[HTC U12+ Guides, News, & Discussion] Freak07:
Hey guys and girls,

I couldn´t find any guide on how to root the U12+ without twrp yet, so I thought maybe it´s good to have one. It´s also useful for people who don´t like to boot/flash the recovery but want root access.

I also decided now to do a little write up about the A/B slot partition system on the U12+.

General Information about the A/B slot partition system and seamless updates

Google firstly introduced seamless updates on the Pixel Phones and with it the A/B partition system.

So this means, contrary to non A/B devices, there are two copys of most partitions except userdata.

We have two system (system_a and system_b), two boot (boot_a and boot_b) and two vendor (vendor_a and vendor_b) partitions, amongst others (can be found further down in the partition list but let´s concentrate on these).

When booted in the OS, one slot is actively used and the other is "inactive".

The main advantage that emerges now is, that in case an OTA arrives the "inactive" partitions get updated, while the OS is running. That means while the actual OTA is happening you can use your phone just like you always do.

The following reboot will boot into the former "inactive" slot and use the seamless updated partitions. This happens seamless and just with a reboot. So OTAs are much faster!

If you are interested further here are some links:

https://www.xda-developers.com/list-android-devices-seamless-updates/

https://source.android.com/devices/tech/ota/ab/

https://source.android.com/devices/tech/ota/ab/ab_faqs

Here’s another writeup from the XDA portal!

https://www.xda-developers.com/how-...ess-updates-affect-custom-development-on-xda/

However there comes some confusion. I will try to update the thread as best as I can when development, ROMs, Kernels etc kick in.

But here are a few tips and tricks:

NOTE:

For most of the commands that are slot specific like changing the active slot etc,download mode is the preferred method!

fastboot flash boot_a boot.img

and commands like this only work in download mode on standard production devices.

See below for these.

However fastboot boot boot.img is not working in download!

How to reboot to bootloader to be able to use fastboot:

From anywhere with buttons:

Long press (sometimes really long!) the Power button until you feel the vibration motor (not the haptic feedback) kick in. When it kicks in let go of power button quickly and push volume down to boot into bootloader.

thanks to [MENTION=3088420]tbalden[/MENTION] for figuring it out intially.

From the OS or recovery via ADB:

adb reboot bootloader

How to reboot to download mode to be able to use fastboot:

From anywhere with buttons:

Long press (sometimes really long!) the Power button until you feel the vibration motor (not the haptic feedback) kick in. When it kicks in let go of power button quickly and push volume down to boot into bootloader.

Now choose your option with volume buttons until you see reboot to download and confirm the option by pressing the power button.

thanks to [MENTION=3088420]tbalden[/MENTION] for figuring it out intially how to get into bootloader!

From the OS or recovery via ADB:

adb reboot download

How to get the active slot:

fastboot getvar current-slot

How to set the active slot:

A word of advice. If you don´t know what you´re doing you should probably not change slots. Because my U12+ only has a working A Slot. The B slot is without the first OTA or flashing a RUU unbootable.

Set active slot to a:

fastboot --set-active=a

Set active slot to b:

fastboot --set-active=b

How to fastboot flash system, boot, vendor and dtbo to only one partition:

Fastboot with A/B devices allow to flash certain files to a specific Slot. I will list here a few of the most common commands. However be warned that not all of them work on the U12+ currently.

It´s currently a WIP to determine why and if it´s possbile with temp S-Off.

These commands seem to work on Standard retail Units only in download mode.

How to flash boot.img to Slot A:

fastboot flash boot_a boot.img

How to flash boot.img to Slot B:

fastboot flash boot_b boot.img

How to flash system to Slot A:

fastboot flash system_a system.img

How to flash system to Slot B:

fastboot flash system_b system.img

How to flash vendor to Slot A:

fastboot flash vendor_a vendor.img

How to flash vendor to Slot B:

fastboot flash vendor_b vendor.img

How to flash dtbo to Slot A:

fastboot flash dtbo_a dtbo.img

How to flash dtbo to Slot B:

fastboot flash dtbo_b dtbo.img

for other partitions the general rule is being obvious in these examples I guess :)

Partition List / Overview for A/B Partitions

Here is a partition list. So you can check if there is an A/B system available for said partition:

htc_imedugl:/dev/block/platform/soc/1d84000.ufshc/by-name # ls -al
total 0
drwxr-xr-x 2 root root 1880 1970-02-05 04:16 .
drwxr-xr-x 4 root root 2040 1970-02-05 04:16 ..
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 abl_a -> /dev/block/sde9
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 abl_b -> /dev/block/sde30
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 aop_a -> /dev/block/sde1
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 aop_b -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 apdp -> /dev/block/sde46
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 avb_rec -> /dev/block/sde56
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 bluetooth_a -> /dev/block/sde6
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 bluetooth_b -> /dev/block/sde27
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 board_info -> /dev/block/sdf1
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 boot_a -> /dev/block/sde13
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 boot_b -> /dev/block/sde34
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 carrier -> /dev/block/sda16
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 cdt -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib64_a -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib64_b -> /dev/block/sde37
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib_a -> /dev/block/sde15
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cmnlib_b -> /dev/block/sde36
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 control -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 cota -> /dev/block/sda17
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ddr -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devcfg_a -> /dev/block/sde17
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devcfg_b -> /dev/block/sde38
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devinfo -> /dev/block/sde44
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 devlog -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dip -> /dev/block/sde45
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dpo -> /dev/block/sde48
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dsp_a -> /dev/block/sde10
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dsp_b -> /dev/block/sde31
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dtbo_a -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 dtbo_b -> /dev/block/sde42
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 extra -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 fataldevlog -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 frp -> /dev/block/sda14
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 fsc -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 fsg -> /dev/block/sdf3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hosd_a -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hosd_b -> /dev/block/sde35
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 hvbmeta -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 hyp_a -> /dev/block/sde3
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 hyp_b -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 keymaster_a -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 keymaster_b -> /dev/block/sde32
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 limits -> /dev/block/sde50
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 local -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 lockbooter_a -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 lockbooter_b -> /dev/block/sde33
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 logdump -> /dev/block/sde54
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 logfs -> /dev/block/sde52
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mdtp_a -> /dev/block/sde8
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 mdtp_b -> /dev/block/sde29
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mdtpsecapp_a -> /dev/block/sde7
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 mdtpsecapp_b -> /dev/block/sde28
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 mfg -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 misc -> /dev/block/sda6
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 modemst1 -> /dev/block/sdf5
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 modemst2 -> /dev/block/sdf6
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 msadp -> /dev/block/sde47
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 oem_misc -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 padding0 -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 padding3 -> /dev/block/sdd1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 persist -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 pg1fs -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 pmic_a -> /dev/block/sde4
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 pmic_b -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 qupfw_a -> /dev/block/sde18
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 qupfw_b -> /dev/block/sde39
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 radio_a -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 radio_b -> /dev/block/sde26
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ramdump -> /dev/block/sda8
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 reserve0 -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 reserve4 -> /dev/block/sde57
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 reserve5 -> /dev/block/sdf7
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sec -> /dev/block/sde43
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sp1 -> /dev/block/sde49
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 ssd -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 sti -> /dev/block/sde53
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 storsec -> /dev/block/sde55
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 system_a -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 system_b -> /dev/block/sda19
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 tool_diag -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 toolsfv -> /dev/block/sde51
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 tz_a -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 tz_b -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 userdata -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vbmeta_a -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vbmeta_b -> /dev/block/sde41
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vendor_a -> /dev/block/sde19
lrwxrwxrwx 1 root root 16 1970-02-05 04:16 vendor_b -> /dev/block/sde40
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_config_a -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-02-05 04:16 xbl_config_b -> /dev/block/sdc2

How to root your phone with TWRP

Prerequisites:

- unlocked bootloader

- enabled USB-Debugging in Developer Options

- latest adb and fastboot binaries

- working adb and fastboot environment

How to root by flashing the magisk zip:

1. Download magisk zip from here:

https://github.com/topjohnwu/Magisk/releases

2. Download TWRP from here: https://xdaforums.com/u12-plus/development/recovery-unofficial-twrp-3-2-2-0-htc-t3819343

3.

fastboot boot nameoftwrp.img

the TWRP Image! The process is described in the thread I linked above

or simply flash the magisk Zip from permanently installed TWRP

4. Flash magisk.zip

5. Reboot, profit and enjoy a rooted phone

How to with flashing a patched boot.img:

1. Download the latest magisk manager apk from here and install it on your phone: https://github.com/topjohnwu/MagiskManager/releases

2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful [MENTION=5832952]5m4r7ph0n36uru[/MENTION] here:

https://xdaforums.com/showpost.php?p=76606102&postcount=2

it´s usually called boot_signed.img ;)

Or extract it from a RUU! the process is described here:

https://xdaforums.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928

3. Copy the boot_signed.img to your phone

4. Open the magisk manager app and tap two times on install

5. Now choose patch boot.img file and select the boot(_signed).img you copied to your phone in the upcoming file chooser

6. Wait for the boot.img to be patched

7. Copy the patched boot.img to your device

8. Download TWRP from here: https://xdaforums.com/u12-plus/development/recovery-unofficial-twrp-3-2-2-0-htc-t3819343

9. fastboot boot the TWRP! The process is described in the thread I linked above.

Or use the permanently installed TWRP

10. Important: Tap on reboot. It will show the active slot! Now switch to the inactive slot and back to your active slot!

11. Tap on install and navigate to the patched boot.img

12. Tap on install img at the bottom

13. Flash the patched.img

14. Tap on reboost system and boot back to system

15. You´re now rooted!

How to root your phone without TWRP

Prerequisites:

- unlocked bootloader

- USB-Debugging in developer options enabled

- latest adb and fastboot binaries

- working adb and fastboot environment

How to:

1. Download the latest magisk manager from here and install: https://github.com/topjohnwu/MagiskManager/releases

2. Get a boot.img that fits your current firmware. You can find one in the firmware zips provided by the kind and helpful [MENTION=5832952]5m4r7ph0n36uru[/MENTION] here:

https://xdaforums.com/showpost.php?p=76606102&postcount=2

it´s usually called boot_signed.img ;)

Or extract it from a RUU! the process is described here:

https://xdaforums.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928

3. Copy the boot_signed.img to your phone

4. Open the magisk manager app and tap two times on install

5. Now choose patch boot.img file and select the boot(_signed).img you copied to your phone in the upcoming file chooser

6. Wait for the boot.img to be patched

7. Now connect your phone to your pc and make sure usb debugging is enabled in developer options

8. Open up a terminal in your fastboot folder and make sure adb is working by typing

adb devices

into terminal which should return your serial number

9. Pull the patches boot.img to your fastboot folder via:

adb pull /sdcard/MagiskManager/patched_boot.img

10. Reboot to download mode:

adb reboot download

11. Check your active slot while in the bootloader mode with

fastboot getvar current-slot

output of this command will show your active slot

12. Depending on the active slot do

For active slot a do:

fastboot flash boot_a patched_boot.img

For active slot b do:

fastboot flash boot_b patched_boot.img

13. If the flash was successful do:

fastboot reboot

14. Congratulations you´re now rooted.

15. You will see a message stating there is an internal problem. That is nothing to worry about and will be resolved on a later stage.

IMPORTANT NOTICES

1. After rooting, the option to enable face unlock from htc will be greyed out.

How to fix:

a. Open Magisk Manager

b. Open the side menu and tap on magisk hide

c. Tick faceunlock to be hidden

d. Go to settings apps and delete data of faceunlock app

e. reboot!

I will refine this thread in the future and include a few more things to it when the time comes.

Drop a thanks if it helped you :)

And have a nice day :)