I'll be backing this up with twrp and getting a little more adventurous (really want to try the BeastMode kernel) soon.
Much thanks for making it nice and simple, Oki !
Oki said:
At what point of the guide is it hanging at the Axon boot screen? after step 4? Have you ensured that the SafetyNet patch is the last thing you flashed before boot?
Click to expand...
Click to collapse
I'm on the same configuration (A2017G B09). I did a step by step installation/reboot/installation/reboot. The Problem is with suhide. After installing suhide the boot process will stick in the Axon screen.
tron1 said:
I'm on the same configuration (A2017G B09). I did a step by step installation/reboot/installation/reboot. The Problem is with suhide. After installing suhide the boot process will stick in the Axon screen.
Click to expand...
Click to collapse
You do not have to reboot after SUhide. The files at step 4 have to be flashed together without leaving TWRP otherwise it won't work.
Oki said:
You do not have to reboot after SUhide. The files at step 4 have to be flashed together without leaving TWRP otherwise it won't work.
Click to expand...
Click to collapse
In theory you're right. But how do like a bugfix to be done if you don't know at which point you're failing?!?
tron1 said:
In theory you're right. But how do like a bugfix to be done if you don't know at which point you're failing?!?
Click to expand...
Click to collapse
The last patch fixes some problems created by SuperSU, SUhide and Xposed. This is why all the patches in step 4 have to be flashed together without leaving TWRP and in the specified order, otherwise it wont work on stock ROMs.
That looks way complicated. What's wrong with the easy way of flashing Magisk V10 + Phh Superuser r266? This has worked on all my devices since the November security patch broke suhide. Magisk now takes care of the flag to hide bootloader unlock status so no need for a kernel patch too. Then flash systemless Xposed by topjohnwu if you want that and you can turn it on and off in Magisk Manager if you want to use Android Pay, play Pokemon Go, etc.
Hi,
I have a A2017G running B08, already unlocked and witch SuperSU 2.79. Just the older version of TWRP.
Can I just upgrade the TWRP and proceed with step 4 and so on? Hate to go back to stock...
Tia,
Cheers,
/Cacti
Tikerz said:
That looks way complicated. What's wrong with the easy way of flashing Magisk V10 + Phh Superuser r266? This has worked on all my devices since the November security patch broke suhide. Magisk now takes care of the flag to hide bootloader unlock status so no need for a kernel patch too. Then flash systemless Xposed by topjohnwu if you want that and you can turn it on and off in Magisk Manager if you want to use Android Pay, play Pokemon Go, etc.
Click to expand...
Click to collapse
For some reason Magisk is not compatible with the Axon 7 kernel. Not yet. This is why it is so complicated and requires a guide. Last time I tested this was yesterday using Magisk v10.2 and phh Superuser r2, and they still failed to root the system.
le_cactus said:
Hi,
I have a A2017G running B08, already unlocked and witch SuperSU 2.79. Just the older version of TWRP.
Can I just upgrade the TWRP and proceed with step 4 and so on? Hate to go back to stock...
Tia,
Cheers,
/Cacti
Click to expand...
Click to collapse
Yes you can try to begin with step 4 with SUhide on. It should work. However I recommend you to upgrade to TWRP 3.0.3 and do the whole step 4.
Gr8. Thanks.
Cheers,
/Cacti
Oki said:
The last patch fixes some problems created by SuperSU, SUhide and Xposed. This is why all the patches in step 4 have to be flashed together without leaving TWRP and in the specified order, otherwise it wont work on stock ROMs.
Click to expand...
Click to collapse
Not quite sure I understand you.
I've tried doing this on A2017g, b09;
0) wipe data/system/boot
1) flash stock Boot stack + System stack zips in twrp 3.0.3 unlocked bl
2) rebooted straight to recovery
3) flashing SuperSU wrote to system so I had to start again but forcing systemless (in terminal; echo "SYSTEMLESS">/data/.SuperSU
4) flash supersu, suhide
5) flash xposed
6) flash the safety net/kcal patch
7) reboot
And I still get stuck on "AXON" boot screen
H0lmEd said:
Not quite sure I understand you.
I've tried doing this on A2017g, b09;
0) wipe data/system/boot
1) flash stock Boot stack + System stack zips in twrp 3.0.3 unlocked bl
2) rebooted straight to recovery
3) flashing SuperSU wrote to system so I had to start again but forcing systemless (in terminal; echo "SYSTEMLESS">/data/.SuperSU
4) flash supersu, suhide
5) flash xposed
6) flash the safety net/kcal patch
7) reboot
And I still get stuck on "AXON" boot screen
Click to expand...
Click to collapse
SuperSU 2.79 installs in systemless mode, no need to set systemless.
Regarding your problem, please try this. Instead of rebooting using the button, open the terminal in TWRP and type "reboot disemmcwp". I hope this was your problem.
This doesn't work for me. Steps:
1. complete wipe
2. install b29 boot stack
2. install b29 system
3. install super su 2.79
4. install su hide 0.55
su hide comes back with an error that says it can't find super su and I should make sure I've installed 2.79 or greater.
edit:
I missed the part in step 3 where you say "reboot directly to recovery". I tried that, but it rebooted to system instead and now I lost TWRP entirely.
edit2:
fastboot flashed twrp again and once in recovery I was able to get through step 4
edit3:
Now it's just stuck on the axon logo. Tried force reboot and the same thing.
Are you sure you tested this from scratch? I have the US version of the axon 7.
Oki said:
SuperSU 2.79 installs in systemless mode, no need to set systemless.
Regarding your problem, please try this. Instead of rebooting using the button, open the terminal in TWRP and type "reboot disemmcwp". I hope this was your problem.
Click to expand...
Click to collapse
I have tried it and am stuck on the same stage also even after using "reboot disemmcwp".
I followed all of your steps and am using an A2017G B08.
corpdecker said:
I just did this on my B29 A2017U phone and it worked perfectly, can switch root on and off with the root switcher and Safetynet passes fully with root set to off.
My previous attempts were all thwarted by the bootloader being unlocked, so that patch to the kernel works great. I'll be backing this up with twrp and getting a little more adventurous (really want to try the BeastMode kernel) soon.
Much thanks for making it nice and simple, Oki !
Click to expand...
Click to collapse
Don't install beast mode yet, from my experience all the steps from op worked fine until I flashed beast mode and it broke safetynet.
lexman098 said:
This doesn't work for me. Steps:
1. complete wipe
2. install b29 boot stack
2. install b29 system
3. install super su 2.79
4. install su hide 0.55
su hide comes back with an error that says it can't find super su and I should make sure I've installed 2.79 or greater.
edit:
I missed the part in step 3 where you say "reboot directly to recovery". I tried that, but it rebooted to system instead and now I lost TWRP entirely.
edit2:
fastboot flashed twrp again and once in recovery I was able to get through step 4
edit3:
Now it's just stuck on the axon logo. Tried force reboot and the same thing.
Are you sure you tested this from scratch? I have the US version of the axon 7.
Click to expand...
Click to collapse
Are you using TWRP 3.0.3? SuperSU 2.79 installs fine and in systemless mode when flashed with the latest TWRP. TWRP 3.0.2 can't flash it properly.
Yes this method has been tested, not only with stock Roms, but also with ZADmix.
If you are doing a complete cleanup before flashing the ROM, boot into system at least once after installing the ROM so the data tree structure is setup. You actually don't need a full cleanup.
Kingo64 said:
I have tried it and am stuck on the same stage also even after using "reboot disemmcwp".
I followed all of your steps and am using an A2017G B08.
Click to expand...
Click to collapse
H0lmEd said:
And I still get stuck on "AXON" boot screen
Click to expand...
Click to collapse
Please ensure you have flashed the right stock ROM for your unit. I have modified Ingredient 2 in the OP since it was highly misleading. Ensure you have unlocked bootloader, TWRP 3.0.3 and flash the right ROM for your system: ZTE_A2017GV1.0.0B09_BootStack_by_tron1.zip and ZTE_A2017GV1.0.0B09_StockSystem_by_tron1.zip. And boot to the system at least once before continue to the rest of the procedure.
Hello,
I'm trying to root my old Moto E 2nd Gen and install the xposed framework.
However, I keep getting stuck in a bootloop.
These are the steps I'm taking..
- Wipe device
- Flash stock firmware, Android 5.1
- Install TWRP to recovery
- Flash Magisk through TWRP
- Open Magisk, install Magisk Manager
- Download Xposed Framework through Magisk and install
- Upon rebooting, I'm stuck in a bootloop.
I've also tried rooting via SuperSu and the same thing happened.
Also note, the first time I tried install xposed I got it to work, but messed something else up and had to restart. Since then I've been getting the bootloop - ie. the phone stays frozen on the "OEM unlocked" screen.
Any help? Am i missing a step?
A while ago, I had TWRP and magisk working. I decided to try and install xposed from the magisk repository, which ended in a bootloop, so I restored the phone using eRecovery.
After this, I installed TWRP and attempted to install magisk again, which led to a bootloop once again - this happens every time I install magisk.
I have tried using uninmod, which just displays no modules to uninstall when I use it in the terminal, and I have tried mounting magisk.img to a folder, but this just contains "lost+found" and no modules.
It would be a great help if someone could offer some advice on how to fix this, because I hope to flash EMUI 9.
Just some quick instructions that helped me with issues with Magisk 19 most recently.
Problem: you updated the ROM, flashed Magisk and now the phone always reboots to recovery within a few seconds of unlocking it.
Solution:
- Flash Magisk 17.3. this should get you back to a stable system with root, but without working modules.
- Install Magisk Manager 6 to use with 17.3
- Use Root Explorer and go to /data/adb
- Delete all files called Magisk and the modules folder
Reboot and reflash Magisk 19
- update Magisk Manager
I almost gave up and would have started from scratch. I don't know why Magisk 19 corrupted after the update but even after deleting only the modules folder it wouldn't work. The phone finally worked normal again after just deleting all things Magisk in the /data/adb folder.
Unfortunately TWRP doesn't mount the encrypted /data partition yet so you can't use Magisk Recovery or Magisk uninstaller from TWRP. I found this workaround finally fixed my issues and I hope it is helpful to someone else on the forum.
Best of luck!
mrchrister said:
Just some quick instructions that helped me with issues with Magisk 19 most recently.
Problem: you updated the ROM, flashed Magisk and now the phone always reboots to recovery within a few seconds of unlocking it.
Solution:
- Flash Magisk 17.3. this should get you back to a stable system with root, but without working modules.
- Install Magisk Manager 6 to use with 17.3
- Use Root Explorer and go to /data/adb
- Delete all files called Magisk and the modules folder
Reboot and reflash Magisk 19
- update Magisk Manager
I almost gave up and would have started from scratch. I don't know why Magisk 19 corrupted after the update but even after deleting only the modules folder it wouldn't work. The phone finally worked normal again after just deleting all things Magisk in the /data/adb folder.
Unfortunately TWRP doesn't mount the encrypted /data partition yet so you can't use Magisk Recovery or Magisk uninstaller from TWRP. I found this workaround finally fixed my issues and I hope it is helpful to someone else on the forum.
Best of luck!
Click to expand...
Click to collapse
Had this issue a while back and ended up starting with a clean install. Nice that you found a fix, should come in handy if I ever face the same problem again...
Hi,
I have similar issue as you but slightly different. Whatever I tried to flash (e.g: twrp (multiple version) or patched magisk boot img). It always reboot to mi official recovery.
Do you face this issue before and how you fixed it?
Info:
Mi 9 EEA rom
cutesniper22 said:
Hi,
I have similar issue as you but slightly different. Whatever I tried to flash (e.g: twrp (multiple version) or patched magisk boot img). It always reboot to mi official recovery.
Do you face this issue before and how you fixed it?
Info:
Mi 9 EEA rom
Click to expand...
Click to collapse
Take a look, if your bootloader is unlock!
Maybe it is relocked.
I had the same issue today, what I did is quickly opened up Magisk manager, and clicked uninstall. It still rebooted in the middle of the process, but after I flashed 19.1, it never rebooted again!
bombername said:
Take a look, if your bootloader is unlock!
Maybe it is relocked.
Click to expand...
Click to collapse
No, I can confirmed it's unlocked because I'm able to flash global rom into mi 9 china phone.
—Problem—
Boot loop... is there anyway to solve this problem without a reset?
—generel Infos—
Device: OnePlus 5 (rooted)
OS: oxygenos 9.0.3
Recovery: TWRP
Other: using EDXposed &
Nethunter Kernel
—the reason?—
I think it was the experimental setting in GravityBox Pie. There was a warning but I didn’t read it because ... I don’t know. The setting required a reboot but after that I stuck in the boot loop.
—what I ´ve tried—
I saw a guide on xda how to disable xposed modules via twrp. The problem was that I was using EDXposed. It was a different. But I deleted a similar file via twrp file manager ( /data/data/com.[IdontKnowTheExactPackgeName].xposed.manager/shared_prefs/[SomethingWithModules])
I tried to reboot but without success
I installed mm ( a for twrp to disable/enable magisk modules and more)
In mm I disabled the EDXposed Module und riru Core Module ( Im not sure if I was riru)
I tried to reboot but without success
I flashed magisk uninstaller and after flashing was done( magisk couldn’t restore boot image or something like that but the flash worked so I ignored it) I got the error: error creating fstab ( the same error occurred when wiping cache/dalvic)
I tried to reboot but without success
I wanted to flash EDXposed but it didn’t work because I haven’t magisk installed
So I flashed magisk again ( this solved the fstab error) and after that the EDXposed uninstaller. Both flashes worked
I tried to reboot but without success
Now I gave up and hope that you have an ansewer
Master Luca said:
—Problem—
Boot loop... is there anyway to solve this problem without a reset?
—generel Infos—
Device: OnePlus 5 (rooted)
OS: oxygenos 9.0.3
Recovery: TWRP
Other: using EDXposed &
Nethunter Kernel
—the reason?—
I think it was the experimental setting in GravityBox Pie. There was a warning but I didn’t read it because ... I don’t know. The setting required a reboot but after that I stuck in the boot loop.
—what I ´ve tried—
I saw a guide on xda how to disable xposed modules via twrp. The problem was that I was using EDXposed. It was a different. But I deleted a similar file via twrp file manager ( /data/data/com.[IdontKnowTheExactPackgeName].xposed.manager/shared_prefs/[SomethingWithModules])
I tried to reboot but without success
I installed mm ( a for twrp to disable/enable magisk modules and more)
In mm I disabled the EDXposed Module und riru Core Module ( Im not sure if I was riru)
I tried to reboot but without success
I flashed magisk uninstaller and after flashing was done( magisk couldn’t restore boot image or something like that but the flash worked so I ignored it) I got the error: error creating fstab ( the same error occurred when wiping cache/dalvic)
I tried to reboot but without success
I wanted to flash EDXposed but it didn’t work because I haven’t magisk installed
So I flashed magisk again ( this solved the fstab error) and after that the EDXposed uninstaller. Both flashes worked
I tried to reboot but without success
Now I gave up and hope that you have an ansewer
Click to expand...
Click to collapse
Try reflashing rom you are using again in recovery.so dirty flash over existing one
Sent from my LEX820 using Tapatalk
bilausdaniel said:
Try reflashing rom you are using again in recovery.so dirty flash over existing one
Sent from my LEX820 using Tapatalk
Click to expand...
Click to collapse
Still in boot loop ( I let it boot for 18 min )
Did you tried to disable xposed on booting?
There is key combination when system boots up, to disable xposed, and so all modules.
Go into recovery, and boot up again from there (normal boot), and when logo appears click at least 3 times power button, and xposed will understand it need to disable itself.
That should work.
And if you have some data in phone, you can make app backup from recovery and if you have files you can connect to PC and copy those files on PC.
I am currently having this problem. Some fully updated systems on some devices won't boot into safe mode. Among those devices are many Xiaomi Devices. I can only boot into fastboot mode.
I've got Orange Fox so theoretically I should be able to delete Riru, effectively disabling exposed, however, Orange Fox is asking for a decryption password and I can't access files to delete them.
ADB sideload failed.
Not sure if I can even do a wipe back to default state.
brasscupcakes said:
I am currently having this problem. Some fully updated systems on some devices won't boot into safe mode. Among those devices are many Xiaomi Devices. I can only boot into fastboot mode.
I've got Orange Fox so theoretically I should be able to delete Riru, effectively disabling exposed, however, Orange Fox is asking for a decryption password and I can't access files to delete them.
ADB sideload failed.
Not sure if I can even do a wipe back to default state.
Click to expand...
Click to collapse
go in twrp and to android/adb/modules.. module there reboot phone
bilausdaniel said:
go in twrp and to android/adb/modules.. module there reboot phone
Click to expand...
Click to collapse
delete that module in there