[Moto Z2 Force  Guides, News, & Discussion] enetec:
WARNING #1: operations indicated on this post might potentially brick your device, make it unusable, to cause explosions, eruptions of nearest volcano and a lot of similar disasters.

For sure they will void your warranty in most countries and need all of your data permanently deleted, so

make a copy of anything

valuable before starting and

don't do any operations if you are not a trained guy

and sure about what you are going to do.

These are *not* operations for rookies. I will not be responsible in any case about eventual damages. XDA is your friend: if unsure, please ask! :fingers-crossed:

WARNING #2: operations elencated on this post are indicated and first hand tested as working only on Moto Z2 Force (Nash) XT1789-06 GSM/3G/LTE dual sim 6GB RAM 64GB storage unbranded international version on sale on German market with Nougat v.7.1.1 onboard.

They will probably work on most of unlockable bootloader & SIM unlocked versions, included US -04 versions too, but

you'll test them yourself

.

They are

not intended

for (US mainly...) CDMA versions (-01 & -03 if I don't go wrong...) since of a bit different hw/fw so avoid to apply them "as is" on those devices.

WARNING #3: there will probably be better methods to obtain same results and, for sure, there would be more in future. This is only a "recap" of what I've found working and applied first hand on my unbranded XT1789-06 Nash - with, IMHO, great results... - on November 2017.

I think this could be useful for many.

WARNING #4: I'm Italian, English is not my first Language, so... be patient! :D

1. INTRODUCTION

On this guide you will not find anything particularly new and/or not already present on this section of XDA.

So, why this guide? For some reasons...

First of all, to date every guide posted here is for a single operation (e.g. root, TWRP, etc...) and do not take in needed consideration interactions between single operations that, often, can be present, potentially dangerous and/or lead to unexpected behaviours.

More, for a single operation here there are often different posts with different guides/solutions and this could leads to errors and or doubts about what's better for our device... :confused:

Last but not the least, to date Nash developers here are mainly from US and so working on devices for the most part provided with branded fw and/or a bit different hw/fw respect to international unbranded versions sold on Europe, Asia, South America & Australia.

From my previous experience with my "old" Griffin (Moto Z) Motorola's fws are often interchangeable between devices with no (or only minimal...) issues at all, but, anyway, having a guide with operations first hand tested on same device is surely safer... ;)

So, in this guide I'll link all best single guides posted here and I'll comment & link them to obtain a single complete "to do list" of works... :o

2. WHAT WE'LL GET

Following this guide we'll get a Moto Z2 Force with unlocked bootloader, latest available firmware (at present...) on board, a working TWRP recovery, complete root access, BusyBox support (needed for A LOT of interesting sw/tasks...) and Xposed support (I don't think I need to explain Xposed features & benefits here... :cool:).

Taking in consideration how Moto's devices come with a "quite stock/vanilla" Android version on board, they are between the best devices to be rooted & Xposed provided to obtain a great customized system.

If you want to remain stock with your device eventually go with Samsungs (or similar...), but if you want a device that is a "blank canvas" for your customizations, Motorolas and this configuration would quite be the best you could want.

You are surely thinking about lack of Magisk and "SU hiding" solutions... obviously there are reasons for this.

Magisk: I have first hand seen how Magisk is a "

very intrusive

" software with its installation, it goes to modify *A LOT* of things on system partitions and this could leads to eventual issues/incompatibility.

More, it has its own rooting system (that in my humble opinion isn't better than SuperSU) that I preferred not to use (beneath I think it could be disabled... :rolleyes:) and that could conflict with SuperSU, if not now, maybe on successive Magisk updates (as it happened on my old Griffin... :mad:).

Last but not the least, it seems to still have issues with particular partitioning present on our device (we'll see them later) and with TWRP flashing for same reasons...

Not to mention how, to date, it has really so few functions/modules we can't have using Xposed....

SUhide: there is a detailed guide on how to install succesfully SuperSU with its SUhide function on our device. On the same guide it's reported how that method is uncompatible with Xposed and leads to unsolvable bootloops if we setup both of them.

It is still not clear (to me...) if this is related to SUhide itself or to the different SU installation needed for SUhide to work but, anyway, I preferred Xposed obviously.

Not to mention that for Xposed have been developed some modules to succesfully hidden root (even if I don't know if they already works with Nougat... :confused:)

3. LET'S TAKE A LOOK TO OUR DEVICE

Knowledge is power. So, taking a look to our device particular features will help us to avoid errors and eventual issues...

Motorola developed our device with a new configuration/partitioning scheme seen before only on Google Pixels / Pixels XL, making our device probably the first "not Google" one to adopt it. :cool:

It is mainly marked by two news:

- there is no more a recovery partition :eek::crying:

- there are two copies of boot and system partitions, called boot_a, boot_b, system_a & system_b and device is capable eventually to boot from every of them :cyclops:

Let's look them in details..

Recovery is obviously still present (:victory:) BUT it has no more its own partition, it is instead included in boot partition (where before there was only kernel and little more...) creating a potentially unwanted (by us tweakers, probably wanted by Google for the opposite reason! :rolleyes:) link between boot and recovery where safe rules would want them as unlinked as possible! :rolleyes:

This leads to the need to flash a boot.img containing both kernel and recovery when we want to update only one of them (e.g. installing TWRP...) and this will have to be taken in account every time we would go to update kernel, TWRP but even when rooting (in fact, at first, developers were not able to gain root together with TWRP... issue then solved succesfully :highfive:).

On Pixels their developers have found some methods to overcome this problem, but on our device, to date, we still don't have a complete solution to this issue. Anyway we are going in the right direction and it will be only matter of time in my opinion (especially since I'm "stressing" our developers to realize a similar solution...! :D).

Double partitions for boot & system, often referred as "A/B partitioning" is a system introduced by Google to distribute OTAs in safer & seamless way, without interrupting user work during updates... (bah... :rolleyes:).

They are so totally unuseful as originally designed for US, since of going with TWRP/root, OTAs are no more a solution to upgrade and this partitioning scheme introduced some complications which have led to issues as with Magisk (as already seen...).

BUT as soon as we'll learn how to well manage them, new horizons will open (like updating fw on a partition still having the older one on the other for safety reasons and/or having two different fw versions and be able to choose what to boot from.. :p). It's only matter of time...

Anyway in this guide we'll face them ever with safe in mind at the moment...

4. READY? LET'S GO WITH UNLOCKING BOOTLOADER!

If your device has unlockable bootloader (and if it is an international unbranded XT1789-06 it should have...!), you can easily unlock it with this good guide:

https://xdaforums.com/z2-force/how-to/how-to-unlock-bootloader-t-mobile-t3654657

There is no more to say about this guide since it is well done, only some notes:

- guide title speaks of T-Mobile but obviously is suitable for international/unbranded too...

- please note that unlocking bootloader will wipe from your device all data & media storage (and they will be wiped again in successive steps, so *be sure* not having nothing valuable - e.g. your girl pics.. :p - before starting with procedures);

- install Motorola's latest drivers & fastboot provided on their site as hinted on guide. Don't skip this step to avoid potential issues in successive steps...

- if I don't wrong remember, step 8 of guide has to be repeated two times to confirm unlocking. Anyway look at your console messages and follow directions... ;)

Reboot to system and make a fast configuration (we'll wipe them in minutes... :D) to check all is ok and re-enabling usb debugging is preferred.

5. DOWNLOAD & UPDATE YOUR FW

I don't know with what firmware your device will come, BUT if it has anything *before* Nougat v.7.1.1 rel. NXPS26-122-68-1 we well go to update to this for following reasons:

- we need a (good) complete stock fw image to be flashed in case of problems;

- it is updated to September 2017 security patch;

- we have a TWRP with *this exact kernel* (they are linked in same image, remember?) for those (like me... :p) which like a "so close to stock as possible" system...

This firmware can be downloaded from the following link: https://mirrors.lolinet.com/firmwar...ubsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip (about 2,35 GB..)

PLEASE NOTE: If you have newer firmware don't use this BUT try to download a matching version with your actual one.

Zipped file has to be fully unzipped into the folder containing fastboot executable (downloaded from Motorola!) on your PC.

If you get any error unzipping, *DON'T FLASH* anything and download again (eventually from another browser/PC).

Fastboot sequence I used is the following:

fastboot devices
pause
fastboot flash modem NON-HLOS.bin
pause
fastboot flash fsg fsg.mbn
pause
fastboot erase modemst1
pause
fastboot erase modemst2
pause
fastboot flash bluetooth BTFM.bin
pause
fastboot flash dsp adspso.bin
pause
fastboot flash logo logo.bin
pause
fastboot flash boot boot.img
pause
fastboot flash system system.img_sparsechunk.0
pause
fastboot flash system system.img_sparsechunk.1
pause
fastboot flash system system.img_sparsechunk.2
pause
fastboot flash system system.img_sparsechunk.3
pause
fastboot flash system system.img_sparsechunk.4
pause
fastboot flash system system.img_sparsechunk.5
pause
fastboot flash system_b system_b.img_sparsechunk.0
pause
fastboot flash system_b system_b.img_sparsechunk.1
pause
fastboot flash system_b system_b.img_sparsechunk.2
pause
fastboot flash system_b system_b.img_sparsechunk.3
pause
fastboot flash oem oem.img
pause
fastboot erase carrier
pause
fastboot erase cache
pause
fastboot erase userdata
pause
fastboot erase ddr
pause
fastboot reboot

That is ready to be put into a batch file to avoid errors and having the possibility to check results of every single flashing since of pause commands presence (press a key to continue to next file). Batch file has to be placed and started from same folder of fastboot & unzipped files to avoid errors.

Please note:

- I've added a fastboot devices command as first to check if your device is properly connected;

- I've used stock sequence of flashing BUT removed gpt (partitions) and bootloader for safety reasons (no need to flash them usually... and let Motorola upgrading your bootloader rarely is a good choice... :rolleyes:)

If all flashes will go fine your device /data would be wiped (yes, again!) and phone will reboot after last command.

If something go wrong stop the sequence by CTRL+C and do not reboot your phone until you have understood/cleared/fixed what has gone wrong.

If fine, again... reboot to system and make a fast configuration (we'll wipe them in minutes... :D) to check all is ok and re-enabling usb debugging is preferred.

6. INSTALL TWRP

This is a quite simple step, but you have to take a decision before you start...

I'll provide two different boot+TWRP image files as attachment to chose from (both of them realized by [MENTION=3659125]joemossjr[/MENTION] )

First one is composed by stock NPXS26 kernel and TWRP v.2 (it's a 3.1.1-0 in TWRP versions), while the second is composed by a kernel recompiled (with little modifications) from sources by joemossjr and TWRP v.3 (still a 3.1.1-0 in TWRP versions) with some little improvements (you can go to his thread for details on TWRP https://xdaforums.com/z2-force/development/twrp-3-1-1-0-moto-z2-force-nash-t3687421 and to this one for details on Pantheon kernel https://xdaforums.com/z2-force/development/kernel-pantheon-kernel-t3702208 ).

If you are on NXPS software version (flashed before) and want to remain "full stock" go with TWRPNPXS.zip, otherwise (you preferring newest firmware or want all newest features) go with TWRPREV3.zip.

Both files *have to be* decompressed, *can't be directly flashed* and your choice of them has to be flashed in fastboot mode with the command:

fastboot flash boot TWRPxxxx.img

where xxxx is matching your choice.

If all have gone fine, you can now reboot to recovery and make some backups if you prefer (please note you will need to place them to an sd card or to a plugged USB key, since internal memory will be fully deleted again soon... :rolleyes:

PLEASE NOTE: during this phase still *don't enable* TWRP to Mount system as R/W ("Swipe to allow modifications for /system" message...) since it could lead to a not booting system if DM verity check is still enabled (it shouldn't since what [MENTION=8462351]ChainfireXDA[/MENTION] reported on Twitter, but it is better to be safe...).

A reboot to system to check all is still ok is preferred. If TWRP asks to install his app files on exit, *be sure* to decline/skip (ever! There is an option in TWRP to disable this request too!).

PLEASE NOTE: this way we are flashing ONLY ONE of the boot partitions with TWRP (usually boot_a) while the other (boot_b) is unaffected. This is a wanted behaviour to stay on "safe side".

PLEASE NOTE: On the linked thread [MENTION=3659125]joemossjr[/MENTION] put a flashable zip file to update it from inside TWRP itself which flash both boot_a & boot_b. So if you'll want to update to newer versions (and remain on safe side...) unzip that file too (instead to flash it in TWRP), extract boot.img contained inside and flash it with the same command indicated before.

Please note all newer versions will use Pantheon Kernel.

WARNING: If you will in future reflash kernel/TWRP to update them, you would lose both root & disabled forced encryption!!!

So, after every boot.img flashing *you will need*,

before booting system

, to boot TWRP and flash again SuperSU before reboot to system.

If you fail to do this you'll face bootloops and/or your /data partition will be corrupted. So a /data backup (on external storage!) before a kernel/TWRP update would be mandatory.

7. ROOT & DECRYPT DEVICE

In this step we will go to finally root the device and decrypt its /data partition. This operation *will delete all data again* on you device (downloaded files & pics too!).

Decryption of /data is needed for many reasons:

- to date TWRP is unable to work with compressed /data (and, anyway, it's ever dangerous to work with encrypted data backups/restore... :rolleyes:)

- some advanced software you'll go to use could have issues with encrypted data

- a decrypted device is slightly faster

- you definitely will want it unencrypted... listen to me! :D

Since our phone will come "force encrypted" (it can't be disabled on stock fw!), we need SuperSU help on this and so we'll need to follow *at perfection* the following provided sequence!

Not all SuperSU are equals (more... they are all different! :silly:) so, tested working fine version to be used is this: http://download.chainfire.eu/1220/SuperSU/SR5-SuperSU-v2.82-SR5-20171001224502.zip?retrieve_file=1

If newer will be out, don't mind, you could ever upgrade it from inside a working system... ;)

Steps are:

- boot to fastboot mode (from off, VOL DOWN + POWER)

- from fastboot mode select RECOVERY mode

- go to wipe menu and select /data FORMAT (not wipe or factory reset, FORMAT!)

- if you have placed downloaded SuperSU zip file on SDcard or USB key browse to it in TWRP Install menu (otherwise connect your phone to PC and trasfer it to internal memory and then browse for it), then Flash it.

- *do not* and I repeat it, *do NOT* clear cache/dalvik cache

- reboot to system

First boot could take a while and probably it reboots one (or two...) times, but at the end it will boot... :fingers-crossed:

You'll have to reconfigure again your system BUT this time, if all has gone fine, it's the good one, so you can do a better configuration if you want.

You will need a working Play Store for next steps, so add a data SIM and/or a wireless network and setup a Google account to enable it.

To check if all has gone fine you should have:

- a SuperSu icon into apps drawer

- on Settings - Security there should be an option to encrypt your system (DON'T chose it! :silly:) instead of the previous "encrypted" status..

It could be a good moment to download an useful Root check app. A good one is Root Check by JRummy Apps which is able to check Busybox & Xposed presence too (and more...).

8. BUSYBOX & XPOSED

If you have reached this point and all is fine, now it's very simple to complete.

Both Busybox & Xposed can in fact be installed from inside a working rooted system, so...

- download from Play Store BusyBox (free version) by Stephen (Stericson), open it, grant root permissions and press Install button without wait all the (unuseful) checks

- reboot

- enable in Settings - Security the "unknown sources"

- download from here https://xdaforums.com/attachment.php?attachmentid=4319220&d=1509453299 latest Xposed installer/manager apk

- install it, open it and grant root

- select Xposed v.88.2 (or newer if available) for arm64 (if many options are showed be sure to select this, arm64!!!) and select Install (*NOT* via recovery... simply normal Install)

- when prompted for a reboot, accept it.

Please note first reboot could take a while and, again, it could self reboot one (or two times...). When at last it will reboot... gotcha!!! It's cigar time!!! :victory:

Well... it has been a LONG WORK to write this as simple & complete as possible. I hope to not have inserted any error and to have been enough clear on provided instructions.

If you'll find any errors please report to me for corrections.

Newer & better methods are welcome too.

If you liked this, PLEASE USE THANKS BUTTON! :D

EneTec

MANY THANKS TO:

[MENTION=283343]seniorstew[/MENTION]

[MENTION=3659125]joemossjr[/MENTION]

[MENTION=7308704]jhofseth[/MENTION]

[MENTION=4604067]Uzephi[/MENTION]

for their useful linked guides and/or great development! :good: