Database Develop

[RECOVERY] TWRP Recovery 2.8.7.0 - Apollo/Thor

Hello All,
NOTE: You should unlock your bootloader.
These are patched TWRP recovery images for the Apollo and Thor devices only. Now Built from the latest .4.5.3 sources.
WARNING:
- Be sure to have a working /system partition before proceeding with installation.
Installation
- Ensure you are running stock firmware .3.2.3.2
- Obtain Root
- Copy the recovery image to the root of your sdcard
- Flash the recovery image by issuing the following commands:
Code:
adb shell
su
dd if=/sdcard/signed-<device>-twrp-2870.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
Download
- Apollo Recovery Image
- Thor Recovery Image
Thanks
- @vortox for the exploit

I see that everyone (well, almost) is using his exploit now. Is there a tool and/or link that I missed?

r3pwn said:
I see that everyone (well, almost) is using his exploit now. Is there a tool and/or link that I missed?
Click to expand...
Click to collapse
I gave @Cpasjuste and @ggow an earlier access to my tool, because I could't write my guide as fast as thought.

vortox said:
I gave @Cpasjuste and @ggow an earlier access to my tool, because I could't write my guide as fast as thought.
Click to expand...
Click to collapse
Ah.

I wrote the recovery on my apollo device which is running 14.3.2.3.2_user_323001720 version and it appears to work flawlessly. I booted into recovery (TWRP) successfully and rebooted the system successfully as well. Awesome!

Thanks for the feedback, glad it's all working
I haven't got a device at the moment to try it out on.
Sent from my Kindle Fire HDX using Tapatalk

Thanks ggow. Could we expect CM roms soon from your new release?

Working on 14.3.1.0
I just want to confirm, on 14.3.1.0_user_310078820 everything so far is working correctly, I can enter into TWRP, reboot system aswell, successfully tested backup and restore (from Safestrap created backups)
Thanks.

tuanda82 said:
Thanks ggow. Could we expect CM roms soon from your new release?
Click to expand...
Click to collapse
Hello tuanda82,
It depends on Amazon, my unlocked Apollo stopped working so they sent me a new one but came pre-installed with 4.5.2.
They have refused to downgrade me back to the old firmware. And after a lot of to and fro they agreed to replace it again .
I hope I have luck with the new device been on the required firmware.
But yes I definitely would like to make such a release.

dangerous
jeryll said:
I just want to confirm, on 14.3.1.0_user_310078820 everything so far is working correctly, I can enter into TWRP, reboot system aswell, successfully tested backup and restore (from Safestrap created backups)
Thanks.
Click to expand...
Click to collapse
I would not be trying interchang eROMs and or backups ppluntil certain things are verified by our developersgosh it only takes a few minutes to understand that one is built for locked bootloader the other one bypasses and they both flash completely different partitions and have different installation scripts.you're just asking to be one of the ignorant whiners on the sidelines while we have fun ..stuck with your brick. be patient guys this is all new stuff if you can't afford to be a developer then I devise you let somebody else take the risk

Can you tell me where TWRP Recovery is stored and what the boot process is like? Is TWRP called by the boot loader instead of the Linux kernel and it will in turn then start the Linux kernel from your installed system?
What happens when TWRP Recovery is damaged? Is there still a way to recover?
And is there a difference in how TWRP is started as opposed to Safestrap?
Edit: ok, so I see that TWRP Recovery is flashed to the recovery partition, so I guess it's separate from the boot image. And pressing volume up + the power button presumably activates the recovery image rather than the boot image. Did Safestrap work in the fashion I described? Why are we using TWRP for recovery now instead of Safestrap? Are there any advantages?

tbm13 said:
Can you tell me where TWRP Recovery is stored and what the boot process is like? Is TWRP called by the boot loader instead of the Linux kernel and it will in turn then start the Linux kernel from your installed system?
What happens when TWRP Recovery is damaged? Is there still a way to recover?
And is there a difference in how TWRP is started as opposed to Safestrap?
Edit: ok, so I see that TWRP Recovery is flashed to the recovery partition, so I guess it's separate from the boot image. And pressing volume up + the power button presumably activates the recovery image rather than the boot image. Did Safestrap work in the fashion I described? Why are we using TWRP for recovery now instead of Safestrap? Are there any advantages?
Click to expand...
Click to collapse
New recovery system
- Allows for custom kernels (meaning, CyanogenMod, Overclocking, and other things)
- Installed to "recovery" partition
- Bypasses signature verification check with some weird thing about exponents of 3 and the cubed root of something. I don't entirely understand how the exploit works.
- Called from the bootloader
- If you're in a bootloop, hold VOL+ & POWER (I think) to boot into TWRP.
SafeStrap
- No custom kernels (no CM)
- Installed to "system" partition (no key presses can get you to here if you're in a bootloop)
- Designed to provide semi-custom ROMs on devices with locked bootloaders
- Called from the Kernel

r3pwn said:
New recovery system
- Allows for custom kernels (meaning, CyanogenMod, Overclocking, and other things)
- Installed to "recovery" partition
- Bypasses signature verification check with some weird thing about exponents of 3 and the cubed root of something. I don't entirely understand how the exploit works.
- Called from the bootloader
- If you're in a bootloop, hold VOL+ & POWER (I think) to boot into TWRP.
SafeStrap
- No custom kernels (no CM)
- Installed to "system" partition (no key presses can get you to here if you're in a bootloop)
- Designed to provide semi-custom ROMs on devices with locked bootloaders
- Called from the Kernel
Click to expand...
Click to collapse
Do you have to be in the stock rom slot to install? Or can you be on a custom rom slot and install?

Håvi said:
Do you have to be in the stock rom slot to install? Or can you be on a custom rom slot and install?
Click to expand...
Click to collapse
Flash the rollback image to stock slot. This will then enable you to get back to 3.1.0

ggow said:
Flash the rollback image to stock slot. You need to be on stock version < 3.2.4.[/QUOT
Edit, found answer in OP
Click to expand...
Click to collapse

I was able to roll back to 3.1.0 and installed twrp. I was able to make a backup and successfully restored the backup. However after about an hour I came back to my kindle an noticed it updated itself to 4.1.1. I was under the impression with recovery installed any new updates would . Not be able to install. Now when I try to boot into recovery it on l y boots kindle recovery not twrp.
Sent from my KFAPWI using Tapatalk

tuanda82 said:
Thanks ggow. Could we expect CM roms soon from your new release?
Click to expand...
Click to collapse
The main problem for cm on appolo seems to be the kernel/bootloader. To run CM kernel (or amazon > 3.2.4) we need (or at least its the only way I found) to modifiy the boot image to manually happen the DT information's to the kernel zImage. Unfortunately this was tested with @ggow and it's not working on appolo. If someone if willing to send me an appolo device I could work on that ...

Cpasjuste said:
The main problem for cm on appolo seems to be the kernel/bootloader. To run CM kernel (or amazon > 3.2.4) we need (or at least its the only way I found) to modifiy the boot image to manually happen the DT information's to the kernel zImage. Unfortunately this was tested with @ggow and it's not working on appolo. If someone if willing to send me an appolo device I could work on that ...
Click to expand...
Click to collapse
Man, I wish I had more time for XDA. First time I've checked in in months. At any rate, it is awesome to see y'all learning & sticking with it! Since I haven't had much time for anything that isn't work related lately, I passed my rooted 3.2.6 Apollo to my Mom. I don't know if she uses it much, but I'll ask her & unless she did a complete 180 & is now becoming a tablet-phile, I could probably send you mine. I will ask her if I can have it back tonight & let you know.

Cpasjuste said:
The main problem for cm on appolo seems to be the kernel/bootloader. To run CM kernel (or amazon > 3.2.4) we need (or at least its the only way I found) to modifiy the boot image to manually happen the DT information's to the kernel zImage. Unfortunately this was tested with @ggow and it's not working on appolo. If someone if willing to send me an appolo device I could work on that ...
Click to expand...
Click to collapse
Amazon are sending me a new Apollo device (again)... hopefully I'll be back in business soon. I think there was something wrong with my device which is why I was having so many problems.
When I get the new device, hopefully it will be on the required firmware for me to try out the new kernel and CM. I'll report back when I have something... Shouldn't take me too long to get something up and running once I have a working device.

GSLEON3 said:
Man, I wish I had more time for XDA. First time I've checked in in months. At any rate, it is awesome to see y'all learning & sticking with it! Since I haven't had much time for anything that isn't work related lately, I passed my rooted 3.2.6 Apollo to my Mom. I don't know if she uses it much, but I'll ask her & unless she did a complete 180 & is now becoming a tablet-phile, I could probably send you mine. I will ask her if I can have it back tonight & let you know.
Click to expand...
Click to collapse
Thanks gsleon but don't rob your mom
---------- Post added at 10:57 AM ---------- Previous post was at 10:53 AM ----------
ggow said:
Amazon are sending me a new Apollo device (again)... hopefully I'll be back in business soon. I think there was something wrong with my device which is why I was having so many problems.
When I get the new device, hopefully it will be on the required firmware for me to try out the new kernel and CM. I'll report back when I have something... Shouldn't take me too long to get something up and running once I have a working device.
Click to expand...
Click to collapse
Crossing fingers

Bootable(only) TWRP development

Our phone needs a bootable only TWRP, this is a fact.
This is because of the a/b partitioning but, more, since of the "new" recovery-in-boot.IMG design which links kernel & recovery presence in an unwanted way...
And a bootable TWRP is the "official solution" developed by TWRP Team for Pixel 2/2 XL - the more similar device up to date - to overcome this issue in better way. I fully agree with their solution and I had thought of it even before of their official release...
A LOT of development has been done on this phone during only last month, better installable TWRP, better kernels, better installation methods developed for them, both for first install and for upgrade too, BUT the lack of a boot-only TWRP, something easily (& ever...) accessible with a simple fastboot boot twrpboot.img command is every day more evident...
For some reasons this has been achieved (even if still with limitations...) on Pixels (with available sources obviously...) but, to date, not for our device...
I would like this thread will become the reference thread to all which would want to contribute on this development, a place to report achieved results and faced issues so that others could try to help & overcome them...
We still have a restricted team of developers, but most of them are *great* on their work... I'm sure that only with a bit more teamed up work, this is a result we could achieve in weeks... probably before Christmas!
So, just to start, everyone which has tried to develop (or study...) this, could report what type of issues has faced to date...

I will still have twrp on my boot image. When I was testing kernels without twrp and I got a horrid kernel panic, stock recovery just wiped the device rebooted, wiped, repeat. When I had a bad kernel panic alpha testing on twrp, it would just boot to twrp in tact then I could flash the old kernel. If everything was too messed up, just reflash twrp. All kernels I have made besides the ones that gave those issues work perfect in twrp. Even the ones where bogoMIPS freq was used instead of our frequencies. (38.0 MHz). I like the idea of not having to hook my device up to a computer to boot into recovery.

Uzephi said:
I will still have twrp on my boot image. When I was testing kernels without twrp and I got a horrid kernel panic, stock recovery just wiped the device rebooted, wiped, repeat. When I had a bad kernel panic alpha testing on twrp, it would just boot to twrp in tact then I could flash the old kernel. If everything was too messed up, just reflash twrp. All kernels I have made besides the ones that gave those issues work perfect in twrp. Even the ones where bogoMIPS freq was used instead of our frequencies. (38.0 MHz). I like the idea of not having to hook my device up to a computer to boot into recovery.
Click to expand...
Click to collapse
Yes, I understand this, BUT there are a lot of other scenarios where having a bootable TWRP could save the day and/or at least make things simpler....
On the other hand, you are the first developer I know who is quite ever going without root!
(So you can't be taken as the "average user"... )

enetec said:
Yes, I understand this, BUT there are a lot of other scenarios where having a bootable TWRP could save the day and/or at least make things simpler....
On the other hand, you are the first developer I know who is quite ever going without root!
(So you can't be taken as the "average user"... )
Click to expand...
Click to collapse
I am confused...(I am I am long time enthusiast, pls forgive my naivety!)
I can reboot into twrp without issue using current method in this forum. Is "bootable twrp" referencing where / how twrp is implemented on this device? What are we missing as users and fans of all the great room devs out there by using our current method?
Ty for any insights in advance.

3's&7's said:
I am confused...(I am I am long time enthusiast, pls forgive my naivety!)
I can reboot into twrp without issue using current method in this forum. Is "bootable twrp" referencing where / how twrp is implemented on this device? What are we missing as users and fans of all the great room devs out there by using our current method?
Ty for any insights in advance.
Click to expand...
Click to collapse
The bootable refers to the command fastboot boot boot_a your-filename.img or fastboot boot boot_b your-filename.img . For the Moto Z2 Force, it has to be compiled differently than a boot image intended to be flashed as with the command fastboot flash boot_a your-filename.img , or fastboot flash boot_b your-filename.img . The reason it now has to be compiled differently is that our boot image is combined with recovery. If you try to fastboot boot a fastboot flash type, it would boot normally into Android OS--if all went OK. If you fastboot flash flashed a fastboot boot type, the device would boot into recovery instead of normal Android OS. Both fastboot boot and normal boot result in the kernel and ramdisk being written to RAM--to volatile memory; the difference is whether the data originally came from the device's non-volatile storage or external PC via USB-C cable.
Alternatively, there are two main forms of zip installers for a combined boot image, which are intended to be flashed inside TWRP or an apk like FlashFire (FlashFire does not play nice with already Magisk rooted Z2 Force, in my experience): a zip flash that flashes the entire boot.img (ramdisk + kernel), or a zip flash that only replaces half of the boot image (the ramdisk). For combined boot images, the ramdisk-only type that does not replace kernel is the more common of the two flash zip types on the site TWRP.me . In fact, I have never seen an official installer that also replaced boot image kernel on the official site.
As mentioned above, the fastboot boot type is not meant to be fastboot flash flashed; rather, it is primarily meant to be a platform utilized to flash the TWRP zip installer. You will see some devices on TWRP.me that have both fastboot boot type and zip flash type, and the aforementioned technique is why both are provided. Take a look at Pixel 2 XL (codenamed Taimen) on TWRP.me, and you'll see this method supported.

@jhofseth .... I could never explain it in a better way! :silly::good:

To come back IT... @jhofseth I know you have studied a lot this thing in these weeks, so I have a question for you...
If you take a boot.img containing a TWRP recovery like one we already have, and try a fastboot boot TWRP.IMG it should boot to its included kernel and then to system (if possible...), right?
This way we can test a new kernel without flashing it but it isn't our goal...
Well, when already flashed on phone we can choose between reboot to kernel/system or TWRP by adb commands or by extensions like Gravity Box...
Is it so hard/possible/thinkable to modify one of our boot.img so that it is in some way "forced" to boot to its TWRP in any case?
(and so even when loaded with a fastboot boot command...)

enetec said:
To come back IT... @jhofseth I know you have studied a lot this thing in these weeks, so I have a question for you...
If you take a boot.img containing a TWRP recovery like one we already have, and try a fastboot boot TWRP.IMG it should boot to its included kernel and then to system (if possible...), right?
This way we can test a new kernel without flashing it but it isn't our goal...
Well, when already flashed on phone we can choose between reboot to kernel/system or TWRP by adb commands or by extensions like Gravity Box...
Is it so hard/possible/thinkable to modify one of our boot.img so that it is in some way "forced" to boot to its TWRP in any case?
(and so even when loaded with a fastboot boot command...)
Click to expand...
Click to collapse
I would work on this if someone explains in detail why our current setup is an issue. I have ran into plenty of kernel issues when building bad kernels and twrp as recovery was better than stock recovery (as stated above). Please, I want this if there is a real reason for it. Our stock recovery just factory resets the device, so a recovery with other options is kinda nice.
Temp booting a kernel: use AIK and inject kernel into a boot image.
New TWRP update, just flash the boot image (which might have new boot image as well) and just reflash kernel. It is better than needing to hook the phone up to a PC every time you want to boot TWRP...

enetec said:
To come back IT... @jhofseth I know you have studied a lot this thing in these weeks, so I have a question for you...
If you take a boot.img containing a TWRP recovery like one we already have, and try a fastboot boot TWRP.IMG it should boot to its included kernel and then to system (if possible...), right?
This way we can test a new kernel without flashing it but it isn't our goal...
Well, when already flashed on phone we can choose between reboot to kernel/system or TWRP by adb commands or by extensions like Gravity Box...
Is it so hard/possible/thinkable to modify one of our boot.img so that it is in some way "forced" to boot to its TWRP in any case?
(and so even when loaded with a fastboot boot command...)
Click to expand...
Click to collapse
Yeah, that is one way to test, but sometimes that will fail even when the kernel works. For example, sometimes if you fastboot flash, sometimes you also have to flash latest Magisk again right away in TWRP, or it won't boot into Android OS. That would be impossible with fastboot boot (i.e., unless you patched boot image first with Magisk manager apk, or some other tool), because you would be unable to flash latest Magisk (or SuperSU 2.82 beta SR5). So, sometimes fastboot boot would fail to normally boot into Android OS--even though the kernel may be completely OK.

Uzephi said:
I would work on this if someone explains in detail why our current setup is an issue. I have ran into plenty of kernel issues when building bad kernels and twrp as recovery was better than stock recovery (as stated above). Please, I want this if there is a real reason for it. Our stock recovery just factory resets the device, so a recovery with other options is kinda nice.
Click to expand...
Click to collapse
There are plenty of scenarios where a bootable TWRP could be hassle saving / needed BUT you ask for a single one and I'll give you one... Or two! :laugh:
I want to be free to install the kernel I want with TWRP version I want.
Now this is not possible (if not with weird/tricking installations! ).
E.g.: let's imagine to want to install latest *stock* kernel with latest TWRP.
I have kernel, I have TWRP flashable zips ( @jhofseth made some which are fantastic...) BUT no (simple) way to merge them.
More: as you like to have tweaked kernel BUT without root, there is plenty of people who like to not have TWRP flashed on their systems BUT still being able to make backups and/or flash zips... (e.g. we have already seen some incompatibility between CF-Root and TWRP in past...) and/or remain free to take OTAs... & so on...
I could continue for hours, but these are already valid reasons IMHO...
Pixel 2 developers are not stupid... they have choosed this solution for valid reasons...

enetec said:
There are plenty of scenarios where a bootable TWRP could be hassle saving / needed BUT you ask for a single one and I'll give you one... Or two! :laugh:
I want to be free to install the kernel I want with TWRP version I want.
Now this is not possible (if not with weird/tricking installations! ).
E.g.: let's imagine to want to install latest *stock* kernel with latest TWRP.
I have kernel, I have TWRP flashable zips (@jhofseth made some which are fantastic...) BUT no (simple) way to merge them.
More: as you like to have tweaked kernel BUT without root, there is plenty of people who like to not have TWRP flashed on their systems BUT still being able to make backups and/or flash zips... (e.g. we have already seen some incompatibility between CF-Root and TWRP in past...) and/or remain free to take OTAs... & so on...
I could continue for hours, but these are already valid reasons IMHO...
Pixel 2 developers are not stupid... they have choosed this solution for valid reasons...
Click to expand...
Click to collapse
Answer (I have done this before I flashed TWRP and it worked wonders): root a boot image, go into system, adb shell, su, dd if=/dev/block/sde17(sdf17 for slot B) of=/sdcard/boot.img You now have a rooted bootable image, return to stock image. now you can use Flash Fire to make backups and flash stuff....
You can flash any kernel to TWRP. you want the stock kernel to flash? I can make a flashable zip with the stock kernel by Motorola if needed. It isn't hard tbh...

jhofseth said:
Yeah, that is one way to test, but sometimes that will fail even when the kernel works. For example, sometimes if you fastboot flash, sometimes you also have to flash latest Magisk again right away in TWRP, or it won't boot into Android OS. That would be impossible with fastboot boot, because you would be unable to flash latest Magisk (or SuperSU 2.82 beta SR5).
Click to expand...
Click to collapse
Why do you think a "booted" TWRP wouldn't be able to correctly flash zips?
I don't see reasons for this...
jhofseth said:
...
So, sometimes fastboot boot would fail to normally boot into Android OS--even though the kernel may be completely OK.
Click to expand...
Click to collapse
In fact I wrote "if possible"... BUT anyway this is of no interest. We *only* need to boot to TWRP, we are not interested in boot to an "unflashed kernel" if you understand what I mean...
We have only to force it to boot *ever* in TWRP. Kernel parts not used by TWRP (if some are needed on our phone, like some Mediatek devices need...) could be omitted at all (as done on bootable TWRP for Pixels2 if I don't go wrong...).

Uzephi said:
Answer (I have done this before I flashed TWRP and it worked wonders): root a boot image, go into system, adb shell, su, dd if=/dev/block/sde17(sdf17 for slot B) of=/sdcard/boot.img You now have a rooted bootable image, return to stock image. now you can use Flash Fire to make backups and flash stuff....
You can flash any kernel to TWRP. you want the stock kernel to flash? I can make a flashable zip with the stock kernel by Motorola if needed. It isn't hard tbh...
Click to expand...
Click to collapse
This are exactly the *weird/tricking* solutions I was talkin'about...
(Edit: let me add I don't like this a bit... Root how? Command could be mistyped & flashfire for backups is an orrible & unsafe solution... Just imagine do all this with valuable data in danger... )
All is possible. BUT these are NOT solutions for average user. And every single one requires a different solution/set of commands.
This is not for average user. I repeat it.
You & @johfseth are *NOT* average users... you are fu**ing good developers* and can't evaluate all scenarios with your (advanced) skills & capabilities...

enetec said:
All is possible. BUT these are NOT solutions for average user. And every single one requires a different solution/set of commands.
Click to expand...
Click to collapse
I have offered to give a bootable rooted image to other people in my kernel thread. The thing is, if ANYTHING is edited, OTA won't work, so bootable TWRP won't be feasible, unless you just backup your system and not edit anything.
If the average user can't follow a dd if/of command, would you want them to have to "fastboot boot (image)?" they might flash it, then their boot image needs to be flashed back or it won't boot. There are downsides for bootable TWRP as well. Because we don't know the decryption keys, you still have to wipe data. If you don't decrypt with the zip or SU, you can't update, etc. Decrypting modifies system which in turn makes you not able to get OTAs. It's a vicious cycle. The keys as per DeesTroy change with each boot image, so we would have to make a TWRP that has all keys, then comes to what devices do we support. Currently, the two who are actively developing and have worked on TWRP or assisted with it's boot kernel have only two devices, Sprint and T-Mobile. We wouldn't be able to debug any other model for it's decryption key.
To reiterate: to have working bootable TWRP with all the idiosyncracies you are asking for, we'd have to go through the java code like DeesTroy did and get it working. I am not fluent in java. I can make a bootable TWRP, but you'll have to be decrypted, because I know C and Python which is what kernels and most ROMs use. I don't know much about Java to find the decryption keys for each device.
Edit: for easy analogy: let's say computer languages are like human languages. I know two languages that are anglo-saxan in heritage, but you are asking me to read something latin based. I might know some things in it, but it's all greek to me still... XD
Edit 2: Looking at the TWRP for Pixel 2, the only reason they have a bootable image is to flash TWRP to both boots per their OP. It wasn't suggested to temp boot it for flashing purposes or backup purposes. It was implemented to have it in both boot partitions per the TWRP OP linked here

enetec said:
Why do you think a "booted" TWRP wouldn't be able to correctly flash zips?
I don't see reasons for this...
In fact I wrote "if possible"... BUT anyway this is of no interest. We *only* need to boot to TWRP, we are not interested in boot to an "unflashed kernel" if you understand what I mean...
We have only to force it to boot *ever* in TWRP. Kernel parts not used by TWRP (if some are needed on our phone, like some Mediatek devices need...) could be omitted at all (as done on bootable TWRP for Pixels2 if I don't go wrong...).
Click to expand...
Click to collapse
I understand, I was mainly referring to fastboot stuff, not within TWRP. Any within TWRP stuff was related to Magisk, not the inability of TWRP to flash once TWRP was loaded, but the importance of re-flashing Magisk and the consequences of not re-flashing Magisk. It was really just centered on the importance of re-flashing Magisk. Anything related to kernels stemmed from someone's question about testing kernels. Just minor stuff, but someone asked.

Uzephi said:
...
Edit 2: Looking at the TWRP for Pixel 2, the only reason they have a bootable image is to flash TWRP to both boots per their OP. It wasn't suggested to temp boot it for flashing purposes or backup purposes. It was implemented to have it in both boot partitions per the TWRP OP linked here
Click to expand...
Click to collapse
And this is *ALL* we need IMHO!!!
Is this doable in your (or others...) opinion?
EDIT: and anyway it probably will work fine to flash something and/or to fully backup a system *including* stock boot.img highfive & only excluding encrypted /data (the same encrypted /data our flashed TWRP is unable to manage too... so, what's the point on it? )

Anyway, we are really going OT here... this is not "Could a bootable TWRP be useful?" thread (it's *obvious* it is... ) this is a "What are the issues we have to face & fix to get a working bootable TWRP?" …
So my questions are basically two:
- is there a method to modify (read: force...) a boot.img with TWRP inside like ones we already have so that it boots to TWRP and not to system?
- can Pixels2/2XL bootable-only official TWRP (sources should be available...) be modified to make it work on our (similar...) device?

I would like to keep OTA (at least until there is a lineage os) and must encrypt my z2. Will the bootable TWRP decrypt the system password and allow backup? If I go with a modified boot.img with TWRP, then can I get OTA updates? or must I wait until someone modifies the OTA boot and publishes it? Can I keep one partition with the OTA and the other with a custom rom image?

kendallgreen said:
I would like to keep OTA (at least until there is a lineage os) and must encrypt my z2. Will the bootable TWRP decrypt the system password and allow backup? If I go with a modified boot.img with TWRP, then can I get OTA updates? or must I wait until someone modifies the OTA boot and publishes it? Can I keep one partition with the OTA and the other with a custom rom image?
Click to expand...
Click to collapse
To get OTA, both slots have to have an unmodified boot image, oem image and system. If anything got modified, OTA will fail

Just to link some very useful info(s) posted elsewhere...
https://forum.xda-developers.com/showpost.php?p=74665682&postcount=347
https://forum.xda-developers.com/showpost.php?p=74667790&postcount=350

[Pie/Oreo/Nougat] How to root your Z2 [ALL]

Since no guide has been updated with information on official TWRP for root and backup reasons, I thought I'd create one.
DISCLAIMER:
To do this method requires you to unlock your bootloader. Your warranty is now void. This method assumes you have basic knowledge of ADB and Fastboot commands and know how to recover your device if you accidentally type a wrong command and now boot to TWRP and can't boot to system. If you cannot recover from this, Read up on guides to "return to stock" and familiarize yourself on how to recover your device should something go wrong.
There are two methods for root. You can flash TWRP to your boot image to be able to reboot to TWRP without a PC, or just a temp boot so you can just have root and not TWRP. I'll put in brackets the minor differences.
1: Get ready
Download latest build of TWRP img file from their website.(Previous link is to their instructions and device specific patches, download page is HERE.) {download the latest zip if you want to flash TWRP}
Download what you want on your phone (SU, Magisk, etc)
2:
Hook phone up to your PC, be sure you have latest adb/fastboot drivers. (I do not support windows related questions. If you have latest drivers, you'll have no issue with the below commands, Linux just works for this kind of thing)
3:
Navigate to your directory that has that img downloaded. (windows, shift right click and say "open command prompt here")
Type the below commands, and terminal output should be similar: (I.E. this is a copy/paste of terminal)
Main thing to remember is "Fastboot boot {filename}.img"
Code:
[email protected]:~$ adb reboot bootloader
[email protected]:~$ cd Downloads
[email protected]:~/Downloads$ fastboot boot twrp-3.2.1-1-nash.img
downloading 'boot.img'...
OKAY [ 0.841s]
booting...
OKAY [ 5.135s]
finished. total time: 5.976s
[email protected]:~/Downloads$
BE SURE TO DO BOOT AND NOT FLASH!!! (If you ask why you can no longer boot to system, I'll let you know you missed this line.)
5:
You're now in TWRP!
It will ask you for your password. This is your PIN or password to unlock your phone. Enter it.
TWRP has now decrypted your storage to read the zip file(s) you put on your phone!
Go to install and navigate to your directory where you put that file
Install Magisk/SU/TWRP/whatever you please.
(Note: some root zips require a factory reset)
6:
Reboot!
You're Done congratulations!
Attached are images if they help you see you're doing the right thing.
Special thanks @erfanoabdi @invisiblek @npjohnson @joemossjr @jbats
Without the above people a lot of what's above woudn't have been possible for this device specifically. Also, thanks to everyone who pitched in to get a device over to invisiblek. Leaps and bounds have been done since that donation. And thanks to the other devs who have invested in this phone and their time to help out.
(Quoted from Nathan Chance)
Quite a few people have asked to donate to me in the past and I have turned them down. I am not in this for the money, this is my hobby, something I truly enjoy. If you truly want to donate to something (it is not expected in the slightest), I recommend an entity like the Open Source Initiative, the Free Software Foundation, XDA, or any one of the people I have thanked in the OP. Additionally, you are free to copy any and all of my work; the only thing I request is that you not ask for donations as well (though I can't really enforce this lol). Thank you.

Random issues post:
SU does some wonky edits to the ramdisk. It is highly suggested to flash Magisk for root.
Some have reported needing to wipe data after flashing Magisk. If you can't boot after flashing Magisk, just go back into recovery (can be twrp or stock) and wipe data/factory reset to boot again.

Note: we do not have a recovery partition. Never flash the img file! Download the flashable zip if you want twrp on your phone and flash per OP instructions.

Awesome thanks

I get into a bootloop and right back into TWRP using this method. I got the failed to mount data invalid argument. I got rid of this by formating data in TWRP. Now I get failed to mount system device or resource busy when I attempt to flash Magisk.
Bootloop.
I am on TMO running the latest 27.1 Oreo

droidgreg said:
I get into a bootloop and right back into TWRP using this method. I got the failed to mount data invalid argument. I got rid of this by formating data in TWRP. Now I get failed to mount system device or resource busy when I attempt to flash Magisk.
Bootloop.
I am on TMO running the latest 27.1 Oreo
Click to expand...
Click to collapse
Be sure to mount system under the "mount" button

I need the OCX27.1 oreo. I did a return to stock flashall to OCX27 and now reflashed TWRP and Magisk and boots fine but I lost baseband and IMEI

Added warning to OP that some root zips require a data wipe.

I apologize in advance for asking a question that may have an obvious answer, but will this work for the Verizon variant of the Z2 Force? I'm not interested in trying out different ROMs just yet, but I would like to be able to remove adds, bloatware, and go back to using FoxFi the way it was meant to be used, specifically as a wireless hotspot. I can use the hotspot feature built into the phone, but it caps at 15 gigs & gets reduced to low, low speed after. Thanks in advance. Oh, and I should mention I'm currently running Oreo.

will4958 said:
I apologize in advance for asking a question that may have an obvious answer, but will this work for the Verizon variant of the Z2 Force? I'm not interested in trying out different ROMs just yet, but I would like to be able to remove adds, bloatware, and go back to using FoxFi the way it was meant to be used, specifically as a wireless hotspot. I can use the hotspot feature built into the phone, but it caps at 15 gigs & gets reduced to low, low speed after. Thanks in advance. Oh, and I should mention I'm currently running Oreo.
Click to expand...
Click to collapse
This guide assumes you can unlock your bootloader. Since Verizon and AT&T feel they have a right to lock down their devices, this guide won't work. That is why I voted with my wallet and left Vz after my M7 due to them putting phone OEM's privates in a vice and forced them to lock out those carrier variants.

Has this method been tested with OCX27.1 Oreo on TMO?

droidgreg said:
Has this method been tested with OCX27.1 Oreo on TMO?
Click to expand...
Click to collapse
It probably hasn't been tested, but it should work in theory.

Uzephi said:
It probably hasn't been tested, but it should work in theory.
Click to expand...
Click to collapse
I was on 27.1 when I attempted to root and got into a bootloop and lost my baseband when I flashall back to stock OCX27. I have a feeling 27.1 update isn't compatible with this method and cannot be downgraded to even OCX 27 Oreo

so no go on 27.1 twrp? I have root on 27.1 TMO obtained post update. Obtained by fastbooting the nash twrp and running magisk 16.zip. No needing to format data or anything
I was just wondering about the installable twrp zip. I am coming from samsung development so all this A/B partitioning and some of the other partitions are new to me.
As soon as I can get twrp on the phone and feel comfortable recovering. The kernels and roms will start coming.
Feels strange not having odin to save my ass

droidgreg said:
Has this method been tested with OCX27.1 Oreo on TMO?
Click to expand...
Click to collapse
tested and working

mattlowry said:
tested and working
Click to expand...
Click to collapse
Have you actually flashed installer.zip to install TWRP or just booted TWRP and only flash magisk or SU for root without installing TWRP?

I fastboot booted the twrp. I didn't try the installer. What is it?

Doesn't work for me, i've done every step whitout problems but after installing SU and reboot, it wont boot anymore, stays in Moto logo.

luponcooper said:
Doesn't work for me, i've done every step whitout problems but after installing SU and reboot, it wont boot anymore, stays in Moto logo.
Click to expand...
Click to collapse
I'll put a warning about SU then. It also causes other stuff to not flash right. Suggested root is magisk for our device. Reflash your boot.img from the flash all and reroot with magisk then wipe data (wiping might not be needed, I never had to but some people have needed to).

Uzephi said:
I'll put a warning about SU then. It also causes other stuff to not flash right. Suggested root is magisk for our device. Reflash your boot.img from the flash all and reroot with magisk then wipe data (wiping might not be needed, I never had to but some people have needed to).
Click to expand...
Click to collapse
Thanks a lot uzephi for answering.
I have the 6gb ram and 64gb model, XT1789-05. I try whit no succes to install Magisk (Error1) so i made a factory reset but still doesn't boot, stays in M logo.
Im super noob, can you guide me? i dont know how to recover the boot.img.
excuse my english.

[Recovery] TWRP LG H872 (Unofficial)

Download
v3.2.1-0
Sauce: Github
Fixed /system mounting issues
let me know if you have any issues and I will do what I can to fix them.
Credit: @Josh1x for having the h870 device tree put together for me to clone and update. I will fix the original author on my master branch as soon as I get some time

Thank you!

Works like a charm. No issues here, thanks bro.
---------- Post added at 02:27 PM ---------- Previous post was at 01:42 PM ----------
Also this recovery also fixes the error messages apon flashing mods and what not

How can we apply it if no fastboot commands work

Trippyy Doee said:
How can we apply it if no fastboot commands work
Click to expand...
Click to collapse
Follow the steps exactly in this guide https://forum.xda-developers.com/tmobile-g6/how-to/root-h872-to-including-11g-t3775518 afterwards flash the image provided here in recovery

MudaTrucka said:
Follow the steps exactly in this guide https://forum.xda-developers.com/tmobile-g6/how-to/root-h872-to-including-11g-t3775518 afterwards flash the image provided here in recovery
Click to expand...
Click to collapse
So this is all we've been waiting for ?! Finally can haz root ? ?

MudaTrucka said:
Follow the steps exactly in this guide https://forum.xda-developers.com/tmobile-g6/how-to/root-h872-to-including-11g-t3775518 afterwards flash the image provided here in recovery
Click to expand...
Click to collapse
when i go into recovery mode all i get is no command. what should i do?

purplekushDGK said:
when i go into recovery mode all i get is no command. what should i do?
Click to expand...
Click to collapse
I think you might have to reflash recovery but idk I'm not the best with this

MudaTrucka said:
I think you might have to reflash recovery but idk I'm not the best with this
Click to expand...
Click to collapse
Opemilekan's method actually worked, had to flash supersu then used flashify to flash h872 twrp. thanks for the response man

purplekushDGK said:
Opemilekan's method actually worked, had to flash supersu then used flashify to flash h872 twrp. thanks for the response man
Click to expand...
Click to collapse
No problem, I thought I'd at least try to help

@KAsp3rd W00T -- glad to see that you built this.
The new version of the lafsploit will be out later today, and with it you can use any recovery your want. It handles all the hash verifications internally. It is about as automated as I can make it.
It will be:
./flash-h918-laf.py # Flashes the h918 laf without the need of LG UP, so no brick risks if people aren't paying attention
./root-h872.sh <recovery.img> # If specified, it will use the recovery.img passed, if not, then it will use this version which will be included in the repo
./post-root.sh # This takes care of all the final steps.
So three commands, and that is it. If I could force a reboot back into download mode, it would be one command, but a reboot into download mode is required between each command..
-- Brian

MudaTrucka said:
No problem, I thought I'd at least try to help
Click to expand...
Click to collapse
Can you tell me this method? I cannot get this image to stick, it always reverts back to H870, meaning I cannot flash anything custom (guess I could run Remix H870-would that work?)

agmyers76259 said:
Can you tell me this method? I cannot get this image to stick, it always reverts back to H870, meaning I cannot flash anything custom (guess I could run Remix H870-would that work?)
Click to expand...
Click to collapse
Flash the image to recovery, use the steps in the root thread to get it to stick and make sure you're actually booting into recovery and not laf

runningnak3d said:
@KAsp3rd W00T -- glad to see that you built this.
The new version of the lafsploit will be out later today, and with it you can use any recovery your want. It handles all the hash verifications internally. It is about as automated as I can make it.
It will be:
./flash-h918-laf.py # Flashes the h918 laf without the need of LG UP, so no brick risks if people aren't paying attention
./root-h872.sh <recovery.img> # If specified, it will use the recovery.img passed, if not, then it will use this version which will be included in the repo
./post-root.sh # This takes care of all the final steps.
So three commands, and that is it. If I could force a reboot back into download mode, it would be one command, but a reboot into download mode is required between each command..
-- Brian
Click to expand...
Click to collapse
Any idea when this might be ready good sir? I am not in a good place right now with my G6, could really use these commands---stuck in TWRP and can boot a rom, but somehow didnt follow your Step 3 in the Root guide, and my misc.img didnt get moved over, thus I have a rom that cannot connect to Wifi due to lack of MAC--this update would be huge, as I would go back to stock and restart this mess.
TIA

That won't help you now. Hopefully you still have the backup of your misc partition that was made in step 2. If so, boot to TWRP, and run:
adb push misc.img /sdcard/
adb shell dd if=/sdcard/misc.img of=/dev/block/bootdevice/by-name/misc
-- Brian

how do you flash the update
how do you flash the update? its not a option in the system app

purplekushDGK said:
Opemilekan's method actually worked, had to flash supersu then used flashify to flash h872 twrp. thanks for the response man
Click to expand...
Click to collapse
I used flashify and was promted for a decryption password upon booting recovery. Am I doing something wrong?
(Note that I can still access storage on the original download mode twrp, but not on this one)

Like everyone else I'm also confused as to how I can get the h872 recovery to work without breaking anything since I have the h870 recovery on laf

Stupid question I think, but I get a "Traceback (most recent call last):" after entering ./partitions.py --restoremisc twrp-3.2.1-0-h870.img .
Is there a specific place to put the TWRP ing file ? I think when I run the command its not finding the img.

MudaTrucka said:
Follow the steps exactly in this guide https://forum.xda-developers.com/tmobile-g6/how-to/root-h872-to-including-11g-t3775518 afterwards flash the image provided here in recovery
Click to expand...
Click to collapse
Hey so I already followed this tut last week and have been on root but having issues that this recovery fixes, how can I flash to this TWRP?

How to reset firmware

so i've tried a few roms, and couldn't get gpay working. im going to try a few things mentioned in other threads, but before i start that. i want to properly/fully reset my phone to the stock, to hopefully make sure i don't mess anything up in the future.
my first issue was installing twrp, i tried to `fastboot flash` the recovery, but nothing worked until i followed these steps: https://www.getdroidtips.com/download-and-install-twrp-recovery-for-redmi-k20-pro-latest/
im worried about what might be in the misc.bin in that zip. cuz i couldn't reboot into twrp recovery until i flashed that. does anyone know what that is? i think i just want to flash/reset? everything on my phone back to miui, make sure i update to the latest firmware etc. but, tbh, i find navigating xda difficult and can't seem to find the official firmware anywhere, or steps on how to reset the phone...
thanks for any help

Um, i think ur in the wrong category

thejacer87 said:
my first issue was installing twrp, i tried to `fastboot flash` the recovery, but nothing worked until i followed these steps ...
im worried about what might be in the misc.bin in that zip. cuz i couldn't reboot into twrp recovery until i flashed that. does anyone know what that is?
Click to expand...
Click to collapse
The misc.bin file is basically just a script that tells the Device to directly boot into TWRP, because Xiaomi Devices / MIUI are configured to overwrite TWRP after a reboot. If you still feel uncomfortable having to flash the misc file, try "fastboot *BOOT* TWRP.img" instead of "fastboot *FLASH* TWRP.img".
If you wish to keep MIUI installed instead of an Custom ROM make sure to flash Magisk, as it patches the DM-Verity stuff that causes the Device to either get stuck in a Bootloop or replace TWRP with the Stock Recovery.
If you're planning to run an Custom ROM like LineageOS, AOSiP etc. you don't have to flash Magisk as long as your Device isn't encrypted. Rebooting from TWRP to System without flashing Magisk on an encrypted Device will encrypt your Data Partition and you'll have to format Data to be able to access the Internal Storage again. (Flashing Magisk in that case will prevent your Device from encrypting all your Data again after an ROM Flash.)

Fatal_Scythe said:
The misc.bin file is basically just a script that tells the Device to directly boot into TWRP, because Xiaomi Devices / MIUI are configured to overwrite TWRP after a reboot. If you still feel uncomfortable having to flash the misc file, try "fastboot *BOOT* TWRP.img" instead of "fastboot *FLASH* TWRP.img".
If you wish to keep MIUI installed instead of an Custom ROM make sure to flash Magisk, as it patches the DM-Verity stuff that causes the Device to either get stuck in a Bootloop or replace TWRP with the Stock Recovery.
If you're planning to run an Custom ROM like LineageOS, AOSiP etc. you don't have to flash Magisk as long as your Device isn't encrypted. Rebooting from TWRP to System without flashing Magisk on an encrypted Device will encrypt your Data Partition and you'll have to format Data to be able to access the Internal Storage again. (Flashing Magisk in that case will prevent your Device from encrypting all your Data again after an ROM Flash.)
Click to expand...
Click to collapse
k thanks for the info. what's the difference b/w the boot v flash for twrp?
is the misc.bin from that link i posted safe then? where did it come from? is there a thread here where files like that are posted/talked about?
i definitely plan to stick with either lineage or Pixel experience. i just want to get google pay going. so i think my next attempt will be to relflash magisk and look into that sql fix everyone mentions

thejacer87 said:
so i've tried a few roms, and couldn't get gpay working. im going to try a few things mentioned in other threads, but before i start that. i want to properly/fully reset my phone to the stock, to hopefully make sure i don't mess anything up in the future.
my first issue was installing twrp, i tried to `fastboot flash` the recovery, but nothing worked until i followed these steps: https://www.getdroidtips.com/download-and-install-twrp-recovery-for-redmi-k20-pro-latest/
im worried about what might be in the misc.bin in that zip. cuz i couldn't reboot into twrp recovery until i flashed that. does anyone know what that is? i think i just want to flash/reset? everything on my phone back to miui, make sure i update to the latest firmware etc. but, tbh, i find navigating xda difficult and can't seem to find the official firmware anywhere, or steps on how to reset the phone...
thanks for any help
Click to expand...
Click to collapse
If you're planning to go back to stock MIUI and locked bootloader, I highly recommend using Mi Flash and flashing the original fastboot MIUI ROM which can be found here https://www.xda-developers.com/download-miui-11-xiaomi-redmi-note-7-pro-poco-f1/amp/. All you gotta to do is extract the ROM file which is .tgz to any folder, and in Mi Flash select that folder click on "clean all and lock" in the bottom right corner, and click flash. This should theoretically make your device "out of the box".
Keep in mind that this method requires a PC with all ADB and fastboot drivers, they can be downloaded from here https://forum.xda-developers.com/showthread.php?t=2588979 .

thejacer87 said:
k thanks for the info. what's the difference b/w the boot v flash for twrp?
is the misc.bin from that link i posted safe then? where did it come from? is there a thread here where files like that are posted/talked about?
i definitely plan to stick with either lineage or Pixel experience. i just want to get google pay going. so i think my next attempt will be to relflash magisk and look into that sql fix everyone mentions
Click to expand...
Click to collapse
BOOT will just let the Device temporarily boot into the Recovery (without making changes to the Recovery Partition) FLASH will write the Recovery Image to the Recovery Partition so you can boot to it whenever you want / need to.
I don't know if there's any kind of threads where certain files are talked about sorry, but I could be wrong though.
I don't know much about G Pay, I was gonna try it too but my Bank doesn't support it. I've seen quite a few people reporting success in getting it to work / making payments with it in local stores with the mentioned SQL Fix so if you're lucky it'll work for you too

Fatal_Scythe said:
BOOT will just let the Device temporarily boot into the Recovery (without making changes to the Recovery Partition) FLASH will write the Recovery Image to the Recovery Partition so you can boot to it whenever you want / need to.
I don't know if there's any kind of threads where certain files are talked about sorry, but I could be wrong though.
I don't know much about G Pay, I was gonna try it too but my Bank doesn't support it. I've seen quite a few people reporting success in getting it to work / making payments with it in local stores with the mentioned SQL Fix so if you're lucky it'll work for you too
Click to expand...
Click to collapse
just got gpay to work with the sql fix. thanks for the help