yashsingh1/xdaforums huggingface dataset:
[ONE Android Development] armini0:
Worked fine.

Installed drivers, booted in fastboot mode by cmd: adb reboot bootloader

Booted in temp recovery (after renaming recovery.img to twrp.img (twrp is found in another thread) cmd: fastboot boot twrp.img

Flashed the zip at first post. TWRP asked to install superSU, i clicked yes and rebooted into android (was not rooted at that moment)

Reboot another time to fastboot mode to check bits after rebooted in Android (which worked fine): adb reboot bootloader

cmd: fastboot oem device-info

This shows that the temper bit is on false and the bootloader unlock status is on true.

Intalled CWM Philz edition by going to the fastboot mode again and running the batch file that came in the zip (check the other tread for the zip):

adb reboot bootloader

After that booted in Android (CWM was installed fine), clicked the SuperSU app and it asked to intall the binaries, clicked yes and rebooted in CWM. These installed fine, rebooted automatically and I'm now unlocked and rooted without losing any data :D

Many many thanks! :D
[ONE Android Development] stefan.pilsu:
Reset tamper bits goes back to true after reboot all the time even after installing the zip TWRP confirm it as false
[ONE Android Development] Xephrey:
Thank you!

Thanks so much for this! I was pulling my hair out trying to get both toggles to match and to be able to OEM lock / unlock. I was one of those cases where a simple 'fastboot oem unlock' just didn't cut it.
[ONE Android Development] Vonnegut:
I've read all of the thread...i congratulate the 2 guys who tracked down both the bit and wrote/updated the script.

Anyway, as far i've understood the 2 bits are part of aboot. Any OTA comes with the stock emmc_appsboot.mbn ready to be flashed anytime.

The OTA script itself checks if aboot doesn't match the SHA1 code...if so it flashes it:

run_program("/sbin/dd", "if=/dev/block/platform/msm_sdcc.1/by-name/aboot", "of=/tmp/test.img");

ifelse((sha1_check(read_file("/tmp/test.img")) == "91e99f6bc85b318caa9ef75bb0b16587d4f516a2"),(ui_print("/dev/block/platform/msm_sdcc.1/by-name/aboot already up to date")),(package_extract_file("emmc_appsboot.mbn", "/dev/block/platform/msm_sdcc.1/by-name/aboot")));

Moreover, Oneplus doesn't care about unlocking the booloader at all.

To sum it up, whenever we get an OTA, the stock bootloader gets reinstated and the two bits too. So i guess the only real use for this modding is to unlock the bootloader again (whenever we get an OTA update) in order to avoid a factory reset. Right?
[ONE Android Development] Mnt-XDA:
Very good finding ... though I got ota cm11s 25R even I was rooted and unlocked...

need to test your finding in next OTA...

:good:
[ONE Android Development] Vonnegut:
I did a quick experiment. I downloaded the official OTA and removed about everything from the .zip.

I also edited the updater-script leaving only the following commands:

ui_print("Testing OTA");

run_program("/sbin/dd", "if=/dev/block/platform/msm_sdcc.1/by-name/aboot", "of=/tmp/test.img");

ifelse((sha1_check(read_file("/tmp/test.img")) == "91e99f6bc85b318caa9ef75bb0b16587d4f516a2"),(ui_print("/dev/block/platform/msm_sdcc.1/by-name/aboot already up to date")),(ui_print("/dev/block/platform/msm_sdcc.1/by-name/aboot would have been flashed")));

delete("/tmp/test.img");

I replaced the original third ifelse argument (red) with a harmless message.

My bootloader is both unlocked and tampered: after flashing the fake OTA zip ( http://www.mediafire.com/download/55mzgcz66tb4g7d/Fake-11.0-XNPH25R-bacon-signed.zip ) via TWRP i've got the following log:

Installing '/sdcard/Fake-11.0-XNPH25R-bacon-signed.zip'...

Checking for MD5 file...

Skipping MD5 check: no MD5 file found

I:Zip contains SELinux file_contexts file in its root. Extracting to /file_contexts

I:Legacy property environment initialized.

Testing OTA

about to run program [/sbin/dd] with 3 args

2048+0 records in

2048+0 records out

1048576 bytes (1.0MB) copied, 0.025785 seconds, 38.8MB/s

/dev/block/platform/msm_sdcc.1/by-name/aboot would have been flashed

P.S. If you are in the mood you might test the .zip with both the bits locked...just to confirm.

The output message should be /dev/block/platform/msm_sdcc.1/by-name/aboot already up to date but i'm not sure it would work 'cause it has write on the disk. I guess that (with both bits in a false state) it can be possibile only checking the otacert+md5+releasekey.
[ONE Android Development] Mnt-XDA:
Thank you , I will surely try ...give me some time
[ONE Android Development] _Beni_:
Can i lock my bootloader again after flashing paranoidandroid?
[ONE Android Development] Heisenberg:
You could, but why?

Transmitted via Bacon
[ONE Android Development] Vonnegut:
He's getting paranoid.

So i guess he fears Oneplus might connect remotely to his One and check the bootloader.
[ONE Android Development] Quinnaay:
never done anything like this before and no matter how many times i read i just dont understand :( [MENTION=4153349]timmaaa[/MENTION] how do you get command prompt up and where do i get the recovery..
[ONE Android Development] Heisenberg:
Download the recovery here:

http://techerrata.com/browse/twrp2/bacon

Navigate to where you have fastboot.exe located on your PC and paste the recovery file in the same folder. Stay in that folder then shift + right click anywhere within it, select open command prompt here. Now you can issue this command:

fastboot boot recovery "filename.img"

(Type the exact recovery filename minus the talking marks)

Then continue on with the procedure.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
So this is the first step?

Its all the tamper bits etc i keep reading which i dont know what im on about. Do i need to download anything else other than the recovery? and what is next. I've searched youtube and unfortunately this method isn't on there yet

edit: downloaded TWRP and moved it to the folder where fastboot.exe is..
[ONE Android Development] Heisenberg:
You also need to download the OnePlusOne-BootUnlocker.zip from the bottom of the first post, place it on the root of your internal storage on your phone. After you give the "fastboot boot recovery" command the phone will boot into TWRP recovery, hit the install button from the main menu, navigate to the OnePlusOne-BootUnlocker.zip on your internal storage and select it, then swipe to install. It'll run an auto script at this point, once it's finished you can just reboot system and let the phone boot up. Go back to fastboot mode so you can check the results with this command:

fastboot oem device-info

Both flags should be set to true now which means you have an unlocked bootloader.
[ONE Android Development] Quinnaay:
Think ill give this a go now, final question because i saw it on another youtube video, dos the update CM recovery in developer options need to be unticked?
[ONE Android Development] Heisenberg:
At this stage, no. But once you've successfully unlocked your bootloader you'll need to do that before actually installing TWRP recovery rather than just booting into it.

A piece of advice: YouTube videos really aren't all they're cracked up to be, the information given right here on XDA is usually all you should need. It's very important that you don't rely on videos, and instead learn to take written instructions as that's what's available (and most accurate) most of the time.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
Thanks for the help mate, ive just ran a MD5 check and it saying codes dont match? i wanted to check before i did it.. and i downloaded the Md5 from the link you gave.

edit never mind they match
[ONE Android Development] Heisenberg:
If the md5 doesn't match it means the file has become corrupt during the download, delete it and download it again.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
Well i tried the first step and failed lol, it said no such file or directory.. the twrp file ends in .md5 not .img (although the .img is before .md5 is this a problem ? should it be renamed?
[ONE Android Development] Heisenberg:
What did you download? It should be this:

http://techerrata.com/file/twrp2/bacon/openrecovery-twrp-2.7.1.1-bacon.img

Are you saying it's named openrecovery-twrp-2.7.1.1-bacon.img.md5?

What size is the file? How did it get the .md5 on the end? Exactly why did you do after downloading it?

Transmitted via Bacon
[ONE Android Development] Quinnaay:
correct thats what it says.
[ONE Android Development] Heisenberg:
I've edited my previous post, please see extra questions.

Transmitted via Bacon
[ONE Android Development] r8zer:
Can I ask you a question you have done a post on how to unlock and other guides. Your clearly knowledgeable.
[ONE Android Development] Quinnaay:
ugh im not cut out for this lol, ive just re downloaded it and now it doesnt say .md5 however retyred the command and it says the same, the file is in the same place as the fastboot i put my phone in fastboot mode and i also copied it to make sure it was typed correct still no joy.

isit normal for my One not to show up in the drives when in fastboot mode too?
[ONE Android Development] Heisenberg:
Please copy/paste the text from the command prompt on a failed attempt here so I can analyse.

Transmitted via Bacon

---------- Post added at 08:42 AM ---------- Previous post was at 08:41 AM ----------

Do you mean me? If so, probably best to ask in my guide thread unless your question is specific to this exploit.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
C:\Users\Luke\Downloads\Root Guide (OnePlus One)\Turoials\4 - Boot Recovery IMG>

fastboot boot recovery openrecovery-twrp-2.7.1.1-bacon.img

< waiting for device >

cannot load 'recovery': No such file or directory

C:\Users\Luke\Downloads\Root Guide (OnePlus One)\Turoials\4 - Boot Recovery IMG>

fastboot boot recovery openrecovery-twrp-2.7.1.1-bacon.img

cannot load 'recovery': No such file or directory

i attempted twice..
[ONE Android Development] Heisenberg:
Ok. Try typing the first part (fastboot boot recovery ), make sure you put a space after the word recovery, then drag and drop the recovery file into the command prompt window and hit enter.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
same again, didnt work mate .. dont understand.

---------- Post added at 10:52 PM ---------- Previous post was at 10:51 PM ----------

C:\Users\Luke\Downloads\Root Guide (OnePlus One)\Turoials\4 - Boot Recovery IMG>

fastboot boot recovery "C:\Users\Luke\Downloads\Root Guide (OnePlus One)\Turoial

s\4 - Boot Recovery IMG\openrecovery-twrp-2.7.1.1-bacon.img"

< waiting for device >

cannot load 'recovery': No such file or directory

C:\Users\Luke\Downloads\Root Guide (OnePlus One)\Turoials\4 - Boot Recovery IMG>

fastboot boot recovery openrecovery-twrp-2.7.1.1-bacon.img

cannot load 'recovery': No such file or directory

top line was dragging it into command prompt the second was copying the name again

does it matter if its in a folder with some other .exe from rooting? think its time to go to sleep, have to check it out tomorrow working in early in the morning
[ONE Android Development] Heisenberg:
What do you get when you give this command?

fastboot devices

Or this one?

fastboot oem device-info

Can you post a screenshot of your fastboot folder (where you have fastboot and the recovery located) on your PC?

It shouldn't really matter what else is in the folder, but you could try moving the other exe out.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
---------- Post added at 11:01 PM ---------- Previous post was at 10:58 PM ----------

it says device tampered true

unlocked false

charger screen false
[ONE Android Development] Heisenberg:
What's the other recovery you have in there? Is that from when you rooted? How did you use that one?

Transmitted via Bacon
[ONE Android Development] Quinnaay:
all i did was click the start.bat file.. and it booted a recovery up, yes it was from rooting

ive just moved them out the folder and re tried and this error came up
[ONE Android Development] Polarfuchs:
The command is wrong:

fastboot boot recovery openrecovery-twrp-2.7.1.1-bacon.img

leave the recovery word out.

So the correct command is:

fastboot boot openrecovery-twrp-2.7.1.1-bacon.img
[ONE Android Development] Heisenberg:
Damnit. Can't believe I got that wrong. Thanks for correcting my mistake.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
it now says, device tampered false, device unlocked true, charger screen false.. cant believe all that headache and it was that simple, are they correct? how come the "tampered" changed to false?

so has that unlocked the bootloader AND installed a custom recovery? or just unlocked the bootloader

edit just checked i still have root :D
[ONE Android Development] Heisenberg:
Awesome sauce. That's just unlocked your bootloader. Install the recovery with this command:

fastboot flash recovery "recovery.img"

(You know, the exact filename minus the talking marks)

You'll still have root. Once you've installed the recovery you can make a nandroid.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
already done it, i went back to your guide, thanks for the patience fellas we got there lol!
[ONE Android Development] Heisenberg:
Excellent. Sorry I made the whole process more drawn out with my syntax error.

Transmitted via Bacon
[ONE Android Development] Quinnaay:
Looked an easy mistake to make. Ill do a nandroid backup in the morning at work and transfer it to PC tomorrow afternoon and install xposed and some modules :)

Appreciate it
[ONE Android Development] Wisiwyg:
Can anyone confirm this is happening with their phone too? If so and the tamper bit reset doesn't stick, is there a way to run the script so that the tamper bit reset to false does stick?
[ONE Android Development] dryspuri:
Yes tempered bit is not working it goes back to tempered

may be because cutom recovery is on the phone. I will try sideloading
[ONE Android Development] Quinnaay:
I did it yesterday and I was rooted so it was set to true I did the above and its now set to false.. Even after reboot
[ONE Android Development] Mnt-XDA:
Thanks for confirming....:good:
[ONE Android Development] stefan.pilsu:
:confused:

Doing what exactly?
[ONE Android Development] Quinnaay:
If you go back two pages or so you will see the headache and process timmaaa gave me
[ONE Android Development] stefan.pilsu:
Headaches or not...it's your head.

So the tamper remain false even after reboot ?
[ONE Android Development] Quinnaay:
Correct
[ONE Android Development] gunvald89:
I have a similar problem.

I am stock in a bootloop but I can’t get in to recovery, only fastboot. The bootloader is locked and I can’t change it with the command “fastboot oem unlock”. How did you do?
[ONE Android Development] tkdsl:
You need to use the op and boot into a temp recoerry and flash the file. That worked for me
[ONE Android Development] gunvald89:
That’s one of my problems. I can’t boot into a temp recovery, my phone just restarts and gets stuck in a boot loop. My bootloader is tampered but unlocked and I can’t unlock and I can’t get in to my recovery or a temp recovery… Does that make any sense to you or anyone else for that matter?
[ONE Android Development] Heisenberg:
How did you get to this point?

Transmitted via Bacon
[ONE Android Development] zephiK:
He told me that he ran a toolkit and then pressed the root button and that's how he came to his problem. Everything I suggested lead to the same road.

His bootloader is locked, and every time when you do fastboot boot imgfile.img the phone reboots goes to the oneplus screen and then it reboots again. I believe he doesn't even see the boot animation either.

We've tried reinstalling drivers, using different computer. His tampered bit is true but unlocked bit is false.
[ONE Android Development] Heisenberg:
Oh I see, toolkits. It seems there's an increasing amount of problems being created by toolkits lately. Do we know if these problems are all being created by the same toolkit? And if so, we might need to contact the developer of that toolkit to possibly put a halt to the download.

Transmitted via Bacon
[ONE Android Development] zephiK:
The toolkit he used was by manudroid19. But I agree, I certainly don't endorse using toolkits but on some phones I can see why its nice to have but on the Nexus/One/HTC devices where u have fastboot oem unlock its really not needed.

I really wish XDA banned the usages of Toolkits and its kinda disheartening that TK (tkdsl) no offense but its a developer website not a consumer website for your "Average Joe." Posting on XDA TV on how to root and unlock the bootloader of the OnePlus One by using a toolkit is wrong https://www.youtube.com/watch?v=5O2e_R_TbVg you should be endorsing the usages of using command prompt and typing fastboot oem unlock, fastboot flash recovery recoveryname.img and then flashing supersu.zip

Just like the post from another thread, I think you read it too. Back in the days when I used a G1, it took me 30-45 minutes to root my G1 doing it from my PC and G1 with so many different commands and whatnot. Was it scary at first? Yeah.. it required a lot of reading and at one given point if I mess up, I can screw up my phone but it also thought me a lesson that no toolkit could ever teach me. And that is to read instructions and perform them as well as gaining basic fastboot, adb skills. This is how people on XDA help each other, if they just use toolkits they are doing things without understanding why they're doing it.
[ONE Android Development] Heisenberg:
I couldn't agree more. I saw that video by TK and shook my head. This phone simply doesn't need toolkits, in fact no phone really needs them. All they do is create a bunch of people who have no idea what they're doing, and in some cases, bork phones. People need to learn how to do things for themselves, I always say this: if you can read, and if you can type, you can use adb & fastboot, it's that simple. Do it a few times and you start to get the feel for what you're doing. Driving a car for the first time is daunting for most people, but the more you do it the better you become. I believe that's a good analogy for modifying your phone.

Transmitted via Bacon
[ONE Android Development] Mnt-XDA:
In my opinion , toolkits are good for those who are not so comfortable with fastboot, sideload , adb , flashing & scripting...etc

But , I would recommend all to use direct commands , recovery flashing, adb , fastboot

It will help us to understand the concept behind (developer / advance user point of view)
[ONE Android Development] Heisenberg:
They may seem good for those people, but they're not, they're hampering them, because they stop those people that are uncomfortable with fastboot and adb from ever becoming comfortable with it. The only way to advance yourself and become comfortable with something is through experience, and toolkits completely bypass that altogether. They create a group of people who are modifying their device without the slightest idea of what they're doing, not a good scenario.

Transmitted via Bacon
[ONE Android Development] Mnt-XDA:
I agree with you completely ...
[ONE Android Development] manudroid19:
That's half-true. OK, yes, toolkits may make some people modify their phone without knowing what they're doing... But that's not the purpose of a toolkit.. The purpose of a toolkit is to introduce newbies to dev world.. Much of them would be scared with cmd... But if they really want to learn, they will try cmd as well as the toolkit... That's why I'm creating right now a log option in my toolkit, so people can know which commands is the toolkit launching and do so by themselves...

The other purpose of the toolkit is doing repeating and boring things like flashing cm11s.. You have to launch like 10 commands and wait between them. But the toolkit does it for you. You know what you're doing, but you do it with a toolkit because its easier to you.

Toolkits are useful, but some use them in the wrong way.. I had a guy telling me that I had bricked his phone (It just had a bootloop). What happened was that when my toolkit was flashing cm11s, he got scared and unplugged the phone. He could really brick his phone... But that type or things are not my fault..

Why do I make a toolkit? For me, it's my first serious development... And it helps people to start in this world..
[ONE Android Development] rahulrai:
Looks like this thread is about discussion on not using tool kits????? Come on guys at least respect the devs hard work. Let people use if they want. No one can force anyone. Remember Linux is a open source platform & it's meant to be this way. I'm not here for an argument but when I saw the discussion, I was surprised. I use both cmd & tool kits. Technology is a waste of not used. Have a good day.
[ONE Android Development] :
I cannot seem to unlock my phone nor boot on a custom recovery via fastboot. flashing the zip nor unlocking the phone viafastboot is not an option.

Somehow my phone has maintained root. So anyway I can do this via an alternative method?

Cant you guys sign the zip so its cyanogenmod recovery flashable?
[ONE Android Development] Mnt-XDA:
Use -- fastboot boot twrp.img

then flash the zip by sideload
[ONE Android Development] :
please dont answer if you dont read.

as stated in my question I have tried that
[ONE Android Development] playya:
[MENTION=5461670]bachera[/MENTION]

Come on man you just insulted the OP who would of been the one to try and help you with this. I told you what to do in your thread in reference to signing a zip file. Its simply google how to sign a zip file then follow instructions. Sorry but I do not see what the difficulty in that is. I hope you figure out your issue but this is unfortunately not the way to handle your situation. Good Luck my friend
[ONE Android Development] r8zer:
Then u also do not know how to use fastboot then. And also insulting or being that ignorant to others won't get you any help in here.
[ONE Android Development] :
thanks bro

Sorry sometimes people anwer and dont read the question. Its annoying.

Sorry if I insulted anyone.

anyways. Created a signed zip and it didnt work.

Cant find a hexeditor on my phone to manually change aboot. So am kinda stuck. It sucks
[ONE Android Development] Mnt-XDA:
Don't worry, ... Just give us the exact steps that you tried and the exact errors that you got (may be with some screenshots if possible)

We will try to solve your issue...

It's my fault that I did not read your post carefully in details... :)

:good:
[ONE Android Development] r8zer:
Right. Step 1

Is both adb and fastboot recognising your device.

Put phone in fastboot then.

Fastboot devices should be read as AC001 or something like that.

Is all of your recovery .IMG in the same place as your fastboot. Have you mispelt anything?

Just go through a check list even do a screen grab and post on youtube .

---------- Post added at 09:06 PM ---------- Previous post was at 09:01 PM ----------

Also u say fastboot not an option. there should be no reason y fastboot not working apart from driver issue.

So do you already have a custom recovery then cause u have root. Have you tried a complete ROM install. With the original ROM.
[ONE Android Development] :
thanks all.

Ok what I tried:

fastboot boot recovery.img, tried dr philz,cwm and twrp. All same error, its loaded onto device, but then says it cannot go further cause its locked.

Fastboot flash recovery it says locked error.

fastboot all other img from stock fail with error that its locked.

Updating ota cm11 dont work, have to manually flash update zip. That works. Other roms dont work. Says signture failed.

Tried to create a signature zip file with zipme. Also just says failed.

So I am kinda stuck. Tubas hexeditor savednmy efs once on Samsung phone. Doest work on this one.

tried all tools I could find, all fail.

lol never been this frustrated lol

tried flashing old update on different Cyanogenmod simple recovery. above steps, all fail. :(

forgot to mention I tried multiple times that unlock code. Even tried to lock it, which it already is.It says succesful, but reboots instantly into cyanogenmod recovery. Before recovery in a split second an android fallen down with red exclamation mark is shown.