Develop Bugs

Unlocking Bootloader and root

YES, I have read as much as I can in the forums (all day today, rather nice way to spend a holiday though).
I have a Xperia Z1 Compact D5503 handset (FR SFR version, from eBay). I have recently updated it to Android 5.0.2 via XperiFirm tool. I flashed the Customized_IN version (D5503_Customized IN_1281-0184_14.5.A.0.242_R3D). It WAS NOT rooted and I don't remember if I had unlocked the bootloader.
[I have a laptop running Windows 8.1 x64, with latest versions of XperiFirm, FlashTool x64, Android Studio (with Google USB driver), PC Companion. My laptop detects my phone as MTP (or MSC when I choose so), but in the Device Manager, it never shows as android adb device (always MTP, or USB stick). I tried Update Driver option but to no avail, it says the Google USB driver or the downloaded Z1 Compact driver (from Sony site) is not supported (either by the phone or the PC). But the phone shows debugging connected, even prompts my authorization (first time only). Flashmode and Fastboot modes are detected well enough.]
Now, it says I am not allowed to unlock bootloader (via "*#*#7378423#*#* > Service Info > Configuration" menu). It shows the following:
------------------------------------------------------
Rooting Status:
Bootloader unlock allowed: No
------------------------------------------------------
I am unable to unlock the bootloader (or root, yeah, that's the ultimate goal) via the following methods:
1. Official Sony Method,
2. ZergRush
3. TowelRoot,
4. Easy Root Tool,
5. Newroot (by Doomlord),
6. Flashtool (that BLU option),
7. Fastboot via cmd.exe,
8. Flashing pre rooted zip files (cannot open stock recovery option, does this have any? I used the stock recovery a lot on my old Samsung).
Flashtool, cmd and Newroot showed variants of this same error: "only position independent executables (PIE) are supported."
Sony gave me a code, but that also yielded another variant of the same.
Now, as far as I have understood, what I need is one or more of the following:
1. a pre-rooted ftf file (someone said that is impossible as for Sony's encryption, is that right?)
2. some way to root without unlocking bootloader (Newroot does that, but did not work)
3. some way to override that crazy arrogance of Sony and unlock the bootloader and be my white knight...
Can anyone provide me with a guide or some example? It is not at all fair of Sony to create these non-allowance nonsense.
P.S. Please do not mind my tone, I am usually very docile but a whole day (literally; 6 AM to 6 AM next day!!!) in front of my PC without any result have mutated me a bit.
BTW, I am fairly proficient in following complex instructions only if they are conclusive (I don't want to spend another day figuring out how to follow them)

i cannot contribute in any way, i just wanted to tell you you´re not the only one with the problem. if i find a solution i will get back to you

Flash .108 firmware, root with "rootkitxperia", install dualrecovery, use prf creator to make a flashable rooted zip of lollipop (if that's what you want) and flash in recovery. Job done

I'm actually relieved to see someone else experiencing the exact same problems, I've already spent several days figuring out how to unlock the bootloader and get my phone rooted, but to no avail. However my device does state that the bootloader can be unlocked, but can't be found through cmd prompt when connected in fastboot mode and get's the same error: 'only PIE (position independent executables) are supported when trying to unlock the bootloader with flash tool.
White knights on problem solving horses would be greatly appreciated indeed!

I got a Z1C recently from eBay but have also done this on a Z Ultra and Z2, because of the cross development Sony stuff this is very similar for all of them.
You only need to unlock the boot loader if you want to flash a custom kernel or ROM. You don't need to unlock it to get root access, however to get root access you'll have to flash an old version of Android. You're flashing an old version from before they patched the exploits you want to use to get root.
So the steps are:
1. Get an old version of the official Sony ROM.
2. Flash the old ROM.
3. Exploit it to obtain root access.
4. Install a custom recovery.
5. Make a custom flashable zip of the firmware you want to use with root included.
6. Enter custom recovery and flash the zip you created in step five.
The files I used to do this are:
From XperiFirm I download "1280-5440 Netherlands T-Mobile NL 14.4.A.0.108 / R9C".
Using Flashtool I made an FTF from it and flashed it.
Then I used "EasyRootTool v12.4" to get root access.
I installed "Z1C-lockeddualrecovery2.8.21-RELEASE.installer.zip" from Nut's site.
Then you go back to XperiFirm and grab the version of Android you want to use. I used the 5.0.2 Customised AU one as I'm in Australia, you probably want the Indian one.
Use PRFCreator to make a flashable zip with a custom recovery and SuperSU, for that you need the "Z1C-lockeddualrecovery2.8.21-RELEASE.flashable.zip" not the installer.
There are posts with this info around, it's almost 5am for me so I'm not going to go looking for the links to the posts, you'll have to do that yourself. If you read for the day you've probably found them already.

First of all, I would advise against unlocking your bootloader unless you have a backup of your TA partition. Otherwise you risk losing your DRM keys and might criple your camera. This is irreversible damage without a backup. Second, on the official Sony unlock page it states specifically that not all devices are allowed to unlock the bootloader. If it doesn't, though luck then I guess but I could be wrong.
Now to backup the TA partition you need to be rooted which is not possible up to now with Lollipop unless your bootloader is unlocked. So this is a bit of a problem. Luckily flashtool (make sure to use the older 0.9.18.6 version at the bottom of the download page) allows you to flash a previous version without unlocked bootloader or being rooted. Choose one from the list at the bottom of this link but make sure to use a .108 one from the "KitKat [Old]" section (I chose Generic UK unbranded => link points to UA version, UK FTF here). Then root it through one of your preffered methods, backup TA partition and install a recovery.
Then create your own stock FTF with flashtool. Use this method with PC Companion or just download it through flashtool's built-in Xperifirm with this method.
Then create your own pre-rooted flashable zip with PRFCreator with part 2 from this guide. Continue with part 3 from the same guide (maybe skip the 3 big cups of coffee), exhale and get on with your life.
Maybe check out this one and this one (basically the same process) too.
It's the same procedure as written above but with some links I used to gather the information. I just went through this myself so still had all the tabs open. These were most of the useful ones I believe. It really is a PITA to gather all the bits and pieces from miscellaneous posts scattered all over this forum.

Why flash a 108 kk and then root? Just create lollipop rom with prf creator and flash that.

spudata said:
Why flash a 108 kk and then root? Just create lollipop rom with prf creator and flash that.
Click to expand...
Click to collapse
PRFCreator doesn't make FTF's but flashable zips. From the PRFCreator thread:
To flash a pre-rooted firmware, you need a recovery menu
Click to expand...
Click to collapse
To install a recovery you need to be rooted (at least as far as I know) or have an unlocked bootloader. The point is not to unlock the bootloader at all (like when it is not possible) or maybe only after taking a backup of TA partition if not already done so (which again needs root access).

You're absolutely right, my mistake. Think i had a memory lapse

Help with rooting Htc M8 marshmallow

Hi,
So I'm new to these forums and have been browsing all of the rooting guides for my HTC M8. I am running official Marshmallow and really want to root my phone (again) as far I know I have unlocked boot loader. I had to factory reset my phone last year and never got round to re rooting, but now with marshmallow I wish to do so again.
My issue is I can't seem to understand the steps the guides are outlining. I download the links and try and open them, but nothing happens. Is there a step by step fluid guide in rooting my phone? As all the guides I have found have basically blown over my head. I used a toolkit in the past which did everything for me automatically. If no such post exists would someone be able to explain the steps in a simplified manner? (If possible)
Many thanks in advance to any who help

Optcpsi said:
as far I know I have unlocked boot loader
Click to expand...
Click to collapse
This is easy to determine definitely. Boot into bootloader (if you don't know how, ask and I'll explain) and it will either say bootloader is: LOCKED, UNLOCKED or RELOCKED near the top of the screen.
Vomer's guide is dated at this point, but mostly still accurate for what you want to do (root MM); and its the best guide I know of: http://forum.xda-developers.com/htc-one-m8/general/vomerguides-m8-bootldr-unlock-s-off-t2800727
If your bootloader is UNLOCKED, you can skip the whole section on unlocking it, and pick back up the guide again where it says CUSTOM RECOVERY. If the bootloader is LOCKED or RELOCKED, you'll need to do the section for unlocking the bootloader.
AFAIK, the only part of Steps 0 and 1 that is out of date, is the TWRP version. For MM, you should use TWRP 3.0. And somewhat obviously, the fastboot command to flash TWRP will need to have the corresponding file name; rather than the old version number given in the guide's example.
You'll also want to use SuperSU 2.76 (if the SuperSU version is too old, it will fail to root MM and leave you stuck with no boot). But the guide is already rigged to link to the latest stable version (not a particular version number), so presently it already links to 2.76.
Don't continue to Step 2 of the guide. Its not longer accurate, and not needed for root.

redpoint73 said:
This is easy to determine definitely. Boot into bootloader (if you don't know how, ask and I'll explain) and it will either say bootloader is: LOCKED, UNLOCKED or RELOCKED near the top of the screen.
Vomer's guide is dated at this point, but mostly still accurate for what you want to do (root MM); and its the best guide I know of: http://forum.xda-developers.com/htc-one-m8/general/vomerguides-m8-bootldr-unlock-s-off-t2800727
If your bootloader is UNLOCKED, you can skip the whole section on unlocking it, and pick back up the guide again where it says CUSTOM RECOVERY. If the bootloader is LOCKED or RELOCKED, you'll need to do the section for unlocking the bootloader.
AFAIK, the only part of Steps 0 and 1 that is out of date, is the TWRP version. For MM, you should use TWRP 3.0. And somewhat obviously, the fastboot command to flash TWRP will need to have the corresponding file name; rather than the old version number given in the guide's example.
You'll also want to use SuperSU 2.76 (if the SuperSU version is too old, it will fail to root MM and leave you stuck with no boot). But the guide is already rigged to link to the latest stable version (not a particular version number), so presently it already links to 2.76.
Don't continue to Step 2 of the guide. Its not longer accurate, and not needed for root.
Click to expand...
Click to collapse
Thanks for posting, couldn't find an up-to-date tutorial anywhere.
TWRP is asking to keep system read-only and I'm confused. If I allow modificaions, can I automatically never receive OTA updates again?
Will there even be another one for the M8/ will it get Nougat? Anyways, can I still root it with read-only?

Schmix said:
Thanks for posting, couldn't find an up-to-date tutorial anywhere.
TWRP is asking to keep system read-only and I'm confused. If I allow modificaions, can I automatically never receive OTA updates again?
Will there even be another one for the M8/ will it get Nougat? Anyways, can I still root it with read-only?
Click to expand...
Click to collapse
You need to allow modifications for root. At least traditional root. Systemless root, I would think would work if you stay read only - but do the research especially if you don't know the difference between traditional root and systemless root.
You can't install OTA updates with a rooted device in any case, so that point is irrelevant.
If/when ever an OTA comes, you would need to return to stock never rooted ROM and stock recovery, in order to OTA update (there are guides on this forum). This would remove any modification by TWRP.
But that's mostly just FYI/academic. Its extremely unlikely we'll get an OTA update to Nougat. Your best bet for Nougat will be custom ROMs, anyway.

1. UNLOCK bootloader with HTC Dev site.
2. Flash latest twrp recovery
3. Flash Stable v2.65 SuperSU
4. Flash wp mod.
5. Update SuperSU on Play Store.
Latest SuperSU 2.76 zip kills Boomsound. Permissive zip can fix that.

Need help rooting device

Hi,
As the title says, I need help rooting a Xiaomi Mi A2 Lite device, that is updated to Android 9.
I tried rooting it, but the issues are:
1. It needs unlocking the device first, so I tried going to - //en(DOT)miui.com/unlock/.
There it wants me to connect my device to my Mi account in Setting > Developer Options > Mi Unlock Status. Thing is that this device is using one of the ROM versions, which doesn't have Mi Unlock Status.
2. This led me to try and update the ROM. Issue here is that doing so through the fastboot is not possible because the device needs to be unlocked, so I tried this - //en(DOT)miui.com/a-232.html
3. From there on, everything is fine until step 3. In android 9, they have decided to move the System Update to another table, which is fine but there are no longer 3 dots or an option to select a package. I tried looking for that without success.
4. Downgrading to Android 8 is not possible anymore, and I haven't really checked if I can do it with a locked phone.
Can someone help me find what I am missing here? There must be a way I can root the device.
Thank you!

developer options , unlock oem, boot to bootloader and type fastboot oem unlock, its that simple. All you nee to do after this is follow a tutorial for rooting with magisk.

My friend you were following the wrong guide. This is an Android One device you don't need the unlock procedure that the other MIUI device have to do.
As mentioned above the unlocking is straight forward, however the steps following can be a bit more confusing.
Basically there are different methods on how to actually gain root access, the most popular and recommended one would be using a framework/app called Magisk.
Download the magisk manager from the app store and more importantly check exactly your build number in your phone settings as you will need a patched boot.img file for exactly that build (here you can either download the patched boot from one of the thread here but its more safe to actually patch the original boot.img yourself).
However most of the stuff is written in this thread, it's only missing the updated boot files for Android Pie.
I recommend you to patch the boot from the official Rom files (for example for Pie 10.0.2.0 here and patch it via magisk manager yourself)

Thank you all. I managed to root it.
1. Not entirely sure how the unlock went but it was successful. I tried the fastboot oem unlock. I think that did it.
2. Got TWRP on the fastboot and installed Magisk
3. Root access was granted, data got wiped twice though, but the second part was my fault.

Help! Bootloop Nightmare!

I was trying to root/custom rom/etc in a hurry and I was interrupted a million times, so I screwed up. SM-N910v. I started out on kitkat, 4.4.1. I tried this guide: https://forum.xda-developers.com/no...t/howto-bootloader-unlock-upgrade-to-t3398144
I odin N910VVRU2BPA1_N910VVRU2CPD1_FullFirmware.tar.md5. That upgraded me lollipop 5.5.1. I then follow a guide similiar to this: https://forum.xda-developers.com/no...asy-guide-how-to-root-verizon-galaxy-t3454593
Its not the exact one, but there is several guides that are the same. I temporary rooted with kingoroot, installed TWRP. One of the guides said not to let it boot normally, so I freaked out and made sure I didn't do that. I booted back into twrp. Using this guide: https://forum.xda-developers.com/note-4-verizon/development/cyanogenmod-t3253973
I can't remember or find the exact guide I was on... But I flashed these files in the following order:
BETA-SuperSU-v2.71-20160331103524.zip
Emotion-TW-5.1.1-nightly-r21-RC1-SM-N910P.zip (this was really dumb)
cm-13.0-20160919-UNOFFICIAL-trltevzw.zip
I tried to boot, I left it on for atleast 30 mins, and the clockworkmod logo kept animating abnormally fast.
I then installed N910VVRU2BPA1_N910VVRU2CPD1_FullFirmware.tar.md5 again (... doh ...).
Now it bootloops.... so I said.. 'ok, maybe I just need my TWRP recovery back'. Tried to install TWRP and fail....
I can boot into safe mode fine, but not normal mode. The problem with safe mode is you can't install apps.
I've tried factory reset, wipe cache, dalvik, etc etc. Nothing. I've also tried a different firmware I believe as well.. I am lost...
Current Android Info:
5.1.1
security patch level: 2015-12-01
baseband version: N910VVRU2CPD1
Kernel version: 3.10.40 Jan 20 2016
Build Number: LMY47X.N910VVRU2BPA1
The information above indicates that I am still in this version: N910VVRU2BPA1_N910VVRU2CPD1_FullFirmware.tar.md5
Ok so.. I just odin this file N910VVRU2BPA1_N910VVZW2BPA1_N910VVRU2BPA1_HOME.tar.md5
Same story, I can boot into normal mode, but not safe mode.
I check my info:
5.1.1
security patch level: 2015-12-01
baseband version: N910VVRU2BPA1
Kernel version: 3.10.40 Jan 20 2016
Build Number: LMY47X.N910VVRU2BPA1
Factory reseting now... and seeing if that fixes my problem... nope... same bootloop problem...
my thinking is... if I undo "samsung_unlock_n4-fix" and that would fix my bootloop. If thats true..... I guess my biggest question is: if the boot loader is unlocked, then why can't I flash TWRP like I was able to the first time??
I appologize, I will be unaviable for the next 5 or 6 days..... any help would be much appreciated!

I followed Max Lee's guide on youtube for rooting/unlocking the bootloader I recommend downloading the files he has linked, just ensure that your phone is the SM-N910V the hardest part or more time consuming part is getting kingo root to get you that temporary root needed to unlock your bootloader/root phone. Kingo root is very unstable and your phone will freeze/restart many times, You definitely need a spare sd card, at least a 2GB from my experience and patience, set aside a few hours because your follow through is crucial. If all goes well you will be able to install TWRP. I hope this helps. Tip, if you decide to follow his method, the file titled 'samsung_unlock_n4-2' you need to rename it to say 'samsung_unlock_n4-fix' good luck!

UmbrellaTakedown said:
I followed Max Lee's guide on youtube for rooting/unlocking the bootloader I recommend downloading the files he has linked, just ensure that your phone is the SM-N910V the hardest part or more time consuming part is getting kingo root to get you that temporary root needed to unlock your bootloader/root phone. Kingo root is very unstable and your phone will freeze/restart many times, You definitely need a spare sd card, at least a 2GB from my experience and patience, set aside a few hours because your follow through is crucial. If all goes well you will be able to install TWRP. I hope this helps. Tip, if you decide to follow his method, the file titled 'samsung_unlock_n4-2' you need to rename it to say 'samsung_unlock_n4-fix' good luck!
Click to expand...
Click to collapse
I appreciate your post. However I don't think you quite understand whats going on.
https://galaxynote4root.com/cwmtwrp-recovery/
His site specifically states: "Verizon SM-N910V unless you have a developer’s edition phone as retail version come with locked bootloaders meaning you cannot install regular CWM or TWRP!!!"
It also shows that comment in the video. I definitely DO NOT have the developers edition.
In summary: I flashed the firmware that has the bootloader unlock vulnerability->Installed twrp->Installed CWM->Installed Firmware with bootloader vulnerability, which replaced everything I did. Now it seems like the bootloader is re-locked, and I can't boot into normal mode, which means I can't run kingo again. I can't flash TWRP, the only things I can do are: adb sideload, odin, boot any 5.1.1 in safe mode.

TouchOdeath said:
I appreciate your post. However I don't think you quite understand whats going on.
https://galaxynote4root.com/cwmtwrp-recovery/
His site specifically states: "Verizon SM-N910V unless you have a developer’s edition phone as retail version come with locked bootloaders meaning you cannot install regular CWM or TWRP!!!"
It also shows that comment in the video. I definitely DO NOT have the developers edition.
In summary: I flashed the firmware that has the bootloader unlock vulnerability->Installed twrp->Installed CWM->Installed Firmware with bootloader vulnerability, which replaced everything I did. Now it seems like the bootloader is re-locked, and I can't boot into normal mode, which means I can't run kingo again. I can't flash TWRP, the only things I can do are: adb sideload, odin, boot any 5.1.1 in safe mode.
Click to expand...
Click to collapse
I did not have a developers edition either, I have retail, this method makes your phone into the developer edition. This method is designed for verizons note 4. So what i'm saying is, I followed his method using a retail note 4 branded verizon and this exploit makes it into a developers edition so you may install twrp and roms. You are able to odin flash stock firmware for marshmallow and then downgrade to 5.1 to run max's method.

Ok so.. I managed to get everything working... so I'm happy. Thank you UmbrellaTakedown for invoking thought and thank you for replying, your the only person who replied, so much appreciated!
1. Boot into safe mode
2. Install app by: adb install c:\kingoroot.apk
3. At this point, its installed but the launcher needs to be refreshed for the icon to show up. I don't know how to refresh the launcher without a reboot.. so...
4. Find the kingoroot package name: adb shell 'pm list packages -f'
5. In my case it said: package:/data/app/com.kingo.root-1/base.apk=com.kingo.root So your answer is: com.kingo.root
6. Now in order to launch kingo, you need to find the activity of the package: adb shell pm dump PACKAGE_NAME | grep -A 1 MAIN
7. Start the activity: adb shell am start -n com.kingo.root/com.kingoapp.root.MainActivity
From here I was able to temp root through kingo, and run samsung_unlock_n4-fix. This time I had to only run samsung_unlock_n4-fix once. After that, TWRP installed no problem (where before it would not).
Update:
I am now officially on Jasmine ROM marshmallow. I had to copy the jasmine folder to /data/media/0/TWRP/BACKUPS/xxxx/jasmine
xxxx= you get that from adb devices
Then simply do a restore, after restore, restore the partial firmware file (it has to be done in that order or else it won't work)

TouchOdeath said:
Ok so.. I managed to get everything working... so I'm happy. Thank you UmbrellaTakedown for invoking thought and thank you for replying, your the only person who replied, so much appreciated!
1. Boot into safe mode
2. Install app by: adb install c:\kingoroot.apk
3. At this point, its installed but the launcher needs to be refreshed for the icon to show up. I don't know how to refresh the launcher without a reboot.. so...
4. Find the kingoroot package name: adb shell 'pm list packages -f'
5. In my case it said: package:/data/app/com.kingo.root-1/base.apk=com.kingo.root So your answer is: com.kingo.root
6. Now in order to launch kingo, you need to find the activity of the package: adb shell pm dump PACKAGE_NAME | grep -A 1 MAIN
7. Start the activity: adb shell am start -n com.kingo.root/com.kingoapp.root.MainActivity
From here I was able to temp root through kingo, and run samsung_unlock_n4-fix. This time I had to only run samsung_unlock_n4-fix once. After that, TWRP installed no problem (where before it would not).
Update:
I am now officially on Jasmine ROM marshmallow. I had to copy the jasmine folder to /data/media/0/TWRP/BACKUPS/xxxx/jasmine
xxxx= you get that from adb devices
Then simply do a restore, after restore, restore the partial firmware file (it has to be done in that order or else it won't work)
Click to expand...
Click to collapse
Just an FYI, you need to run the sasmung_unlock_n4 application twice. The first time, it will write your eMMC CID to the correct one, and the second time you execute, it will write the CID signature/blob to the bootloader - completing the unlock process. Glad to see you got it working.

Any way to root this thing?

Bought this to replace an LG V20. Was really looking forward to transferring everything using Swift Backup but it requires root access. Googled for a guide or instructions but nothing. Kingo Android Root gives me Connection Server Failed, and KingRoot gives me no option to even perform the operation. Need some help here since root access opens up many of the apps that I use. Thank you!

You need to extract the boot image from an OTA, patch it in the Magisk app, and then fastboot flash boot.img after unlocking the bootloader.

Is it that easy? I got one a month back. I got the android 11 update and now it’s time to root. i have heard it was tough to root but I just really started checking for a good clean process.

pdnorman said:
Is it that easy? I got one a month back. I got the android 11 update and now it’s time to root. i have heard it was tough to root but I just really started checking for a good clean process.
Click to expand...
Click to collapse
Yes, it shouldn't be that hard. As long as full OTAs can be found, and the bootloader can be properly unlocked, it should just work. Lmk

NateDev said:
You need to extract the boot image from an OTA, patch it in the Magisk app, and then fastboot flash boot.img after unlocking the bootloader.
Click to expand...
Click to collapse
Not possible. Every single update so far is a patch update that only comes with parts of files. No update so far has given the ability to get a full boot.img to patch, hence why there's no root. I have downloaded every update so far, so far no full boot.img
Also, at least on US models, there's zero ways to unlock the bootloader. I contacted their customer service about it and they stated they don't give out info on how to unlock it