yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] bobo31:
I have a UFI box I will try to download a couple of stockrooms that you can play with. But I looked at some thing today I may can download you the QCN file that will have all the Wi-Fi IME settings that you would need. So after you route the phone then you can go back and flash the modem image and the persist image and that should give you back your network settings. But you have to get the original motor image from your stock wrong
[Android Q&A, Help & Troubleshooting] bobo31:
Stock rom
[Android Q&A, Help & Troubleshooting] cratrent:
I have tried every methods but no luck. I have the stock Msm download tool for the international version of R9s (CPH1607EX). I'm sharing it here to see who can modify it to be able to flash custom recovery.

Download Link

For anyone who wants to flash the stock firmware or unbrick your phone:

1. Download and unzip.

2. Run ENABLE.exe as admin.

3. Run Msm download tool and wait a few seconds.

4. Flash your phone.
[Android Q&A, Help & Troubleshooting] texpol:
Mod edit - translated by https://translate.google.com/. Oswald Boelcke, Senior Moderator.

I am using Oppo R9sk, when I flash the global ROM, the screen light level drops excessively and I can hardly see the screen. Is there a solution to this or is there a different stabilized global ROM?

*********************

Oppo r9sk kullanıyorum global rom atınca ekran ışık seviyesi aşırı şekilde düşüyor ekranı zor görüyorum bunun çözümü varmı ve ya farklı bir stabilize global rom varmı
[Android Q&A, Help & Troubleshooting] Oswald Boelcke:
Hello and good morning, @texpol

As a one-time courtesy I've translated your above post. With reference to rule no. 4 of the XDA Forum Rules, please post in English or add at least an English translation to your Turkish posts.

Spoiler content hidden.

Thanks for your cooperation.

Regards

Oswald Boelcke
[Android Q&A, Help & Troubleshooting] Oswald Boelcke:
Thread closed! If interested in this subject, please refer to

How to root Oppo R9s Plus (CPH1611) international version

Step by step guide for Oppo R9s Plus international version This is for the Oppo R9s international version cph1611 1. First download the files from this folder (alternative links at the end of the post)...

xdaforums.com

Regards

Oswald Boelcke
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
If you guys spot one for the R9s plus please report back on here....I beg you! :)
[Android Q&A, Help & Troubleshooting] jacksmack:
Not a problem. :)

I sent you a PM with a link to the aboot.

---------- Post added at 05:50 PM ---------- Previous post was at 05:49 PM ----------

Will do.
[Android Q&A, Help & Troubleshooting] off-signer:
Dear Lum_UK, I would agree with you if I could solve the notification problem. No push-notifications for Facebook, Instagram, Twitter etc. Any ideas so far? I have to circle all these apps one by one to see if anything has come.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Please find a solution for the R9s Plus...Please,please,please...
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Can you see if he can do the same for the R9s Plus?
[Android Q&A, Help & Troubleshooting] Lum_UK:
That Wu Xian Lin guy has done pretty much every Oppo phone ever, eventually, so I'm sure the R9S Plus will be forthcoming.

Going to go try this now. Will see if I can simplify or automate the process. No promises though.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Thanks mate. Good luck.
[Android Q&A, Help & Troubleshooting] Lum_UK:
This should automate the root & TWRP process if anyone wants to try it! (updated 2017-01-30)

https://xdaforums.com/android/general/root-oppo-r9s-auto-root-tool-t3547546/post70795809
[Android Q&A, Help & Troubleshooting] jacksmack:
Awesome! Will this do anything different than the Wu Lin method?
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Praying for the 9s plus to get this...
[Android Q&A, Help & Troubleshooting] Lum_UK:
It uses the same method, there is only one change which is where instead of running a load of commands via 'adb shell' it uploads a script with the same commands in, and then runs that from adb shell. This is purely to make it work from a batch file.

I did my own phone with it, but in stages as I was writing the file. I don't want to un-root to do it all again, but it should work :)
[Android Q&A, Help & Troubleshooting] Lum_UK:
OK, tested the CM ROM a bit

Working:

Fingerprints

Bluetooth

WiFi

Camera*

Flash

Sound

Dual-sim

Mobile data

Not working:

Stock camera app.

Not tested:

Voice calls

Anything I didn't mention above

*Fix by installing OppoCamera or any other camera app from the play store

https://xdaforums.com/oneplus-one/themes-apps/port-coloros-camera-cm11s-t3030369
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Any news on R9s plus? ...Sorry to be a pain...
[Android Q&A, Help & Troubleshooting] Lum_UK:
I don't own one, so not looking.

You can try the R9S root method and just skip the last bit where you install TWRP. If you can get a root shell you're halfway there.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
I don't have the expertise like you have to do that just in case I brick the phone..
[Android Q&A, Help & Troubleshooting] jacksmack:
Voice calls work, as does Xposed and Viper, Disabling SELINUX and MTP, etc.

This camera from HTC E8 (one of my old phones) works really well on the r9s: https://mega.co.nz/#!yR5UxIQC!1MQrvg...5ilFfCwDiR-ZgA
[Android Q&A, Help & Troubleshooting] Lum_UK:
Speakerphone doesn't seem to work :(

Did my root script work for anyone?

Edit: Also for anyone trying to download from Baidu, this GreaseMonkey script bypasses the need to have a Baidu account or install sketchy software: https://greasyfork.org/en/scripts/7382-baidupandownloadhelper-modify-by-ted423/code
[Android Q&A, Help & Troubleshooting] Lum_UK:
If you're going to install SuperSU. Wu Xianlin did a ColorOS specific version which you can get here:

https://pan.baidu.com/s/1qXVAbDy#li...O R9s/常用补丁/supersu&parentPath=/android/第三方ROM

Problem is you need to install it from TWRP!
[Android Q&A, Help & Troubleshooting] jacksmack:
If the exploit works for mikejasonsmith, do you think the permissive SELINUX state would be enough to let KingRoot do the rest?
[Android Q&A, Help & Troubleshooting] Lum_UK:
Honestly, I have no idea.

Take backups first and re-flash stock from recovery if it fails I guess.

I suspect a dump of the stock recovery, from that root shell, will be needed before anyone can make a TWRP for the R9S+
[Android Q&A, Help & Troubleshooting] t-mobile_mda:
hey guys..

so there is no international/custom(working) rom for this device..? R9s..?

tia..
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Thanks for your help guys...I may give some of this a go...Scared of bricking the phone .

Or I may search and see if anyone has rooted it yet and put Cm on it...Surely somebody has cracked it?
[Android Q&A, Help & Troubleshooting] pancmp:
I have followed the steps but the launcher could not be hidden....its said

neither user 2000 nor current process has android.permission
[Android Q&A, Help & Troubleshooting] celoxocis:
Well, we don't know if the R9S and the R9S+ have the same major kernel version which allows for this exploit. In theory should the kernel patch state be the same. The exploit should work for the R9S+.

But you are right about the recovery.

I think it's called recowvery for a reason. It uses the exploit to actually boot the recowvery too.

Unless we know how to build a recowvery for the R9S+ everyone should NOT try this exploit for the R9S+.

I can build an TWRP recovery for the R9S+ that is no problem. But it's useless as I don't know how to build an TWRP "recowvery". Which like already mentioned uses the exploit to be able to boot.
[Android Q&A, Help & Troubleshooting] pancmp:
Actually, is there a way to use original android os, the coloros is like ios.....
[Android Q&A, Help & Troubleshooting] Lum_UK:
The exploit is almost certainly still there (on older ROM versions) as the Dirty Cow exploit was only recently fixed on basically every Linux kernel, so would require Oppo to actually push out updates that fix something!

The recowvery script, from what I can tell is a generic(ish?) exploit that came from github. It's not actually a recovery but instead sets SELinux to permissive and then boots regular android in that state.

I'd say definitely don't do it if you don't know how to recover your phone with the MSM tools, but there is a non-zero chance of the exploit working on both.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Thanks all.

I will sit tight for something that gets me CM on my 9s+ or similar...For now I'm using my old phone until someone kindly figures this out.

Happy to buy them a beer to get it done :)
[Android Q&A, Help & Troubleshooting] jacksmack:
A couple things to report:

1) the CM lockscreen is unforgivably buggy. I had to reinstall everything twice yesterday because I got locked out of my phone after setting a pattern lock with an associated fingerprint. The most stable solution for the lockscreen I've found is to deactivate it.

2) I ran into an issue last night after CM locked me out again and I thought I'd give one of the ColorOS ROMs from Wu Lin's Baidu folder a spin to see if they worked with Viper and Xposed. After installing one of them in TWRP, then installing SuperSU and Viper, I went to reboot and somewhere between exiting TWRP and hitting the boot animation ColorOS devoured TWRP and then proceeded to go into an endless bootloop. Massive panic. I don't think I've ever had a ROM eat my recovery before. :) Anyway, after doing a bunch of Google translates I was finally able to get a booting phone again and repeat the rooting process. So, be careful flashing a ColorOS ROM from TWRP, especially if you're adding stuff on top of it like Viper, because it might send your phone for a ride.
[Android Q&A, Help & Troubleshooting] celoxocis:
It's not generic. It's actually JCD's code from here: https://github.com/jcadduono/android_external_dirtycow

If you open up the code in a hex editor you will even see jcd's signature.

One thing to try would be to build a TWRP for the Oppo R9S and write that image to the recovery partition using 'dd'.

If it's working than the recovery doesn't require any special patching.

I could ask jcd myself but im to busy with my other project phones.

None the less. I think unless a proper bootloader unlock hack comes to light. The Oppo R9S will not see any dev support for custom ROM's. Except Wuxialin's work.

He hasn't replied to my email and i'm not expecting he will at all.
[Android Q&A, Help & Troubleshooting] Lum_UK:
That's the link I was looking for, thank you! I wanted to credit JCD in my script as well as Wu Xianlin.

By generic I meant a generic Android exploit, not an R5S specific one. In theory it should work on the R9SPlus too, just don't flash TWRP for the R9S!

Also can people please stop PMing me for help with the R9SPlus. I'm far from an expert in all this and I don't own one, so I can't help you. Even if I were able to I'd rather do it on this thread where any stuff that works is documented for others to find later.
[Android Q&A, Help & Troubleshooting] celoxocis:
Yes I think it could work. Oppo is pretty lazy when it comes to security updates. I'm sure dirtycow is still open on the R9S Plus too.

About the PMing. Welcome to the club xD

People think they can get "special support for free" when they PM someone. Those are usually the ones that don't read a threads entire discussion and simply keep asking questions that have been already answered and they are even to lazy to hit the thanks button and keep complaining when they brick their device. I simply ignore them.

Unfortunately XDA has grown to big to be able to enforce the rules and keep those away.
[Android Q&A, Help & Troubleshooting] Lum_UK:
TBH most of what I do on these forums is take other's work (with full credit given) and try and document or automate it to make it a bit easier for normal people. The aim being to try and stop the actual devs getting so many annoying questions, so I don't mind the PMs too much if the question is a reasonable one.

Problem is, I don't own an R9SPlus. You may as well PM me asking how to stop a Note7 from exploding for all the good it'll do!
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
I hold my hands up and admit was one of the people who pmd you so my sincere apologies for doing that.

Any help with the 9s+ is greatly appreciated as always as is all the help I receive on these forums.

Thanks.

Mike
[Android Q&A, Help & Troubleshooting] Lum_UK:
It's fine I just couldn't be bothered to reply to like 8 people individually :)
[Android Q&A, Help & Troubleshooting] celoxocis:
If you can post partition information about the Oppo R9S I can build you a proper TWRP.

Just to test and see if the recowvery is a patched variant of TWRP or not.

As you know how to read make files.

All I need is partition information about:

https://github.com/TeamWin/android_device_lenovo_p2a42/blob/cm-13.0/BoardConfig.mk#L48

The other information I will be able to extract from the stock ROM.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Good luck let us know how you get on...
[Android Q&A, Help & Troubleshooting] celoxocis:
Well you could actually post the same information about your R9S Plus.

The difference afaik is only the SoC.

The exploit should work but not the recowvery.

And paste a link to the stock ROM for the R9S Plus.

Not just an OTA.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Hi.

I don't know how to do any of what you ask as I am not as talented as you unfortunately.

However happy to buy you a beer if you get something going on the 9s+ as it's unusable for me at the moment.
[Android Q&A, Help & Troubleshooting] celoxocis:
I will post some commands sometime today. You simply have to enter adb shell, run them. Copy and paste it's output to pastebin.com.

Just make sure you have enabled ADB debugging in the developer options of the phone.

You don't have root but the information can still be acquired.
[Android Q&A, Help & Troubleshooting] celoxocis:
[MENTION=2146370]mikejasonsmith[/MENTION]

do this in adb shell:

cat /proc/partitions

Copy/Paste the output into Notepad(++).

then do this:

Copy/Paste the output into Notepad(++).

cat /sys/class/block/*/uevent

and finally do this:

Copy/Paste the output into Notepad(++).

for i in /sys/class/block/*/uevent;do grep DEVNAME $i;echo -n '\t';grep PARTNAME $i;echo ----;done]

Copy/Paste all Saved output to pastebin.com and click "Create New Paste".

No need to register.

If you don't know how to use adb shell, follow my Guide here from step 12 through 17. Then step 23.

And then with step 24. You simply input above commands after "adb shell [Hit Enter]" instead of the one in the Guide.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Thanks for this.

Will do this as soon as I get home from work.

Very much appreciated.

Mike
[Android Q&A, Help & Troubleshooting] celoxocis:
are those .ozip's just renamed zip files? (guessing "O"ppo Zip here).

Or do they require a specific way to be extracted?

I'm downloading them now to my build server.
[Android Q&A, Help & Troubleshooting] Lum_UK:
I was able to extract the 005 ROM usinz 7zip, but not the 006 ROM.

There's a random github project called ozip, but it doesn't appear to be related and can't extract them.

Wu Xianlin's Baidu repository has _local.zip versions that are flashable from TWRP.
[Android Q&A, Help & Troubleshooting] celoxocis:
I would rather stick to the original. I'm still downloading. The oppo servers are so slow...

I will try standard unzip and then 7zip. I need the stock rom to extract the required kernel and information.

Also can you provide partition information for the Oppo R9S?

You can either run:

A: Above listed commands. As no root is required.

or

B: Simply switch into "su" and list the partitions by name:

ls -la /dev/block/bootdevice/by-name/

and simply do

fdisk -l *fill in partition*

to get the information required.

---------- Post added at 14:42 ---------- Previous post was at 14:36 ----------

Just tried unpacking it with zip and 7zip both give me CRC errors.

I also tried dtrx

dtrx: ERROR: could not handle R9s_11_OTA_005_all_201611050005_local.ozip
dtrx: ERROR: not a known archive type

which knows countless archive types.

Oppo is cooking up its own soup?

I despise them even more now.
[Android Q&A, Help & Troubleshooting] Lum_UK:
I will do. I'm just in work currently :)
[Android Q&A, Help & Troubleshooting] celoxocis:
Could you mirror that file to a mega mirror? All attempts to unpack the stock rom file fail.
[Android Q&A, Help & Troubleshooting] celoxocis:
I did some digging on the .ozip.

Oppo indeed started encrypting their stock ROM files to further close down the possibilities for open developers.

Not only did they remove the fastboot binarys. They are now encrypting their stock ROM's.

Here is proof:

[B]zipinfo R9s_11_OTA_005_all_201611050005_local.ozip[/B]
Archive: R9s_11_OTA_005_all_201611050005_local.ozip
Zip file size: 1063221552 bytes, number of entries: 24
warning [R9s_11_OTA_005_all_201611050005_local.ozip]: [B]4176 extra bytes at beginning or within zipfile[/B]
(attempting to process anyway)
-rw---- 1.0 fat 0 bx stor 16-Mar-01 03:51 system.patch.dat
-rw---- 2.0 fat 51501 bl defN 16-Mar-01 03:51 META-INF/com/android/file_contexts
-rw---- 2.0 fat 155 bl defN 16-Mar-01 03:51 META-INF/com/android/metadata
-rw---- 2.0 fat 525088 bl defN 16-Mar-01 03:51 META-INF/com/google/android/update-binary
-rw---- 2.0 fat 5152 bl defN 16-Mar-01 03:51 META-INF/com/google/android/updater-script
-rw---- 2.0 fat 134217728 bl defN 16-Mar-01 03:51 NON-HLOS.bin
-rw---- 2.0 fat 16777216 bl defN 16-Mar-01 03:51 adspso.bin
-rw---- 2.0 fat 10693884 bl defN 16-Mar-01 03:51 boot.img
-rw---- 2.0 fat 197184 bl defN 16-Mar-01 03:51 cmnlib.mbn
-rw---- 2.0 fat 33580 bl defN 16-Mar-01 03:51 devcfg.mbn
-rw---- 2.0 fat 592904 bl defN 16-Mar-01 03:51 emmc_appsboot.mbn
-rw---- 2.0 fat 226008 bl defN 16-Mar-01 03:51 keymaster.mbn
-rw---- 2.0 fat 15987200 bl defN 16-Mar-01 03:51 logo.bin
-rw---- 2.0 fat 3774656 bl defN 16-Mar-01 03:51 mdtp.img
-rw---- 2.0 fat 173744 bl defN 16-Mar-01 03:51 rpm.mbn
-rw---- 2.0 fat 369120 bl defN 16-Mar-01 03:51 sbl1.mbn
-rw---- 2.0 fat 10485760 bl defN 16-Mar-01 03:51 static_nvbk.bin
-rw---- 2.0 fat 2110914560 bl defN 16-Mar-01 03:51 system.new.dat
-rw---- 2.0 fat 1221 bl defN 16-Mar-01 03:51 system.transfer.list
-rw---- 2.0 fat 1473792 bl defN 16-Mar-01 03:51 tz.mbn
-rw---- 2.0 fat 1424 bl defN 16-Mar-01 03:51 META-INF/com/android/otacert
-rw---- 2.0 fat 1529 bl defN 16-Mar-01 03:51 META-INF/MANIFEST.MF
-rw---- 2.0 fat 1771 bl defN 16-Mar-01 03:51 META-INF/CERT.SF
-rw---- 2.0 fat 1522 bl defN 16-Mar-01 03:51 META-INF/CERT.RSA
24 files, 2306506699 bytes uncompressed, 1063212790 bytes compressed: 53.9%

let's look at those 4176 extra bytes:

[B]head -c 4176 R9s_11_OTA_005_all_201611050005_local.ozip[/B]
OPPOENCRYPT!106321737603a0fabedd3b7282548b93263524dceeabf62b91ota-id=R9s_11.A.05_005_201611050005
ota_version=R9s_11.A.05_005_201611050005
patch_type=1
post-timestamp=1478277062
version_name=R9s_11_A.05_161105
wipe=0

Note the "OPPOENCRYPT!"?

One more reason to stay way from this OEM!

There seem's to be some talk about it on Weibo. The chinese reddit.

I can't access it nor do i read chinese. Simply google for "OPPOENCRYPT!" and you will find Wuxianlin's weibo account.
[Android Q&A, Help & Troubleshooting] Lum_UK:
WTF, and Oppo used to be so good with the opensource community too!

This is probably going to be my last Oppo.

Currently struggling to grab anything from Baidu. I have a TWRP backup of the stock ROM, but that would've been made after being hit with dirtycow, and won't include the recovery.

Also here's the partition dump from the R9S. Note that I did it from CM though, as I wasn't able to flash back to stock as can't DL from Baidu.

http://pastebin.com/XRiivwbS
[Android Q&A, Help & Troubleshooting] celoxocis:
Can you dump the stock boot.img, system.img?

I will also need the stock build.prop for a proper extraction for the info.

I would have done it from the stock ROM but Oppo encrypted it.
[Android Q&A, Help & Troubleshooting] Lum_UK:
boot.img is here: https://mega.nz/#F!2xdx0YjI!WbYbio7rUPQ4a1e6FIe2bQ

It's ripped from my TWRP backup, but seems to open fine in 7zip.

I'll have the system.img up in the same folder shortly, it's nearly a gig (compressed) and I have crap upload, but it's on its way. Not that this is not 100% stock as it's after modification with the dirtycow exploit. Not sure if those modifications get saved or not.

build.prop is here: http://pastebin.com/VjehgZMK

For some reason there was a second build.prop in the root of the system image, it contains one line. Not sure what that is about:

50 RHT.security.selinux=u:object_r:system_file:s0
[Android Q&A, Help & Troubleshooting] celoxocis:
It CRC corrupts when unpacked.

The dirtycow modifications don't matter. I simply need to extract additional binarys.

Could you put the build.prop file on mega too?

I think the copy/pasting into pastebin reformats the UNIX linebreaks. Which makes it unreadable for the extract tools. Thanks
[Android Q&A, Help & Troubleshooting] Lum_UK:
Apparently you're not suppossed to unpack it, it's a gzipped kernel image, which explains the odd data after the payload.

MD5 should be: 7febeea022bdb99b9d75f8d8197c7d2d

build.prop is there now.
[Android Q&A, Help & Troubleshooting] celoxocis:
No I meant the content of .ozip stock file becomes corrupted when unzipped. I know the the kernel is gzip'd. See my github repo such as my TeamWin project phones about it.

Thanks for uploading.

I will take a look at it tomorrow.
[Android Q&A, Help & Troubleshooting] Lum_UK:
Sorry, I thought it was a complaint about a duff upload :/

I've been dealing with end-users all day in work, please excuse me :)

edit: wait, are Oppo encrypting their kernel images too?!

---------- Post added at 07:51 PM ---------- Previous post was at 07:25 PM ----------

Also, R9S+ people, keep an eye out here and see if he does anything for it...

https://pan.baidu.com/share/home?uk=1310298545#category/type=0
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Hi mate.

Just done this.

On paste bin under Oppo R9s PLUS
[Android Q&A, Help & Troubleshooting] celoxocis:
This looks specific to the exploit.
[Android Q&A, Help & Troubleshooting] celoxocis:
[MENTION=4657592]Lum_UK[/MENTION] I've sent you a pm for the TWRP test.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Did you get my pastebin info mate?
[Android Q&A, Help & Troubleshooting] celoxocis:
No I couldn't find it.

Just paste the direct link to the pastebin.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Here is the link - hope it works.

http://pastebin.com/qMvjAkMW
[Android Q&A, Help & Troubleshooting] Lum_UK:
Ok, I've managed to get myself a Baidu account, so I can download without dodgy plugins. It's slow going though, like 200KB/sec slow going, and only allowed to download 2 files at a time.

Currently grabbing: R9s_11_A.04_161025.rar which I'm hoping is flashable with the Qualcomm MSM tools, and R9s_11_OTA_0180_all_201701120100_local.zip which appears to be a new OTA of the stock rom (TWRP version).

Anyone got any requests for things they want me to grab, let me know.
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Anything that has 9s Plus attached :)
[Android Q&A, Help & Troubleshooting] Lum_UK:
Keep an eye on the other link I posted, the one that has all the phones Wu Xianlin has messed with. If R9Plus appears, let me know and I'll grab them for you, but I'm too lazy to keep checking that myself :)
[Android Q&A, Help & Troubleshooting] mikejasonsmith:
Will do mate.

And thanks by the way....

Mike