yashsingh1/xdaforums huggingface dataset:
[Mate 8 General] franzyroy:
How to root your Huawei device on Nougat​

Disclaimer:

/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this TUTO
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you. Hard. A lot.
*/

Hi mates

For all those who, like me, have a lot of trouble to root their Mate 8.

I've successful to root my phone from the B560.

Last tuto (FINAL):

* Have the B560 firmware (or above - ask me for that) without no changes for Huawei Mate 8 with Nougat firmware - for the others devices, ASK ME!!!

* This Boot_Insecure_BXXX_Fix-adb_dm-verity-v2.img or v3- 5 versions for the moment: B560 - B580 - B581 - B582 - B585 - B588- B590- B592- B594- B595- B596. For another kernel, ASK ME!

* Have this TWRP 3.1.0-x - or this one (following the update)

* Have this SuperSU-v2.xx-EMUI5.0.zip on your external sdcard for supersu Chainfire - method 1

* Have the PHH superuser.zip on your external sdcard for PHH superuser - method 2

1 -

Easy way to root with supersu Chainfire:

Install the TWRP via adb, or SRKtools or still TWRP if you already have it

Install the new_Insecure_BXXX_dm-verity-v2.img or v3 via adb

Reboot to the recovery

Install SuperSU-v2.xx-EMUI5.0.zip from TWRP

Reboot system

2 -

Easy way to root with PHH superuser:

Install the TWRP via adb, or SRKtools or still TWRP if you already have it

Install the new_Insecure_BXXX_dm-verity-v2.img or v3 via adb

Reboot to the recovery

Install PHH superuser.zip from TWRP

Reboot system

Install PHH superuser app via PlayStore (if necessary, you had to make it with previous version)

Devices with which it works:

HUAWEI Mate 8

HUAWEI Honor Note 8

HUAWEI P9

HUAWEI Honor 8

HUAWEI MediaPad M3

HUAWEI P9 Plus

Misc:

It's certainly possible to root others Huawei models . For them, send me the stock boot.img of your current firmware in order that I make an insecure boot Fix-adb dm-verity for your device.

All apps requiring root works well with this method.

Following a problem with access to developer options, a update was made that now makes us to v3.

Credits:

ajsmsg78 - who explained me how to create the insecure boot

jac10000 - who helped me to create the insecure boot Fix-adb dm-verity

Chainfire for supersu

phhusson for PHH superuser

Donators:

Thanks to them

letschky

Frittenfresser

Tecalote

Version Information:

Status: Functionnal

Created: 2017-02-12

Last Updated: 2018-02-07

If you like that, hit the THANKS button below !​
[Mate 8 General] franzyroy:
Report me if it works fine for you! I'll add you in the OP post.

Report me on which firmware you used my method.

Changes:

[B][I]Boot_Insecure_BXXX_Fix-adb_dm-verity-v2.img[/I][/B]
* fixes issue adb doesn't work

[B][I]Boot_Insecure_BXXX_Fix-adb_dm-verity.img[/I][/B]
* based on the [URL="https://xdaforums.com/mate-8/orig-development/boot-decrypted-insecure-boot-img-adb-t3555257"]insecure boot[/URL]
* remove the boot checking of dm-verity for a better rooting
* authorize read/ write on the partitions

Thanks! ;)
[Mate 8 General] franzyroy:
Install TWRP (SRKtools method)​

TWRP TUTO:

Download this twrp.img

Rename it as twrpmate8mm.img

Goes to the SRKtools folder

Goes to the recovery folder

Goes to the mate8 folder

Goes to the emui41 folder

Open mate8.zip file with winrar or other extractor

Inside, you've 2 files,stockrecoverymate8mm.img and twrpmate8mm.img, delete twrpmate8mm.img file in the zip and confirm

Drag and drop your renamed file (twrpmate8mm.img) in the opened zip, confirm

Plug your phone

Authorize Debug mode in Settings\Developper options

Check if "Enable OEM unlock" is ticked

Authorize Debug mode in popup windows

Now, you launch SRKtools app

In the menu, choose 3 (Install recovery 6.0) and enter

Choose 2 (Huawei Mate 8) and enter

Choose 3 (Install Mate 8 TWRP for Marshmallow (EMUI 4.1) and enter

Type y and enter

Type f and enter

Wait the end of installation

The phone will reboot to this recovery and you will see that is good recovery
[Mate 8 General] franzyroy:
Install TWRP (ADB method)​

TWRP TUTO:

Download this twrp.img

Rename it as twrp.img

Plug the phone with the debug mod activated

Check if "Enable OEM unlock" is ticked

Launch a command prompt from you ADB folder - like on the Flash_boot_img_tuto_02.jpg screenshot

Type: adb devices

Type: adb reboot bootloader

Put the twrp.img file in C: (you can put anywhere but you should know the path. So the better is to follow my instructions)

Type: fastboot flash recovery C:\twrp.img (Wait the end of installation, it's quick)
[Mate 8 General] bluheart:
Brilliant work buddy! Keep it coming :D
[Mate 8 General] lovemajj:
Thank you!

Thank you for your hard work. I will try it immediately, downloading everything I need now.

Will report back when I have done it :)

---------- Post added at 07:08 PM ---------- Previous post was at 07:02 PM ----------

Question:

If I am already on official OTA B560, can I skip these steps?
[Mate 8 General] franzyroy:
[MENTION=2570493]dexz[/MENTION] 's method arranged by me​

to avoid to format data again​

Only use if you are in the situation below... otherwise follow this method

Good news for those who are in my situation with my method. The [MENTION=2570493]dexz[/MENTION] 's method works fine but force again to format data... personnally I had more than tired to format data. So I made this....

You are with the semi rooted B560 or other perhaps

You have Chainfire supersu

You have decrypted your data

You have a Decrypted data boot and you wanted to keep it

Put my Decrypted data boot on the external SD

Phone is on... then unroot it fully with Chainfire supersu in its settings - it asks you to restore the boot.img, I pushed "NO" because I had a doubt if I still had it, in addition it will install again in this tuto

Reboot in TWRP (frd-twrp like [MENTION=2570493]dexz[/MENTION] 's tuto)

Install Decrypted data boot

Wipe Dalvik & cache - Strongly advised after to have flashed the boot, it doesn't eat some bread ;)

Install superuser_noverify_nocrypt.zip

Reboot to system - It will take about 3-5mins or less, it's due to the wipe Dalvik & Cache

Go to playstore and Install phh's SuperUser app

And like me, you are fully rooted... Again thanks to [MENTION=2570493]dexz[/MENTION] for his method! The one above isn't more complicate and avoid to format again the data if you are in my situation.
[Mate 8 General] lovemajj:
Okay thanks for quick reply, will try with update_data only :)

---------- Post added at 07:19 PM ---------- Previous post was at 07:15 PM ----------

Another question, last one I promise.

You did not mention this in the thread, not that I saw at least.

Do I need to unlock my bootloader?
[Mate 8 General] franzyroy:
Perhaps it will work only with update data... I know someone has already rooted his phone like that (here).
[Mate 8 General] franzyroy:
Yes! I add it in the OP post! ;)
[Mate 8 General] lovemajj:
Okay thank you! :)
[Mate 8 General] franzyroy:
Done
[Mate 8 General] :
Short question is it possible that someone makes a twrp backup and i just reroll this on my phone?^^
[Mate 8 General] lovemajj:
How do I unlock the FRP lock?

EDIT: Nevermind, I figured out how to do it.

If anyone else needs an answer to this question here it is:

Before you unlock the bootloader, you MUST enable "OEM Unlocking".

If you do not do it before you unlock the bootloader, it will be greyed out and you will have to relock the bootloader and do it all over again.

---------- Post added at 09:26 PM ---------- Previous post was at 08:41 PM ----------

I have tried it now and it works!

Although I skipped one thing, which was step 3. I did not install the insecure boot because I know from the past that it screwed up my phone.

In short I did like this:

Enabled OEM Unlocking

Unlocked bootloader

Flashed TWRP (found in OP)

Factory reset

Format Data (here I rebooted to recovery)

Flashed the SuperSU zip (found in OP)

Flashed update_data_full_hw_eu.zip (also found in OP)

Then I flashed SuperSU again.

Reboot to system and done

Thank you for this post :)
[Mate 8 General] franzyroy:
So it works for you like that.

Thanks for your report, I will add you in the OP post.

Edit: Finally no, I will not add you, you don't match those who have a problem to root.
[Mate 8 General] apollo_81:
TWRP.img

[MENTION=2875350]franzyroy[/MENTION] I do not understand the point 8. Why boot.img fastboot flash recovery? I for flashing the recovery I always used FASTBOOT command FLASH RECOVERY TWRP.img Thanks
[Mate 8 General] franzyroy:
It's a typo. Sorry!
[Mate 8 General] franzyroy:
[MENTION=7561835]apollo_81[/MENTION]

It was a typo, I corrected it.

This is:

fastboot flash recovery C:\twrp.img
[Mate 8 General] franzyroy:
[MENTION=7561835]apollo_81[/MENTION]

Can you remove your quote here #16 that others persons don't make the error.
[Mate 8 General] franzyroy:
I did it and I haven't had any issue.
[Mate 8 General] franzyroy:
I don't change the size, so I haven't searched. But you can add it to the build.prop if you want. I can also make you a script to install in the TWRP. Now it works with root method.
[Mate 8 General] letschky:
I change the Icon Size in /cust/hw/eu/prop

and add the line in the Section:

2.BASEAPP TEAM BEGIN:

ro.config.app_big_icon_size=118

or the Size what you want
[Mate 8 General] sozofriend1234:
This fails for me. Not allowing me to save the changes to the file.
[Mate 8 General] franzyroy:
Like I said above, you can always make it via a script. Just ask to me! :cool:
[Mate 8 General] danterape:
Last method work in like 80% like I told you. Maybe today I will try to do it one more time with a new guide. Ill tell you my mate (:D) if it works for me.

It is important for me because of debloat that i've to do by myself (fu google for this apps that i must have because they told me to have them like google music or some ****.)

Cheers and thanks for the effort bro
[Mate 8 General] franzyroy:
Last method, so you talk about of the current method, the one that I wrote "fully functionnal"? For me, it's fully functionnal!
[Mate 8 General] danterape:
No bro, last method i mean the "OLD METHOD". :)

i haven't tried this new one yet. in about 5hrs ill report what is up with screenshots.

Also the new method - it looks like one twrp is for system flash and the other one is for rooting it :D what a fancy swap haha
[Mate 8 General] franzyroy:
I'm waiting your report.

Anyway, even if the new method can seem "fancy"... It has the merit to work.
[Mate 8 General] letschky:
You can flash the file from Attachment in Twrp,But Backup your Cust in Twrp before flash this file.

Screenshots in Attachment
[Mate 8 General] sozofriend1234:
Ok, my phone might not be in as good condition as I thought.

1st off, I can not see internal storage data in the TWRP completely. I can see the storage mounted and I can go to that storage. It even shows the size of storage and all but no files displayed.

2nd, when I checked the bootloader, it is stuck on FRP lock even after I removed google and huawei account manually. It is somehow stuck to the setting FRP lock. Now I can flash the official OS using the TWRP and do a factory reset which should fix the issue but I am wondering why it happened and my best guess is due to the NRD90M build no in build.prop.

Can it be due to the fact that I used the boot image from EU version on my meafnaf??
[Mate 8 General] franzyroy:
Which tuto did you follow? Old or current tuto?

Old tuto could make what you tell.
[Mate 8 General] danterape:
So, anyway... the same story here as I got last time.

Step by step and the root is only showed up, but it doesnt work fully. Last pic says that "it can't be uninstalled".
[Mate 8 General] sozofriend1234:
I used the latest tutorial feom OP.
[Mate 8 General] franzyroy:
Even if the tuto has worked fine for me, I think that format data should perhaps be before like that:

You are on the B560 without root

Install frd-twrp (with ADB or SRKtools methods - tutos posts 3 & 4) - if not already installed

Install my insecure boot B560 img with adb - I write how below, you can see it with screenshots (below) under Windows 10

Plug the phone with the debug mod activated

Launch a command prompt from you ADB folder - like on the Flash_boot_img_tuto_02.jpg screenshot

Type: adb devices

Type: adb reboot bootloader

Rename my insecure_boot_b560.img as boot.img

Put the boot.img file in C: (you can put anywhere but you should know the path. So the better is to follow my instructions)

Type: fastboot flash boot C:\boot.img (Wait the end of installation, it's quick)

Unplug your phone

Reboot in frp-twrp

Wipe - factory reset

Advanced wipe -anything but not internal and external memories (you can try not doing this step)

Format data - yes

Flash this TWRP-3.0.3.0-Mate8-2016-12-26.zip in your current frd-twrp

Reboot in twrp

Install SuperSU-v2.79-201612051815-EMUI5.0.zip

Install update_data_eu

Install update.zip

Flash again frp-twrp in your current twrp

Reboot in frp-twrp

Install again SuperSU-v2.79-201612051815-EMUI5.0.zip

Flash again this TWRP-3.0.3.0-Mate8-2016-12-26.zip

Reboot system (possible it restarts twice - it was my case)

Enjoy! Your system is fully rooted. :laugh:

The fact to format data could create an issue if we don't reboot the recovery after. So it might solve the issues for certains. To see.
[Mate 8 General] danterape:
I will try. I dont care about full wipe so tommorow ill test it again
[Mate 8 General] franzyroy:
Thanks to the guys like you who help a lot to improve our tutorials. It's really great. I also did a lot of tests before I had a stable version, so now I don't know if for my case it would have more interest than I test again, since it's functional for me .
[Mate 8 General] purplefrozt:
what insecure boot inage did you used for L29C185B560, can you share it thank you.
[Mate 8 General] franzyroy:
The one of OP post, there are not others.
[Mate 8 General] hanygrandaton:
.............................

---------- Post added at 06:01 AM ---------- Previous post was at 05:55 AM ----------

Sure you can add me to the OP post

---------- Post added at 06:33 AM ---------- Previous post was at 06:01 AM ----------

The one of OP post, there are no other one .
[Mate 8 General] Hilton.Swart:
Experiencing the same errors - No access to Data partition and no access to Storage.

Have attempted flashing other ROMs to fix the error but it seems they remain inaccessible, and fail in TWRP.

Have successfully got root using the new method in the OP but its currently useless as Adblock cant write to the partition, and that is my main reason for Root access.
[Mate 8 General] Leo_83:
I belive someone posted a solution to adaway, they changed the folder that adaway wrote to. I think they pointed to a folder on the sd-card.

Skickat från min HUAWEI NXT-L29 via Tapatalk
[Mate 8 General] danterape:
This tuto made my /data crypted. ;] Ill try to boot phone up now and see what is going on with the system and the root but i guess it will be broken anyway...
[Mate 8 General] franzyroy:
Yes I confirm, it's written in the previous posts.
[Mate 8 General] franzyroy:
Crypted?

Broken, yeah it's possible in this case. So this one (tuto) isn't good.

Thanks
[Mate 8 General] danterape:
Ill try to back to stock 560 and then follow the new one again. At least still 80% working root is better than 0% :)
[Mate 8 General] franzyroy:
What doesn't it work?
[Mate 8 General] danterape:
Like I told you before. Even if the root is granted for app like "ROOT APP DELETER" i cant delete google apps.

in root - its very important to me. to delete some **** that i dont use :)
[Mate 8 General] franzyroy:
Say me what's app, pls? That I test.

Thanks!
[Mate 8 General] danterape:
Root App Deleter by TopDev (red icon with green sweeper in it)
[Mate 8 General] franzyroy:
Ok

What Google app want to delete?
[Mate 8 General] Leo_83:
https://play.google.com/store/apps/details?id=zsj.android.systemappremover

Skickat från min HUAWEI NXT-L29 via Tapatalk
[Mate 8 General] danterape:
Doenst matter, try hangouts or google music or google photos or drive...
[Mate 8 General] franzyroy:
I'll take a look when I've a moment!;)
[Mate 8 General] danterape:
TY. If you can find another way to delete apps that require root or do you have any idea how to do that - ill take anything. just to clean some dirty ****.
[Mate 8 General] franzyroy:
Oh yeah, you're right. Finally, I began Google kiosk, no problem, it has been deleted. After I wanted to remove Hangout & Google Video, I've successful to remove theirs patchs but not the apps. Like if the system is also crypted! :confused::(

I will look what I can make for that. :silly:
[Mate 8 General] danterape:
Yeah... At least i can patch with lucky patcher and that is a good news :D
[Mate 8 General] franzyroy:
Yeah at least.

You tried to remove something in system via an explorer? Or even modify something.

Via TWRP, all works, I tried my script for the double tap, it's ok.

I can also access to the data folder via TWRP, it's ok.

Same for the system.

It's why I wonder if the system was crypted. Never saw but well... I no longer know.
[Mate 8 General] franzyroy:
[MENTION=6746124]danterape[/MENTION]

Last time, I tried this beta supersu, but if I don't remember well,, I think it reboot my phone before to finish (even certainly to begin) the installation. You can see if it's the same thing for you.
[Mate 8 General] franzyroy:
I make a test with an explorer.

Here the result:

Copy a file from system to sdcard --> OK

Copy a file from sdcard to system --> null

Conclusion:

It's like if the system was READ-EXECUTE. However the permissions is 755, so normally READ, WRITE and EXECUTE for the owner, and READ and EXECUTE for groups and others.

Weird, I don't understand! :eek:

Or we are not recognized as owner.
[Mate 8 General] danterape:
Maybe not now :) dont have time to do that ;/
[Mate 8 General] Nirak:
Last tuto worked for me, got root, but Titanium BackUp won't work correct. I can't freeze or restore apps, but when i install app from Playstore i can restore data. TWRP works, i can make a full backup, but TWRP identifies my device as NRD90M-test-keys (I have AL10 transferred into NXT-L29 long ago).

I've made a fresh install for adaway , it works just fine.

I simply deleted some huge system apps (Chrome etc..) APK's from the system folder and i think i can live without full functional TiBu for now. Would be great to have it all up and running again, but in the meantime i'm happy with my rooted Nougat

I'm beginning to believe it is Titanium BackUp that's the problem and not root.
[Mate 8 General] franzyroy:
No problem! I'll also test it again by myself in the evening.
[Mate 8 General] franzyroy:
Now, I'm beginning to believe that's something else! :rolleyes:
[Mate 8 General] franzyroy:
[MENTION=394546]Nirak[/MENTION]

But if you're happy, you can hit my thanks button in the OP post. At least, it proves that my work is good.

Can I add you to my OP post as persons who has rooted his phone with my method?
[Mate 8 General] Nirak:
[MENTION=2875350]franzyroy[/MENTION], sure you can!
[Mate 8 General] Ostrogradsky:
Thank you so much!! You are the maaan!!
[Mate 8 General] dexz:
I have no problem writing from system to sdcard & sdcard to system.
[Mate 8 General] franzyroy:
Thanks! ;)

It's for my tuto?

Yeah but you, you had no issue since you are on the B560. You had flashed the insecure boot before to past on this one.
[Mate 8 General] natispain:
I can't delete some apps too. It sais that is a System app. Google Play música etc. Email, notes,.... The root Is not full but is the only we have. For that readon Titanium doesn't work fully.
[Mate 8 General] dexz:
Yeah. Will try to install fresh and install your insecure boot and see if i got the same issues with you. Report back later.
[Mate 8 General] franzyroy:
Yes, it's the current issue. I talk about of that with another mate on Frandroid. Like me, he created an insecure boot (from my tuto) but only with desactivated encryptage. He hasn't the issue. Maybe it's due to the change of default.prop file that I made.

Thanks for your test!:good:
[Mate 8 General] danterape:
I hope you can find a solution. I dont have any clue what to do to help you my friend :(
[Mate 8 General] franzyroy:
I hope too!
[Mate 8 General] Ostrogradsky:
Of course it is! finally i rooted my phone! Have a nice day sir!
[Mate 8 General] franzyroy:
Can I add you in the OP post as someone who has successful to root his phone with my method?
[Mate 8 General] amin318:
I dunno why my BT won't work after this root method! I tried flashing over and over but no luck!

And a friendly advice: do not luck ur bootloader if u have twrp on ur nougat! U will end up with no OS and no twrp and un-unlockable bootloader!

I taked my phone to Huawei consumer services and they changed my phone's main board

I'll wait for official twrp with supporting emui5 kernel
[Mate 8 General] Ostrogradsky:
Yeah sure you can! ;)
[Mate 8 General] franzyroy:
I understand you my friend. However, you say, lock the BL and you have no longer the TWRP neither OS. But for that, you already had no longer the OS?! If you lock the bootloader with a functional OS, the fact to lock the BL doesn't kill your OS. Do you agree with that? Maybe I should precisate it in the OP post but certainly not what you say there.

Sorry for you MB!

Added! ;)
[Mate 8 General] franzyroy:
Maybe a solution from monpseudo on Frandroid or [MENTION=4479135]jac10000[/MENTION] (it's the same ;) ).

He used it for him and he is FULLY root, and there when I say FULLY... it's FULLY. At least for him, on Frandroid, there aren't enough of comeback (like here) to say if yes or no, it might be the final tuto.

Install the frd-twrp

Reboot to the recovery - due to the new recovery installation

Wipe factory Reset - Like always for the new sytem installation

Install Update.zip - in first, it's better for the following

Install frd-twrp.img from the twrp - Because "Update.zip" erase the recovery/ install the erecovery

Install decrypted data boot (new: modified only encryptage to data) - It's new because with insecure boot I noticed something if we install it at this step.

Reboot to the recovery - due to the new recovery installation

Format DATA - here, I think that's the good moment to format data, after installation of Update.zip

Reboot to the recovery - due to the "Format DATA"

Install update_data_full_hw_eu.zip - after the "Format DATA", it couldn't be before

Install SuperSU-v2.79-201612051815-EMUI5.0.zip - For the end, it's fine.

Reboot system

Why a new tuto?

I find that the order of the steps in this tutorial really makes sense depending on what we want. Even more than mine.

Why the "decrypted data boot"?

Because the insecure boot installed at this moment, when you will reboot your phone, you might activate the Developer options but never acceed to this options. The insecure boot unactive its access.

Then why not in the tuto of OP post?

Because, the update "Update.zip" is installed after, not as this tuto. The "Update.zip" install its boot.img, so overwrite the insecure boot.img.

Did you test it?

No, I gonna do it this weekend probably. Always the weekend for me, mainly in the evening, sorry I use my phone for my work and family. But [MENTION=4479135]jac10000[/MENTION] has tested as it's written here (in french)

I cross fingers
[Mate 8 General] jac10000:
That worked for me, I hope that will work for others :)
[Mate 8 General] danterape:
Ill test it in about 1 hr and will leave here a feedback bro