Root [TWRP + Magisk] kills device Security :: Pin/Fingerprints broken - Samsung Galaxy Note 9 Questions & Answers

Hello XDA, I'm going to keep this short and sweet - I was able to root my device using the TWRP + Magisk method and some online guides. I believe after experimenting and flashing over the weekend, there is a bug, race condition, or something that prevents bio metrics and security from properly working on the Note 9.
If I set a pin, as it's required for me to add my fingerprints - when I later try to unlock the phone, the device will say the wrong pin. Deleting the cache, reading guides etc will only get you in a bootloop.
I'm in a state right now where I'm rooted with no device security, as adding a pin will effectively brick the device until flashing with Stock Android again.
_______
I was able to root last week Friday. I didn't bother setting a pin as I was happy to have root. Yesterday, I decided to go ahead and set my pin and soon enough, was prompted to use it to disable security.
I really thought I had mistakenly confirmed a stray character in my pin, and after toying, researching, and flashing my device over the weekend, Ive come to a crux where I could use some expert assistance.
Some guides I used had links to an RMM disabled or some ****, another guide had two zips for a different type of disabler. I'm not linking them, because apparently none of them work, but I believe this is where the problem lies. I think one of the zips is to remove the OEM Integrity Check or some **** Samsung wrote to secure the device. One of the packages I flashed took all those packages but nothing has worked.
Setting your pin during setup, or later in settings yields the same results - you will lock yourself out until you flash Stock Android to restart the process.
We're almost there guys, just need to be able to lock my device like a normal cellhpone user - thank you

dekalbcountyman said:
Hello XDA, I'm going to keep this short and sweet - I was able to root my device using the TWRP + Magisk method and some online guides. I believe after experimenting and flashing over the weekend, there is a bug, race condition, or something that prevents bio metrics and security from properly working on the Note 9.
If I set a pin, as it's required for me to add my fingerprints - when I later try to unlock the phone, the device will say the wrong pin. Deleting the cache, reading guides etc will only get you in a bootloop.
I'm in a state right now where I'm rooted with no device security, as adding a pin will effectively brick the device until flashing with Stock Android again.
_______
I was able to root last week Friday. I didn't bother setting a pin as I was happy to have root. Yesterday, I decided to go ahead and set my pin and soon enough, was prompted to use it to disable security.
I really thought I had mistakenly confirmed a stray character in my pin, and after toying, researching, and flashing my device over the weekend, Ive come to a crux where I could use some expert assistance.
Some guides I used had links to an RMM disabled or some ****, another guide had two zips for a different type of disabler. I'm not linking them, because apparently none of them work, but I believe this is where the problem lies. I think one of the zips is to remove the OEM Integrity Check or some **** Samsung wrote to secure the device. One of the packages I flashed took all those packages but nothing has worked.
Setting your pin during setup, or later in settings yields the same results - you will lock yourself out until you flash Stock Android to restart the process.
We're almost there guys, just need to be able to lock my device like a normal cellhpone user - thank you
Click to expand...
Click to collapse
did you encrypt your device? when you reboot, do you see an animation of a pad lock?

bober10113 said:
did you encrypt your device? when you reboot, do you see an animation of a pad lock?
Click to expand...
Click to collapse
Bober, first of all thanks for taking YOUR TIME to respond - as a senior member I feel like we can make progress
No, my phone is not encrypted - there is no lock when booting up, just the Stock Samsung animation
I do not use any system encryption or anything like that. I’m a hardware first guy, and use a suite of my own private encrypted cloud software
I played with my Note 9 before I rotted cow TWRP + Magisk - all tutorials out there mentioned flashing various encryption/security zips which I have - I think those zoos are geared for Knox
After you root the phone, you cannot set any type of biometric security or pin or you will be stuck in a bootloop/lock loop as the device is unable to authenticate your pin

dekalbcountyman said:
Bober, first of all thanks for taking YOUR TIME to respond - as a senior member I feel like we can make progress
No, my phone is not encrypted - there is no lock when booting up, just the Stock Samsung animation
I do not use any system encryption or anything like that. I’m a hardware first guy, and use a suite of my own private encrypted cloud software
I played with my Note 9 before I rotted cow TWRP + Magisk - all tutorials out there mentioned flashing various encryption/security zips which I have - I think those zoos are geared for Knox
After you root the phone, you cannot set any type of biometric security or pin or you will be stuck in a bootloop/lock loop as the device is unable to authenticate your pin
Click to expand...
Click to collapse
Are you using Snapdragon or Exynos?

mmjs14 said:
Are you using Snapdragon or Exynos?
Click to expand...
Click to collapse
Sir, I am using a
Galaxy Note 9
SM-N960F Internationals Unlocked
Alpine White
Exynos
Boot loader is TWRP and OEM Unlock is staying open permanently
I have all the hardware required, just need to overcome this software quirk so I can lock my phone when I’m not using it

dekalbcountyman said:
Bober, first of all thanks for taking YOUR TIME to respond - as a senior member I feel like we can make progress
No, my phone is not encrypted - there is no lock when booting up, just the Stock Samsung animation
I do not use any system encryption or anything like that. I’m a hardware first guy, and use a suite of my own private encrypted cloud software
I played with my Note 9 before I rotted cow TWRP + Magisk - all tutorials out there mentioned flashing various encryption/security zips which I have - I think those zoos are geared for Knox
After you root the phone, you cannot set any type of biometric security or pin or you will be stuck in a bootloop/lock loop as the device is unable to authenticate your pin
Click to expand...
Click to collapse
ive never seen this. what firmware are you on?
have you tried to download the very latest and completely wipe your phone? use samfirm tool 0.3.6 do dl the latest.
fill up all the slots with the md5 files u dled with samfirm and flash using odin( in csc slot use csc.md5 instead of home_csc.md5.)
go dl
magisk zip:
https://github.com/topjohnwu/Magisk/releases/download/v19.2/Magisk-v19.2.zip
and apk:
https://github.com/topjohnwu/Magisk/releases/download/manager-v7.2.0/MagiskManager-v7.2.0.apk
ketan oem fix +root
https://www.androidfilehost.com/?w=files&flid=281291
once back on latest stock firmware root again using twrp 3.2.x.x tar
flash it with odin but go to option and uncheck autoreboot
and flash twrp.tar in the AP slot.
once successful, manualy reboot phone to recovery( dont let it boot to homescreen! so hold vol up + Bixby +power
once in twrp swipe to get in recovery. go to wipe button and Format ( type yes) and go to reboot button and choose reboot to recovery
once back to recovery go again to wipe button and choose factory wipe.
once done flash dr ketan oem and root zip. ( within the aroma setup of that zip choose yes to both option for root and kernel)
once finished you can now flash the latest magisk.zip as dled earlier.
now reboot and setup your device. once done you can install magisk manger .apk that was dled earlier.

Bober, I did your steps exactly as described and used the links you provided and got it working w/ Biometric Security
I've flashed my phone like 20 times so the process took like 15 minutes max - this was also the first time I flashed all the files in the firmware download. Other guides out there tell me I only need to load the AP slot when flashing for this phone.
The "ketan oem fix +root" is the only security/system level zip I flashed using TWRP - besides looking like an early 2000s rootkit, the Terms of Use had an old version listed and said the binary was from 2015
I couldn't take screens, but everything went well when I checked the version
Thank You so much - in the future, will this root method hold for the life of the Note 9? Like when the new Android after Pie is released, will it be as simple as
1. Backing Up Phone
2. Flashing Android 10 Stock via Odin
3. Reflashing TWRP and Rooting
or is there a more streamlined approach to this? Thanks mate

dekalbcountyman said:
Bober, I did your steps exactly as described and used the links you provided and got it working w/ Biometric Security
I've flashed my phone like 20 times so the process took like 15 minutes max - this was also the first time I flashed all the files in the firmware download. Other guides out there tell me I only need to load the AP slot when flashing for this phone.
The "ketan oem fix +root" is the only security/system level zip I flashed using TWRP - besides looking like an early 2000s rootkit, the Terms of Use had an old version listed and said the binary was from 2015
I couldn't take screens, but everything went well when I checked the version
Thank You so much - in the future, will this root method hold for the life of the Note 9? Like when the new Android after Pie is released, will it be as simple as
1. Backing Up Phone
2. Flashing Android 10 Stock via Odin
3. Reflashing TWRP and Rooting
or is there a more streamlined approach to this? Thanks mate
Click to expand...
Click to collapse
actualy the root method that dr ketan created is just a way to bypass an issue that not all phones have(rmm state aka binaries error when booting.
but technically the method should be;
flash twrp, format, reboot again to recovery and flash official magisk .zip
you can also rely on rom developpers to flash their version instead of stock android via odin. this allows you to not always have to go through the twrp/root procedure each time and also rom devs include nice additional features.
anyways glad i could help.

Related

[GUIDE] Unlock bootloader, root the device and install any custom ROM! (ALE-L23/21)

Hi all! So, you have a P8 lite in your pocket and you hate EMUI? Well, that was my case too, it's uncustomizable, ugly, and removes plenty of features from android stock. I do not like it one bit, and I like even less the fact that this phone is getting no more updates, ever. This sucks, it all sucks, luckily we can say "F all that" and do whatever we want with this device, provided you follow this guide.
I am making this guide because I want to condensate every single thing I know about this device in one single thread. One big guide to help all of you out installing custom ROMs. Without this, you would have to do research along multiple threads, often with conflicting information, and what's even worse, DEAD LINKS! There's nothing more frustrating than finally finding the solution to your problem, just one download away, just to be greeted by a dead link, and you would need to scout for another file that may or may not work... ugly stuff.
So, the point of this is to bring up to date info so you can make this device rock. This guide assumes you have Huawei's EMUI 4.0 installed which runs on Android 6.0. I'm also assuming you have your bootloader locked, and I will explain how to unlock it FOR FREE. No need to pay to some shady site in order to access what effectively belongs to you.
These are the requirements for this guide:
Code:
#USB cable
#A PC
#Some charge on the device to ensure nothing goes wrong
#An SD Card
#Patience
Before beggining, a quick disclaimer:
Code:
#It's not my objective to break your device, however there's always a risk when doing these kind of things.
#When you follow this guide's steps your are accepting the risks and are taking full responsiblity for whatever may happen to your device.
#Don't blame me for breaking your stuff if that happens, all I'm listing here worked for me, and should work for you.
#I won't be babysitting anybody to help solve their specific problems, don't PM me asking me why X doesn't work.
#I am unaware if this works in other versions of this device, but I'm positive this works on both ALE-L23 and ALE-L21
#If you have a "CAM-XXX" device, it's highly likely this works for you too, but as with everything, TRY AT YOUR OWN RISK.
#YOU HAVE BEEN WARNED!
Ok, so let's begin. As the title says, the guide is applicable to any custom ROM. However, I will be installing Lineage OS 14.1 which runs on (almost stock) Android 7.1.2. Regardless, the final step where we install the custom ROM is interchangable, and you can use whichever you please.
This process WILL wipe all of your data (except SD card). Make sure to make a backup of everything you want to save (app configs, photos, videos and whatever else).
1. DOWNGRADING TO ANDROID 5
As you may know, Huawei has stopped providing bootloader unlock codes for very stupid reasons. This has led to many unable to unlock their bootloader and having to pay for third party apps in hopes they don't get scammed. There are some trustworthy sites where you can get these at a fee tho (mainly DC Unlocker at 4 bucks), so if you want to pay up to avoid having to downgrade to Android 5, you can do so. However, I understand that you may not want to pay at all, I didn't want to either.
To get the bootloader unlock code, we need root, and to get root, we need Android 5. Why? Because getting root in Android 6 requires us to flash some zips, and for that we need TWRP, and for that we need an unlocked bootloader, everyhing closes up very nicely. So, we have no choice but to downgrade.
An SD card is not needed for this process, but it is going to be required at a later point, so why not use it now too?
NOTE: It may be a good idea to make a factory reset at this point, to avoid issues. For that, do the following:
Turn your phone off.
Boot the phone by holding the power button and the volume up button at the same time.
Wait untill the Huawei logo appears, then let go of both buttons.
You should be in recovery mode, navigate with the volume keys to the "Wipe data/factory reset" option.
Select it with the power button and wipe everything.
Reboot the device with the option in the menu.
Once the device has booted up, follow the guide.
Alright, once that's done, connect your phone to the PC to transfer some files:
NOTE: There's two Stock Android 5s downloads ("HW_Android_5_Transition.zip" and "HW_Stock_Android_5.zip"). One is a transition package, as the name implies, and the other is Huawei's EMUI 3.1 in all of it's glory. What's the difference? The transition package is a much smaller file that is designed to downgrade the phone from EMUI 4.0 (Android 6) to EMUI 3.1 (Android 5). If you are running EMUI 4.0 (which should be the case) then you can use the transition package which will take less to download. If you have another version (i.e. EMUI 4.1) you should use "HW_Stock_Android_5.zip". However, the latter is the safe bet. If you are not sure which one to use, use "HW_Stock_Android_5.zip". The process is exactly the same for both packages.
Extract the "UPDATE.APP" file from "HW_Stock_Android_5.zip" or "HW_Android_5_Transition.zip".
Navigate to your phone's internal memory or SD card (whichever you want to use) and locate a folder called "dload". If there's not one, create it.
Put the "UPDATE.APP" file inside of the "dload" folder.
Turn your phone off.
Once it's off, press the power button and the two volume buttons until you see the Huawei logo.
That should make the phone recognize the "update" and start flashing it. Once it finishes, it will try to boot by itself, so pressing those 3 buttons was your last input until the phone boots into Android 5. It will take a long time for it to both finish and boot, don't be afraid, the phone is not bricked. If you think the phone is indeed bricked because it has been stuck at the logo screen for way to long (longer than an hour) then proceed to the "Unbricking" section of this guide. However, it's highly unlikely that this will happen, as Huawei checks the file before flashing it, so if it's incompatible with your device it should not do anything and boot again into Android 6 with everything untouched.
2. ROOTING ON ANDROID 5 AND EXTRACTING BOOTLOADER UNLOCK CODE
Once you are in Android 5, we will need to root the device. Download KingRoot (proved to work) or another one click root app of your choice. I'm aware of KingRoot's bad reputation because of the spyware accusations, but the phone will be wiped anyway and we are sure it works, so it doesn't really harm at all. If you still don't want to use it, check with other apps, I haven't done so myself so I don't know what else works.
Once your phone is rooted, we will need to use the terminal for the first time. We will need to setup ADB and Fastboot, if you already have that, skip this step.
Extract the "platform-tools" folder from the zip and place it somewhere nice.
Shift right click on a blank space INSIDE of the "platform-tools" folder.
Select "Open command window here".
This should be enough to get ADB working, but we need to make some config on the phone itself too.
Go to Settings -> About Phone
Look for a line that says "Build Number" and tap it multiple times.
When the message saying "You are now a developer" pops up, go back and enter the new "Developer Options" menu.
In there, look for an option called "USB Debugging" and turn it on.
Connect the phone to your PC via USB cable.
A message should have popped up on the phone asking for permission to use USB Debugging, tap on "Always allow from this PC" and then on "Allow".
NOTE: If the message doesn't pop up, you can try a number of things. I prefer to tap the "Revoke USB debugging authorizations" button to ensure that no PC is authorized, so the message must pop up at some point. Once you revoked authorizations, disconnect and connect the phone again, if you still don't see it, try to select MTP as the transfer protocol. If not, then PTP, if you still don't see it install Hi Suite on your PC and open it, it should pop up now.
Once you have everything working, type the following in the terminal in your PC:
Code:
adb devices
If you see a serial number there, that's your phone, and that means everything is set up correctly (make sure you don't have any other device attached to your PC, or you could confuse the two and make bad stuff happen for that other device). If you don't see it, make sure USB Debugging is enabled. You can try to use different cables if you still have problems. Now type:
Code:
adb shell
And then:
Code:
su -c "grep -m1 -aoE 'WVLOCK.{14}[0-9]{16}' /dev/block/mmcblk0p7 |grep -aoE '[0-9]{16}'"
KingRoot (or the app you used to root) should prompt you (in your phone) if you want to give ADB root access, make sure to allow it to make this work. This should give you your unlock code. SAVE IT INTO A TXT FILE AND COPY THAT FILE TO ALL OF YOUR PCS, ALL OF YOUR CLOUD ACCOUNTS AND ALL OF YOUR MOBILE DEVICES.
(Maybe the terminal gets stuck at this point, press CTRL + D (or C) to get it unstuck).
Seriusly tho, it didn't happen to me, but it is a possibility that your Bootloader can re lock after doing some of the things that follow, in which case you will need to unlock it again, and if you don't have that code... it's back to square one.
3. GOING BACK TO ANDROID 6
Now that we have done all that we wanted on Android 5, it's time to go back. The process is exactly the same.
Extract the "UPDATE.APP" file from the "HW_Stock_Android_6.zip" file and move it to the dload folder (SD card or Internal).
Turn off your phone and turn it on again with all three buttons pressed.
Wait.
???
Profit.
So, we're back on Android 6. Why did we go back you may ask? Why did we not just flash our precius custom ROM? Well, for once, this gives people the chance to stay on EMUI if all they wanted was to unlock the bootloader and maybe root on Android 6 (which I will explain how to do too, in case you want to). Another, more important reason, we need Android 6 to install the B895/B896 update, which is a requirement for any custom ROM (mainly Android 7.0+) if you don't want any problems with your SIM card (and others that may arise).
4. UNLOCKING BOOTLOADER AND FLASHING TWRP
Now, we need to turn on USB Debugging again, and to allow our PC... again. Do so, and check that everything is right with:
Code:
adb devices
If that's the case, then type the following:
Code:
adb reboot bootloader
Your phone will reboot, and you should see a white screen with a wasted android above a green text saying "PHONE LOCKED". If that's the case, take a moment to say goodbye to that green text, because it will soon turn very red. We will need to unlock the bootloader with the code you got from the previous steps, for that type the following:
Code:
fastboot oem unlock ****************
In place of the "****************" you must enter your code, of course. And that was it, now the green text is replaced with a red "PHONE UNLOCKED". This are good news. Now, we need to flash our custom recovery if we want to do anything fancy with the device. For that, extract the "recovery.img" file from the "TWRP_3.1.1.zip" file and paste it into the same folder where all of the ADB files are located (where "adb.exe" is). Now type:
Code:
fastboot flash recovery recovery.img
This will flash TWRP into your device, hooray! Now type:
Code:
fastboot reboot
And your device should turn back on, today is a bright day my son. Now you must take a decision, do you want to flash a custom ROM and get very nice and fancy features or do you want to stay with what you have? If you prefer Huawei's EMUI 4.0, then follow to the next step. If you want to flash custom ROMs, then skip the next one.
5. ROOTING ON ANDROID 6 (OPTIONAL)
I don't know why you would prefer EMUI over... anything else really, but it's your call. I'll tell you how to root it so you can at least take some advantage of it. You see that file called "HW_Android_6_Root.zip"? Extract it, inside there will be... another folder called Root... huh? Redundant. Anyway, inside of that there should be two zips. 1.zip and 2.zip. You will need to place the folder called "Root" inside of your SD card or your internal storage. Then, go back to the terminal and type:
Code:
adb reboot recovery
You should reboot into TWRP, isn't it nice? Anyway, we have to flash some zips! Go to "wipe" first and wipe the "Cache" partition and the "Dalvik" partition. Once that's done, go to install and navigate to the Root folder your placed... well, you know where. Select 1.zip and flash it, once it's finished reboot the device. If TWRP prompts you to install it's app, DO NOT DO IT. Once the phone has rebooted (it will take longer because of the cache and dalvik wipe), repeat the process but flash 2.zip this time, reboot and your phone should be rooted. This is the end of the line for you now, as you don't want to make anything else to the phone. However, you can go to the final chapter where I explain how to install Xposed framework, if you want more customization. EMUI doesn't like Xposed very much, so there's little you can do with it, but it's something I guess.
6. INSTALLING THE B895/B896 UPDATE
So, you followed the power user path, the one we all really want deep down. That's cool, I respect you. We gotta use that custom recovery we just flashed, but first we need to transfer some files into our phone's memory. We need to install an update to the phone, for which you need Android 6 (that you should already have anyway). There's two different updates, B895 and B896. As you may guess, B896 is newer. However, any of these two will (or rather should) work without issues. I personally used B896, but some people claim B895 is more stable. I can't find a difference really, but the process is the same regardless of which you choose. Once you have made that decision, move "B895_update.zip" or "B896_update.zip" to your phone's internal storage or SD card AS IS (don't extract it). Then type into the terminal:
Code:
adb reboot recovery
You should be in TWRP now. Go to wipe and select the "Cache" and "Dalvik" partitions ONLY, then wipe them. Once that's done, go to install and flash your update of choice. Once finished, reboot the device. If TWRP prompts you to install it's app, DO NOT DO IT. The boot should take longer than usual because of the "Cache" and "Dalvik" wipe... and because of the update too. Once booted, you should be in EMUI 4.1. Go to settings and into "About Phone". In there, look for a field called "IMEI". If you see a number, that means you did everything properly, if you see "unkown" or nothing at all, then that means you lost your IMEI... which means you will have connectivity issues. To fix this, you will need to do a full wipe (so, boot into recovery (we lost TWRP due to the update) and then go to wipe, in there select everything except SD card) and follow the steps again starting from 3, this time flashing the other update (so if you flashed B895, flash B896 this time and vice versa)).
Now, this last step we made has wiped our custom recovery... so sad. We have to flash it again, but we are almost finished!! Now it's time for you to move the custom ROM you want to your SD card (SD card is mandatory, as we will wipe internal storage). You should also move your custom ROM of choice. If you want root, also move the "SuperSUv82.zip" file.
OPTIONAL:
If you want Gapps, that means the Google apps, so PlayStore, Google services and such (and you really should want them, as Android without PlayStore is kinda rough), then you need to download them separately.
So, go to the Gapps website and select the pacakge you want. You NEED to choose the ARM64 platform, the android version depends on the ROM you are flashing, so check which version it runs, and the package itself is personal preference. Here you can see a comparison of each package, detailing what each one contains so you can make a decision. The aroma package is kinda bugged, I would avoid it. Choose wisely, as flashing another Gapps package once you have flashed a different one can and most likely will cause issues. If you want my opinion, I would stick to the nano package. It offers the basic Google functionality and allows you to download other Google apps you may need/use with the PlayStore once you are booted up.
Once you choose your package, move it to your phone's SD card along with the ROM and the SuperSU zip if you want it.
Check that USB Debugging is still enabled, and then type:
Code:
adb reboot bootloader
Once into the bootloader, flash the custom recovery once again with:
Code:
fastboot flash recovery recovery.img
Then:
Code:
fastboot reboot
Once booted up again, type:
Code:
adb reboot recovery
And now it's time to drop the bomb, say bye bye to EMUI, and say hello to... whatever it is you are installing.
7. FLASHING YOUR CUSTOM ROM OF CHOICE
MOST CUSTOM ROMS REQUIRE AN LTE CAPABLE SIM IN ORDER TO HAVE CELLULAR NETWROK WORKING CORRECTLY, THIS DEPENDS ON A ROM TO ROM BASIS, DO YOUR RESEARCH BEFORE FLASHING
Once in TWRP, go to wipe and check every box, I'm serius, check everything except the SD card. Once that's finished, the moment of glory has come. Go to install and flash your ROM. It will take a while, and when that's done reboot. The phone should boot into your ROM. If you want either Gapps or SuperSU, make a quick setup and enable USB Debugging again, then reboot to recovery with:
Code:
adb reboot recovery
Once in TWRP, go to install and flash the Gapps package and the SuperSU zip (in that order) if you want it. Reboot. That should be it! You are done!
8. UNBRICKING
I don't know why, but with all the flashing and the testing I've done you would have thinked that I should have suffered of a brick state at least once... that was, luckily, not the case. I haven't suffered a single brick. I don't know if I'm extremely lucky or if this phone is tremendously resilient, but the case is I haven't had any issues of this kind.
However, I can understand that it is a possibility, so if this happens to you my best advice is to do the following: Boot into recovery mode (either stock or TWRP depending on where in the whole process you got stuck), make a full wipe and apply the update from "HW_Stock_Android_6.zip" with the dload folder and the three buttons method. That should get it unstuck, if not... try the same with the "HW_Stock_Android_5.zip" 's "UPDATE.APP".
9. INSTALLING XPOSED FRAMEWORK (OPTIONAL)
What? A custom ROM is not enough for you? Getting freed from EMUI is not enough? Well fear not then, because there's one last step for the true power user, for that man who thinks that everything is not enough, the good old Xposed Framework *queue fireworks and trumpets.
So, you need to install the Xposed Installer apk. Get it from here, and ONLY THERE. I once installed an apk from another source... ended up being adware, not fun. The apk is at the very bottom of the thread. You will also need the framework itself, get it from here.
Get the latest (arm64) version for your ROM. This depends on what Android version it is running on:
Code:
SDK21 = Android 5.0
SDK22 = Android 5.1
SDK23 = Android 6.0
SDK24 = Android 7.0
SDK25 = Android 7.1
SDK26 = Android 8.0
SDK27 = Android 8.1
You should also get the uninstaller in case things go south.
Once you got the files, install the apk on your phone. Open the app once. Transfer the framework and the uninstaller into your SD or internal storage. Boot into TWRP recovery and install the framework, reboot the device.
NOTE: Android 6.0 takes about 20 mins to boot, wait about an hour before deciding that it's bricked. Android 7.1.2 took me about 2 mins. I'm unaware of the boot times of other versions, but be aware that it can take LONG. If you think it really got bricked, boot into TWRP again and flash the uninstaller. That should get it unstuck and you can either try again or leave it as is.
----------------------------------------------------------------------------
Well guys, that's all I got, quite a big write up huh? I don't really have nothing else to say, just remember that what you are doing here is at your own risk and I don't want anybody blaming me for the bad things that can happen. I will proceed to leave you with the download links so you can try this yourself. I'm currently running Lineage OS 14.1 which features Android Nougat 7.1.2 on my Huawei P8 lite ALE-L23, I've never been happier to be free from the manufacturer's ROM.
DOWNLOADS
(The B895 and B896 update's links are not mine)
Huawei's Stock Android 5:
Android Filehost
Mediafire
Huawei's Android 5 Transition:
Android Filehost
Mediafire
Huawei's Stock Android 6:
Android Filehost
Mediafire
Huawei's Android 6 Root:
Android Filehost
Mediafire
EMUI 4.1 (B895):
Android Filehost
EMUI 4.1 (B896):
Android Filehost
Platform-Tools:
Android Filehost
Mediafire
TWRP 3.1.1:
Android Filehost
Mediafire
Gapps:
Open Gapps
SuperSU:
Android Filehost
Google Drive
Hi,
I didn't understand what do you mean whan you write: Once booted, you should be in EMUI 4.1. If you retained your IMEI, you are in good path, if not... then do a factory reset (wipe everything) and repeat the steps starting from 3.
Could you explain it better?
Thank you
ilmatte said:
Hi,
I didn't understand what do you mean whan you write: Once booted, you should be in EMUI 4.1. If you retained your IMEI, you are in good path, if not... then do a factory reset (wipe everything) and repeat the steps starting from 3.
Could you explain it better?
Thank you
Click to expand...
Click to collapse
Yes, it's basically this: If you go into the "About Phone" section you will see that there's a field detailing your IMEI. I won't lie, I don't know exactly what it is, but it's a unique number for every phone and has something to do with your cellular network connection.
If you messed up at some point, you can lose your IMEI (i.e. you won't see it in that field or it will say "unknown" or something of the sort). If that happens, then it means you did something wrong, and proceeding in this state will make you have problems with your connection. The signal would be really unstable and it would be practically unusable.
To make a simpler check, if you have a cellular network connection, and can make calls and send/receive SMS on EMUI 4.1, then you won't have any problems.
Ah ok it wasn't so clear but I know what an imei is luckily it didn't erase it in my case. Anyway, I don't know how to thank you bro! You saved my life. I beleived to be screwed when I learned that Huawei stopped releasing the bootloader unlock code. How stupid they are. I blamed them through the customer support. I'm running lineage now! Kiss my ass Huawei!
ilmatte said:
Ah ok it wasn't so clear but I know what an imei is luckily it didn't erase it in my case. Anyway, I don't know how to thank you bro! You saved my life. I beleived to be screwed when I learned that Huawei stopped releasing the bootloader unlock code. How stupid they are. I blamed them through the customer support. I'm running lineage now! Kiss my ass Huawei!
Click to expand...
Click to collapse
Glad to hear I helped! Mind dropping a thank on the main thread? Hope you enjoy your phone
Thanks <3 -notes
Thank you tralph3, you make my life so easy, great easy guide. I have a few suggestions for improving clarity:
Step 1. "Stock_Android_5.zip" contains "transitional" android 6.0 ALE-L21C900B500 firmware According to including Spanish documentation "3., 3.1 Download the Android5.0 update package" It must be downloaded another 5.0 firmware. I use this 5.0 firmware to make kingroot preform root.
Firmware: huaweidl.com/download/p8-lite/ale-l21/b204/
Look for a line that says "Compilation Number" and tap...
Click to expand...
Click to collapse
Step 2. second point 2. Change to "Build Number"
su -c "grep -m1 -aoE 'WVLOCK.{14}[0-9]{16}' /dev/block/mmcblk0p7 |grep -aoE '[0-9]{16}'"
Click to expand...
Click to collapse
Step 2. getting unlock code. After executing command. Add step -Kingsroot display root access prompt ALLOW it.
t
Thanks for your work.
BelisTT said:
Thank you tralph3, you make my life so easy, great easy guide. I have a few suggestions for improving clarity:
Step 1. "Stock_Android_5.zip" contains "transitional" android 6.0 ALE-L21C900B500 firmware According to including Spanish documentation "3., 3.1 Download the Android5.0 update package" It must be downloaded another 5.0 firmware. I use this 5.0 firmware to make kingroot preform root.
Firmware: huaweidl.com/download/p8-lite/ale-l21/b204/
Step 2. second point 2. Change to "Build Number"
Step 2. getting unlock code. After executing command. Add step -Kingsroot display root access prompt ALLOW it.
t
Thanks for your work.
Click to expand...
Click to collapse
Thanks for pointing this stuff out, I'll make those changes you suggested and try to fix some typos too. So, what I gather from what you told me about that Android 5 thing is that in order to correctly flash the update I'm providing you NEED to be in Android 6, right? Whereas with the one you are providing me it should boot into Android 5 regardless of what you currently have. If that's the case, I'll include both and tell people of the distinction between the two so they can use the one they want/need (after all, the transition package is much smaller and easier to download). I'll download the package and upload it to Android Filehost along with everything else. I think I'll keep the mediafire downloads as a mirror. I'll get to that, thanks.
tralph3 said:
.... in Android 6, right? Whereas with the one you are providing me it should boot into Android 5 regardless of what you currently have.
Click to expand...
Click to collapse
Yes, exactly. Thanks for curating this additional download, good idea.
Does this also work for the PRA-LX1 version?
I have Android 8.0 on it and absolutely no idea what EMUI version or eben the firmware version.
I want to put crDroid on this phone because EMUI ... you know, it's bad.
Otherwise: I am ok with paying these 4€ if this payed unlock works.
WHICH of all these DC Unlocker Apps do I need for getting the unlock code?
Badoolo said:
Does this also work for the PRA-LX1 version?
I have Android 8.0 on it and absolutely no idea what EMUI version or eben the firmware version.
I want to put crDroid on this phone because EMUI ... you know, it's bad.
Otherwise: I am ok with paying these 4€ if this payed unlock works.
WHICH of all these DC Unlocker Apps do I need for getting the unlock code?
Click to expand...
Click to collapse
DON'T TRY ANY OF THIS. All of what I've detailed is for the P8 lite 2015, your phone is a different 2017 version that's basically another completely different phone with the same name, because Huawei doesn't know how to namr their devices. You have a different chipset, doing anything of what's described here will most likely brick your phone. With that said, maybe the bootloader unlock method works IF YOU FIND ANOTHER WAY TO ROOT YOUR PHONE. DON'T ROLL BACK TO ANDROID 5 WITH THE FILES I'M PROVIDING PLEASE.
This forum is dedicated to P8 lite 2015, you can see there's a different forum for 2017. Good luck.
Hello, I have ALE-L21 with EMUI 4.0.3 - MM 6.0 - version B633 and i can not downgrade to android 5, phone says : update failed, or stuck on 5%. could someone help me please ?
I tried a lot of stock ROMs, 5.0 , 6.0 etc, nothing worked for me.
Thanks,
Ax1qwer said:
Hello, I have ALE-L21 with EMUI 4.0.3 - MM 6.0 - version B633 and i can not downgrade to android 5, phone says : update failed, or stuck on 5%. could someone help me please ?
I tried a lot of stock ROMs, 5.0 , 6.0 etc, nothing worked for me.
Thanks,
Click to expand...
Click to collapse
Are you using the stock package or the transition package? If you are using the transition package, try stock.
I tried both, with no success. And many others.
I tried to update via internal storage and SDcard too, with no success.
If phone is connected to pc, updating stuck on 5%, if not connected to PC, update fails.
Ax1qwer said:
I tried both, with no success. And many others.
I tried to update via internal storage and SDcard too, with no success.
If phone is connected to pc, updating stuck on 5%, if not connected to PC, update fails.
Click to expand...
Click to collapse
Did you wipe all of your data with the stock recovery? If nothing works then I could suggest you to try to apply the downgrade with sideload. (Boot into recovery and select to apply update from adb, then you type adb sideload <filename>)
I'm clueless on why it doesn't work on your device, it should.
Also, you can try to flash the stock android 6 rom first, that's an older emui version (4.0). If you can flash that, then maybe you can flash android 5 after it.
i have tried intalling both the 5.0 stock roms but it always fails at 5%. i got ALE-L21C02B896 with emui 4.1 and android 6.0. i've been trying different guides but all lead me to dead ends. please help
thanks in advance
Wazu786 said:
i have tried intalling both the 5.0 stock roms but it always fails at 5%. i got ALE-L21C02B896 with emui 4.1 and android 6.0. i've been trying different guides but all lead me to dead ends. please help
thanks in advance
Click to expand...
Click to collapse
I have the exact same firmware(ALE-L21C02B896) that you have and I also cant downgrade to android 5.0 using any of the tutorials that I found in XDA Furum.
razorfancy said:
I have the exact same firmware(ALE-L21C02B896) that you have and I also cant downgrade to android 5.0 using any of the tutorials that I found in XDA Furum.
Click to expand...
Click to collapse
Yeah it very frustrating, please let me know if you find a way and ill do the same.
Wazu786 said:
Yeah it very frustrating, please let me know if you find a way and ill do the same.
Click to expand...
Click to collapse
Told you guys, try to flash android 6 and see if that works, afterwards you can flash android 5.
tralph3 said:
Told you guys, try to flash android 6 and see if that works, afterwards you can flash android 5.
Click to expand...
Click to collapse
I tried your Huawei's Stock Android 5, Huawei's Android 5 Transition and Huawei's Stock Android 6 and all failed to install giving error at 5 percent.
tralph3 said:
Told you guys, try to flash android 6 and see if that works, afterwards you can flash android 5.
Click to expand...
Click to collapse
i tried android 6 also and it also failed at 5%, please is there anything else i can try?

Note 8 soft bricked

Salutations everybody. I haven't had a phone from sammy in a while. Finally invested in a SM-N950F note 8. It's oreo. Tried to root earlier today using the pinned guide in the Guides forum. After going through the process, and flashing twrp. Then formatting data. And rebooting it to twrp (which I did a couple of times) (May been where I messed up,but it doesn't seem likely to me) I flashed the oreo n950f oem issue zip and rooted with magisk. Upon rebooting & enabling dev options. The oem toggle was missing. The guide didn't say what to do in the event that it was missing. Just that it was safe to reboot if it was there, and enabled.
Me being rushed for time rebooted anyway, and now when I try to boot up I get only official released binaries may be flashed, and the phone shuts off.
I'm aware I can restore to stock via odin. But I have a couple of questions.
A. Can I use the same odin version I used for the root process to return to stock, or do I need a different one?
And
B. There are loads of options for country and carrier on sammobiles site. I bought the phone used and have no idea of its country of origin. There is a version that says unknown for country and (bat) for carrier. Is that one safe to use, and is there any difference between the firmwares other than carrier setting being preinstalled (would be my guess of the only difference.)
Thanks in advance for any help you can provide.
This msg Only official released binaries are allowed to be flashed cause of the new security patch lock which called RMM or KG and since u were rooted before then u got this error that's cause you flashed a new BL to your device or you were connected to internet before editing kernel to prevent samsung to add the new lock to your device anyway a normal flash through odin will solve your problem and your device will be ready to use it again without any problems but also without any custom files like TWRP and Magsic which means u will not be able to root your device before editing kernel to remove the new security patch lock
ZeroXO said:
This msg Only official released binaries are allowed to be flashed cause of the new security patch lock which called RMM or KG and since u were rooted before then u got this error that's cause you flashed a new BL to your device or you were connected to internet before editing kernel to prevent samsung to add the new lock to your device anyway a normal flash through odin will solve your problem and your device will be ready to use it again without any problems but also without any custom files like TWRP and Magsic which means u will not be able to root your device before editing kernel to remove the new security patch lock
Click to expand...
Click to collapse
Okay I was thinking I might of missed something. The patch for oem issue I thought covered that.
Is the unknown (bat) firmware the one I need to flash to stock?
Sent from my OnePlus6T using XDA Labs
TheLogicalGamer said:
Salutations everybody. I haven't had a phone from sammy in a while. Finally invested in a SM-N950F note 8. It's oreo. Tried to root earlier today using the pinned guide in the Guides forum. After going through the process, and flashing twrp. Then formatting data. And rebooting it to twrp (which I did a couple of times) (May been where I messed up,but it doesn't seem likely to me) I flashed the oreo n950f oem issue zip and rooted with magisk. Upon rebooting & enabling dev options. The oem toggle was missing. The guide didn't say what to do in the event that it was missing. Just that it was safe to reboot if it was there, and enabled.
Me being rushed for time rebooted anyway, and now when I try to boot up I get only official released binaries may be flashed, and the phone shuts off.
I'm aware I can restore to stock via odin. But I have a couple of questions.
A. Can I use the same odin version I used for the root process to return to stock, or do I need a different one?
And
B. There are loads of options for country and carrier on sammobiles site. I bought the phone used and have no idea of its country of origin. There is a version that says unknown for country and (bat) for carrier. Is that one safe to use, and is there any difference between the firmwares other than carrier setting being preinstalled (would be my guess of the only difference.)
Thanks in advance for any help you can provide.
Click to expand...
Click to collapse
Using odin 13.1.3 is recommended.
As you have the N950F, it is part of the multi OXM CSC, so you can flash the filmware for you country and carrier if desired (N950F)
If you want to root, I suggest just flashing a custom rom or kernel, as they have been patched for the RMM KG state issue.

May 2020 QQ2A.200501.001.B2 "FLAME" Magisk-Patched Boot Img [+UPDATE/KEEP ROOT GUIDE]

May 2020 QQ2A.200501.001.B2 "FLAME" Magisk-Patched Boot Img [+UPDATE/KEEP ROOT GUIDE]
Another month, another update. I'll keep churning out these patched / stock file uploads and easy noob-friendly update guides while guinea pigging the updates, so long as my area is still on lockdown and I'm not back to work yet, lol.
I've also installed and tested / verified that Kirisakura 4.2.0 is working great with this month's patch so far.
Also have EdXposed Canary 0.5.0.0 (4548) YAHFA installed. SafetyNet still passing as of now.
Magisk v20.4 Patched Boot Image: https://www.androidfilehost.com/?fid=4349826312261796525
Factory Untouched Boot Image: https://www.androidfilehost.com/?fid=4349826312261796524
THESE FILES ARE FOR 10.0.0 (QQ2A.200501.001.B2, May 2020, All carriers except TW) ONLY! PLEASE ONLY FLASH IF YOU KNOW WHAT YOU'RE DOING!
If these files and/or guides are helpful, please drop a thanks and let me know. =)
EASY UPDATE / SEAMLESS KEEP-ROOT UPDATE PROCESS (using a PC - a very intuitive, effective, and relatively safe method).
** You can only follow this guide exactly if coming from build QQ2A.200405.005, Apr 2020. But the general idea is the same for other builds, you just need the correct files for your device.
flame-qq2a.200405.005-factory-dtbo.img: https://www.androidfilehost.com/?fid=4349826312261796522
flame-qq2a.200405.005-factory-boot.img: https://www.androidfilehost.com/?fid=4349826312261763724
May 2020 sideload OTA zip: https://dl.google.com/dl/android/aosp/flame-ota-qq2a.200501.001.b2-46940f66.zip
I DID NOT BOOT BACK INTO O/S UNTIL ALL STEPS WERE COMPLETED - I DID THIS TO ENSURE EVERYTHING WOULD BOOT BACK UP WITH MAGISK / EDXPOSED ALL RUNNING PROPERLY RIGHT AWAY
1. boot into bootloader
----------------
** I was on custom kernel, so I needed to flash BOTH the stock boot and dtbo images
2. fastboot flash boot flame-qq2a.200405.005-factory-boot.img
3. fastboot flash dtbo flame-qq2a.200405.005-factory-dtbo.img
......* these steps to restore stock recovery; dtbo.img also necessary for some kernel installations
-----------------
4. use volume keys to change selection to boot to Recovery Mode
......- when you reach the android symbol with No Command, hold power button, tap volume up, in case you've forgotten
5. choose option "Apply update from ADB"
6. adb sideload flame-ota-qq2a.200501.001.b2-46940f66.zip
7. Once the OTA sideload is done, Reboot to bootloader (you'll also notice it's now on the other slot after OTA flashed)
8. fastboot flash boot flame-qq2a.200501.001.b2-magisk_patched-20.4.img
9. done, start the phone
(Optional - Flash custom kernel. If you had a custom kernel, you need to re-flash it. I've only personally tested with Kirisakura though.)
This was a 100% seamless update that required no additional / re-setup of any of my Magisk or EdXposed setups. All of the factory files can be found here https://developers.google.com/android/images. boot.img and dtbo.img are in their corresponding full Factory Image zips, and the ota zip is under Full OTA Images.
Thank you for making this so convenient!
ahalol said:
Thank you for making this so convenient!
Click to expand...
Click to collapse
:highfive:
You can thank my wife for going with the P4 instead of P4XL . Now gives me 2 phones to keep up with, although they're basically identical in process. Might as well share with yall over on this board, which seems to get a little less love and attention. But we're definitely lovin the switch to Pixels. Awesome camera too, which is great because we just had our first child 4 months ago and these phones take amazing photos. And this is coming from 2 phones that already had great cameras (HTC U11 and U12+)! I love taking photos when he's sleeping using Night Sight mode. He's so adorable, it comes out so clean, and there's just something about that sleepy ambience .
i just saw on my google news feed that the May patch just started dropping to our devices. i go check XDA and this post is already here. wow that was fast haha! went perfectly smoothly just like last month, thanks so much!!
Why not update the OTA via Magisk, or is this only for those which devices is not able to download OTA:s?
Currently, I have rooted with Magisk, still waiting for OTA update notification in my device...
Should i restore images in Magisk and/or disable any modules or just let 'er rip?!
Vantskruv said:
Why not update the OTA via Magisk, or is this only for those which devices is not able to download OTA:s?
Currently, I have rooted with Magisk, still waiting for OTA update notification in my device...
Click to expand...
Click to collapse
redeyss said:
Should i restore images in Magisk and/or disable any modules or just let 'er rip?!
Click to expand...
Click to collapse
@Vantskruv: FYI, you won't get the OTA update notification because you're modified right now. You can restore the boot image in Magisk first and wait for the OTA notification (what you're thinking of is something like this: https://forum.xda-developers.com/pixel-4-xl/how-to/guide-update-retain-root-t4003839). But from what I understand, it's pretty hit or miss. Apparently it's hit or miss even on complete bone stock anyway lol. The method I outlined just works nice and reliably even when rooted and modded.
@redeyss: Restoring the stock boot image in Magisk Manager is similar to the method linked above, and then taking the OTA the normal way. But if you flashed a custom kernel, keep it mind it won't restore the dtbo partition (not sure if it's necessary with that method tbh). You shouldn't need to restore images in Magisk, nor diable any modules. When you flash the factory April boot and dtbo images, it's doing the same thing as restoring the images through Magisk (plus dtbo). Just let er rip, and if you have any issues, you can always flash the new unmodified factory boot image, which will essentially disable Magisk, and then work from there. It's a very safe method. =)
edit: also in the event of bootloop, this is a great thread to read and understand: https://forum.xda-developers.com/pixel-4/how-to/magisk-modules-disabler-booting-magisk-t3991739
Thank you @i5lee8bit for your answer. Luckily I have restrained myself yesterday to update, thought I where in the Pixel 4XL thread, while this is for the Pixel 4. :laugh:
I am just curious, do any of you expert guys/girls know why this is happening, that OTA updates is not pushed on rooted phones?
Do Google have algorithms that temporarily bans systems which is rooted?
Or is it so simple that some type of fingerprint is changed when rooted, so Google update services does not recognise the device, and not pushing OTA:s?
Sorry for the questions, no need to answer them. It was a long time ago I rooted Android:s, and I have forgot many things.
I think I will try to manually update everything, even though there are more steps included, just to learn how to do it.
https://www.youtube.com/watch?v=kZY8qiz2SZ0
Vantskruv said:
Thank you @i5lee8bit for your answer. Luckily I have restrained myself yesterday to update, thought I where in the Pixel 4XL thread, while this is for the Pixel 4. :laugh:
I am just curious, do any of you expert guys/girls know why this is happening, that OTA updates is not pushed on rooted phones?
Do Google have algorithms that temporarily bans systems which is rooted?
Or is it so simple that some type of fingerprint is changed when rooted, so Google update services does not recognise the device, and not pushing OTA:s?
Sorry for the questions, no need to answer them. It was a long time ago I rooted Android:s, and I have forgot many things.
I think I will try to manually update everything, even though there are more steps included, just to learn how to do it.
https://www.youtube.com/watch?v=kZY8qiz2SZ0
Click to expand...
Click to collapse
No worries, the process for the 4XL is the exact same, but good catch; you definitely need to use the correct files for the device. I actually posted a similar thread with the relevant 4XL files over on that forum.
Not sure exactly the mechanism used to prevent the normal OTA, but probably just checks for a modified boot partition. In any case, the normal factory OTA if I understand correctly relies in part on factory recovery commands at some point, and a modified boot partition won't be able to use them. In fact, try booting to recovery with the modified boot partition flashed and you'll notice it can't load recovery. I may be wrong about the exact reason though. But think about it: even if we had TWRP, the factory OTA mechanism can't make use of it. Even if the OTA popped up while rooted, it probably wouldn't be able to do it, or worse, cause a failure and corruption. I would dare say we're fortunate they prevent factory OTA when running modified.
Anyway, there are a lot of complicated guides out there, and that's why I wanted to share my method. I didn't need to do any further research and it's very intuitively sound. Steps 2+3 essentially restore stock boot and therefore recovery (and dtbo), the rest pretty much follows a standard OTA sideload, and then it's structured in such a way that you're flashing the new Magisk patched boot image before even starting the phone back up. Making it a seamless, keep-root easy upgrade.
Wow ..... what an easy, elegant way to get my Coral device updated while keeping root. Followed the OP process, but used these commands instead to get the June 2020 security update:
- fastboot flash boot coral-qq3a.200605.001-factory-boot.img
- fastboot flash dtbo coral-qq3a.200605.001-factory-dtbo.img
- adb sideload coral-ota-qq3a.200605.001-3b5bb1bd.zip
- fastboot flash boot coral-qq3a.200605.001-magisk_patched-20.4.img
Thanks, @i5lee8bit . Well done. :good:
does anyone have a thread to point me to that is a step by step guide for setting up ADB and how to flash? I did everything a year ago but now I just factory reset and am stuck in boot loop, can't remember all the commands and everything.
in_dmand said:
does anyone have a thread to point me to that is a step by step guide for setting up ADB and how to flash? I did everything a year ago but now I just factory reset and am stuck in boot loop, can't remember all the commands and everything.
Click to expand...
Click to collapse
Did you fix the issue?

[GUIDE] Full process of installing Magisk & TWRP on a OnePlus 7 Pro (TMOBILE SUPPORT)

For me, pwning my new phone was a 7-hour process that required incredible learning capacity. Not everyone is prepared to go through a process like that, and it can easily take multiple days or weeks. This is a guide outlining a version of the exact process that got me to this point. It should be easy for anyone to follow, even people without much technical knowledge. (although, do be careful with the resulting root access)
I started with a GM1915, which is the T-Mobile model. You'd think it would require an unlock key from T-Mobile in order to work, but actually it doesn't. That's what they don't want you to know.
A well-known method for bypassing that requirement is to install an international OS and then upgrade it to a certain developer preview, causing the phone to update the bootloader to a non-crippled version that doesn't require an unlock key. So that's what I did.
However, the process is easier said than done. For someone like me who's done it, it's not too hard, but for a beginner it's intensely confusing. I was a beginner just yesterday and struggled with dumb error messages like "packed image not exist".
The guide is below. Sections starting with "T-MOBILE ONLY" and ending with "END OF T-MOBILE ONLY" are only to be performed on T-Mobile phones with T-Mobile firmware and a locked bootloader. If you have an unlocked bootloader then you can skip those steps.
Make sure you have a Windows machine. The Qualcomm drivers are only available for Windows, the programs are only available for Windows, people on this forum only know Windows. I have a Mac, personally, because Unix is awesome, but unfortunately nobody has thought about us and all the tools are Windows-only. I am just as disappointed as you, trust me. I used a virtual machine, but YMMV, depending on how good your hypervisor's USB passthrough is. You may want to use bare metal if you only have VirtualBox; it's not worth the effort. You will be hot plugging A LOT, and your phone will show up as many different types of USB devices.
You must have fastboot installed, but ADB is not required.
--- T-MOBILE ONLY ---
Install the "L2 drivers" for the phone. You can find them here. Just install as many of them as you can by right-clicking every `.inf` file you find and clicking Install on each one of them. Some of them will have missing files. Some of them won't have a signature. It doesn't matter, as long as you try every one of them, something will work. For me it was the 64-bit driver, in the 64 folder. All the others are 32-bit.
--- END OF T-MOBILE ONLY ---
You should probably plug the phone into your computer now and install the official OnePlus drivers as well. This is so that you can easily access the phone storage, which will become very important soon. Reboot your computer to apply the driver updates.
--- T-MOBILE ONLY ---
Download the "MSM Download Tool" from here (same link as above). Place it in its own folder. This is crucial because you must now download the guacamole-whatever.7z file and extract the .ots file into the same folder as the MSM Download Tool.
MSM Download Tool always looks in its folder for the image and pops up a cryptic error message if it's not found ("packed image not exist"). This is not very widely documented because MSM Download Tool is often distributed in the same folder as the image anyway. That's not the case when you are forced to download them as separate files.
Note that this is the only time you will have to use MSM Download Tool and all other updates can be installed by the phone itself. On international variants you don't have to do this because the bootloader will already be unlockable, which is why this is T-Mobile only.
You need to start downloading three updates. This patched version of international OOS is where you will start, the developer beta will upgrade the bootloader, and the full downgrade will roll you back so you can start updating. Start the downloads now, but you do not have to wait for them to finish yet; it will be a few steps before you have to use them.
Now is about the time to back up any data you want to keep. Everything on your phone will be wiped by the next step, including bootloader unlock status, all your data, the entire operating system and so on.
Now it's time to install international OOS. Place it inside the folder with MSM Download Tool and then start it up. Uncheck the SHA-256 checkbox!
Unplug your USB cable and THEN turn off your phone completely. If the USB cable is plugged in while it's turned off, it will automatically boot into the charging mode which is not what you want. Have your USB cable, and computer mouse, on the ready. You don't want to waste any time, because this may be physically painful: Hold down both volume buttons at the same time for at least 5 seconds, and then plug the USB cable into your phone. Make sure some COM port appears in the tool, then click the "Start" button in MSM Download Tool WHILE STILL HOLDING THEM DOWN. You can only let the volume buttons go AFTER you click "Start", or else the phone will drop out of EDL mode into fastboot.
The process will take a few minutes depending on how fast your USB connection is. Leave the phone plugged in until it is complete. This also gives time to download those two updates, which are together about four gigabytes in size.
Once MSM Download Tool is done flashing, you can reboot the phone and set it up using the setup wizard. Feel free to move fast and enable nothing. You don't need internet, you don't need a correct clock, you don't need accounts or telemetry or anything like that. All data will be wiped again later.
Use your computer to copy the developer preview update to the phone. Don't copy it to the Download folder or anything, copy it into the root (just inside the internal storage). Go to settings > local updates > settings icon in the top right > local update and update to the developer preview.
Once you're in the developer preview, enable OEM unlocking in developer options, reboot into fastboot mode (I do this by also enabling advanced reboot in developer options) and use fastboot oem unlock. Your bootloader is now unlocked! But we're not nearly done yet, there's still lots to do.
After rebooting, since the unlock wiped the phone, you'll have to set it up again. Just breeze through like before, then copy the rollback zip to the phone just like you did for the developer preview.
Go to local update again and use the rollback. This is required in order to go back to a stable OS that can accept OTAs. After this your data will be wiped. This is the real setup wizard. You can set it up with real data; your data will not be wiped again for the rest of this guide.
--- END OF T-MOBILE ONLY ---
If your bootloader is not already unlocked, enable OEM unlocking in developer options and then run `fastboot oem unlock` in Fastboot mode.
Next, you will want to install Magisk. This is a slightly complex process but once it's done your phone will become fully untethered.
First download a tool called Payload Dumper. Extract the entire archive into its own folder. Get an OTA update for your version of OxygenOS (if your phone is T-Mobile, that is the rollback update you just installed; if you aren't following the T-Mobile guide, you may have to download an OTA update from Google), and use WinRAR or similar to extract the `payload.bin` inside into the payload dumper's input folder.
Run the payload dumper. You don't need to run all of it; wait for "boot" to show up in the console window, then wait until something else shows up and then close the window. Inside the output folder there should be a `boot.img`; there may be other img files but the boot is what we're interested in.
Transfer this boot.img to your device and use Magisk Manager to patch it. Transfer the magisk_patched.img to your computer, reboot the phone into fastboot mode and use `fastboot flash boot magisk_patched.img`. Reboot the phone into Android.
If you start Magisk Manager you should see that Magisk is installed. Great. Next step is to install TWRP.
In my experience, flashing TWRP or using `fastboot boot twrp.img` didn't work. You're not clever if you try installing OxygenOS 9.5.4 which adds `fastboot boot` support to the bootloader; it still won't work. In my experience the only correct way to install TWRP on the OnePlus 7 Pro is to use Magisk.
(Someone in the replies below stated that you need to upgrade all the way to OOS 10 in order to boot TWRP using fastboot. This guide details the easier method using Magisk Manager.)
On the phone, go to the TWRP downloads page for the OnePlus 7 Pro, and download the latest installer. Then flash the zip using Magisk.
Crucially, at the end of the installer log it says "you are now unrooted". DO NOT IGNORE THIS MESSAGE! If you reboot now, Magisk will be gone and the stock ROM will immediately overwrite TWRP. You must use Magisk Manager to reinstall Magisk using a "Direct Install". That way, your boot.img will be patched again and your Magisk (and TWRP) will persist across reboots.
Go ahead and try it out. Reboot a few times, sometimes into recovery, sometimes into Android to test Magisk.
We're still not done yet. Wouldn't you love to stay rooted and still be running the latest version of OxygenOS? I sure would. Next I'll describe the process of applying an OTA update while keeping your root and everything. Thanks to A/B you can stay untethered.
Please note that, if you'd like to proceed with the EU version of OxygenOS, you should go grab 9.5.4 before proceeding to the next step, for example from here (MD5 fcec14e2ec053d67c793a27bfdef17d0), and use local update to install it. (note GM21BA instead of GM21AA) The EU version is supposed to have better privacy options and less bloatware, so that's what I personally went with. Converting your OxygenOS from GM21AA to GM21BA has no harmful side effects and should work on any phone. It affects the OTA you'll receive in the next step, and this is possibly the only chance you'll get to switch (or not). So choose wisely.
You can find other versions of OOS in this XDA post.
Remember to turn off all auto-updating in the OxygenOS settings. You don't want your phone suddenly losing Magisk and TWRP after any old reboot. Then you can use the OxygenOS updater to accept an official OTA update. It will recognize you're rooted and install an entire fresh new system to your inactive slot, which is exactly what we want.
There are two steps you need to perform before rebooting. The first is TWRP persistence and the second is Magisk persistence. For TWRP persistence you need to go into Magisk Manager and flash a module called "TWRP A/B retention script". Then for Magisk persistence you need to go install Magisk again, but this time to the inactive slot. You must do TWRP persistence first.
After this you should be good to go back to the update screen and hit reboot. You should still have TWRP and Magisk, but now on the very latest version of OxygenOS. Customize your phone to your heart's content now; it's all yours.
Recommended tweaks:
- install a Magisk module called "Debloater (Terminal Emulator)". Install a terminal emulator like Termux and use `su` to enter a root shell. Then you can run `debloat` and go through the list of apps, removing things you don't want. Certain services need to be watched out for, like PlayAutoInstallConfig (lets your carrier silently install apps without your consent). You can find tidbits online explaining what certain things do, like this pastebin, or this one. Houdini is the kernel driver which is very important.
- enable MagiskHide and hide yourself from Netflix and other DRM-enabled apps. Also hide yourself from Google Play's snet service.
- there is a Magisk module called F-Droid Privileged Extension, it's quite nice.
- use MagiskHide Props Config to set `net.tethering.noprovisioning=true`. This will prevent the carrier from knowing when you are using hotspot features, so they will not immediately cut your connection
- don't install a custom ROM. OxygenOS is high quality and everything you could ever want from a phone honestly. It has all the drivers and stuff for the phone and all of that cool stuff.
Small curiosities:
- SMT download mode is a special flashing mode used by the factory and it can overwrite things like the IMEI. Don't mess with it, you do not know what you're doing.
- Now that you have the software, you can literally just install a Dual SIM tray and have dual SIMs. Your phone is essentially the same as the international OP7P
- Feel free to post if you have any issues or need help with something.
Thank you mate. This will help out a lot of people coming to one plus such as myself. Only wonder I have about it all is the dual sim. I have 2 imei now but obviously both are the same. So I'm trying to figure out how that would work.
TheMadScientist said:
Thank you mate. This will help out a lot of people coming to one plus such as myself. Only wonder I have about it all is the dual sim. I have 2 imei now but obviously both are the same. So I'm trying to figure out how that would work.
Click to expand...
Click to collapse
Yeah, same here. Dual SIM phones are required to have two IMEI numbers since they technically have two transceivers, one for each SIM. Maybe one day someone will post a guide on how to change your IMEI numbers? You could keep one and change the other.
Today I had a little incident with SafetyNet.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I had installed the magisk modules Riru and Riru - EdXposed. Big mistake. Uninstalling them didn't fix it. Reinstalling the OS didn't fix it. I thought I was totally ****ed. However, toggling MagiskHide off and back on again and clearing Google Play Services' data seems to have fixed it:
Phew. This SafetyNet guide really helped
EDIT: Also make sure to clear Play Store's data so it re-checks your device for certification.
LoganDark said:
Yeah, same here. Dual SIM phones are required to have two IMEI numbers since they technically have two transceivers, one for each SIM. Maybe one day someone will post a guide on how to change your IMEI numbers? You could keep one and change the other.
Click to expand...
Click to collapse
Unfortunately we can't discuss that on xda.
TheMadScientist said:
Unfortunately we can't discuss that on xda.
Click to expand...
Click to collapse
Software spoofing is allowed. EMS flashing is not.
Riru - EdXposed seems to pass SafetyNet if you use HiddenCore module (and DO NOT BLACKLIST GOOGLE SERVICES or else they will not get patched and they will fail you). I haven't checked to see how deep this goes. Perhaps third party apps which do their own SafetyNet check will see through it. Anyone here with experience?
Edit: BAD ADVICE DO NOT USE HIDDENCORE IT WILL BREAK SAFETYNET EVEN MORE
Well I got to say your guide it's good. But the part where you can only install twrp with magisk I got to say no there. All you have to do is use the roll back package and then update your phone with the first update it allows in system update. That should put you on Oxygen os android 10. Then fastboot will work. Did it myself so I know. Best regards
LokifiedMee said:
Well I got to say your guide it's good. But the part where you can only install twrp with magisk I got to say no there. All you have to do is use the roll back package and then update your phone with the first update it allows in system update. That should put you on Oxygen os android 10. Then fastboot will work. Did it myself so I know. Best regards
Click to expand...
Click to collapse
People seem to have mixed luck regarding using fastboot to boot TWRP. I understand upgrading the bootloader can enable additional fastboot capabilities which is why I tried it myself. It didn't work for me so that's why this guide takes the safer/guaranteed approach.
I did only upgrade to a later version of OOS 9, though. It added `fastboot boot` but trying it softlocked the phone.
Note that in either case, the OnePlus 7 Pro's recovery is stored in the boot partition, and flashing a zip using Magisk is easier than flashing one with TWRP.
I have revised the post to acknowledge the alternative method.
(Also, it's worth mentioning that I know anyone following this guide probably knows how to flash a zip in TWRP. I'm not saying that's too complicated, but the guide details the process I followed specifically. There are many other guides online detailing alternative methods, but they did not work for me, which is why I made this one.)
LoganDark said:
People seem to have mixed luck regarding using fastboot to boot TWRP. I understand upgrading the bootloader can enable additional fastboot capabilities which is why I tried it myself. It didn't work for me so that's why this guide takes the safer/guaranteed approach.
I did only upgrade to a later version of OOS 9, though. It added `fastboot boot` but trying it softlocked the phone.
Note that in either case, the OnePlus 7 Pro's recovery is stored in the boot partition, and flashing a zip using Magisk is easier than flashing one with TWRP.
I have revised the post to acknowledge the alternative method.
(Also, it's worth mentioning that I know anyone following this guide probably knows how to flash a zip in TWRP. I'm not saying that's too complicated, but the guide details the process I followed specifically. There are many other guides online detailing alternative methods, but they did not work for me, which is why I made this one.)
Click to expand...
Click to collapse
No worries mate. Just giving you the heads up. Cheers
I'm unsure how to flash twrp using magisk. I used a friend's machine to flash magisk last night but don't have access now. I'm waiting on asusurion to send mine back. I stayed on the beta and updated to the latest. Would flashing or booting into twrp be possible? Thanks for the guide, btw
Leskanic said:
I'm unsure how to flash twrp using magisk. I used a friend's machine to flash magisk last night but don't have access now. I'm waiting on asusurion to send mine back. I stayed on the beta and updated to the latest. Would flashing or booting into twrp be possible? Thanks for the guide, btw
Click to expand...
Click to collapse
Apologies for the late reply.
Download the "twrp-installer" zip file and use Magisk to flash it.
After that, you have to "direct install" Magisk again.
I guess my question is which option do i use in magisk to flash the twrp installer zip file? Do I use the install module from storage option or in the section where you patch files? Could i just use terminal emulator to boot into twrp then flash twrp and magisk while I'm in twrp? Sorry for my ignorance it's been a couple years since I've had Android with an unlocked bootloader and not having my laptop doesn't help
Leskanic said:
I guess my question is which option do i use in magisk to flash the twrp installer zip file? Do I use the install module from storage option or in the section where you patch files? Could i just use terminal emulator to boot into twrp then flash twrp and magisk while I'm in twrp? Sorry for my ignorance it's been a couple years since I've had Android with an unlocked bootloader and not having my laptop doesn't help
Click to expand...
Click to collapse
The TWRP installer zip is just a Magisk module that you can flash by going to the modules section and tapping "install from storage".
Basically, step 1: go into this section and install the twrp-installer zip this way
Step 2: go here
and direct install Magisk like this
Yes, you are installing Magisk again. That is because the TWRP installer overwrote it, and if you rebooted, you would lose root (and the stock ROM would immediately overwrite TWRP, leaving your device completely stock)
As for flashing both things via TWRP, you would probably flash TWRP first and then Magisk. If you can get the phone to boot into TWRP in the first place, yeah it's probably possible and many others have probably installed their TWRP+Magisk that way.
Thanks i didn't realize the twrp installer zip could be flashed as a module. Sorry it's been a while and I'm trying to get back up to speed
I have a few XPrivacyLua hooks that can be used to change your model number to GM1917 (at least to Java apps). It doesn't have any side effects except peace of mind.
Add these using the XPrivacyLua Pro companion app (you don't need to buy Pro to edit hooks), MAKE SURE to enter GM1917 in the model text box and save, enable them for every app including system apps in XPrivacyLua, and reboot.
Enjoy
LoganDark said:
For me, pwning my new phone was a 7-hour process that required incredible learning capacity. Not everyone is prepared to go through a process like that, and it can easily take multiple days or weeks. This is a guide outlining a version of the exact process that got me to this point. It should be easy for anyone to follow, even people without much technical knowledge. (although, do be careful with the resulting root access)
I started with a GM1915, which is the T-Mobile model. You'd think it would require an unlock key from T-Mobile in order to work, but actually it doesn't. That's what they don't want you to know.
A well-known method for bypassing that requirement is to install an international OS and then upgrade it to a certain developer preview, causing the phone to update the bootloader to a non-crippled version that doesn't require an unlock key. So that's what I did.
However, the process is easier said than done. For someone like me who's done it, it's not too hard, but for a beginner it's intensely confusing. I was a beginner just yesterday and struggled with dumb error messages like "packed image not exist".
The guide is below. Sections starting with "T-MOBILE ONLY" and ending with "END OF T-MOBILE ONLY" are only to be performed on T-Mobile phones with T-Mobile firmware and a locked bootloader. If you have an unlocked bootloader then you can skip those steps.
Make sure you have a Windows machine. The Qualcomm drivers are only available for Windows, the programs are only available for Windows, people on this forum only know Windows. I have a Mac, personally, because Unix is awesome, but unfortunately nobody has thought about us and all the tools are Windows-only. I am just as disappointed as you, trust me. I used a virtual machine, but YMMV, depending on how good your hypervisor's USB passthrough is. You may want to use bare metal if you only have VirtualBox; it's not worth the effort. You will be hot plugging A LOT, and your phone will show up as many different types of USB devices.
You must have fastboot installed, but ADB is not required.
--- T-MOBILE ONLY ---
Install the "L2 drivers" for the phone. You can find them here. Just install as many of them as you can by right-clicking every `.inf` file you find and clicking Install on each one of them. Some of them will have missing files. Some of them won't have a signature. It doesn't matter, as long as you try every one of them, something will work. For me it was the 64-bit driver, in the 64 folder. All the others are 32-bit.
--- END OF T-MOBILE ONLY ---
You should probably plug the phone into your computer now and install the official OnePlus drivers as well. This is so that you can easily access the phone storage, which will become very important soon. Reboot your computer to apply the driver updates.
--- T-MOBILE ONLY ---
Download the "MSM Download Tool" from here (same link as above). Place it in its own folder. This is crucial because you must now download the guacamole-whatever.7z file and extract the .ots file into the same folder as the MSM Download Tool.
MSM Download Tool always looks in its folder for the image and pops up a cryptic error message if it's not found ("packed image not exist"). This is not very widely documented because MSM Download Tool is often distributed in the same folder as the image anyway. That's not the case when you are forced to download them as separate files.
Note that this is the only time you will have to use MSM Download Tool and all other updates can be installed by the phone itself. On international variants you don't have to do this because the bootloader will already be unlockable, which is why this is T-Mobile only.
Start the MSM Downloader tool and make sure that it's open and ready. Uncheck the SHA-256 checkbox!
You need to start downloading two updates. The developer beta will upgrade the bootloader, and the full downgrade will give you a reference boot.img to use for Magisk. Start the downloads now, but you do not have to wait for them to finish yet; it will be a few steps before you have to use them.
Now is about the time to back up any data you want to keep. Everything on your phone will be wiped by the next step, including bootloader unlock status, all your data, the entire operating system and so on.
Unplug your USB cable and THEN turn off your phone completely. If the USB cable is plugged in while it's turned off, it will automatically boot into the charging mode which is not what you want. Have your USB cable, and computer mouse, on the ready. You don't want to waste any time, because this may be physically painful: Hold down both volume buttons at the same time for at least 5 seconds, and then plug the USB cable into your phone. Make sure some COM port appears in the tool, then click the "Start" button in MSM Download Tool WHILE STILL HOLDING THEM DOWN. You can only let the volume buttons go AFTER you click "Start", or else the phone will drop out of MSM mode.
The process will take a few minutes depending on how fast your USB connection is. Leave the phone plugged in until it is complete. This also gives time to download those two updates, which are together about four gigabytes in size.
Once MSM Download Tool is done flashing, you can reboot the phone and set it up using the setup wizard. This one will be overwritten, so feel free to move fast and enable nothing. You don't need internet, you don't need a correct clock, you don't need accounts or telemetry or anything like that. All data will be wiped again later.
Use your computer to copy both updates (developer preview & rollback) to the phone. Don't copy them to the Download folder or anything, copy them into the root. Go to settings > local updates > settings icon in the top right > local update and update to the developer preview.
Once you're in the developer preview, enable OEM unlocking in developer options, reboot into fastboot mode (I do this by also enabling advanced reboot in developer options) and use `fastboot oem unlock`. Your bootloader is now unlocked! But we're not nearly done yet, there's still lots to do.
Go to local update again and use the rollback. This is required in order to go back to a stable OS that can accept OTAs. After this your data will be wiped. This is the real setup wizard. You can set it up with real data; your data will not be wiped again for the rest of this guide.
--- END OF T-MOBILE ONLY ---
If your bootloader is not already unlocked, enable OEM unlocking in developer options and then run `fastboot oem unlock` in Fastboot mode.
Next, you will want to install Magisk. This is a slightly complex process but once it's done your phone will become fully untethered.
First download a tool called Payload Dumper. Extract the entire archive into its own folder. Get an OTA update for your version of OxygenOS (if your phone is T-Mobile, that is the rollback update you just installed; if you aren't following the T-Mobile guide, you may have to download an OTA update from Google), and use WinRAR or similar to extract the `payload.bin` inside into the payload dumper's input folder.
Run the payload dumper. You don't need to run all of it; wait for "boot" to show up in the console window, then wait until something else shows up and then close the window. Inside the output folder there should be a `boot.img`; there may be other img files but the boot is what we're interested in.
Transfer this boot.img to your device and use Magisk Manager to patch it. Transfer the magisk_patched.img to your computer, reboot the phone into fastboot mode and use `fastboot flash boot magisk_patched.img`. Reboot the phone into Android.
If you start Magisk Manager you should see that Magisk is installed. Great. Next step is to install TWRP.
In my experience, flashing TWRP or using `fastboot boot twrp.img` didn't work. You're not clever if you try installing OxygenOS 9.5.4 which adds `fastboot boot` support to the bootloader; it still won't work. In my experience the only correct way to install TWRP on the OnePlus 7 Pro is to use Magisk.
(Someone in the replies below stated that you need to upgrade all the way to OOS 10 in order to boot TWRP using fastboot. This guide details the easier method using Magisk Manager.)
On the phone, go to the TWRP downloads page for the OnePlus 7 Pro, and download the latest installer. Then flash the zip using Magisk.
Crucially, at the end of the installer log it says "you are now unrooted". DO NOT IGNORE THIS MESSAGE! If you reboot now, Magisk will be gone and the stock ROM will immediately overwrite TWRP. You must use Magisk Manager to reinstall Magisk using a "Direct Install". That way, your boot.img will be patched again and your Magisk (and TWRP) will persist across reboots.
Go ahead and try it out. Reboot a few times, sometimes into recovery, sometimes into Android to test Magisk.
We're still not done yet. Wouldn't you love to stay rooted and still be running the latest version of OxygenOS? I sure would. Next I'll describe the process of applying an OTA update while keeping your root and everything. Thanks to A/B you can stay untethered.
Please note that, if you'd like to proceed with the EU version of OxygenOS, you should go grab 9.5.4 before proceeding to the next step, for example from here, and use local update to install it. (note GM27BA instead of GM27AA) The EU version is supposed to have better privacy options and less bloatware, so that's what I personally went with. Converting your OxygenOS from GM27AA to GM27BA has no harmful side effects and should work on any phone. It affects the OTA you'll receive in the next step, and this is possibly the only chance you'll get to switch (or not). So choose wisely.
Remember to turn off all auto-updating in the OxygenOS settings. You don't want your phone suddenly losing Magisk and TWRP after any old reboot. Then you can use the OxygenOS updater to accept an official OTA update. It will recognize you're rooted and install an entire fresh new system to your inactive slot, which is exactly what we want.
There are two steps you need to perform before rebooting. The first is TWRP persistence and the second is Magisk persistence. For TWRP persistence you need to go into Magisk Manager and flash a module called "TWRP A/B retention script". Then for Magisk persistence you need to go install Magisk again, but this time to the inactive slot. You must do TWRP persistence first.
After this you should be good to go back to the update screen and hit reboot. You should still have TWRP and Magisk, but now on the very latest version of OxygenOS. Customize your phone to your heart's content now; it's all yours.
Recommended tweaks:
- install a Magisk module called "Debloater (Terminal Emulator)". Install a terminal emulator like Termux and use `su` to enter a root shell. Then you can run `debloat` and go through the list of apps, removing things you don't want. Certain services need to be watched out for, like PlayAutoInstallConfig (lets your carrier silently install apps without your consent). You can find tidbits online explaining what certain things do, like this pastebin, or this one. Houdini is the kernel driver which is very important.
- enable MagiskHide and hide yourself from Netflix and other DRM-enabled apps. Also hide yourself from Google Play's snet service.
- there is a Magisk module called F-Droid Privileged Extension, it's quite nice.
- use MagiskHide Props Config to set `net.tethering.noprovisioning=true`. This will prevent the carrier from knowing when you are using hotspot features, so they will not immediately cut your connection
- don't install a custom ROM. OxygenOS is high quality and everything you could ever want from a phone honestly. It has all the drivers and stuff for the phone and all of that cool stuff.
Small curiosities:
- SMT download mode is a special flashing mode used by the factory and it can overwrite things like the IMEI. Don't mess with it, you do not know what you're doing.
- Now that you have the software, you can literally just install a Dual SIM tray and have dual SIMs. Your phone is essentially the same as the international OP7P
- Feel free to post if you have any issues or need help with something.
Click to expand...
Click to collapse
It isn't very clear what version of OOS you started on. If I'm running OOS10 on stock this should still (in theory) work right?
r4w0ne said:
It isn't very clear what version of OOS you started on. If I'm running OOS10 on stock this should still (in theory) work right?
Click to expand...
Click to collapse
OOPS, fuck, I missed a step. You have to use MSM Download Tool to clean install this patched OOS before installing the developer preview. I'll update the post ASAP
Edit: Post has been updated
LoganDark said:
OOPS, ****, I missed a step. You have to use MSM Download Tool to clean install this patched OOS before installing the developer preview. I'll update the post ASAP
Click to expand...
Click to collapse
Glad I asked lol.
r4w0ne said:
Glad I asked lol.
Click to expand...
Click to collapse
I actually mentioned installing international OOS in the post but for some reason I didn't link it or provide instructions. Silly me...
Edit: Post has been updated
LoganDark said:
I actually mentioned installing international OOS in the post but for some reason I didn't link it or provide instructions. Silly me...
Edit: Post has been updated
Click to expand...
Click to collapse
New problem, OEM unlocking is greyed out in the options on the developer preview...
EDIT: I'm a retard and didn't follow instructions. Ignore.

How To Guide how to Root Samsung Galaxy S23/S23+

How to Root Samsung S23/S23+ *Newbie Guide*
Attention, FYI:
The Root method was performed and successfully tested with a Samsung Galaxy S23 SM-911B/DS.
I do not guarantee that it will work on the other models, I can not test it because I do not have the devices.
However, it would be nice to hear if you have done it on another device model and it all works out, post here in the forum which model you have rooted.
Spoiler: Galaxy S23 - Model Information
SM-S911B -- Europe / Africa / Middle East / Oceania
SM-S911B/DS -- (assumed same as above, Dual SIM)
SM-S911U -- USA
SM-S911U1 -- USA ( factory unlocked )
SM-S911W -- Canada
SM-S911N -- Korea
SM-S9110 -- China / Taiwan / Hong Kong
SM-S911E -- Latin America
SM-S911E/DS -- (assumed same as above, Dual SIM)
WARNING
Before you root your device you must be aware that
This will void warranty.
As of now you will lose Samsung Pay and Samsung Pass forever if you root once, even unrooting won't help.
There are many features stop working when you unlock bootloader other than S pay/Pass like Samsung Health, Secure Folder, Galaxy Watch pairing issue, Issue connecting old gear watch (S3 or earlier), Google Pay etc but ROM is patched for all these mentioned features. Still you may trouble using some bank apps and these may fixed by adding these apps to Magisk Hide
There may be some knox features there which you may not able to use but I can't list those as I never used. Just Google It
Patched featurs are working today when writing this, No idea if it may stop working next moment/tomorrow or later
Also to note, once you root, you can't go back to "pre-rooted" state completely. It is one way!
OTA won't work once you root device.
Once you root the device, you will forever receive the following message: "Access denied - Unauthorized changes have been made to your phone. To get help, contact Customer Service.". Even if you reset the device back to factory settings and lock the bootloader, the message remains !!!! (with root there is a solution).
ROOT with caution.
You can unroot & Relock bootloader after flashing stock firmware, but still your warranty flag remain 0x1 and most of countries it still voids warranty. Also after unrooting & relocking bootloader, some knox features never work again.
First of all you need the following tools.
*A previously unlocked bootloader is the prerequisite!!*
Download last Samsung Drivers.
Download Odin v.3.14.1. (Thanks to realbbb)
Download Frija or Bifrost (Github Info)
Download Magisk v26.1 (Github Info) (Please use only this Magisk APK.)
1. Go into your Phone to developer mode and activate USB-Debugging
2. Install Magisk v 26.1 APK.
3. Download your (new) Firmware in Frija or Bifrost and Unzip File to PC.
4. Unzip Downloaded Firmware.zip.
5. Take from Unpacked Firmware.zip the "AP" to your Phone and open Magisk.
Go in Magisk to Install (from Device Slot) and take file the "AP- Data" from Storage and patch.
6. After Patch go your Download Folder from Device there is a MagiskPatched .tar Data. (your new AP-Data !)
Take the MagiskPatched.tar Data from your Phone to you Computer. (in same Folder like the Firmware files)
7. Open Odin on PC and turn off your Phone. Once your device is turned off > Hold Vol. UP + DOWN and Connect your USB-C cable from PC to your Phone. (Now start your Phone in Download Mode.) > Klick 1 time Vol. UP to start Download Mode.
Now in Odin your Device must be connected like "0:COM (Number)" in blue.
8. Now take from Unpacked Firmware.zip >
BL to BL
AP to MagiskPatched.tar
CP to CP
CSC to ***Read Attention***
*** Attention important!!! ***
#CLEAN - If you flash the first time Magisk clean on your device you must use the "CSC_OXM". (Accordingly, you lose all data and must set up your device again!!!)
#Update_Firmware - If you already have Magisk on your device and only make a firmware update take only the "HOME_CSC_OXM" !!! With the "HOME_CSC_OXM" you will not lose any data!
Start the Flash in Odin. (it takes 5 - 10 minutes!!!) Make sure that the cable is not accidentally touched / disconnected. It is best to use the supplied cable! Make sure that the cable has no loose contact and is seated correctly!
9. When the flash is finished, Odin says 1/Successful.
Your device will now restart automatically.
10. Once your device is successfully booted, open Magisk-App and you are successfully rooted. (A further reboot is automatically performed by Magisk!)
Finish !!! Gratulation !!!
If you have rooted your device I recommend the following Magisk extensions:
- Magisk Bootloop Protector v1.8.1-10015 - Safe you from Bootloop if u add wrong Magisk Module.
- BusyBox v1.0.4 - must have...
- SafetyNetFix v.2.4.0 > to pass SafetyNet and use Apps like Banking, etc.
- digitalkey_disabler_afaneh92 v1.0 > to FIX pop-up message "Access denied - Unauthorized changes have been made to your phone. To get help, contact Customer Service.". Even if you reset the device back to factory settings and lock the bootloader, the message remains !!!! (with root there is a solution)."
- ***Knox Patch v.0.5.0 (Thanks to BlackMesa123) > to FIX any Samsung Apps.
***For the KnoxPatch you need LSPosed v.1.8.6-6712-zygisk-release + KnoxPatch-APK + the KnoxPatch-Magisk modul.
Attached I have created a folder where I upload more Magisk extensions and APK tools for the S23. I will try to maintain it. If something useful is added I will pin it directly.
Root-Tools-Collection
If I have forgotten something, complement me.
Greetings Ramme
Do you have experience with ROM tool from Dr.Ketan? In this Magisk module there is an AdFree option and a lot customization. I thought that then KnoxPatch isn't needed because the fixes are also included.
waterpolo said:
Do you have experience with ROM tool from Dr.Ketan? In this Magisk module there is an AdFree option and a lot customization. I thought that then KnoxPatch isn't needed because the fixes are also included.
Click to expand...
Click to collapse
Yes, I personally use the Dr.Ketan Pro version. However, I try to work without the ROM-tool this time.
There is the ROM-tool-apk and if you pay the ProTwearks-extension-apk.
The problem is that you have to reset all settings in both tools after each system update, so I personally see no advantage in the ROM tool. With the last firmware update I was a little too hasty and have even shot me the ROM tool.
Unfortunately, Dr. Ketan makes no FULL ROM for the S23/S23+ so you have to live with it.
The Pro version is personally only for debloat.
On the subject of AD-Free, this is a nice extension, but this is a non-configurable AD-blocker, so you can not set personal configurations such as adding exceptions. So the classic and well working way use AdAway.
For AdAway there are some sources, I recommend if you are lazy the GoodbyeAds source + Own Exceptions.
Regarding the Knock Patch, I can't say anything about it, I use the file I pinned + LS-Posed (as a shortcut) and it works fine.
My SafetyNet is PASS.
Hello will this work on galaxy s23 sm-s911n ?
If not, do you have root instructions for sm-s911n
cashmonkey said:
Hello will this work on galaxy s23 sm-s911n ?
If not, do you have root instructions for sm-s911n
Click to expand...
Click to collapse
If you have the possibility to unlock the bootloader, it should work. The steps do not change.
However, I can't guarantee that it will work, so you have to try it at your own risk.
As far as I know, the bootloader cannot be unlocked on the US models, so you have no possibility to root there.
Ramme said:
If you have the possibility to unlock the bootloader, it should work. The steps do not change.
However, I can't guarantee that it will work, so you have to try it at your own risk.
As far as I know, the bootloader cannot be unlocked on the US models, so you have no possibility to root there.
Click to expand...
Click to collapse
Thank you for the prompt reply!
I'm in USA T-Mobile and purchased the galaxy s23 sm-s911n so I can get the 512gb version
I'll let you know when I get the phone and try the rooting to see if it works.
Fingers crossed
Thanks
hello there
after a further reboot automatically performed by Magisk,i lose root again,how to fix it
thanks
zeroabcdezero said:
hello there
after a further reboot automatically performed by Magisk,i lose root again,how to fix it
thanks
Click to expand...
Click to collapse
Did you use Magisk S23 version.
Last week my S23 rooted with the procedure in OP and have still root.
zeroabcdezero said:
hello there
after a further reboot automatically performed by Magisk,i lose root again,how to fix it
thanks
Click to expand...
Click to collapse
I had exactly the same problem, so it is very important to use exactly this Magisk version, which I have linked. Also, after installing Magisk, do not update Magisk for the time being.
Ramme said:
I had exactly the same problem, so it is very important to use exactly this Magisk version, which I have linked. Also, after installing Magisk, do not update Magisk for the time being.
Click to expand...
Click to collapse
Succeded!
Thank you again.
Ramme said:
I had exactly the same problem, so it is very important to use exactly this Magisk version, which I have linked. Also, after installing Magisk, do not update Magisk for the time being.
Click to expand...
Click to collapse
is the APK you linked the same as the canary version from the official Magisk GitHub?
Enddo said:
is the APK you linked the same as the canary version from the official Magisk GitHub?
Click to expand...
Click to collapse
No this is the APK which was posted in the "How to Root" topic by Dr. Ketan. This is currently the only Magisk APK that works with the S23 models.
For more info about the Magisk(KlickME). (Thanks to @BlackMesa123)
I have only uploaded everything separately in my cloud, on the one hand so that I can find the data quickly, on the other hand so that I can always keep the data up to date.
The only thing stopping me from rooting is losing Samsung Pay, which allows me to pay for public transportation without needing to unlock/authenticate.
Is there a way to retain Samsung Pay after rooting?
Gymcode said:
The only thing stopping me from rooting is losing Samsung Pay, which allows me to pay for public transportation without needing to unlock/authenticate.
Is there a way to retain Samsung Pay after rooting?
Click to expand...
Click to collapse
No there is (currently) no possibility to use SPay, there probably won't be.
You can use GPay as an alternative.
But it is also all described above in the topic. Please read it carefully before questions are asked. Alternatively, use a translator...
If new special possibilities come, I will of course share them with you, if you discover important features, please share them with me as well.
Adway is updated:
Releases · AdAway/AdAway
AdAway is a free and open source ad blocker for Android. - AdAway/AdAway
github.com
Hello all,
I'm running into an issue rooting S23 Plus that im not finding any information about online.
My boot loader is unlocked, I've followed the process to root. After installing the patched file from Magisk, the phone boots fine and gives me the setup, but I get an error at the portion where I accept Samsung terms. I just get -45
If I erase the phone back to the default FW, the setup completes without issue.
Has anyone ever seen this error before?
balbosta said:
Hello all,
I'm running into an issue rooting S23 Plus that im not finding any information about online.
My boot loader is unlocked, I've followed the process to root. After installing the patched file from Magisk, the phone boots fine and gives me the setup, but I get an error at the portion where I accept Samsung terms. I just get -45
If I erase the phone back to the default FW, the setup completes without issue.
Has anyone ever seen this error before?
Click to expand...
Click to collapse
Unfortunately not yet seen/had.
Try to reset your device according to my instructions, but for the first time without Magisk. Do not use the Home_CSC, but the normal CSC for the first time.
If your device can be set up and you get into the system, repeat the flash process with Odin, but now use the patched AP file and the Home_CSC file.
Now your device should boot, is set up and it should also have Magisk on it.
Ramme said:
Unfortunately not yet seen/had.
Try to reset your device according to my instructions, but for the first time without Magisk. Do not use the Home_CSC, but the normal CSC for the first time.
If your device can be set up and you get into the system, repeat the flash process with Odin, but now use the patched AP file and the Home_CSC file.
Now your device should boot, is set up and it should also have Magisk on it.
Click to expand...
Click to collapse
Okay, so just to confirm I'm doing this all correctly, since I'm fairly new to rooting.
I've downloaded the stock FW from Samfrew.
It contains 5 files.
AP, BL, CP, CSC, and HOME_CSC
On a clean install, I need to transfer AP to the phone and use Magisk to patch. After patch, I move back to my PC.
In Odin, I should be using AP from Magisk, then BL, CP, and HOME_CSC files from stock FW.
Is this correct?
balbosta said:
Okay, so just to confirm I'm doing this all correctly, since I'm fairly new to rooting.
I've downloaded the stock FW from Samfrew.
It contains 5 files.
AP, BL, CP, CSC, and HOME_CSC
On a clean install, I need to transfer AP to the phone and use Magisk to patch. After patch, I move back to my PC.
In Odin, I should be using AP from Magisk, then BL, CP, and HOME_CSC files from stock FW.
Is this correct?
Click to expand...
Click to collapse
Download your ROM in Frija.
Take out all the data.
Flash as follows:
BL, AP, CP, CSC. ( do not use the magisk-Patched-AP data)
Boot your device, set it up.
Once it's set up, install the Magisk APK version I post above and launch Magisk.(Dont Update Magisk!)
Drag the AP file to your device, patch the AP into Magisk and make it back to your PC.
Now flash BL, (Magisk-AP), CP, Home_CSC.
Then your device should boot normally and magisk is installed.
Ramme said:
Download your ROM in Frija.
Take out all the data.
Flash as follows:
BL, AP, CP, CSC. ( do not use the magisk-Patched-AP data)
Boot your device, set it up.
Once it's set up, install the Magisk APK version I post above and launch Magisk.(Dont Update Magisk!)
Drag the AP file to your device, patch the AP into Magisk and make it back to your PC.
Now flash BL, (Magisk-AP), CP, Home_CSC.
Then your device should boot normally and magisk is installed.
Click to expand...
Click to collapse
I tried this step by step.
After flashing with BL, Magisk-AP, CP, and Home_CSC, the phone will not boot. Eventually it tells me I need to factory reset. If I factory reset, the phone will boot to the setup, but im still met with "-45" when the phone should activate.

Categories

Resources