Develop Bugs

Easily flashing H815 bootloder with dd?

I've bought an Italian TIM branded H815, got root access through send_command.exe exploit, and within the root shell I got, I've made a backup of the system and "cust" (the branding) partitions; then downloaded the image, injected root and used dd to overwrite the sytem partition with the rooted one.
After that, I've disabled OTAs, installed ssh server (dropbear), removed TIM branding and put back the stock unbranded stuff, removed all the bloatware, changed the dialer with the one shipped with the lollipop nexus 5 and everything works very nicely.
That's when, while exploring the partitions, I've found that the recovery seems to be in /dev/block/mmcblk0p39.
Being the bootloader still locked (and I'd like to keep it that way), I was pretty sure I couldn't write to the partition, BUT I've run dd to fetch the first bytes of the partition, wrote that to a file, and flashed the file back, overwriting what was there. *So, it was possible*.
Here's what I've done:
dd if=/dev/block/platform/f9824900.sdhci/by-name/recovery bs=1 count=70 of=/sdcard/recovery.partial.img
dd of=/dev/block/platform/f9824900.sdhci/by-name/recovery if=/sdcard/recovery.partial.img
Now here're the questions:
- What would happen if I would just write TWRP through dd over the partition from the running system? (ex.: dd if=/sdcard/twrp.img bs=8192 of=/dev/block/mmcblk0p39)... it seems I wouldn't be blocked by anything in doing so!
- Can you see my very same partitions inside the directory /dev/block/platform/f9824900.sdhci/by-name/ ? (at the end of the post the node listing) -- in case you can't, I've tought they could be useful to you to determine where they are in first place: I've read of people that couldn't find the node "recovery", thus couldn't write to it. Anyway, in that case, there are some tools to explore drive images in GPT form like testdisk and they could be used to find the location of that partition and write over it through dd using the "seek=" parameter.
- In case you already know all that, I presume there is a protection system that runs a checksum of the recovery partition on boot and would argue "hey, what's that? here, eat this bootloop!", otherwise I really can't imagine why I can't change the bootloader.
Thanks in advance!
Alessio
PS, here are the GPT partitions:
Code:
lrwxrwxrwx 1 root root 21 Jan 4 2015 DDR -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 20 Jan 4 2015 aboot -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 Jan 4 2015 abootbak -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Jan 4 2015 apdp -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 Jan 4 2015 boot -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 Jan 4 2015 cache -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 Jan 4 2015 cust -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 Jan 4 2015 devinfo -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 Jan 4 2015 dpo -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 Jan 4 2015 drm -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 Jan 4 2015 eksst -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 Jan 4 2015 encrypt -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 Jan 4 2015 factory -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 Jan 4 2015 fota -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 Jan 4 2015 fsc -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 Jan 4 2015 fsg -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 Jan 4 2015 grow -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 20 Jan 4 2015 hyp -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 Jan 4 2015 hypbak -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 Jan 4 2015 keystore -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 Jan 4 2015 laf -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 Jan 4 2015 limits -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 Jan 4 2015 misc -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 20 Jan 4 2015 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Jan 4 2015 modemst1 -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 Jan 4 2015 modemst2 -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 Jan 4 2015 mpt -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 Jan 4 2015 msadp -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Jan 4 2015 persist -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 Jan 4 2015 persistent -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 20 Jan 4 2015 pmic -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 Jan 4 2015 pmicbak -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Jan 4 2015 raw_resources -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 Jan 4 2015 raw_resourcesbak -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 Jan 4 2015 rct -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 Jan 4 2015 recovery -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 20 Jan 4 2015 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 Jan 4 2015 rpmbak -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 Jan 4 2015 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 Jan 4 2015 sbl1bak -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 20 Jan 4 2015 sdi -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 Jan 4 2015 sdibak -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 Jan 4 2015 sec -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 Jan 4 2015 sns -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 21 Jan 4 2015 spare1 -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 Jan 4 2015 spare2 -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 Jan 4 2015 ssd -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 Jan 4 2015 system -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 20 Jan 4 2015 tz -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 Jan 4 2015 tzbak -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 Jan 4 2015 userdata -> /dev/block/mmcblk0p50

you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.

Oh, I see, so there's a sort of DRM; nevermind, thanks for your clarification by the way
One last question: do you know if after the bootloader unlock any partition changes? I wonder if I could just change my whole firmware with an unlocked one, but I guess it's IMEI-dependent and an internal cryptochip would notice it and refuse to boot, right?

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
do you think it would work modifying the boot.img ( adding gov , overclocking, etc) using the any kernel method which extracts the img and modify the boot.img and then repacks it..or would that mess with the lg signing

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
What's stopping you from writing to the bootloader partition? Is it encrypted or something?

bigalex said:
... After that, I've disabled OTAs, installed ssh server (dropbear), removed TIM branding and put back the stock unbranded stuff, removed all the bloatware, changed the dialer with the one shipped with the lollipop nexus 5 and everything works very nicely.
Click to expand...
Click to collapse
Could you please outline the steps necessary to exchange the dialer?
Thanks in advance.

@dogroll: The bootloader is signed, so tampering with it will cause a bootloop, or brick the device anyway.
 @Google~Android: Yeah, tampering with about anything will cause the kernel to know your device has been tampered, and it will complain about it in ways I just don't want to know (probably will surprise you with a nice brick).
 @Jens1969: Yeah, and very happy to have been asked it: you can just install the Nexus 5 "Dialer.apk" you can get from any n5 firmware into the /system partition (it can't be installed into /data).
Doing so will cause, however, logcat messages about "hey, I can't find com.google.android.dialer.support library!".
So, you will also need the library, and you can find it in any gapps flashable package (I've used this one for example: CyanogenMod hxxp://d-h.st/dGPA).
The library is called com.google.android.dialer.support.jar and must be placed into /system/framework.
You also need to put the /system/etc/permissions/com.google.android.dialer.support.xml file in place. Once I have a minute, I will make a package for it

bigalex said:
@dogroll: The bootloader is signed, so tampering with it will cause a bootloop, or brick the device anyway.
@Google~Android: Yeah, tampering with about anything will cause the kernel to know your device has been tampered, and it will complain about it in ways I just don't want to know (probably will surprise you with a nice brick).
@Jens1969: Yeah, and very happy to have been asked it: you can just install the Nexus 5 "Dialer.apk" you can get from any n5 firmware into the /system partition (it can't be installed into /data).
Doing so will cause, however, logcat messages about "hey, I can't find com.google.android.dialer.support library!".
So, you will also need the library, and you can find it in any gapps flashable package (I've used this one for example: CyanogenMod hxxp://d-h.st/dGPA).
The library is called com.google.android.dialer.support.jar and must be placed into /system/framework.
You also need to put the /system/etc/permissions/com.google.android.dialer.support.xml file in place. Once I have a minute, I will make a package for it
Click to expand...
Click to collapse
I tried the method found here. But my Google Phone FCs and I can't use it for incoming calls. Since my Bootloader is still locked (don't want to void my warranty), I can't use a Zip package. But I could extract the contents and simply copy files and change permissions.

Jens1969 said:
I tried the method found here. But my Google Phone FCs and I can't use it for incoming calls. Since my Bootloader is still locked (don't want to void my warranty), I can't use a Zip package. But I could extract the contents and simply copy files and change permissions.
Click to expand...
Click to collapse
Yep, that's exactly what I did (and I forgot to mention the permissions thing that caused it to crash).
Did you check logcat to see why was it causing FC?
My bootloder is locked too, but still I was able to replace the dialer, so don't worry!
Just, remember to disable the LG dialer, and since you're there, debloat everything! (first line in the code below)
LG G4 debloat :
Code:
pm disable com.android.contacts;
pm disable com.android.LGSetupWizard;
pm disable com.lge.sizechangable.weather.platform;
pm disable com.lge.launcher2.theme.tim;
pm disable com.lge.cloudhub;
pm disable com.lge.remote.lgairdrive;
pm disable com.lge.eltest;
pm disable com.android.browser;
pm disable com.lge.bioitplatform.sdservice.service;
pm disable com.lge.sizechangable.favoritecontacts;
pm disable com.lge.wapservice;
pm disable com.lge.wfds.service.v3;
pm disable com.lge.gcuv;
pm disable com.lge.sync;
pm disable com.lge.livewallpaper.multiphoto;
pm disable com.lge.concierge;
pm disable com.lge.musicshare;
pm disable com.lge.pcsyncui;
pm disable com.lge.updatecenter;
pm disable com.lge.lgfota.permission;
pm disable com.lge.mlt;
pm disable com.lge.appwidget.dualsimstatus;
pm disable com.lge.sizechangable.musicwidget.widget;
pm disable com.lge.cic.eden.service;
pm disable com.lge.music;
pm disable com.lge.hiddenpersomenu;

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
I had the same question, as I'm sure many others have too, so I'm glad I found this post. So taking this a little further would it be possible to pull the bootloader from an unlocked device and overwrite the bootloader on a locked device? I'm a little unclear on the boot sequence so perhaps this question doesn't make sense. I'm running on the thought that the bootloader is "boot -> /dev/block/mmcblk0p38", or is it actually buried a bit deeper and not part of the file system at all?
Apologies if this has already been discussed in another thread (can be difficult to think of the right magic search phrase)
EDIT: actually it looks like the bootloader is "aboot -> /dev/block/mmcblk0p8"

[APP] Boot Logo Changer [2016/04/05]

Boot Logo Changer
Change the boot image (NOT the bootanimation) that shows BEFORE the boot animation.
This has only been tested on the P901, but should work on other Galaxy Note Pro 12.2s.
If in doubt, check to see if your PARAM partition is mmcblk0p8.
There are programs on the Play Store that can show the partitions, there names and other info.
This app does make a backup of the original PARAM partition and stores it on your /sdcard as PARAM.bak.
MAKE SURE YOUR SDCARD IS MOUNTED WHEN YOU GET INTO TWRP or CWM.
(Have NOT tested in CWM as I have TWRP installed).
Many thanks to [email protected] for the original script for the Samsung Galaxy Tab 3 8.0.
He has kindly allowed me to modify his script for the Note Pro 12.2.
His xda page is: Samsung Galaxy Tab 3 8.0 Boot Logo
To change the logo (.jpg file), replace the logo.jpg in the tmp folder with your own .jpg file.
Remember the Galaxy Note Pro 12.2 display is 2560x1600.
Steps to install:
- Reboot into recovery
- Select Install from recovery menu
- Select P901-BootLogoChanger.zip
- Follow recovery install prompts
- Reboot and enjoy!
If you need a restore script, please contact me or post a message.
Downloads:
Google: P901-BootLogoChanger.zip
Mega: P901-BootLogoChanger.zip

Great work.

emremutlu said:
Great work.
Click to expand...
Click to collapse
Thanks!

It was working. Now unable to boot to twrp. Can get to download and Odin is flashing. Will a current firmware Odin flash get me booting again? Thank you
Sent from my Nexus 7 2013 using XDA-Developers mobile app

amityg said:
It was working. Now unable to boot to twrp. Can get to download and Odin is flashing. Will a current firmware Odin flash get me booting again? Thank you
Sent from my Nexus 7 2013 using XDA-Developers mobile app
Click to expand...
Click to collapse
Got it booting again by using the param t311 Odin file. Now I will fix with the backup file. Thank you. I still going to use custom logo.jpg as it looks clean.
Sent from my Nexus 7 2013 using XDA-Developers mobile app

gcrutchr said:
Boot Logo Changer
This has only been tested on the P901, but should work on other Galaxy Note Pro 12.2s.
If in doubt, check to see if your PARAM partition is mmcblk0p8.
Click to expand...
Click to collapse
On P900 can confirm PARAM is still partition mmcblk0p8.
[email protected]:/ $ ls -l /dev/block/platform/dw_mmc.0/by-name
lrwxrwxrwx root root 2016-07-13 15:11 BOOT -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2016-07-13 15:11 BOTA0 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2016-07-13 15:11 BOTA1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2016-07-13 15:11 CACHE -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2016-07-13 15:11 CARRIER -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2016-07-13 15:11 CDMA-RADIO -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2016-07-13 15:11 EFS -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2016-07-13 15:11 HIDDEN -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2016-07-13 15:11 OTA -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2016-07-13 15:11 PARAM -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2016-07-13 15:11 PERSDATA -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2016-07-13 15:11 RADIO -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2016-07-13 15:11 RECOVERY -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2016-07-13 15:11 RESERVED2 -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2016-07-13 15:11 SYSTEM -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2016-07-13 15:11 TDATA -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2016-07-13 15:11 TOMBSTONES -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2016-07-13 15:11 USERDATA -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs1 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs2 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs3 -> /dev/block/mmcblk0p6
So this should work, will try and report back.
Edit: worked just fine, p900 users are safe.

Gatsrom said:
On P900 can confirm PARAM is still partition mmcblk0p8.
[email protected]:/ $ ls -l /dev/block/platform/dw_mmc.0/by-name
lrwxrwxrwx root root 2016-07-13 15:11 BOOT -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2016-07-13 15:11 BOTA0 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2016-07-13 15:11 BOTA1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2016-07-13 15:11 CACHE -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2016-07-13 15:11 CARRIER -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2016-07-13 15:11 CDMA-RADIO -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2016-07-13 15:11 EFS -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2016-07-13 15:11 HIDDEN -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2016-07-13 15:11 OTA -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2016-07-13 15:11 PARAM -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2016-07-13 15:11 PERSDATA -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2016-07-13 15:11 RADIO -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2016-07-13 15:11 RECOVERY -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2016-07-13 15:11 RESERVED2 -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2016-07-13 15:11 SYSTEM -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2016-07-13 15:11 TDATA -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2016-07-13 15:11 TOMBSTONES -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2016-07-13 15:11 USERDATA -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs1 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs2 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2016-07-13 15:11 m9kefs3 -> /dev/block/mmcblk0p6
So this should work, will try and report back.
Edit: worked just fine, p900 users are safe.
Click to expand...
Click to collapse
Great to here it worked!
Make sure you keep a backup of the original PARAM file just in case you want to go back to stock.

where do i locate tmp folder with logo.jpg to replace with another logo
gcrutchr said:
Boot Logo Changer
Change the boot image (NOT the bootanimation) that shows BEFORE the boot animation.
This has only been tested on the P901, but should work on other Galaxy Note Pro 12.2s.
If in doubt, check to see if your PARAM partition is mmcblk0p8.
There are programs on the Play Store that can show the partitions, there names and other info.
This app does make a backup of the original PARAM partition and stores it on your /sdcard as PARAM.bak.
MAKE SURE YOUR SDCARD IS MOUNTED WHEN YOU GET INTO TWRP or CWM.
(Have NOT tested in CWM as I have TWRP installed).
Many thanks to [email protected] for the original script for the Samsung Galaxy Tab 3 8.0.
He has kindly allowed me to modify his script for the Note Pro 12.2.
His xda page is: Samsung Galaxy Tab 3 8.0 Boot Logo
To change the logo (.jpg file), replace the logo.jpg in the tmp folder with your own .jpg file.
Remember the Galaxy Note Pro 12.2 display is 2560x1600.
Steps to install:
- Reboot into recovery
- Select Install from recovery menu
- Select P901-BootLogoChanger.zip
- Follow recovery install prompts
- Reboot and enjoy!
If you need a restore script, please contact me or post a message.
Downloads:
Google: P901-BootLogoChanger.zip
Mega: P901-BootLogoChanger.zip
Click to expand...
Click to collapse

anayajade said:
Click to expand...
Click to collapse
It's in the .zip file

Back up
Hi, thanks for thisgreat work. Running a modified version of stock rom lollipop, where can I find my tmp folder with logo.jpg to make a backup incase something goes wrong?
Edit: re-read the op and understood the second time. Works great on p900

bricked
hi, I think I bricked my p900 using this zip file. At first everything went good, then I tried a different logo.png in the temp file and now my p900 wont boot at all, it goes in download mode only, not even recovery works.
Tried odin back to stock but still nothing.
I was on civZ p900 lollipop 5.0.2 with latest twrp recovery before. Can anyone help me please

coco1476 said:
hi, I think I bricked my p900 using this zip file. At first everything went good, then I tried a different logo.png in the temp file and now my p900 wont boot at all, it goes in download mode only, not even recovery works.
Tried odin back to stock but still nothing.
I was on civZ p900 lollipop 5.0.2 with latest twrp recovery before. Can anyone help me please
Click to expand...
Click to collapse
Please explain what you did the 1st time.
What size is the new logo.png (2560x1600 ?) ; also what is the file size of the logo.png?
How did you replace the logo.png file?
How did you try to go back to stock? With a custom rom or a stock .md5 rom?

gcrutchr said:
Please explain what you did the 1st time.
What size is the new logo.png (2560x1600 ?) ; also what is the file size of the logo.png?
How did you replace the logo.png file?
How did you try to go back to stock? With a custom rom or a stock .md5 rom?
Click to expand...
Click to collapse
Hi, I manage to find a complete firmware including pit, bootloader and csc to install with odin and it's alive again.
The new logo was 2560x1600 but I can't recall the file size. I used ES File Explorer apk to copy the new logo image to the temp folder in the zip file and deleted the original logo.png.
I downloaded the latest stock firmare on Sam mobile for my p900 and used odin, everything went perfect with odin but it rebooted in download mode again, no access to recovery, I tried every methods I know to boot in recovery but it didn't work.
So I found a complete Arabic 4.4.2 stock firmware and used odin and boom everything is back an running now, got 5.0.2 OTA update up and running

coco1476 said:
Hi, I manage to find a complete firmware including pit, bootloader and csc to install with odin and it's alive again.
The new logo was 2560x1600 but I can't recall the file size. I used ES File Explorer apk to copy the new logo image to the temp folder in the zip file and deleted the original logo.png.
I downloaded the latest stock firmare on Sam mobile for my p900 and used odin, everything went perfect with odin but it rebooted in download mode again, no access to recovery, I tried every methods I know to boot in recovery but it didn't work.
So I found a complete Arabic 4.4.2 stock firmware and used odin and boom everything is back an running now, got 5.0.2 OTA update up and running
Click to expand...
Click to collapse
Good to hear you are back up and running ok. Make sure you copy the backup file of the logo partition to your PC for safe keeping.

coco1476 said:
Hi, I manage to find a complete firmware including pit, bootloader and csc to install with odin and it's alive again.
The new logo was 2560x1600 but I can't recall the file size. I used ES File Explorer apk to copy the new logo image to the temp folder in the zip file and deleted the original logo.png.
I downloaded the latest stock firmare on Sam mobile for my p900 and used odin, everything went perfect with odin but it rebooted in download mode again, no access to recovery, I tried every methods I know to boot in recovery but it didn't work.
So I found a complete Arabic 4.4.2 stock firmware and used odin and boom everything is back an running now, got 5.0.2 OTA update up and running
Click to expand...
Click to collapse
Any chance you can share this firmware? I'm in the same boat but I can't find a stock firmware that gets me running again. I've downloaded and flashed a couple but I can still only get to download mode.

Nikoli4 said:
Any chance you can share this firmware? I'm in the same boat but I can't find a stock firmware that gets me running again. I've downloaded and flashed a couple but I can still only get to download mode.
Click to expand...
Click to collapse
Sorry to hear that it happened to you also. I don't have this tablet anymore but if I remember correctly, this is the firmware I used,
https://www.androidfilehost.com/?fid=24269982087019604
Hope you will be good and running in no time

Awesome, thanks! Downloading now. I'd like to find a XAR version of this too, but hopefully this gets me working again.

coco1476 said:
Sorry to hear that it happened to you also. I don't have this tablet anymore but if I remember correctly, this is the firmware I used,
https://www.androidfilehost.com/?fid=24269982087019604
Hope you will be good and running in no time
Click to expand...
Click to collapse
That did the trick, I'm back up and running. Thanks again, I appreciate it.

Nikoli4 said:
That did the trick, I'm back up and running. Thanks again, I appreciate it.
Click to expand...
Click to collapse
Glad I can help and if wait a bit it will give you 2 or 3 system update that will bring you back to the latest firmware from Samsung, I think it's 5.0.1
Edit: it's 5.0.2

I created a bunch of splash screens and figured I'd share. I tested all of these on my p900 and they all worked for me. Check them out here. I also added the recovery software and Odin that I used to unbrick mine after a bad flash in case anyone else needs it. Thanks to coco1476 for the original link.

[HELP] Create a nandroid backup (Xperia C6 Clone/China)

Hello.
So, as I described here, I success got root on this device. Now, I want a full backup in case things going bad. And obvious, a way to restore this backup.
I was searching for days for a ROM, but it simply don't exist (yet). This model have an identification (alps l1 mp6 v2 gxq6580 weg l p69) wich is used in some other devices (includings Samsung clones), so, I checked all the ROMs I found looking into /system partition on my device and comparing with /system image of the ROMs (I used SuperR's Kitchen), and none of them are equal, I mean, a lot of files (includind build.prop) are different, so there is a great chance to brick my phone if I use it.
Even if it is found, I can't restore with SP Flash Tools, because it don't work with this phone. I tried to readback, but it recognizes but never start. As the phone is a MT6580 based SoC, maybe is compatability issue also. MTK Droid Tools don't work also. It recognizes, but can't do anything (don't generate scatter, don't root, don't nothing), again maybe a compatibility also.
The stock recovery have no option to backup, and I'm afraid to flash a CWM or TWRP, because I don't know much about porting these things, and I don't have much information about partitions and these things yet. ADB while in recovery give me an unauthorized device, by the way.
The phone accept fastboot commands, but don't accept the 'fastboot boot image.img", to try a temporary recovery, it only accept the 'fastboot flash image.img'. As sayed on the thread above, the bootloader is now unlocked, by the way.
So... this the situation... Can't have backup for now. If it help you to help me, there is the result of ls -all /dev/block/platform/mtk-msdc.0/by-name/ command in adb shell:
Code:
1|[email protected]_weg_l:/ # ls -all /dev/block/platform/mtk-msdc.0/by-name/
lrwxrwxrwx root root 2017-03-30 00:16 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2017-03-30 00:16 cache -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2017-03-30 00:16 expdb -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2017-03-30 00:16 flashinfo -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2017-03-30 00:16 frp -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2017-03-30 00:16 keystore -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2017-03-30 00:16 lk -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2017-03-30 00:16 logo -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2017-03-30 00:16 metadata -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2017-03-30 00:16 nvdata -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2017-03-30 00:16 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2017-03-30 00:16 oemkeystore -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2017-03-30 00:16 para -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2017-03-30 00:16 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2017-03-30 00:16 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2017-03-30 00:16 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2017-03-30 00:16 recovery -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2017-03-30 00:16 seccfg -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2017-03-30 00:16 secro -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2017-03-30 00:16 system -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2017-03-30 00:16 userdata -> /dev/block/mmcblk0p20
[email protected]_weg_l:/ #
I sucessfully (I think) dump a boot image with dd command (dd if=/dev/block/mmcblk0p7 of=/sdcard/boot.img), but I'm not sure it is 100% perfect and if it can be safely used to restore (and how to restore... maybe 'fastboot flash'?). Maybe I can dump some other images, but I don't tried yet.
If you need any other information, I reply in almost same time.
Thanks in advice.

So, I did a dd to dump boot and recovery, and open them sucessfuly on kitchen. Unfortunally, I can't do the same with system because adb only works with phone in normal mode.
Anyway to get the system for this phone? And, can I use these dumped files with 'fastboot flash' command?
Thanks!

romulocarlos said:
So, I did a dd to dump boot and recovery, and open them sucessfuly on kitchen. Unfortunally, I can't do the same with system because adb only works with phone in normal mode.
Anyway to get the system for this phone? And, can I use these dumped files with 'fastboot flash' command?
Thanks!
Click to expand...
Click to collapse
Hello, i have recently posted a complete ROM on needrom. https://www.needrom.com/download/sony-xperia-c6-clone-mt6580/
i guess that is the one your are looking for. Good luck and sorry for my bad englich.

Help
Rom is corrupted, is not it? It's working? tell me how to download, I thank you

[GUIDE] How to root your U12+ | Info about A/B | Adaway | USB Audio Control

Hey guys and girls,
I couldn´t find any guide on how to root the U12+ without twrp yet, so I thought maybe it´s good to have one. It´s also useful for people who don´t like to boot/flash the recovery but want root access.
I also decided now to do a little write up about the A/B slot partition system on the U12+.
General Information about the A/B slot partition system and seamless updates
Google firstly introduced seamless updates on the Pixel Phones and with it the A/B partition system.
So this means, contrary to non A/B devices, there are two copys of most partitions except userdata.
We have two system (system_a and system_b), two boot (boot_a and boot_b) and two vendor (vendor_a and vendor_b) partitions, amongst others (can be found further down in the partition list but let´s concentrate on these).
When booted in the OS, one slot is actively used and the other is "inactive".
The main advantage that emerges now is, that in case an OTA arrives the "inactive" partitions get updated, while the OS is running. That means while the actual OTA is happening you can use your phone just like you always do.
The following reboot will boot into the former "inactive" slot and use the seamless updated partitions. This happens seamless and just with a reboot. So OTAs are much faster!
If you are interested further here are some links:
https://www.xda-developers.com/list-android-devices-seamless-updates/
https://source.android.com/devices/tech/ota/ab/
https://source.android.com/devices/tech/ota/ab/ab_faqs
Here’s another writeup from the XDA portal!
https://www.xda-developers.com/how-...ess-updates-affect-custom-development-on-xda/
However there comes some confusion. I will try to update the thread as best as I can when development, ROMs, Kernels etc kick in.
But here are a few tips and tricks:
NOTE:
For most of the commands that are slot specific like changing the active slot etc,download mode is the preferred method!
Code:
fastboot flash boot_a boot.img
and commands like this only work in download mode on standard production devices.
See below for these.
However fastboot boot boot.img is not working in download!
How to reboot to bootloader to be able to use fastboot:
From anywhere with buttons:
Long press (sometimes really long!) the Power button until you feel the vibration motor (not the haptic feedback) kick in. When it kicks in let go of power button quickly and push volume down to boot into bootloader.
thanks to @tbalden for figuring it out intially.
From the OS or recovery via ADB:
Code:
adb reboot bootloader
How to reboot to download mode to be able to use fastboot:
From anywhere with buttons:
Long press (sometimes really long!) the Power button until you feel the vibration motor (not the haptic feedback) kick in. When it kicks in let go of power button quickly and push volume down to boot into bootloader.
Now choose your option with volume buttons until you see reboot to download and confirm the option by pressing the power button.
thanks to @tbalden for figuring it out intially how to get into bootloader!
From the OS or recovery via ADB:
Code:
adb reboot download
How to get the active slot:
Code:
fastboot getvar current-slot
How to set the active slot:
A word of advice. If you don´t know what you´re doing you should probably not change slots. Because my U12+ only has a working A Slot. The B slot is without the first OTA or flashing a RUU unbootable.
Set active slot to a:
Code:
fastboot --set-active=a
Set active slot to b:
Code:
fastboot --set-active=b
How to fastboot flash system, boot, vendor and dtbo to only one partition:
Fastboot with A/B devices allow to flash certain files to a specific Slot. I will list here a few of the most common commands. However be warned that not all of them work on the U12+ currently.
It´s currently a WIP to determine why and if it´s possbile with temp S-Off.
These commands seem to work on Standard retail Units only in download mode.
How to flash boot.img to Slot A:
Code:
fastboot flash boot_a boot.img
How to flash boot.img to Slot B:
Code:
fastboot flash boot_b boot.img
How to flash system to Slot A:
Code:
fastboot flash system_a system.img
How to flash system to Slot B:
Code:
fastboot flash system_b system.img
How to flash vendor to Slot A:
Code:
fastboot flash vendor_a vendor.img
How to flash vendor to Slot B:
Code:
fastboot flash vendor_b vendor.img
How to flash dtbo to Slot A:
Code:
fastboot flash dtbo_a dtbo.img
How to flash dtbo to Slot B:
Code:
fastboot flash dtbo_b dtbo.img
for other partitions the general rule is being obvious in these examples I guess
Partition List / Overview for A/B Partitions
Here is a partition list. So you can check if there is an A/B system available for said partition:
Code:
htc_imedugl:/dev/block/platform/soc/1d84000.ufshc/by-name # ls -al
total 0
drwxr-xr-x 2 root root 1880 1970-02-05 04:16 .
drwxr-xr-x 4 root root 2040 1970-02-05 04:16 ..
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 abl_a -> /dev/block/sde9
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 abl_b -> /dev/block/sde30
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 aop_a -> /dev/block/sde1
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 aop_b -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 apdp -> /dev/block/sde46
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 avb_rec -> /dev/block/sde56
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 bluetooth_a -> /dev/block/sde6
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 bluetooth_b -> /dev/block/sde27
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 board_info -> /dev/block/sdf1
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 boot_a -> /dev/block/sde13
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 boot_b -> /dev/block/sde34
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 carrier -> /dev/block/sda16
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 cdt -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib64_a -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib64_b -> /dev/block/sde37
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib_a -> /dev/block/sde15
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib_b -> /dev/block/sde36
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 control -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cota -> /dev/block/sda17
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ddr -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devcfg_a -> /dev/block/sde17
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devcfg_b -> /dev/block/sde38
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devinfo -> /dev/block/sde44
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devlog -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dip -> /dev/block/sde45
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dpo -> /dev/block/sde48
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dsp_a -> /dev/block/sde10
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dsp_b -> /dev/block/sde31
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dtbo_a -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dtbo_b -> /dev/block/sde42
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 extra -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 fataldevlog -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 frp -> /dev/block/sda14
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 fsc -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 fsg -> /dev/block/sdf3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hosd_a -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hosd_b -> /dev/block/sde35
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 hvbmeta -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 hyp_a -> /dev/block/sde3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hyp_b -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 keymaster_a -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 keymaster_b -> /dev/block/sde32
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 limits -> /dev/block/sde50
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 local -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 lockbooter_a -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 lockbooter_b -> /dev/block/sde33
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 logdump -> /dev/block/sde54
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 logfs -> /dev/block/sde52
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mdtp_a -> /dev/block/sde8
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 mdtp_b -> /dev/block/sde29
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mdtpsecapp_a -> /dev/block/sde7
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 mdtpsecapp_b -> /dev/block/sde28
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mfg -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 misc -> /dev/block/sda6
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 modemst1 -> /dev/block/sdf5
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 modemst2 -> /dev/block/sdf6
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 msadp -> /dev/block/sde47
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 oem_misc -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 padding0 -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 padding3 -> /dev/block/sdd1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 persist -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 pg1fs -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 pmic_a -> /dev/block/sde4
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 pmic_b -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 qupfw_a -> /dev/block/sde18
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 qupfw_b -> /dev/block/sde39
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 radio_a -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 radio_b -> /dev/block/sde26
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ramdump -> /dev/block/sda8
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 reserve0 -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 reserve4 -> /dev/block/sde57
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 reserve5 -> /dev/block/sdf7
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sec -> /dev/block/sde43
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sp1 -> /dev/block/sde49
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ssd -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sti -> /dev/block/sde53
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 storsec -> /dev/block/sde55
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 system_a -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 system_b -> /dev/block/sda19
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 tool_diag -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 toolsfv -> /dev/block/sde51
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 tz_a -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 tz_b -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 userdata -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vbmeta_a -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vbmeta_b -> /dev/block/sde41
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vendor_a -> /dev/block/sde19
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vendor_b -> /dev/block/sde40
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_config_a -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_config_b -> /dev/block/sdc2
How to root your phone with TWRP
Prerequisites:
- unlocked bootloader
- enabled USB-Debugging in Developer Options
- latest adb and fastboot binaries
- working adb and fastboot environment
How to root by flashing the magisk zip:
1. Download magisk zip from here:
https://github.com/topjohnwu/Magisk/releases
2. Download TWRP from here: https://forum.xda-developers.com/u12-plus/development/recovery-unofficial-twrp-3-2-2-0-htc-t3819343
3.
Code:
fastboot boot nameoftwrp.img
the TWRP Image! The process is described in the thread I linked above
or simply flash the magisk Zip from permanently installed TWRP
4. Flash magisk.zip
5. Reboot, profit and enjoy a rooted phone
How to with flashing a patched boot.img:
1. Download the latest magisk manager apk from here and install it on your phone: https://github.com/topjohnwu/MagiskManager/releases
2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful @5m4r7ph0n36uru here:
https://forum.xda-developers.com/showpost.php?p=76606102&postcount=2
it´s usually called boot_signed.img
Or extract it from a RUU! the process is described here:
https://forum.xda-developers.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928
3. Copy the boot_signed.img to your phone
4. Open the magisk manager app and tap two times on install
5. Now choose patch boot.img file and select the boot(_signed).img you copied to your phone in the upcoming file chooser
6. Wait for the boot.img to be patched
7. Copy the patched boot.img to your device
8. Download TWRP from here: https://forum.xda-developers.com/u12-plus/development/recovery-unofficial-twrp-3-2-2-0-htc-t3819343
9. fastboot boot the TWRP! The process is described in the thread I linked above.
Or use the permanently installed TWRP
10. Important: Tap on reboot. It will show the active slot! Now switch to the inactive slot and back to your active slot!
11. Tap on install and navigate to the patched boot.img
12. Tap on install img at the bottom
13. Flash the patched.img
14. Tap on reboost system and boot back to system
15. You´re now rooted!
How to root your phone without TWRP
Prerequisites:
- unlocked bootloader
- USB-Debugging in developer options enabled
- latest adb and fastboot binaries
- working adb and fastboot environment
How to:
1. Download the latest magisk manager from here and install: https://github.com/topjohnwu/MagiskManager/releases
2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful @5m4r7ph0n36uru here:
https://forum.xda-developers.com/showpost.php?p=76606102&postcount=2
it´s usually called boot_signed.img
Or extract it from a RUU! the process is described here:
https://forum.xda-developers.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928
3. Copy the boot_signed.img to your phone
4. Open the magisk manager app and tap two times on install
5. Now choose patch boot.img file and select the boot(_signed).img you copied to your phone in the upcoming file chooser
6. Wait for the boot.img to be patched
7. Now connect your phone to your pc and make sure usb debugging is enabled in developer options
8. Open up a terminal in your fastboot folder and make sure adb is working by typing
Code:
adb devices
into terminal which should return your serial number
9. Pull the patches boot.img to your fastboot folder via:
Code:
adb pull /sdcard/MagiskManager/patched_boot.img
10. Reboot to download mode:
Code:
adb reboot download
11. Check your active slot while in the bootloader mode with
Code:
fastboot getvar current-slot
output of this command will show your active slot
12. Depending on the active slot do
For active slot a do:
Code:
fastboot flash boot_a patched_boot.img
For active slot b do:
Code:
fastboot flash boot_b patched_boot.img
13. If the flash was successful do:
Code:
fastboot reboot
14. Congratulations you´re now rooted.
15. You will see a message stating there is an internal problem. That is nothing to worry about and will be resolved on a later stage.
IMPORTANT NOTICES
1. After rooting, the option to enable face unlock from htc will be greyed out.
How to fix:
a. Open Magisk Manager
b. Open the side menu and tap on magisk hide
c. Tick faceunlock to be hidden
d. Go to settings apps and delete data of faceunlock app
e. reboot!
I will refine this thread in the future and include a few more things to it when the time comes.
Drop a thanks if it helped you
And have a nice day

Here is described how to get adaway working after rooting the U12+
How to:
1. Download and install latest (at the time of writing 3.3) adaway apk from here:
https://forum.xda-developers.com/showthread.php?t=2190753
2. Please don´t download adaway apk elsewhere or from xda labs because 3.2 will not work.
3. Download busybox installer here:
https://play.google.com/store/apps/details?id=stericson.busybox
4. Open the app, grant root access and install busybox
5. Now open adaway and grant root access.
6. Let adaway do its thing and say yes when you will be asked for symlinking.
7. Reboot and profit!

So one more.
Have you ever wondered if it´s possible to adjust the HTC, Google or Dragonfly USB - C to 3,5mm Adapter/DAC more fine grained to your liking. Like controling analog gain of the phone and hardware gain of the dac seperately to achieve the best audio signal possible?
Fine, because here I have a nifty little tweak for you!
I came across this nice little mod and asked the kind @bjrmd if it was possible to adjust his app for the U11. He agreed and I got him the logs. Eventually he worked it out and got it running. Luckily enough this mod still works on the U12+
Prerequisites:
- Root (see above )
- A supported USB DAC (HTC U11 dongle, google dongle or dragonfly red)
Steps:
1. Visit the thread here: https://forum.xda-developers.com/pixel-2-xl/themes/pixel-2-usb-audio-control-t3704024
2. Read the thread!
3. Drop a thanks!
4. Download the latest pixel 2 audio.apk and install it
5. Download the tinymix32.zip, extract the tinymix32 file and place it in the Download folder of your internal SDCARD!
6. Place it nowhere different!
7. Open the previously installed app and grant root permission
8. Reboot your phone!
9. Let the phone boot up fully. The app will copy the file automatically
10. After you saw the toast message plug in the USB DAC with the headphones inserted. You notice the app will automatically open
11. Choose your favorite volume in the slider menu! (Analog (first row) should be maxed out, hardware dac gain (second row) adjusted to your liking but below max)
12. Play music without plugging the headphones to your ear. It may be loud!
13. Enjoy
14. For further questions visit the linked thread! It is full of interesting info!

and one

updated post #2 with how to get adaway working

Hey mate,
thanks for that brilliant guide. Great job!
Sent from my HTC U12+ using XDA Labs

5m4r7ph0n36uru said:
Hey mate,
thanks for that brilliant guide. Great job!
Click to expand...
Click to collapse
Thank you if you find any niggles I’m always open to suggestions or improvements

Would this method work on an HTC U11+? Given that the correct boot img is used ofcourse...

I have made a TWRP for U12+ , but cannot gain root using supersu, unfortunately.

robieNL said:
Would this method work on an HTC U11+? Given that the correct boot img is used ofcourse...
Click to expand...
Click to collapse
Yes it should work just fine

goodman_east said:
I have made a TWRP for U12+ , but cannot gain root using supersu, unfortunately.
Click to expand...
Click to collapse
Did you try to use the magisk flashable zip? Supersu is deprecated as it stands now. And magisk is more than capable to be a worthy successor
maybe open a thread for your twrp here and publish your sources so we can all start working on it?

Freak07 said:
Did you try to use the magisk flashable zip? Supersu is deprecated as it stands now. And magisk is more than capable to be a worthy successor
maybe open a thread for your twrp here and publish your sources so we can all start working on it?
Click to expand...
Click to collapse
yep, I flashed magisk.zip to gain root.
My twrp has some bugs:
1 data decrtytion failed
2 mtp not working
I don't know how to modify stock kernel to enable touch function, so I use kernel file from @sabpprook, but resulting in flashable twrp zip not working properly.

goodman_east said:
yep, I flashed magisk.zip to gain root.
My twrp has some bugs:
1 data decrtytion failed
2 mtp not working
I don't know how to modify stock kernel to enable touch function, so I use kernel file from @sabpprook, but resulting in flashable twrp zip not working properly.
Click to expand...
Click to collapse
Could you get us a dmesg and logcat?
And the recovery log too?

Freak07 said:
Hey guys and girls,
I couldn´t find any guide on how to root the U12+ without twrp yet, so I thought maybe it´s good to have one. It´s also useful for people who don´t like to boot/flash the recovery but want root access.
Prerequisites:
- unlocked bootloader
- latest adb and fastboot binaries
- working adb and fastboot environment
How to:
1. Download the latest magisk manager from here and install: https://github.com/topjohnwu/MagiskManager/releases
2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful @5m4r7ph0n36uru here:
https://forum.xda-developers.com/showpost.php?p=76606102&postcount=2
it´s usually called boot_signed.img
3. Copy the boot_signed.img to your phone
4. Open the magisk manager app and tap two times on install
5. Now choose patch boot.img file and select the boot(_signed).img you copied to your phone in the upcoming file chooser
6. Wait for the boot.img to be patched
7. Now connect your phone to your pc and make sure usb debugging is enabled
8. Open up a terminal in your fastboot folder
9. Pull the patches boot.img to your fastboot folder via:
Code:
adb pull /sdcard/MagiskManager/patched_boot.img
10. Reboot to bootloader:
Code:
adb reboot bootloader
11. Check your active slot in the bootloader/download mode on your phone.
12. Depending on the active slot do
For active slot a do:
Code:
fastboot flash boot_a patched_boot.img
For active slot b do:
Code:
fastboot flash boot_b patched_boot.img
13. If the flash was successful do:
Code:
fastboot reboot
14. Congratulations you´re now rooted.
I will refine this thread in the future and include a few more things to it when the time comes.
Drop a thanks if it helped you
And have a nice day
Click to expand...
Click to collapse
Would you mind writing a fool-proof all-in-one version of guide?
I'm sorry but seems like I am already encountering lots of confusion while reading the first few lines.
For instance, I know how to unlock my u12+'s bootloader and have already done so but I don't understand what boot.img means and also, the firmware version of my u12+ is 1.15.708 and there's only 401/617 for me so what can I do? Also what is adb and fastboot binaries? and does acquiring these 2 necessarily means acquiring both working adb and fastboot environment at the same time? if not, what are the difference?
Sorry but I am really a noob at rooting I would like to spend more time to learn about it but whenever I try to look up the forum the fact that there are too many articles to read from bombards me :crying:

Then you shouldn't be trying this. Not to be a pain, but if you don't learn about this stuff, you shouldn't play with it. The OP is quite articulate and easy to understand if you understand the entire process and Android architecture.

hgoldner said:
Then you shouldn't be trying this. Not to be a pain, but if you don't learn about this stuff, you shouldn't play with it. The OP is quite articulate and easy to understand if you understand the entire process and Android architecture.
Click to expand...
Click to collapse
Just like the essential phone now.

Hi people, I can not unlock my Phone
Anyone have an idea, whats the problem?
C:\adb>fastboot oem get_identifier_token
...
(bootloader) [KillSwitch] : /dev/block/bootdevice/by-name/frp
(bootloader) [KillSwitch] Last Byte is 0X00, disable unlock
(bootloader) [KillSwitch] oem unlock Turn Off!
OKAY [ 0.004s]
finished. total time: 0.004s
Click to expand...
Click to collapse
ok, got it!
had to ennable aditional to unlock the bootloader in developers menu in the phone
---------- Post added at 08:42 PM ---------- Previous post was at 08:34 PM ----------
next Problem ,
Unlocking Bootloader Failed!
Sorry it didn't work out. Here's why:
Required Resources
Please make sure all items are installed and up to date.
We're sorry, but it appears your attempt to unlock the bootloader on this device has failed. This could be caused by several factors including simple errors in the entry of the unlock token, problems with your device, or a lack of manufacturer support for the unlocking process. Please see the specific error code listed below, and try again if necessary.
Error Code: Invalid Bootloader Token Length.
Error Reason: The submitted Token appears to be the wrong length and won't work.
Click to expand...
Click to collapse
Edit: solved too, copied too much , deleted all (bootloader)

ataf said:
Hi people, I can not unlock my Phone
Anyone have an idea, whats the problem?
ok, got it!
had to ennable aditional to unlock the bootloader in developers menu in the phone
---------- Post added at 08:42 PM ---------- Previous post was at 08:34 PM ----------
next Problem ,
Click to expand...
Click to collapse
You probably copied something from the token you shouldn’t have copied?

Updated post #3 with another interesting mod! for all you audio guys out there!
https://forum.xda-developers.com/showpost.php?p=76781657&postcount=3

Freak07 said:
2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful @5m4r7ph0n36uru here:
https://forum.xda-developers.com/showpost.php?p=76606102&postcount=2
it´s usually called boot_signed.img
Click to expand...
Click to collapse
My firmware's version is 1.15.708.6, which is not available in that post for download. What can I do to root my phone?

General Boot/Vbmeta IMGs for November Firmware / SD1A.210817.036

Hey everybody,
I skimmed the threads and it seems nobody tried to extract the boot.img from a device that´s been updated to November firmware.
So at the moment there´s no easy way to root devices where users took the november firmware update already, since factory images are only available for October firmware.
TLDR: Attached to this post are boot.img and vbmeta.img of November firmware that will allow you to root your pixel 6 pro running the updated firmware.
If you´re interested how these were obtained here´s a rough guideline:
Starting point is being a Pixel 6 pro on October firmware rooted.
Taking OTA will fail as boot and vbmeta partitions are altered due to the rooted installation.
Solution: restore those partitions to stock while the device is running, take the OTA but don´t reboot (this will flash OTA to the inactive slot), backup the now updated but still inactive partitions again.
I´ll write a quick mockup how this works, but it´s for advanced users only. So if you´re not comfortable with this I´d suggest to not attempt this.
I was on slot B with October firmware as starting point.
So the goal is to restore original B partitions while the OS is running, apply OTA (which would fail if you´re running altered partitions, boot/vbmeta) and backup updated inactive slot, in my case A.
First problem: Partitions to restore while OS is running need to be unblocked via the command:
Code:
blockdev --setrw <block>
Otherwise you get this error:
Code:
1|raven:/ # dd if=/data/local/tmp/boot.img of=/dev/block/by-name/boot_b
dd: /dev/block/by-name/boot_b: write error: Operation not permitted
1+0 records in
0+0 records out
0 bytes (0 B) copied, 0.002125 s, 0 B/s
To determine which partition you need to unblock run:
Code:
126|raven:/ # cd dev/block/platform/14700000.ufs/by-name/
raven:/dev/block/platform/14700000.ufs/by-name # ls -al
total 0
drwxr-xr-x 2 root root 1020 2021-10-28 21:58 .
drwxr-xr-x 3 root root 1120 2021-10-28 21:58 ..
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 abl_a -> /dev/block/sdb5
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 abl_b -> /dev/block/sdc5
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl1_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl1_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl2_a -> /dev/block/sdb3
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl2_b -> /dev/block/sdc3
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl31_a -> /dev/block/sdb6
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 bl31_b -> /dev/block/sdc6
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 boot_a -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 boot_b -> /dev/block/sda21
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 devinfo -> /dev/block/sdd1
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 dpm_a -> /dev/block/sdb10
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 dpm_b -> /dev/block/sdc10
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 dram_train_a -> /dev/block/sdb4
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 dram_train_b -> /dev/block/sdc4
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 dtbo_a -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 dtbo_b -> /dev/block/sda18
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 efs -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 efs_backup -> /dev/block/sda6
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 fips -> /dev/block/sda9
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 frp -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 gsa_a -> /dev/block/sdb8
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 gsa_b -> /dev/block/sdc8
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 klog -> /dev/block/sda2
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 ldfw_a -> /dev/block/sdb9
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 ldfw_b -> /dev/block/sdc9
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 metadata -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 mfg_data -> /dev/block/sdd2
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 misc -> /dev/block/sda3
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 modem_a -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 modem_b -> /dev/block/sda20
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 modem_userdata -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 pbl_a -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 pbl_b -> /dev/block/sdc2
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 persist -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 pvmfw_a -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 pvmfw_b -> /dev/block/sda25
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 super -> /dev/block/sda26
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 tzsw_a -> /dev/block/sdb7
lrwxrwxrwx 1 root root 15 2021-10-28 21:58 tzsw_b -> /dev/block/sdc7
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 userdata -> /dev/block/sda27
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_a -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_b -> /dev/block/sda22
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_system_a -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_system_b -> /dev/block/sda23
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_vendor_a -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vbmeta_vendor_b -> /dev/block/sda24
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vendor_boot_a -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 2021-10-28 21:58 vendor_boot_b -> /dev/block/sda19
Example how to restore changed partitions: (if you flashed a modified boot.img and vbmeta.img to root, you need to restore those two while the device is running otherwise the OTA will fail.)
Code:
raven:/ # blockdev --setrw /dev/block/sda21
raven:/ # dd if=/data/local/tmp/boot.img of=/dev/block/by-name/boot_b
131072+0 records in
131072+0 records out
67108864 bytes (64 M) copied, 8.790461 s, 7.2 M/s
This will restore boot_b to the original one so that partition won´t fail to apply the incremental OTA to.
After the OTA was successfully flashed we want to backup the updated boot slot. That would be boot_a in my case.
Command for doing so:
Code:
dd if=/dev/block/bootdevice/by-name/boot_a of=/storage/emulated/0/boot_a.img
I backed up november boot.img and vbmeta.img that way. Please note that I had to flash vbmeta again and disable verity to obtain those imgs. OTA won´t flash if partitions are altered in any way. This wiped my device.
Attached to this post are completely stock boot.img and vbmeta.img from the November build I´m on.
This will allow people to root their devices on November firmware if they took the OTA.
Please note that those boot.imgs are from build SD1A.210817.036.
It´s a european Pixel 6 pro. I don´t think there should be a difference to the factory images from the other carriers like verizon etc regarding the boot.img. If you want to be absolutely sure, somebody on a different firmware needs to follow this process or we just wait for the factory images with nov security patch to drop.

That's the firmware I'm currently running.

I can confirm it works with the provided November vbmeta / boot images.
Thank you !!

Thibale said:
I can confirm it works with the provided November vbmeta / boot images.
Thank you !!
Click to expand...
Click to collapse
thanks for reporting back

So you had to wipe data to Root the October stock firmware and then wipe again to upgrade to November firmware?

Nekromantik said:
So you had to wipe data to Root the October stock firmware and then wipe again to upgrade to November firmware?
Click to expand...
Click to collapse
Yes, but due to the process I used to obtain boot.img and vbmeta.img if you read through the first post.
Pixel 5 process for updating, once full OTA/factory images are available like usual, will make that redundant.
(after initial vbmeta wipe)

Great job @Freak07 nice to see you've joined us

Thanks for this tutorial. But its also very annoying that you can't update the system while rooted lol

So it there's no way to update once rooted without wiping?
I used to download factory images and do flash all bat minus the -w flag.

Cares said:
So it there's no way to update once rooted without wiping?
I used to download factory images and do flash all bat minus the -w flag.
Click to expand...
Click to collapse
No confirmed way for this phone yet. When the new factory images (likely .036 or maybe another one) are released on Monday, people who are currently rooted on .015 can update and see if the manual OTA installation method works without having to wipe. I guess there have been mixed results with this method on the Pixel 5.

Man having to wipe every update might be a deal breaker for me. Might resort to locking bootloader if that's the case.

Cares said:
Man having to wipe every update might be a deal breaker for me. Might resort to locking bootloader if that's the case.
Click to expand...
Click to collapse
Yeah, sad to say it might be for me too. I'm unrooted at the moment (had already set up on the 26th so didn't want to wipe and do it all over again) so we'll see how long I can stand it.
Can't believe I'm actually saying this

Cares said:
Man having to wipe every update might be a deal breaker for me. Might resort to locking bootloader if that's the case.
Click to expand...
Click to collapse
Unfortunately the same for me. I have been going back and forth between unlocking or not. Even if the work around can be used on the P6 it is really more involved than I want it to be and not something I really want to do every month. Really disappointing Google has made it such a pain.

I don't mind any amount of workaround, as long as it's stable, consistent, and doesn't require wiping every time.

roirraW edor ehT said:
I don't mind any amount of workaround, as long as it's stable, consistent, and doesn't require wiping every time.
Click to expand...
Click to collapse
Yeah, flashing OTAs & factory images with the -w removed, disabling dm-verity, patching boot images, etc., I don't mind at all. I like doing that stuff. But I don't like having to wipe and set up anew every month. That just might break this old man's back

Agree, wiping all the time is not my idea of ota update fun!

galaxys said:
Agree, wiping all the time is not my idea of ota update fun!
Click to expand...
Click to collapse
I got so used to it with the S21 Ultra. Backups restore pretty quick (google backups)

You got the phone...Nice!
Hope all is well buddy!

Ok, time for a dumb question. If I unlock my bootloader, but don't root, my device will still break the basic integrity of safety net, correct?

mkhcb said:
Ok, time for a dumb question. If I unlock my bootloader, but don't root, my device will still break the basic integrity of safety net, correct?
Click to expand...
Click to collapse
Yes