[Android Q&A, Help & Troubleshooting] smokeyou:
Enjoy!

XP8 Android Root Theory - DEBUG or Magisk over EDL

EDL is a must since Fastboot cannot be unlocked initially from standard "user" builds.

One option is flash a userdebug image (below) allowing for adb root, fastboot unlocking, and other useful features.

or

Without unlocking the bootloader - Similar flashing methods remain valid when standard magisk powered root is desired. This method allows preservation of all current system data aside from boot.img. All is covered since Magisk works with AVB and we have EDL as a flashing alternative. Please see Android Boot Flow > LOCKED Devices with Custom Root of Trust for more information.

Recommend method ..

It's up to you.. If you want OTA updates and your planning to use root apps then go with Magisk. As of today we have current debug images available and I personally prefer isolated adb root access only however future availability of updated Debug images cannot be guaranteed.

Disclaimer

-Devices with locked bootloaders will display a custom OS warning at boot

-Tested on AT&T branded devices only - please provide system dump for validation on other builds

-I have not identified any JTAG procedures and I can not help if you hard brick your device!

-This guide only touches boot_a and should be relatively safe since boot_b remains unmodified. I'm pretty sure this is enough to restore the original boot.img to boot_a under a failure scenario.. But I'm not really qualified enough to say definitively either.

-Take great caution - this is raw emmc access and critical system data! You are proceeding at your own risk!

Magisk Root

Step 1 - Pull Boot.img

We need to pull the boot.img in order to feed it to magisk later for patching. It's also good to keep on hand for if/when you need to restore for any reason.

1. Create an XML file with the data below

<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="boot.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>

2. Boot to EDL mode and load firehose programmer

QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf

3. Backup boot.img using the following command

fh_loader.exe --convertprogram2read --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0 --memoryname=emmc --noprompt --reset

Or visit the XP8 carrier firmware thread for full system backup steps.

https://xdaforums.com/showpost.php?p=80465045&postcount=6

Step 2 - Magisk Patch

1. ADB push boot.img /storage/self/primary/Download/

2. Install Magisk Manager and apply patch to boot.img

2a. Download from https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445

2b. Extract and run adb install magisk.apk

2c. Open Magisk app and apply patch to boot.img

3. ADB pull /storage/self/primary/Download/magisk_patched.img

Step 3 - Restore

1. Change the filename attribute in the XML to reflect newly created magisk_patched.img as shown below

<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>

2. Boot back into EDL mode and load firehose programmer

QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf

3. Apply magisk_patched.img using the following command

fh_loader.exe --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0 --memoryname=emmc --noprompt --reset

USERDEBUG Flash

Step 1 - Backup

1. Boot to EDL mode and load firehose programmer

2. Generate rawprogram0.xml - Run GPTConsole <COM Number>

Example: GPTConsole 19

3. Initiate backup

fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=rawprogram0.xml --lun=0 --memoryname=emmc --noprompt --reset

4. Wipe all partitions

fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=erase.xml --lun=0 --memoryname=emmc --noprompt --reset

5. Restore new image

fh_loader.exe --port=\\.\COM<#> --sendxml=rawprogram0.xml --lun=0 --memoryname=emmc --noprompt --reset --search_path=<extracted image file directory>
// rawprogram0_unsparse.xml for some images

Images and OTA Files

Full 8.1 System Image

XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00

XP8A_ATT-user-8A.0.5-10-8.1.0-10.49.00

USERDEBUG Images

XP8A_ATT_userdebug_8A.0.5-11-8.1.0-10.54.00

XP8A_ACG-userdebug-8A.0.0-00-7.1.1-32.00.12

XP8A_USC-userdebug-8A.0.0-00-7.1.1-34.00.10

(ATT 7.1 pending upload. Please check back or use other links available further in thread.)

OTA Updates

XP8_ATT_user_N10.01.75-O10.49.00

XP8_ATT_user_O10.49.00-O10.54.00

XP8_TEL_user_N12.00.24-O12.23.00

Flash Tools - programmer (elf) file provided by eleotk!

XP8 Drivers

Firmware Carrier Codes

None = 0,
ATT = 10
Bell = 11
Telus = 12
Sasktel = 13
Harris = 14
Verizon = 15
Ecom = 16
NAM = 17
Rogers = 18
T_Mobile = 19
EU_Generic = 20
MSI = 21
CISCO = 22
NAM_Public_Safety = 23
Vodafone_Global = 24
Orange = 25
Southern_Linc = 26
OPTIO = 27
India = 28
SPRINT = 29
JVCK = 30
AUS = 31
ACG = 32
CSPIRE = 33
USC = 34
SB = 35
Multi = 99

Automatic OTA without AT&T service:

Purchase a blank AT&T SIM card ($5)

Start online prepaid activation - complete pages 1 & 2

**SIM Card is now partially active without funding - do not complete page 3 (payment)***

*#*#368378#*#* > Clear UI > Check for updates in settings

XP5s

Sprint Image: XP5SA.0.2-03-7.1.2-29.03.00

Works the same. Tested with unmodified Sprint firmware. Like most other apps, the Magisk manager app is unusable since the XP5s has no touch screen - I had to patch the boot image on another device. You can plug in a USB mouse however the cursor does not seem to invoke in-app tap's.

Need to use the appropriate Firehose loader (prog_emmc_firehose_8920.mbn) and replace the boot image location according to the XP5s GPT (start_sector="790528").