Read this whole guide before starting.
This is for the 2nd gen Fire TV (sloane)
Current relase: amonet-sloane-v1.1
NOTE: This process does not require you to open your device if you're already rooted or you have TWRP.
NOTE: If something goes horribly wrong and your device gets bricked, you'll have to open it and unbrick it through bootrom (post 2).
NOTE: This process will modify the partition-table (GPT) of your device.
NOTE: Your device will be reset to factory defaults (including internal storage) during this process.
NOTE: Flashing prerooted ROM will disable unlocked TWRP. It's recommended to flash an stock update.bin until that gets sorted out.
To update to the current release if you are already unlocked, just flash the zip in TWRP.
What you need:
A Linux installation or live-system
A a-a cable
1. Download the attached zip-file "amonet-sloane-v1.1zip".
2. Copy the zip-file to the internal storage of the box or copy the zip-file to an external SD/USB storage and connect it to the box.
3. Reboot the FireTV to rbox's TWRP recovery and flash the zip-file.
NOTE: If you are on firmware 5.2.7.3 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you need to continue with bootrom-step-minimal.sh:
NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.
NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip once you're in TWRP.
Once the zip-file finished flashing, disconnect the device and run:
Code:
sudo ./bootrom-step-minimal.sh
Then plug the device back in.
The device will reboot to hacked fastboot mode (Static Amazon White Logo + white blinking LED).
Then run:
Code:
sudo ./fastboot-step.sh
After that, the device will reboot to unlocked TWRP. Then go to Wipe > Format Data and type "YES".
You can now install Magisk from there.
Important information
NOTE: This has nothing to do with the unlock process.
You have 10 seconds to force TWRP to keep ADB over USB active by using
Code:
adb wait-for-recovery && adb shell setprop twrp.usb.mode 0
In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)
Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @k4y0z and @t0x1cSH for making all this possible by porting the LK exploit to sloane and implementing the RPMB-key derivation for sloane.
Special thanks also to @xyz` for making all this possible and releasing the original amonet exploit for karnak.
Special thanks also to @retyre for porting the bootrom-exploit to mt8173.
Special thanks also to @Sus_i and @DanielF50 for testing.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Unbricking / Unlocking with non-rooted Firmware
Prepare the environment, disable modemmanager and install the required packages:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip linked in the first post (OP).
If FireOS is still accessible there are other means of recovery, don't continue.
If your device shows one of the following symptoms:
It doesn't show any life (screen stays dark)
You see the white amazon logo, but cannot access FireOS.
If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).
Unplug the device from the wall
Start bootrom-step.sh
Plug in the power source and then the USB
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
1. Extract the attached zip-file "amonet-sloane-v1.1.zip" and open a terminal in that directory.
2. Start the script:
Code:
sudo ./bootrom-step.sh
It should now say Waiting for bootrom.
3. Connect the USB A-A cable, short the board according to the picture (DAT0 with GND), and connect the power supply.
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:
sudo ./fastboot-step.sh
8. Wait for the device to reboot into TWRP.
9. Format data and use TWRP to flash a custom ROM, Magisk or SuperSU.
Checking USB connection
In lsusb the boot-rom shows up as:
Code:
Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone
If it shows up as:
Code:
Bus 002 Device 014: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.
dmesg lists the correct device as:
Code:
[ 6383.962057] usb 2-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
Unlocking with ADB + root
NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.
1. Extract the attached zip-file "amonet-sloane-v1.0.1.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings.
3. Start the script:
Code:
sudo ./step-1.sh
Your device will now reboot into recovery and perform a factory reset.
NOTE: If you are on firmware 5.2.7.3 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you need to continue with bootrom-step-minimal.sh:
NOTE: Please refer to the #2 post on how to prepare your environment before proceeding.
NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip once you're in TWRP.
Once the zip-file finished flashing, disconnect the device and run:
Code:
sudo ./bootrom-step-minimal.sh
Then plug the device back in.
The device will reboot to hacked fastboot mode (Static Amazon White Logo + white blinking LED).
Then run:
Code:
sudo ./fastboot-step.sh
After that, the device will reboot to unlocked TWRP. Then go to Wipe > Format Data and type "YES".
If you used this method (brick), you're done with the unlock. Skip the step 4.
NOTE: Make sure you re-enable ADB after Factory Reset.
4. Start the script:
Code:
sudo ./step-2.sh
The exploit will now be flashed and your device will reboot into TWRP.
You can now install Magisk from there.
There are three options for interacting with TWRP:
A mouse/keyboard via USB
ADB over ethernet/USB
TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
Via /cache/recovery/command
Example for /cache/recovery/command:
Code:
echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
If you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
Code:
sudo ./boot-fastboot.sh
Code:
sudo ./boot-recovery.sh
NOTE: This will only work if the boot-exploit is still there.
Source Code:
https://github.com/chaosmaster/amonet-sloane
https://github.com/R0rt1z2/android_device_amazon_sloane
https://github.com/chaosmaster/android_bootable_recovery
Reserved
Nice to see this released - it's been a while in the making... just glad that me and my multiple sloanes could be of service to the community
edit: obviously Magisk works with a full unlock, but as Rortiz2 states above this must be flashed to boot_x - I would advise you pull your ROM's boot.img, patch it with MagiskManager & then flash this manually via hacked fastboot, otherwise it won't work & you'll probably brick your device again.
DanielF50 said:
Nice to see this released - it's been a while in the making... just glad that me and my multiple sloanes could be of service to the community
Click to expand...
Click to collapse
Yeah I'll second that, It works perfect and flawlessly. Be sure to follow the guide to the letter ..... .... It's good to see development continue to make progress on what I would say is the best amazon device of them all.
Well done. All your hardwork is greatly appreciated. @k4y0z , @Rortiz2 , @t0x1cSH, @Sus_i , @retyre , @diplomatic @DanielF50 without you guys continued attention and testing of these sticks/boxes we would be stuck with plain old boring devices.
Cheers again
regards
DanielF50 said:
I would advise you pull your ROM's boot.img, patch it with MagiskManager & then flash this manually via hacked fastboot, otherwise it won't work & you'll probably brick your device again.
Click to expand...
Click to collapse
Don't worry, magisk flashing in TWRP works (now).
Time to pull the Sloanes out of the drawer!
Ok, so I ran into some issues. I flashed the zip in the pre-rooted TWRP. No errors and reboots into unlocked TWRP. From unlocked TWRP i format data and type yes, then reboot. Now i am at the black amazon fire logo and nothing happens. I think i missed or didnt understand the downgrading part to older than 5.2.7.3. So, i think i have to do the shorting method now? Also, does anyone know where i can find a old version <5.2.7.3 .bin to flash? Is there anyway to get back into unlocked TWRP now?
http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.7.0-rooted_r1.zip
http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.6.7-rooted_r1.zip
All here, scroll down
Fire TV & Fire TV Stick Downloads: APKs von Apps & Games
Fire TV Downloads Sammlung von Android Apps (APK-Dateien), die man herunterladen und auf dem Amazon Fire TV und Fire TV Stick 4k installieren kann.
aftvhacks.de
0815hoffi said:
http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.7.0-rooted_r1.zip
http://aftvhacks.de/downloads/rooting/fire-tv-2/sloane-5.2.6.7-rooted_r1.zip
All here, scroll down
Fire TV & Fire TV Stick Downloads: APKs von Apps & Games
Fire TV Downloads Sammlung von Android Apps (APK-Dateien), die man herunterladen und auf dem Amazon Fire TV und Fire TV Stick 4k installieren kann.
aftvhacks.de
Click to expand...
Click to collapse
Thanks, great resource. I am looking for stock though...
" NOTE: Flashing prerooted ROM will disable unlocked TWRP. It's recommended to flash an stock update.bin until that gets sorted out. "
Michajin said:
Ok, so I ran into some issues. I flashed the zip in the pre-rooted TWRP. No errors and reboots into unlocked TWRP. From unlocked TWRP i format data and type yes, then reboot. Now i am at the black amazon fire logo and nothing happens. I think i missed or didnt understand the downgrading part to older than 5.2.7.3. So, i think i have to do the shorting method now? Also, does anyone know where i can find a old version <5.2.7.3 .bin to flash? Is there anyway to get back into unlocked TWRP now?
Click to expand...
Click to collapse
If the zip flashed fine forget about the downgrading part. Are you able to boot unlocked TWRP using boot-recovery.sh?
Here's an stock update.bin: https://d1s31zyz7dcc2d.cloudfront.n...indle-full_sloane-36.6.4.8_user_648594820.bin
Rortiz2 said:
If the zip flashed fine forget about the downgrading part. Are you able to boot unlocked TWRP using boot-recovery.sh?
Here's an stock update.bin: https://d1s31zyz7dcc2d.cloudfront.n...indle-full_sloane-36.6.4.8_user_648594820.bin
Click to expand...
Click to collapse
yes, boot-recovery works perfect. That is exactly what I needed thanks!
In case someone needs some newer 'full OTA update' packages of the stock rom, only for sloane:
Fire OS 5.2.7.3 (652614020).
https://d1s31zyz7dcc2d.cloudfront.net/7af0a9a31621db60bf48d23e680751d3/update-kindle-full_sloane-36.6.5.2_user_652614020.bin
Fire OS 5.2.7.4 (656638420).
https://d1s31zyz7dcc2d.cloudfront.net/7758ad70f668023cc93ddee2655c6226/update-kindle-full_sloane-36.6.5.6_user_656638420.bin
Fire OS 5.2.7.6 (659654620).
https://d1s31zyz7dcc2d.cloudfront.net/c5b513d2116f5ad2942426ab79bb437b/update-kindle-full_sloane-36.6.5.9_user_659654620.bin
5.2.7.6 is the latest OS (as of today).
Don't forget to rename the file, i.e. .bin to .zip.
Sus_i said:
Don't worry, magisk flashing in TWRP works (now).
Click to expand...
Click to collapse
Oh, awesome news!
Hey guys, So do users of the new unlocked twrp to only use the clean update.bin files provided by @Sus_i and not the rbox prerooted stock (supersu) roms? Just to clarify for the sake of Magisk clashing with Supersu prerooted firmware incase it throws some nasty surprises.
Regards
Next OTA update incoming...
Full OTA update package (latest stock) for sloane:
Fire OS 5.2.7.7 (662663720).
https://d1s31zyz7dcc2d.cloudfront.net/b9f7c8f9a8a4ba1f34da8ce7a8077474/update-kindle-full_sloane-36.6.6.2_user_662663720.bin
Sus_i said:
Next OTA update incoming...
Full OTA update package (latest stock) for sloane:
Fire OS 5.2.7.7 (662663720).
https://d1s31zyz7dcc2d.cloudfront.net/b9f7c8f9a8a4ba1f34da8ce7a8077474/update-kindle-full_sloane-36.6.6.2_user_662663720.bin
Click to expand...
Click to collapse
5.2.7.7 yipeee
Seconds later bootloader is locked lol
I'm currently on 5.2.7.4 I think I'll stay there. This is the os before big A started messing with adb and accessibility (launchers) you can just disable launcher and firehomestarter apk provided there is a settings apk installed (hoffis is great).
lol
Related
Introducing: Kindle Fire 2nd-bootloader + TWRP 2.6.3.0 for the Kindle Fire 2nd GEN
*** USE AT YOUR OWN RISK! WHILE I TRY MY BEST TO PROVIDE WORKING KERNELS/ROMS, I AM NOT RESPONSIBLE IF THIS SOFTWARE OR ANYTHING I'VE WORKED ON SUDDENLY FRIES YOUR DEVICE. ***
*** READ CAREFULLY BEFORE DOING ANYTHING ***
*** Kindle Fire 1st-gen ROMs/KERNELS are *NOT* compatible with the Kindle Fire 2. Please only flash ROMs/KERNELS that are made for the Kindle Fire 2. ***
** IF YOU HAVE QUESTIONS, RE-READ THROUGH THE THREAD FOR ANSWERS. WHEN YOU'RE ABSOLUTELY SURE NO ONE HAS ASKED YOUR QUESTION, GO AHEAD AND RE-READ THE THREAD AGAIN AND USE THE SEARCH FEATURE. THEN POST YOUR QUESTION IF YOU STILL CAN'T FIND THE ANSWER **
** WHEN MOVING FROM AMAZON OS TO CM10.1 IN TWRP: "WIPE" -> "SYSTEM" AND "FACTORY RESET" TO CLEAR SYSTEM/DATA/CACHE. YOUR APPS FROM AMAZON ICS AREN'T COMPATIBLE. IF NOT YOU'LL LOOP ON THE CM10.1 BOOT ANIMATION **
[03/27] NEW support thread for OFFICIAL CM on the Otter2 (Kindle Fire 2):
http://forum.xda-developers.com/showthread.php?t=2209995
** YOU SHOULD HAVE A WORKING FASTBOOT CABLE + FASTBOOT DRIVERS/ACCESS ON YOUR PC. **
Q: How do I know if my fastboot works?
A: Plug the cable into your device and then the computer. Reboot the Kindle. It *SHOULD* show a Fastboot screen. Once at the screen use this command on your computer:
fastboot -i 0x1949 devices
You should see something like this:
0123456789ABCDEF
Here's 1 website you can purchase a FASTBOOT adapter from (works with your normal USB cable)
http://shop.teamblackhat.info/Factory-Adapters-motadapt.htm
** I don't make any commission or fee from the sales of these devices, I just know they have them on stock most of the time and ship in a reasonable time frame unlike the Chinese variants found on ebay.
If you do NOT see this, then make sure you have the SDK installed correctly and you have the right setup for fastboot on your PC before proceeding.
*** BE SURE YOU HAVE A GOOD CHARGE ON THE DEVICE ***
INITIAL SETUP INSTRUCTIONS (1st TIME ONLY) FOR 2ND-BOOTLOADER + TeamWinRecoveryProject INSTALL:
STEP 1. Backup your stock partitions to your own HD for later if you need disaster recovery:
Code:
adb pull /dev/block/mmcblk0boot0
adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/boot
adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/system # This will take a few minutes
Take those files and put them somewhere safe.
STEP 2: Download the files you will need to install 2nd-bootloader, TWRP and CM10.1:
Stack override file:
http://goo.im/devs/Hashcode/otter2/stack
[12/09] otter2-freedom-boot-10.4.6.img (USED ONLY THE FIRST TIME -- .zip files will have their own boot.img's from now on):
http://goo.im/devs/Hashcode/otter2/otter2-freedom-boot-10.4.6.img
md5sum: 80f9b9ba80910de361463560f86f315a
[09/03] TeamWin Recovery 2.6.3.0:
http://goo.im/devs/Hashcode/otter2/otter2-twrp-2.6.3.0-recovery.img
md5sum: a66a8cbab92fd5daaa85f6303e9cc0c3
older 10.2.4 bootloader file and flash to your device via fastboot:
http://goo.im/devs/Hashcode/otter2/otter2-u-boot-prod-10.2.4.bin
md5sum 5b03a7b428325de8d360ec201a745498
(You SHOULD check the MD5SUM before using fastboot -- downloads CAN be corrupted)
CM-10.1/CM-10.2 for the Kindle Fire 2 (choose the latest version from):
http://www.get.cm/?device=otter2
Google Apps from: http://goo.im/gapps (choose the version: CM10.1 or CM10.2)
Place the ROM and the gapps .zip on your device in the /sdcard area
STEP 3. Install the stack override in /system:
ADB commands entered while booted up into STOCK *rooted* Amazon Kindle OS -- May need to enable ADB debugging in Settings:
[2013-08-21] edited the location where stack is placed on device due to permissions changes
Code:
adb push stack /sdcard/
adb shell su -c "dd if=/sdcard/stack of=/dev/block/platform/omap/omap_hsmmc.1/by-name/system bs=6519488 seek=1"
[ Connect fastboot cable, and reboot the device so that "Fastboot" is showing ]
STEP 4.
Flash the OLD bootloader, new otter2-freedom-boot.img and TWRP recovery.[/B]
*DONT RE-FLASH FREEDOM-BOOT.IMG LATER AFTER FLASHING CM10.1 -- IT'S FOR STOCK AMAZON OS ONLY / FIRST INSTALL ONLY*
Code:
fastboot -i 0x1949 flash bootloader otter2-u-boot-prod-10.2.4.bin
fastboot -i 0x1949 flash boot otter2-freedom-boot-10.4.6.img
fastboot -i 0x1949 flash recovery otter2-twrp-2.6.3.0-recovery.img
fastboot -i 0x1949 reboot
** If everything was done correctly you will at this point see the bootmenu with a BLUE logo during the reboot. **
TO ENTER RECOVERY:
During the blue logo screen press the power button to cycle through options and select "Recovery" to enter TWRP.
Once in TWRP you can Install" the CM-10.1/CM-10.2 by selecting "Install" and then browsing the device and selecting it, then "Add Zip" and select the Gapps .zip as well.
Use the slider to start the install.
FLASHING BACK TO STOCK:
** FIND THE FILES WE BACKED UP IN STEP #1 OR DOWNLOAD NEW ONES FROM THE RECOVERY THREAD HERE: **
http://forum.xda-developers.com/showthread.php?t=2035047
Once you have these files (we'll name them boot.img/recovery.img and system.img for the purpose of these instructions, but they could be different on your system).
Plug in your fastboot cable and reboot so that you see the fastboot screen and enter the following commands:
Code:
fastboot -i 0x1949 flash boot [B]boot.img[/B]
fastboot -i 0x1949 flash recovery [B]recovery.img[/B]
fastboot -i 0x1949 flash system [B]system.img[/B] # This one will take a few minutes
fastboot -i 0x1949 reboot
Enjoy
THANKS TO:
fattire for finding the original bootloader exploit
TESTERS: powerpoint45 and FMKilo
Changelog: updated 2013-07-08
freedom boot.img (for use w/ stock Amazon OS + 2nd-bootloader):
[07/08] Updated w/ kernel from 10.4.3 release
TeamWin Recovery (TWRP) 2.6.0.0
[07/08] USB Vendor ID / Product ID in recovery now matches stock Amazon OS
[07/08] Based on 10.4.3 stock kernel
[07/08] Fixed recovery bootloop issue
[07/08] TWRP 2.6.0.0 update
one more reserved space
no chance to flash without fastboot cable? cause when i do
su
reboot bootloader
the fire boots into fastboot...does this work too?
Hondologe said:
no chance to flash without fastboot cable? cause when i do
su
reboot bootloader
the fire boots into fastboot...does this work too?
Click to expand...
Click to collapse
Yes, this would work, however if something goes wrong (and it frequently can during early development) you will have NO WAY of recovering the device without a fastboot cable. So I don't recommend this method currently.
Also, these instructions are BRAND NEW, and I understand if you really want to get this setup, but please let some users w/ fastboot cables run through the instructions to make sure I didn't typo something, etc.
Good work man! Can't wait for my fastboot cable so I can try this out.
Sent from my SAMSUNG-SGH-I727 using Tapatalk 2
mindmajick said:
Good work man! Can't wait for my fastboot cable so I can try this out.
Sent from my SAMSUNG-SGH-I727 using Tapatalk 2
Click to expand...
Click to collapse
I`m gonna try it later WITHoUT FB cable . If it fails i just have to wait a couple of days, so its worth it if i get CM onto my kindle
BTW If it fails, im gonna blame it on you (Just kidding...)
Thanks hash code!!! Is this ROM the updated one so Apollo won't force close?
powerpoint45 said:
Thanks hash code!!! Is this ROM the updated one so Apollo won't force close?
Click to expand...
Click to collapse
I did make the /storage/usb0 changes in this ROM. No telling if it'll fix the Apollo FCs till we get it tested.
Hashcode said:
I did make the /storage/usb0 changes in this ROM. No telling if it'll fix the Apollo FCs till we get it tested.
Click to expand...
Click to collapse
OK cool! Looking forward to build custom ROM. Downloading latest ROM now... I think Darwin's upload failed ): not showing up as right file size on goo.im. will check md5 at home
Edit:no FC yet
i just ordered my factory cable... thanks hashcode and powerpoint45!
powerpoint45 said:
OK cool! Looking forward to build custom ROM. Downloading latest ROM now... I think Darwin's upload failed ): not showing up as right file size on goo.im. will check md5 at home
Edit:no FC yet
Click to expand...
Click to collapse
Goo doesn't always update the file size on the webpage during large uploads. Have him double-check the md5sum.
Hashcode said:
Goo doesn't always update the file size on the webpage during large uploads. Have him double-check the md5sum.
Click to expand...
Click to collapse
OK. I will when I get home so I can check md5. Any ideas to fix ducati?
powerpoint45 said:
OK. I will when I get home so I can check md5. Any ideas to fix ducati?
Click to expand...
Click to collapse
If someone has the time to do a video guide for this that would be great.
Congrats!
(that's all I got)
Congrats and thanks again to you and all involved!
Just soldered my own factory cable this evening from a spare micro-usb cable, and I could start my kindle in fastboot mode
Too late now so I'll take a deeper look and try to flash tomorrow evening and give some feedback - also have to find this damn fastboot command, wouldn't shop up in my terminal?!
Jowyn said:
Congrats and thanks again to you and all involved!
Just soldered my own factory cable this evening from a spare micro-usb cable, and I could start my kindle in fastboot mode
Too late now so I'll take a deeper look and try to flash tomorrow evening and give some feedback - also have to find this damn fastboot command, wouldn't shop up in my terminal?!
Click to expand...
Click to collapse
You will probably need to install the Android SDK to get the fastboot command.
Hashcode said:
You will probably need to install the Android SDK to get the fastboot command.
Click to expand...
Click to collapse
And all the image files that need to be flashed via fastboot need to reside where fastboot.exe is just to clarify.
Hashcode said:
You will probably need to install the Android SDK to get the fastboot command.
Click to expand...
Click to collapse
If you follow the noob guide on rooting the kindle fire 2 it tells you to download two files, inside of either of those two files is adb and fastboot as well as all the needed drivers, if you place the files needed to do this process inside of either of those folders holding down control while right clicking inside of the folder ( making sure nothing is highlighte) select open command prompt here, that way you should be able to do this process without the sdk
Let me know how it turns out and hopefully that will save some people the headache of getting their environmental variables set up correctly ( my computer likes to play stupid )
and nobody mentioned me.. come on, I thought I was listed in credits as moral support, and kid who flashed without a fbcable.. I know how to do it, and you could too if you just read up enough on idme and bootmodes..
No more from me, I don't want to be the one who is in trouble for bricked non factory cable owning users..
Preamble
As the title suggests, I had a Nexus 5 running stock Android 5.0, with root and TWRP, and wanted to update to Android 5.0.1 (without losing all my data, of course). I couldn't find any guides for my particular circumstances, so after working out how to do it myself, I thought I'd share my method.
Note: This guide is not for the uninitiated. Be prepared to Google something for yourself if you don't understand it.
Prerequisites
Before starting this guide, you should have:
A Nexus 5 that running stock Android. The presence of root/Xposed/custom recovery (maybe custom kernels?) shouldn't be relevant, but I can't vouch for the efficacy of this guide if you've done something obscure to your install.
Android SDK tools, specifically the ADB and fastboot binaries. Additional USB drivers may be required on Windows.
The factory image for the Android version you are currently running.
1. Uninstall root and other /system modifications
If you have rooted your Android, and/or installed BusyBox, Xposed or other modifications to /system, you will need to uninstall these modifications. Failing to do so will cause the OTA to complain that there's something funky going on in your /system partition.
You may be able to manually uninstall each of these modifications, but this was not enough for my install – doing a ‘Full unroot’ in SuperSU still left behind files in /system. The easiest way to uninstall all /system modifications is to reflash the /system partition.
Extract the Nexus 5 factory image (e.g. hammerhead-lrx21o-factory-01315e08.tgz), yielding a directory with files such as flash-all.bat and image-hammerhead-XXXXXX.zip. Do not use the flash-all script, as this will unnecessarily wipe all data on the device.
Extract the image-hammerhead-XXXXXX.zip file, specifically the system.img file.
Open a command prompt/terminal window.
Connect the phone to the computer with a USB cable.
Boot the phone into the bootloader.
Method 1: Power down the phone, then hold VolUp + VolDn + Power until the phone boots into the bootloader.
Method 2: From the terminal, run adb reboot bootloader while the phone is still powered on.
From the terminal, run fastboot flash system /path/to/system.img.
2. Uninstall any custom recovery
Custom recoveries don't seem to support OTA updates, making it necessary to uninstall the custom recovery by reflashing the stock recovery.
Extract the recovery.img file from the factory image, as in Part 1.
Open a command prompt/terminal window, connect the phone to the computer, and boot into the bootloader, as in Part 1.
From the terminal, run fastboot flash recovery /path/to/recovery.img.
Optional: Reflash boot.img and/or cache.img
Some users have reported that reflashing system.img was not sufficient, and that reflashing boot.img and/or cache.img was also necessary. I did not have this problem, but if you do:
Extract the boot.img and/or cache.img files from the factory image, as in Part 1.
Open a command prompt/terminal window, connect the phone to the computer, and boot into the bootloader, as in Part 1.
From the terminal, run fastboot flash boot /path/to/boot.img.
From the terminal, run fastboot flash cache /path/to/cache.img.
3. Apply the OTA update
The simple part. In the bootloader, use the VolUp/VolDn buttons to select ‘Start’, then press the Power button, to reboot into Android. Follow the system update instructions to install the OTA update.
4. Reflash the custom recovery and re-root
Also self-explanatory.
Hey,
I just wanted to say thanks. This totally fixed the problem I was having. I also want to add that after I flashed the system.img, I was getting errors related to "EMMC:/dev/block/platform/msm_sdcc.1/by-name/boot" with a bunch of numbers after. I googled it and found I had to also flash boot.img, and after that, the OTA worked fine. I would assume if anyone else gets errors like this, they should flash whatever img it shows in the error (ie: mine said /by-name/boot so I flashed boot.img).
-BGM
It worked for me
I've always been using a toolkit for my rooting purposes, I have done Full Unroot on SuperSU, but still getting an error when trying to update to 5.0.1
Will flashing stock wipe everything(whatsapp image, camera's,messages, etc etc)on my phone?
azlan96 said:
I've always been using a toolkit for my rooting purposes, I have done Full Unroot on SuperSU, but still getting an error when trying to update to 5.0.1
Will flashing stock wipe everything(whatsapp image, camera's,messages, etc etc)on my phone?
Click to expand...
Click to collapse
I also had problems using ‘Full Unroot’ in SuperSU. It's not actually as ‘full’ as it sounds.
Flashing a full factory image would normally wipe everything, but carefully following this guide will only reset the /system partition, not any user data.
I'd like to say thank you very much! I was looking for this kind of tutorial... I encountered an error while following all the steps because I forgot I had a custom kernel. So I wanted to add that if you have a custom kernel remember to do the same steps as described above for the kernel (return to stock) and then follow the system and recovery steps afterwards.
If you don't like running commands in terminal you can use Nexus Root Toolkit, on advanced, you have all the commands you need available.
Thank you very much RunasSudo
Taiyo85 said:
I'd like to say thank you very much! I was looking for this kind of tutorial... I encountered an error while following all the steps because I forgot I had a custom kernel. So I wanted to add that if you have a custom kernel remember to do the same steps as described above for the kernel (return to stock) and then follow the system and recovery steps afterwards.
If you don't like running commands in terminal you can use Nexus Root Toolkit, on advanced, you have all the commands you need available.
Thank you very much RunasSudo
Click to expand...
Click to collapse
I have my ADB and Fastboot ok as confirmed by nexus root toolkit, but I am not sure on how to use terminal.. I launched command prompt but it doest recognise all the commands..
Tried Flash Stock + Unroot on Nexus Root Toolkit but the software will crash (fastboot.exe has stopped responding)
I am really clueless on what to do next..
azlan96 said:
I have my ADB and Fastboot ok as confirmed by nexus root toolkit, but I am not sure on how to use terminal.. I launched command prompt but it doest recognise all the commands..
Tried Flash Stock + Unroot on Nexus Root Toolkit but the software will crash (fastboot.exe has stopped responding)
I am really clueless on what to do next..
Click to expand...
Click to collapse
Flash Stock + Unroot wipes everything and defeats the purpose of the tutorial made by RunasSudo
First and foremost you should download Android SDK (Tools only) on http://developer.android.com/sdk/index.html and then ask to install the extra: Google USB Driver.
With Nexus Root Toolkit you don't need terminal, click on advanced and you should see options to flash through fastboot the system only, recovery and kernel. It is pretty straighforward and it asks where the .img are in your computer
Thanks! This guide worked.
For Ubuntu users, you need to install adb and fastboot with these commands :
sudo add-apt-repository ppahablet-team/tools && sudo apt-get update (optional)
sudo apt-get install android-tools-adb android-tools-fastboot
Thanks for the great step by step.
As with some of the other posters, re-flashing system.img was not enough for me, I had to also re-flash the boot.img. Once that was done, I had no problems side loading the update and am now running LRX22C.
I only seem to fiddle with adb once a year - when it OTA time comes - and can never seem to remember some of the steps that need to be taken. Reading through some of the other threads, I have a feeling a lot of people who rooted/custom recovery and cant do the OTA are going to be doing complete image re-flashes when this guide makes that completely unecessary.
thanks again,
.d
BananasGoMoo said:
I googled it and found I had to also flash boot.img, and after that, the OTA worked fine.
Click to expand...
Click to collapse
datcon said:
As with some of the other posters, re-flashing system.img was not enough for me, I had to also re-flash the boot.img.
Click to expand...
Click to collapse
Thanks for the feedback! I've added a note about boot.img to the OP.
+1 for flashing boot.img worked perfect after I did that.
I tried with this tutorial. I flashed system and recovery and then restart. Confirm OTA but I get ERROR.
Then I flashed boot as it was described. Now I don't get OTA In About phone, I'm still on 5.0.0, Check for updates now don't find update
Any idea?
UPDATE - UPDATE: After hour now it is here ... super, it works.
This walkthrough was most helpful! Ended up replacing the boot.img as well since I had ElementalX installed. My apps are optimizing as we speak. Thank you!
Worked for me. What a hassle!
Here is a summary of the process for those looking for a less wordy procedure, with a few added steps:
Download Nexus 5 5.0 (LRX21O) file (note: NOT 5.0.1 yet) https://developers.google.com/android/nexus/images
Unzip via 7-zip multiple times in order to get boot.img, recovery.img, system.img
Enable USB debugging: http://www.kingoapp.com/root-tutorials/how-to-enable-usb-debugging-mode-on-android-5-lollipop.htm
Plug phone into PC > cmd prompt where adb is installed > type "adb devices" to ensure connection is valid (will need to authorize via popup on phone > then "adb devices" should return your device id and "device"; if it says "unauthorized" then look for the popup on your phone)
adb reboot bootloader
Put system.img, recovery.img, and boot.img in same folder as fastboot.exe
Run commands:
fastboot flash system system.img
fastboot flash recovery recovery.img
fastboot flash boot boot.img
fastboot erase cache (this is optional. I didn't have to do it, but you might)
Use Volume Up/Down to select Start > press Power Button to reboot
Update via Settings > About Phone > System Update
Re-flash TWRP recovery:
Get the file from here: http://forum.xda-developers.com/showpost.php?p=57580889&postcount=1
adb reboot bootloader
fastboot flash recovery openrecovery-twrp-2.8.1.0-hammerhead.img
Paul22000 said:
Worked for me. What a hassle!
Here is a summary of the process for those looking for a less wordy procedure, with a few added steps:
1. Download Nexus 5 5.0 (LRX21O) file (note: NOT 5.0.1 yet) https://developers.google.com/android/nexus/images
2. Unzip via 7-zip multiple times in order to get boot.img, recovery.img, system.img
3. Enable USB debugging: http://www.kingoapp.com/root-tutorials/how-to-enable-usb-debugging-mode-on-android-5-lollipop.htm
4. Plug phone into PC > cmd prompt where adb is installed > type "adb devices" to ensure connection is valid (will need to authorize via popup on phone > then "adb devices" should return your device id and "device"; if it says "unauthorized" then look for the popup on your phone)
5. adb reboot bootloader
6. Put system.img, recovery.img, and boot.img in same folder as fastboot.exe
7. Run commands:
fastboot flash system system.img
fastboot flash recovery recovery.img
fastboot flash boot boot.img
8. Use Volume Up/Down to select Start > press Power Button to reboot
9. Update via Settings > About Phone > System Update
Click to expand...
Click to collapse
Maybe you could add `fastboot erase cache` as stepp 8.
gee2012 said:
Maybe you could add `fastboot erase cache` as stepp 8.
Click to expand...
Click to collapse
I added it to step 7, thanks. :good: I also cleaned up the formatting and added step 10 about re-flashing TWRP.
Loading problem
I flashed system, recovery & boot images strictly following the instructions, restarted the phone. It got stuck in loading where balls in four colors keep running for half an hour. Shall I keep waiting? I think there must be something wrong. Your advises are welcome.
guangy said:
I flashed system, recovery & boot images strictly following the instructions, restarted the phone. It got stuck in loading where balls in four colors keep running for half an hour. Shall I keep waiting? I think there must be something wrong. Your advises are welcome.
Click to expand...
Click to collapse
Try flash the partitions again. If it's still not working, you may need to reflash a factory image.
RunasSudo said:
Try flash the partitions again. If it's still not working, you may need to reflash a factory image.
Click to expand...
Click to collapse
I flashed the cache image as well, then the problem solved. Thanks
First, thanks to @Uzephi and @41rw4lk for helping me to use/recover my phone. Please, read and do not underestimate the guides: our phone is tricky! We have two system partitions (slot a and b) to allow stock updates on-the-fly. This complicates the normal flashing process and if you do not follow the steps, you may bootloop. Use these guides at your own risk!
Reading this page is a good beginning to understanding the A/B partitioning scheme and how Motorola Z2 Force works:
1) Our phone has A/B partitioning, so flashing Magisk/XPosed is different
2) It does not support Project Treble (faster stock updates)
3) It does not a recovery partition, so flashing TWRP is different
Note also that the RSD Lite from Motorola has issues with Windows 10 and you’ll need to manual flash firmware if you bootloop (see Process E below). Other way is directly flashing from Qualcomm EDL mode (Emergency Download Mode) from which users can perform various tasks like unbricking, unlock bootloader, and installation of any custom ROMs.
Right now, this guide has 5 parts (maybe we can dual boot our phone in the future). If you just want to use a rooted stock ROM, please, search for other guides here on xda. These guides were written (and tested) using a Motorola Z2 Force XT1789-05 phone (Brazil), although most of it should work for other variants if you download and use proper firmware files for these other phones. For other models, better if you follow Uzephi’s guide.
A. Opening bootloader
B. Preparing the phone to move into custom ROMs (AOSP) + TWRP recovery
C. Flashing a custom AOSP ROM + rooting
D. Dirty flashing AOSP ROM updates
E. Recovering from bricks or returning to stock
F. Oreo ROM features comparison table
If you want to move your Motorola Z2 Force to Project Treble ROMs, please, check this guide.
Here is a list of the ROMs that are waiting for you.
A. Opening bootloader
With enough battery in your phone (80%), you can follow the Motorola official guide which steps are:
1. Backup everything you need. Your phone will be reseted including the internal sdcard.
2. Into the phone, enable the Developer Options clicking 7 times over the version (About section in the Settings). Go to Developer Options, click the OEM unlock option to enable it. Also enable USB debugging.
3. Install the Motorola drivers in your computer, but (in my personal experience) not the Android SDK suggested in the official guide. Instead, extract these adb/fastboot files in a blank folder of your computer.
3.1) Do not use other adb/fastboot binaries: I cannot guarantee they will work.
3.2) You need to use a USB 2.0 port of your computer. Some users report that USB 3.0 will also work.
4. Open a command line window in the adb/fastboot folder (step 3), reboot the phone into the bootloader (see adb command below or press power + volume down buttons). Plug the phone on computer (see 3.2 above). Test the connection and run the command to get the code for unlocking:
Code:
adb reboot bootloader
fastboot devices
fastboot oem get_unlock_data
You’ll get:
Code:
(bootloader) Unlock data:
(bootloader) <code 1>
(bootloader) <code 2>
(bootloader) <code 3>
(bootloader) <code 4>
(bootloader) <code 5>
5. You’ll need to join 5 codes and, after logging into your own Motorola account, check by clicking the button “Can my device be unlocked” (step 6) by Motorola here. Read the text: your warranty will be void if you go ahead. Consider if you have enough knowledge, time and money to deal with a troublesome (or bricked) device. Although, it’s not that easy to hard brick this phone (see process E below).
Code:
<code 1><code 2><code 3><code 4><code 5>
6. You’ll receive back an email with the code to unlock your bootloader (if it is available for your model). Then you’ll run the following command:
Code:
fastboot oem unlock <code 1><code 2><code 3><code 4><code 5>
7. You’ll receive a warning that all your data would be erased (see step 1 above) and need to re-run the same command to confirm. At this point, your bootloader should be unlocked. As an Android restriction, each time you boot the phone you’ll see a warning. Do nothing, wait for 5 seconds and the phone boots normally. Some users bother with this warning and try to get rid of it.
B. Preparing the phone to move into custom ROMs (AOSP) + TWRP recovery
Requirements: unlocked bootloader (see guide A) and no security lock: disable PIN, gestures and fingerprinting (because TWRP cannot read the locked/cryptographed data of the phone). Enough battery in your phone (80%).
If you do not prepare your phone to custom ROMs and if you do not have both bootloaders of the phone in the same Android version of the ROM you’ll flash, you’ll hard brick the phone and lose also the access to the bootloader! You’ve been warned: follow the guide!
Note: if you hard brick, I suggest you be prepared to follow the Unbrick Qualcomm mobiles with Step-by-step guide or the Unbrick All Qualcomm Snapdragon’s from Qualcomm HS-USB QDLoader 9008 guide, but I never tested them myself. You can also use Qualcomm Flash Image Loader (QFIL) tool.
1. Backup everything you need. Your phone will be reset including the internal sdcard.
2. Into the phone, enable the Developer Options clicking 7 times over the version (About section in the Settings). Go to Developer Options and enable USB debugging.
3. Install the Motorola drivers and the adb/fastboot files.
3.1) do not use other adb/fastboot binaries: we cannot guarantee they will work.
3.2) you need to use a USB 2.0 port of your computer. Some users report that USB 3.0 will also work.
4. Download the firmware of the same Android major version of the future ROM you’ll install (Oreo for Oreo ROMs, for instance). When (and if) we move to Android P, most probably we will need to follow this guide again.
- Retail (XT1789-05) (Europe/Brazil).
- Other models (branded): ATT, Sprint, T-Mobile (TMO), USC, Verizon.
- Note: NPXS26 versions stand for Nougat and OPXS27 for Oreo. You do not need Nougat versions for anything.
5. Extract the zip contents to a blank folder in your computer.
6. Download the FlashAll_XT1789-05.zip file, extract the content and move all files to the same firmware folder (step 5 above). Be sure to overwrite any file (if needed).
7. Run the Preparation.bat file there to generate the flashfile.bat file that will send the commands to the phone. Credits: the original preparation files were from RootJunky (can be downloaded here) and include more options that we do not need for our purpose here. Also, it includes adb/fastboot binaries that could not work with our phone.
8. Reboot the phone into the bootloader (see adb command below or power + volume down buttons). Open a command line window in the firmware folder (step 5 above), test the connection and execute the flashfile.bat file generated on step 7.
Code:
adb devices
adb reboot bootloader
fastboot devices
flashfile.bat
Never ever unplug the device from the USB 2.0 port while flashing the firmware. This could cause a hard brick and your device will be dead.
9. There is a pause at the end. You should review if everything went fine (or even click on the menu of the command line window, select all and copy&paste the contents in a .txt file for further help/revision).
10. Reboot your phone into the system (ROM) and do a quick configuration (remember that everything will be deleted when you install TWRP further…).
11. Into the phone, enable the Developer Options clicking 7 times over the version (About section in the settings). Go to Developer Options and enable USB debugging.
12. Download both the .img and .zip file of the TWRP recovery from the official site. It's the same file for all models/variants of Z2 Force phone. Put the files into our firmware folder (step 5 above). Copy the .zip file to the phone internal card. Note: versions older than 3.2.2-2 does not support PIN/Password/Fingerprint, so disable them before proceed. Most probably, ROMs before July 20th, 2018 cannot be flashed in older TWRP.
13. Now boot (not flash) the TWRP .img file using a command line window in the same firmware folder (step 5 above):
Code:
adb devices
adb reboot bootloader
fastboot devices
fastboot boot <TWRP file name>.img
14. Only now that you’re inside TWRP temporarily flash the TWRP .zip file you’ve saved into the phone (step 12 above).
15. Reboot into TWRP (use the main reboot menu in TWRP).
16. Now, you should reboot again into bootloader: inside TWRP, go to Reboot menu and choose Bootloader.
17. Now you will wipe all user data via bootloader. This is necessary to use an AOSP ROM when you come from stock. Using a command line window in the same firmware folder of your computer (step 5 above), run the following commands:
Code:
fastboot devices
fastboot -w
18. Now you can reboot the phone into System using the buttons volume up/down to navigate and confirming with the Power button. You’ll be with stock ROM and TWRP. If you want to move to a custom AOSP ROM, do a quick configuration: into the phone, enable the Developer Options clicking 7 times over the version (About section in the settings). Go to Developer Options and enable USB debugging and go to the proper guide (Process C).
C. Flashing a custom AOSP ROM + rooting
1. Requirements:
1.1 Motorola drivers.
1.2 Our custom adb/fastboot files (others may not work!).
1.3 USB debugging enabled into the Developer Options.
1.4 If you're using TWRP older than 3.2.2-2, disable disable PIN/gestures/fingerprinting. Also, most probably, ROMs after July 20th, 2018 cannot be flashed in older TWRP.
1.5 An USB 2.0 port of your computer (some users report that USB 3.0 will also work).
1.6 Two Oreo bootloaders (process B above).
1.7 Permanent TWRP
1.8 Enough battery in your phone (80%).
2. Download the AOSP ROM you want and move the .zip files to the phone. Right now, we have:
2.1 Dirty Unicorns: no need for Gapps. Official and Weeklies can be dirty flashed interchangeably. RC has a different signature. Support on Google+ page. More about DU kernel.
2.2 Lineage OS 15.1. MindTheGapps needed. OpenGapps not compatible yet. XDA thread.
2.3 Mokee: Gapps needed. Take care: online guides assume that you already have an AOSP ROM, TWRP and rooted device.
Deprecated (?)
2.4 AOSiP: no need for Gapps. XDA thread.
2.5 Invictrix. Gapps are built in. XDA thread
3. Choose the root method and download the .zip files: Magisk (suggested) or LineageOS SU Addon. Move the .zip files to phone. Note: if you bootloop on Magisk, most probably you’re flashing a wrong/different version of Magisk or you did not reboot between flashing ROM/Gapps and Magisk. Note: SuperSu is deprecated.
4. Reboot into TWRP:
Code:
adb reboot recovery
Then flash the ROM. It will be flashed in two steps only in the “other” slot. We have two slots, A and B. Our phone can be upgraded on-the-fly because the update is always applied to the slot not booted, the “other” slot. Then, immediately, flash the .zip TWRP or you will lose it.
5. Go to Reboot menu of TWRP and reboot into bootloader. Then, in the folder with adb/fastboot binaries (see 1.2 above), you need to wipe data (including sdcard) with the following commands:
Code:
fastboot devices
fastboot -w
6. Now you need to reboot the phone into System using the buttons volume up/down and confirming with the Power button (or typing fastboot reboot into the command line windows). You’ll be with an AOSP ROM and TWRP.
7. Once into the phone, enable the Developer Options clicking 7 times over the version (About section in the settings). Go to Developer Options and enable USB debugging if you intend to dirty flash ROM updates.
8. Reboot into TWRP again, flash Magisk (your settings and modules will be preserved). Note: if you bootloop on Magisk, remember it is mandatory to reboot between ROM flash (step 4 above) and GApps/Addon flash due to verity/slot-swap logic.
9. A good place to read what is not working is in the section known problems of LineageOS.
D. Dirty flashing AOSP ROM updates
1. If you follow all the processes above, you can dirty flash updates because you have:
1.1 Motorola drivers installed.
1.2 Specific adb/fastboot files for our phone and an USB 2.0 port in a Windows computer (some users report that USB 3.0 will also work).
1.3 Unlocked bootloaders (Process A above).
1.4 Permanent TWRP running and TWRP .zip file placed inside your phone and ready to be flashed again.
1.5 An AOSP ROM already running.
1.6 Developer Options and USB debugging enabled.
1.7 If you're using TWRP older than 3.2.2-2, disable disable PIN/gestures/fingerprinting. Also, most probably, ROMs after July 20th, 2018 cannot be flashed in older TWRP.
1.8 Enough battery in your phone (80%)
2. Download your ROM .zip update, copy it into the phone sdcard and reboot your phone into TWRP. See download links here.
3. Within TWRP you should flash (install) things in the following order:
3.1 ROM update .zip file. Remember that, at this time, the update will be flashed int the other slot and inside phone you’ll have both the system before update (in the booted slot) and updated ROM in the other slot.
3.2 TWRP .zip file (step 1.4 above) once again (do not skip this step or you’ll bootloop!).
4. Reboot to System: if you skip this step, you’ll bootloop.
5. Reboot into TWRP again, flash Magisk (your settings and modules will be preserved) or LineageOS SU Addon .zip file. Note: if you bootloop on Magisk, most probably you’re flashing a wrong/different version of Magisk. I suggest v16.0 and, after you got rooted with 16.0, you can update. It is mandatory to reboot between ROM flash (step 4 above) and GApps/Addon flash due to verity/slot-swap logic.
Note: SuperSu is deprecated.
6. Wipe Dalvik/ART cache: go to Wipe menu of TWRP > Advanced Wipe > Dalvik/ART Cache only.
7. Reboot your phone into System (ROM) will use the “other” slot, the one with the updated ROM.
8. You can use XPosed installer app (and reboot).
9. Now you can add your PIN, fingerprint, gestures back until next flashing.
E. Recovering from soft bricks or returning to Stock
If you’re reading this is because you already unlock your bootloader (see guide A) and anything went wrong, but you still can boot your phone into bootloader. Plug your phone and get enough battery (even if you do not see any charging signal).
1. Install the Motorola drivers and the specific adb/fastboot files for our phone. Remember, follow the rules because our device is tricky!
1.1) Do not use other adb/fastboot binaries: we cannot guarantee they will work.
1.2) You need to use a USB 2.0 port of your computer (some users report that USB 3.0 will also work).
2. Download the latest firmware for your model:
- Retail (XT1789-05) (Europe/Brazil).
- Other models (branded): ATT, Sprint, T-Mobile (TMO), USC, Verizon.
- Note: NPXS26 versions stand for Nougat and OPXS27 for Oreo. You do not need Nougat versions for anything.
3. Extract the zip contents to a blank folder in your computer.
4. Download the FlashAll_XT1789-05.zip file (it should work for other Motorola Z2 Force models as well), extract the content and move all files to the same firmware folder (step 2 above). Be sure to overwrite any file (if needed).
5. Run the Preparation.bat file there to generate the flashfile.bat file that will send the commands to the phone. Credits: the original preparation files were from RootJunky (can be downloaded here) and include more options that we do not need for our purpose here. Also, it includes adb/fastboot binaries that could not work with our phone.
6. Reboot the phone into the bootloader (see adb command below or power + volume down). Open a command line window in the firmware folder (step 5 above), test the connection and execute the flashfile.bat file generated on step 5.
Code:
adb reboot bootloader
fastboot devices
flashfile.bat
Never ever unplug the device from the USB 2.0 port while flashing the firmware. This could cause a hard brick and your device will be dead.
7. There is a pause at the end. You should review if everything went fine (or even click on the menu of the command line window, select all and copy&paste the contents in a .txt file for further help/revision).
8. Reboot your phone into system (ROM) and do not forget, later, to enable the Developer Options and USB debugging again.
Note: if you hard brick, I suggest you be prepared to follow the Unbrick Qualcomm mobiles with Step-by-step guide or the Unbrick All Qualcomm Snapdragon’s from Qualcomm HS-USB QDLoader 9008 guide, but I never tested them myself. You can also use Qualcomm Flash Image Loader (QFIL) tool. Maybe these Latest 2017 Qualcomm Diag QD-Loader Windows 10 Drivers signed will help you.
F. Oreo ROM features comparison
This is a table for Oreo ROM features comparison for Motorola Z2 Force - nash.
I would like to receive feedback and updates from the users, as I can't keep changing from one ROM to another and they get new features, updates, improvements, etc.
I consider Lineage OS 15.1 our stock ROM regarding to customization. So, it's not listed there.
Legend:
Code:
X = Feature present
XX = ROM excels in this particular feature (in my opinion).
If you want to move your Motorola Z2 Force to Project Treble ROMs, please, check this guide.
Here is a list of the ROMs that are waiting for you.
I came back to stock ROM. the problem is that it gets stuck in the initial configurations of the android trying to find a wifi network, to continue the configuration, without success, because I see in fastboot that the baseband is unknown, and I also can not install any rom, or recovery image because I have the following message in fastboot: FLASHING_LOCKED. and since I can not get past the initial android settings, I also can not unlock the developer options to enable OEM unlocking. now I'm standing in a rom that does not leave the initial configuration, it does not connect to any network and a fastboot that does not let me install anything. and I also tried the recovery mode and even tried to install an update via sideload, without success. I do not know what else to do if you can give me a light.
renanjones said:
I came back to stock ROM. the problem is that it gets stuck in the initial configurations of the android trying to find a wifi network, to continue the configuration, without success, because I see in fastboot that the baseband is unknown, and I also can not install any rom, or recovery image because I have the following message in fastboot: FLASHING_LOCKED. and since I can not get past the initial android settings, I also can not unlock the developer options to enable OEM unlocking. now I'm standing in a rom that does not leave the initial configuration, it does not connect to any network and a fastboot that does not let me install anything. and I also tried the recovery mode and even tried to install an update via sideload, without success. I do not know what else to do if you can give me a light.
Click to expand...
Click to collapse
I see two possible scenarios:
1. Your bootloader is locked (yet) (see guide A).
2. Your in a "false locked" situation that, maybe, could be solved by resetting data via recovery or in bootloader (with the command: fastboot -w).
Great tutorial, but I did not get 4g in any of the roms, only 3g
Gutto said:
Great tutorial, but I did not get 4g in any of the roms, only 3g
Click to expand...
Click to collapse
I got 4G in any ROM... AOSIP, DU or Invictrix...
Are you using a branded (carrier) phone? If not, maybe you should return to stock (to recover any changes on partitions).
Technical said:
I got 4G in any ROM... AOSIP, DU or Invictrix...
Are you using a branded (carrier) phone? If not, maybe you should return to stock (to recover any changes on partitions).
Click to expand...
Click to collapse
My cell phone and Sprint, I did every process that you indicated, but not 4G
So I followed the instructions as noted, as soon as I got to the root installation part, it started throwing a "cannot mount /system" error. I thought a reboot would solve the issue, but now I think I'm bricked. Can't boot into anything, all I can do is plug my phone in and listen to it keep disconnecting every 10 seconds or so. The phone had booted up fine prior to starting the installation process, and I don't see how just a bad ROM install is preventing me from getting into either bootloader or recovery. Any advice?
For clarity, i'm unable to use QBOOT to do anything since after it hits the "powered on" state I'm assuming it's in, it just resets and does the same thing over and over again
shalpp said:
So I followed the instructions as noted, as soon as I got to the root installation part, it started throwing a "cannot mount /system" error. I thought a reboot would solve the issue, but now I think I'm bricked. Can't boot into anything, all I can do is plug my phone in and listen to it keep disconnecting every 10 seconds or so. The phone had booted up fine prior to starting the installation process, and I don't see how just a bad ROM install is preventing me from getting into either bootloader or recovery. Any advice?
For clarity, i'm unable to use QBOOT to do anything since after it hits the "powered on" state I'm assuming it's in, it just resets and does the same thing over and over again
Click to expand...
Click to collapse
Have you tried holding vol dwn + pwr btn to force it into bootloader mode? If you can get there, then you can use the keys to get to recovery and try a factory reset. If that don't work, go back to bootloader mode and try flashing back to stock. Might double check that the battery has plenty of charge.
41rw4lk said:
Have you tried holding vol dwn + pwr btn to force it into bootloader mode? If you can get there, then you can use the keys to get to recovery and try a factory reset. If that don't work, go back to bootloader mode and try flashing back to stock. Might double check that the battery has plenty of charge.
Click to expand...
Click to collapse
I'm unable to get the phone out of qboot (or whatever it's called). I've tried using a blank-flash but all that happens is device restarts as made evident by the "device disconnect" sound playing every few seconds. The phone had around 80% when I started the process. Should I just let it die and try loading into BL after a few hours of this thing power cycling itself?
shalpp said:
I'm unable to get the phone out of qboot (or whatever it's called). I've tried using a blank-flash but all that happens is device restarts as made evident by the "device disconnect" sound playing every few seconds. The phone had around 80% when I started the process. Should I just let it die and try loading into BL after a few hours of this thing power cycling itself?
Click to expand...
Click to collapse
It's weird that it is power cycling like that. Have you tired unplugging the phone and booting? Whether it's recovery, bootloader, qboot; you need to get to one place or the other if possible because power cycling won't allow you to do anything. If you can get a stable boot in any mode I would suggest moving your cable to another port so any corruptions aren't a factor anymore. I don't think a drain will resolve anything, but I've never heard anyone mention power cycling like that.
41rw4lk said:
It's weird that it is power cycling like that. Have you tired unplugging the phone and booting? Whether it's recovery, bootloader, qboot; you need to get to one place or the other if possible because power cycling won't allow you to do anything. If you can get a stable boot in any mode I would suggest moving your cable to another port so any corruptions aren't a factor anymore. I don't think a drain will resolve anything, but I've never heard anyone mention power cycling like that.
Click to expand...
Click to collapse
Power cycling is just an assumption since regardless of whatever port its in it keeps an endless loop of connect, disconnect". Basically after rebooting the device after attempting to install the ROM is when it went black and started not doing anything other than connect, disconnect
shalpp said:
Power cycling is just an assumption since regardless of whatever port its in it keeps an endless loop of connect, disconnect". Basically after rebooting the device after attempting to install the ROM is when it went black and started not doing anything other than connect, disconnect
Click to expand...
Click to collapse
When it's trying to connect do you have a pop up on your pc showing what it sees the phone as? Does it say nash fastboot, or 9008, Z2? That might give some idea of where it's failing.
41rw4lk said:
When it's trying to connect do you have a pop up on your pc showing what it sees the phone as? Does it say nash fastboot, or 9008, Z2? That might give some idea of where it's failing.
Click to expand...
Click to collapse
It appears as Qualcomm 9008
It only starts the loop after starting a blankflash. That's about the only response I get out of the device, otherwise it does absolutely nothing, no combination of buttons do anything
Edit: Confirmed connect/disconnect on another machine with the same driver configuration
This guide is only for the Fire TV 2 2015 (not stick) codenamed "sloane" with mt8173.
This will flash correct partitions and TWRP into it.
This WILL NOT clean RPMB neither will unlock the device.
I am not responsable of any physical damage in your device, YOU choose to make this modifications.
NOTE: Full unlock has been released, please refer to this thread: https://forum.xda-developers.com/t/unlock-root-twrp-unbrick-firetv-2-sloane.4222331/
NOTE: You will need to open the device so be prepared
NOTE: This will flash 5.6.2.8 images meaning RPMB will be updated.
MATERIAL NEEDED:
Linux based system.
USB A-A Cable.
Something conductive (paperclip, tweezers, etc).
Something to open the device.
- Install python3, PySerial, adb, fastboot:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot
- Uninstall/disable modemmanager:
Code:
sudo apt remove modemmanager
PROCEDURE:
0. Open up the device. You can use a pick or a kinfe or any special tool to open it up.
1. Locate DAT0 in the attatched image. You will need to flip the motherboard.
2. Download amonet-mt8173-sloane from downloads and unpack it.
3. Open the unpacked folder of amonet, open a terminal inside it and type:
Code:
sudo ./bootrom-step.sh
4. Wait until you see something like:
Code:
[2019-02-07 14:35:59.478924] Waiting for bootrom
5. Once that message shows up, connect the A-A cable but not the power supply. After that, prepare the short and at same time you short DAT0 with GND, plug in the power supply to the wall.
6. The script will ask you to remove the short. When this happens, stop shorting DAT0 and then press enter.
7. Wait until it finishes.
8. The device should now reboot into TWRP. Please, consider now flashing a prerooted ROM or LineageOS 12.1 for get full TWRP.
NOTES:
In lsusb boot-rom shows up as:
Code:
Bus 001 Device 009: ID 0e8d:0003 MediaTek Inc. MT6227 phone
If you see:
Code:
Bus 001 Device 013: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
means you're in preloader mode. Try shorting again.
If somehow you have a corrupt gpt (shouldn't happen), just run:
Code:
sudo ./gpt-fix.sh
If TWRP freezes, DON'T UNPLUG THE THE POWER SUPPLY, instead, open an adb shell session and type the following command to restart TWRP:
Code:
killall recovery
Please, your bootloader is still LOCKED. If you flash custom kernels/unsigned boots (i.e: Magisk Manager, etc) the bootloader will refuse to load the boot image and you will be not able to boot in TWRP anymore unless you re-unbrick the device.
THANKS:
- @CFKod for his patience and for test the script
- @retyre & @k4y0z for the initial port to mt8173
- @xyz` for his original exploit for the HD8 2018.
- @Sus_i for locate DAT0, DAT1 and DAT2.
- @rbox for TWRP/Boot menu.
DOWNLOAD:
amonet-sloane-v1.3.zip (Or attachments)
Source Code: https://github.com/R0rt1z2/amonet/tree/mt8173-sloane
Brick no more!!
thank you for your patience and knowledge.
My brick was because I wiped system.
I've added another photo, I simply shorted against the metal hole circled in the picture. This is so useful, it not only unbricks, it allows for downgrade of preloader
Meaning I was then able to resolve my lack of system with @rbox unbrick image.
Also it's so much quicker than flashing via mediatek inject. Wooooo
Rortiz2 said:
8. Now your device should start booting back to FireOS. Mount it and enjoy your unbricked TV.
Click to expand...
Click to collapse
Looks good. :good:
I suppose if step 8 (reboot to system) fails for someone, i.e. something in /system is messed up, the old unbrick solution from @rbox comes handy, in order to flash a system?
Don't know, don't own that box, but maybe it's possible to add a 'flash TWRP to recovery partition' to your unbrick solution? As last point, instead of boot system, boot to recovery... Then users could flash the latest prerooted rom from @rbox, and skip the old unbrick solution? Just a thought... as I said, I don't know details about that box.
Edit: probably flash TWRP won't work, since the bootloader isn't unlocked?
Sus_i said:
Looks good. :good:
I suppose if step 8 (reboot to system) fails for someone, i.e. something in /system is messed up, the old unbrick solution from @rbox comes handy, in order to flash a system?
Don't know, don't own that box, but maybe it's possible to add a 'flash TWRP to recovery partition' to your unbrick solution? As last point, instead of boot system, boot to recovery... Then users could flash the latest prerooted rom from @rbox, and skip the old unbrick solution? Just a thought... as I said, I don't know details about that box.
Click to expand...
Click to collapse
Sure. I can use MISC flags for boot to recovery.
But the question is: Does the twrp can be loaded with newest preloader?
Also if my memory is OK, I remember it's a ramdisk
Cheers.
Rortiz2 said:
Sure. I can use MISC flags for boot to recovery.
But the question is: Does the twrp can be loaded with newest preloader?
Also if my memory is OK, I remember it's a ramdisk
Cheers.
Click to expand...
Click to collapse
If I remember right, @k4y0z said that the recovery is flashed out of the boot.img at first boot... and if the TWRP solution is a ramdisk like on the first fireTV, then flashing a TWRP image to the recovery partition will probably not work. Don't know.
Sus_i said:
If I remember right, @k4y0z said that the recovery is flashed out of the boot.img at first boot... and if the TWRP solution is a ramdisk like on the first fireTV, then flashing a TWRP image to the recovery partition will probably not work. Don't know.
Click to expand...
Click to collapse
Correct. TWRP is actually a ramdisk.cpio.
rbox flashes it using his 2ndinit script which needs to be runned with "su".
This script, simply put SeLinux in permissive mode and boots TWRP at every boot:
https://github.com/androidrbox/firetv-2ndinit/blob/master/jni/2ndinit.c
As you said, flashing the ramdisk directly into /recovery partition will not work since in needs to be signed.
Cheers.
Rortiz2 said:
Correct. TWRP is actually a ramdisk.cpio.
rbox flashes it using his 2ndinit script which needs to be runned with "su".
This script, simply put SeLinux in permissive mode and boots TWRP at every boot:
https://github.com/androidrbox/firetv-2ndinit/blob/master/jni/2ndinit.c
As you said, flashing the ramdisk directly into /recovery partition will not work since in needs to be signed.
Cheers.
Click to expand...
Click to collapse
Ok. I know that from the 1gen stick/box.
Maybe there is a way to (push and) boot that recovery ramdisk as last step with your script, in order to have the option for flashing the latest prerooted?
Don't know... If you could manage that somehow, you can add the [ROOT] tag into the thread headline
@rbox, what do you think?
Sus_i said:
Ok. I know that from the 1gen stick/box.
Maybe there is a way to (push and) boot that recovery ramdisk as last step with your script, in order to have the option for flashing the latest prerooted?
Don't know... If you could manage that somehow, you can add the [ROOT] tag into the thread headline
@rbox, what do you think?
Click to expand...
Click to collapse
Yeah it will be pretty nice.
If we can't, we can downgrade preloader, run unbrick image via Preloader and then run a second part of the script that restores correct preloader.
Idk, just for throw ideas.
I added source code in the second post for rbox.
Cheers.
Rortiz2 said:
This guide is only for the Fire TV Stick 2 codenamed "sloane" with mt8173.
Click to expand...
Click to collapse
Sloane it's Fire TV 2 Gen, not Stick
Kramar111 said:
Sloane it's Fire TV 2 Gen, not Stick
Click to expand...
Click to collapse
Thanks
@Sus_i I think I have an idea
https://forum.xda-developers.com/fire-tv/orig-development/firetv-2-recovery-installer-t3309785
That installer will help us since it talks with the preloader.
Well, I've a added an argv in the main.py that allows you to downgrade the preloader in order to be able to use rbox tools.
After the downgrade, the scripts reboots the TV and immediatelly it starts with the .sh by rbox that injects the necessary files into the /system/partition.
This is what should do the (let's say step-1.sh). When it finishes, the idea is that the user can run bootrom-step.sh to restore new preloader (shorting again obv) and allow the device to boot with the injected TWRP
What do you think?
Best regards!
Rortiz2 said:
@Sus_i I think I have an idea
https://forum.xda-developers.com/fire-tv/orig-development/firetv-2-recovery-installer-t3309785
That installer will help us since it talks with the preloader.
Well, I've a added an argv in the main.py that allows you to downgrade the preloader in order to be able to use rbox tools.
After the downgrade, the scripts reboots the TV and immediatelly it starts with the .sh by rbox that injects the necessary files into the /system/partition.
Click to expand...
Click to collapse
Yeah, sounds good, if the system is in good condition it should work fine.
If system is somewhat corrupt, maybe by an interrupted or failed update or so, I don't know if it will work.
Maybe we think to complex. I assume the amonet script can flash all partitions!? Why not flash a whole new system with that.
Since the prerooted rom is in sparse image format and the updater script does all the rooting stuff after flashing, we can't use that.
But maybe it's possible to write a dd image of a allready rooted /system partition with the amonet script.
Just an idea, don't know if that will work.
Sus_i said:
Yeah, sounds good, if the system is in good condition it should work fine.
If system is somewhat corrupt, maybe by an interrupted or failed update or so, I don't know if it will work.
Maybe we think to complex. I assume the amonet script can flash all partitions!? Why not flash a whole new system with that.
Since the prerooted rom is in sparse image format and the updater script does all the rooting stuff after flashing, we can't use that.
But maybe it's possible to write a dd image of a allready rooted /system partition with the amonet script.
Just an idea, don't know if that will work.
Click to expand...
Click to collapse
/system doesn't need to be ok. We need a working boot.img that loads the 2ndinit.
We can't flash a system with bootROM, it will take 1 day lol.
Take this commit as reference:
https://github.com/R0rt1z2/amonet/commit/339bb4ab2055507f2ed72ebea3861dbdfef67484
Rortiz2 said:
/system doesn't need to be ok. We need a working boot.img that loads the 2ndinit.
We can't flash a system with bootROM, it will take 1 day lol.
Take this commit as reference:
https://github.com/R0rt1z2/amonet/commit/339bb4ab2055507f2ed72ebea3861dbdfef67484
Click to expand...
Click to collapse
lol, as I said, don't know if that is possible with the amonet script
Yeah, if the boot.img will load 2ndinit, i.e. the recovery, that should do the trick fine :good:
Sus_i said:
lol, as I said, don't know if that is possible with the amonet script
Yeah, if the boot.img will load 2ndinit, i.e. the recovery, that should do the trick fine :good:
Click to expand...
Click to collapse
Let's see if we can try today.
Also it will require to copy the ramdisk recovery to an external usb or external sd.
Regards!
Rortiz2 said:
Let's see if we can try today.
Also it will require to copy the ramdisk recovery to an external usb or external sd.
Regards!
Click to expand...
Click to collapse
Yes, have seen it on github, but both is possible with the second gen FireTV box... only the usb port could be a problem, if usb debugging is enabled (but I don't know if debugging is aviable at this early stage?).
Sus_i said:
Yes, have seen it on github, but both is possible with the second gen FireTV box... only the usb port could be a problem, if usb debugging is enabled (but I don't know if debugging is aviable at this early stage?).
Click to expand...
Click to collapse
I don't think usb debugging is aviable at Preloader Stage
Basically would be this:
Format the sdcard/usb and copy the .cpio on it, then insert sdcard/usb into the TV.
Run first step:
Code:
sudo ./step-1.sh
It will downgrade preloader & inject 2ndinit.
After that, you disconnect the tv and run bootrom-step for restore working imgs:
Code:
sudo ./bootrom-step.sh
After that will reboot and since we have 2ndinit as pppd it will boot in TWRP.
From there you flash prerooted ROM and you're done
That's my idea but maybe doesn't work.
Cheers.
Rortiz2 said:
That's my idea but maybe doesn't work.
Cheers.
Click to expand...
Click to collapse
Sounds and looks good. :good:
I'm confident that it will work :fingers-crossed:
only sad thing is that I can't test it
Hey @Rortiz2, thanks for this! My sloane has been bricked for a few months after trying to root - this script ran & uploaded the boot.img to the device, but unfortunately it still won't boot (flashing with amazon logo).
I tried using your twrp test, but that results in terminal hanging at the below:
I was hoping I could get twrp running & then flash a pre-rooted image so that it clears whatever's wrong with the unit, but as above, I don't seem to be able to get it to boot
Any ideas?
Edit: welp, after cancelling the terminal command she now won't boot at all, lol... no signs of life but I'll keep this updated if I get can resurrect her.
This version of TWRP works on the Lenovo TB-X606FA, TB-X606F and TB-X606X.
Warning: this TWRP will not work for any of the Tab M10 variants with Qualcomm SOCs. For the TB-X505F, see this thread. For the TB-X605F/L, see this thread.
Code:
#include <std_disclaimer.h>
/*
* We are not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at us for messing up your device, we will laugh at you.
*/
Encryption
This device was released with Android 9 using full disk encryption (FDE). But we now have Android 13 GSIs for this tablet - and Android 13 does not support FDE. Android 13 only supports file-based encryption (FBE).
If you are using a ROM/GSI that uses FBE, you must use the twrp with -fbe in the name. If you use the wrong one, twrp will not be able to decrypt the data partition.
If you don't know if you're using FBE or FDE, then run this command while Android is running: adb shell getprop ro.crypto.type. If it returns "block", then your device is FDE. If it returns "file", it's FBE.
Installation
With a stock ROM, it is recommended that you also install Magisk. This will ensure TWRP remains your default recovery.
If Windows 10/11 does not recognise your tablet in fastboot mode, then see post #2.
Step-by-step guide
download TWRP to your PC (see the Download section below)
download the latest magisk.apk to your SDcard or OTG device. Change the filetype from "apk" to "zip".
get a copy of the vbmeta.img file from the stock ROM. It should be located in one of the subdirectories of LMSA's c:\ProgramData\LMSA\Download\RomFiles directory (after you download it using the LMSA rescue (power-off mode). This is only required the first time you flash TWRP, or the first time after you re-flash the whole stock ROM.
if your bootloader is already unlocked, go to step 5. To unlock bootloader:
on tablet: go to Settings->System->About and press "Build number" 7 times to enable Developer Options.
on tablet: go to Settings->System->DeveloperOptions. Turn on: "OEM unlocking" and "USB debugging".
connect tablet to your computer. Tablet will ask for permission to "Allow USB debugging". Tick "always allow" and select "OK".
backup any files you want to keep to an external device (MicroSD/OTG/computer), because the next step will wipe all your photos, files, google account etc on the tablet.
Now unlock the bootloader:
Code:
adb reboot bootloader
fastboot flashing unlock
follow the instructions on the tablet, then reboot to Android.
note: if fastboot reports <waiting for device>, then you need to install the Mediatek USB drivers. Go to developer.android.com/studio/run/oem-usb, then find the link to Mediatek (MTK) and follow the installation instructions.
note: after unlocking, tablet will take a while to come back up - because it has to do a factory reset and encrypt data again.
flash the TWRP image:
Code:
adb reboot bootloader
fastboot flash recovery twrp_X606FA_11.img
fastboot --disable-verification flash vbmeta vbmeta.img
fastboot reboot recovery
backup the stock boot, system and vendor partitions in TWRP, if you don't have backups already
load Magisk:
In TWRP:
select "Install"
use "select storage" to locate device you stored magisk.zip on.
press the OK button
select the Magisk zip file
swipe to confirm Flash
when Magisk is finished, hit the "Reboot System" button
finished!
If you prefer to use button combos, rather than fastboot/ADB commands:
Vol Down + Power = fastboot mode
Vol Up + Vol Down + Power = recovery mode
Changelog
Code:
2023-03-27 - add TWRP 3.7.0 for FBE ROMs/GSIs (Android 13+) only
2022-02-06 - added separate download for TB-X606F
2021-12-16 - TWRP 3.6.0 updates
- support for Android 12 decryption (keymaster)
2021-07-05 - TWRP 3.5.2 updates
- corrected display of Cyrillic (and other non-ASCII characters) in file names on external drives (utf8)
2021-03-10 - TWRP 3.5.1 updates
- cherrypicked update 1995 to force splash screen to display on boot
- orientation is now landscape (for tablets)
- updated install instructions to reflect new Magisk apk (v22).
2021-02-02 - fix blank screen on boot - don't need to press power button anymore to wake screen up
2021-01-24 - TWRP 3.5.0_10-0: initial release
Downloads (FDE)
This will work with stock ROMs and most pre-A13 ROMs/GSIs.
TWRP 3.6.0_11-0 for X606FA: twrp-X606FA_11.img
TWRP 3.6.0_11-0 for X606F: twrp-X606F_11.img
Downloads (FBE)
This will not work with stock ROMs or most pre-A13 ROMs/GSIs. This is for ROMs/GSIs that use FBE to encrypt. Android 13+ only supports FBE.
TWRP 3.7.0_12-1 for X606FA with FBE encryption: twrp-X606F_12.1.fbe.img
Source code
https://github.com/minimal-manifest-twrp/platform_manifest_twrp_aosp/tree/twrp-12.1
https://github.com/Yahoo-Mike/recovery_device_lenovo_X606FA/tree/android-12.1-fbe
Credits
The guys at TeamWin Recovery Project.
Everyone whose device trees I plagiarised from GitHub.
Contributors
Yahoo Mike
Created 2021-01-24
Last Updated 2023-03-27 (FBE support)
Windows 10/11 does not recognise tablet in fastboot mode
If your tablet is recognised by ADB but not by fastboot in Windows, you might need to get the latest versions of fastboot and the Mediatek usb drivers.
1. use the latest fastboot version
Make sure you are using the latest version of fastboot. There were major changes to fastboot for Android 10.
If you are using PowerShell, make sure it's picking up the fastboot you expect: fastboot --version. If not, use ./fastboot from the directory with the executable.
2. update device drivers
Try the latest Mediatek (MTK) drivers from Install OEM USB drivers. When they are loaded, they appear in Device Manager as "Kedacom USB Device/Android ADB Interface".
If Windows complains that the drivers are unsigned and refuses to load them, then do this as Administrator in Windows:
bcdedit /set testsigning on
reboot Windows
install the drivers
bcdedit /set testsigning off
In Windows 11, you might also need to turn off Secure Boot in your PC's BIOS to get the bcdedit command to work.
So I have the ZA5W0097US, would you suggest this wouldn't work?
ldeveraux said:
So I have the ZA5W0097US, would you suggest this wouldn't work?
Click to expand...
Click to collapse
That looks like a TB_X606F. This TWRP might work. We won't know for sure until someone tries.
Remember, the screen will be blank when TWRP boots up. You'll just have to click the power button twice to wake it up. I'll try and fix that over the next few days.
If you decide to try this TWRP and it doesn't work, please let me know what happens. And when you're booted into Android, can you tell me what the results of these ADB commands are?
Code:
adb shell getprop ro.hardware
adb shell getprop ro.boot.hardware
New version is now available in the first post.
The blank screen issue is mostly fixed...mostly. The screen is still blank on boot when decrypting data, but then it wakes up. No need to press the power button anymore.
I just got my TB-X606F (it's actually finishing setup right now) and I'm going to try flashing this TWRP onto it. I *think* the only difference between the "F" and "FA" version is that the "FA" comes with some sort of Alexa capability.
Both adb commands output "mt8768".
TB-X606F/ZA5T0300US (the manual also says TB-X606X) confirmed TWRP and Magisk are working. Had a hell of a time with getting fastboot to work on my main machine so I used a virtual machine to do everything with fastboot.
sirp0p0 said:
TB-X606F/ZA5T0300US (the manual also says TB-X606X) confirmed TWRP and Magisk are working. Had a hell of a time with getting fastboot to work on my main machine so I used a virtual machine to do everything with fastboot.
Click to expand...
Click to collapse
Cool. I'll update the OP.
Maybe check you have the latest version of fastboot on your main machine. There were some major changes for Android 10.
Good call. My adb and fastboot were both way out of date.
I also have the TB-X606F and was able to get this working 100%. I thought it was going to wipe my system so I backed everything up beforehand, but no wipe. Just replaced recovery with TWRP and here I am. Thanks a ton, great to have another TWRP recovery device!
ldeveraux said:
... I thought it was going to wipe my system so I backed everything up beforehand, but no wipe.
Click to expand...
Click to collapse
It will only wipe if you are unlocking the bootloader for the first time.
Thanks for the feedback.
Tried this process and ran into an issue. Flashed TWRP Okay, flash vbmeta ok, rebooted to twrp, but could not find magisk on sdcard for some reason. Not tablet won't take fastboot commands. Says waiting for device
adb device shows the tablet
snickle said:
Tried this process and ran into an issue. Flashed TWRP Okay, flash vbmeta ok, rebooted to twrp, but could not find magisk on sdcard for some reason. Not tablet won't take fastboot commands. Says waiting for device
adb device shows the tablet
Click to expand...
Click to collapse
Rebooteed to bootloader flashed twrp and vbmenta. REbooted to recovery and twrp came up. Installed magisk zip and rebooted. No root and stock recovery comes up instaead of TWRP.
THoughts?
Also still no fastboot commands available when tablet booted, just from bootloader.
Tried completely reflashing stock image, still no change.
snickle said:
...rebooted to twrp, but could not find magisk on sdcard for some reason.
Click to expand...
Click to collapse
You have to download Magisk-v21.4.zip and push it to /external_sd/.
If you did that, can you see your other files in /external_sd/ ?
snickle said:
...tablet won't take fastboot commands. Says waiting for device
adb device shows the tablet
Click to expand...
Click to collapse
Make sure you have the latest adb and fastboot from Google. There were some major changes to fastboot for Android 10.
Also make sure you have the latest USB drivers from Lenovo.
I have the latest adb and drivers. fastboot commands used to work.
I rebooted to bootloader and flashed thre patched boot image made with the canary version of magisk and got root.
I then reflashed twrp and vbmeta and things seem to be working. Except for fastboot commands whlle booted.
snickle said:
I have the latest adb and drivers. fastboot commands used to work.
Click to expand...
Click to collapse
For Windows, the latest fastboot --version is 31.0.0-7110759
snickle said:
...things seem to be working. Except for fastboot commands whlle booted.
Click to expand...
Click to collapse
If you are using Windows 10, check that the "Android Bootloader Interface" driver is loaded in Device Manager when the tablet is in fastboot mode. See this post.
And when you say "except for fastboot commands while booted", do you mean "while the tablet is booted in fastboot mode" or "while the tablet is booted in twrp recovery or Android system"?
Yahoo Mike said:
For Windows, the latest fastboot --version is 31.0.0-7110759
If you are using Windows 10, check that the "Android Bootloader Interface" driver is loaded in Device Manager when the tablet is in fastboot mode. See this post.
And when you say "except for fastboot commands while booted", do you mean "while the tablet is booted in fastboot mode" or "while the tablet is booted in twrp recovery or Android system"?
Click to expand...
Click to collapse
Latest ADB and drivers loaded.
Fastboot commands work while in fastboot mode, but do not work when booted to system any more.
snickle said:
Fastboot commands work while in fastboot mode, but do not work when booted to system any more.
Click to expand...
Click to collapse
That's ok. That's how it's supposed to work.
ADB only works when your device is in recovery or system. It won't work when you're in fastboot or EDL mode.
Fastboot only works when your device is in fastboot mode. It won't work when you're in EDL, recovery or system.
The fastboot utility is an interface to the Android bootloader. When your device is in fastboot mode, you can use this utility to configure (some of) the bootloader and partition images. That's about it. I'm oversimplifying again, but...once the bootloader has passed on execution to EDL or a kernel (recovery or system), the fastboot utility can't work because the bootloader process is no longer running.
Unhelpfully fastboot just displays the "waiting for device" message, rather than something like "waiting for device to enter fastboot mode".
I hope that helps explain what's going on.
Twrp is working as expected no issues I have found, except for the need to press the power button s few times after booting into recovery to get twrp screen.
Hello! I need a bit of help... I have a TB-606F, 4GB/64GB version
I'm stuck on step 5. I've unlocked the bootloader, flashing TWRP and vbmeta seems successful, but then I cannot reboot into recovery. Using the fastboot reboot command I get "fastboot: usage: unknown reboot target recovery". If I try to reboot using volume up + volume down + power it eventually boots to Android.
Any thoughts are much appreciated!