[Android Q&A, Help & Troubleshooting] portsample:
ATT XP8 backup, rooting, and wifi hotspot

Rooted an ATT (carrier unlocked) Sonim XP8 this afternoon and enabled wifi hotspot on the device. Below are notes. These are compiled mostly from XDA posts by Smokeyou. Kudos for his efforts and posts. Thanks also to Sergsinger for his PDA forum posts .Wifi hotspot adjustment by RJGlenn. Feel free to PM me with corrections, additions, and clarifications. This is a work in progress

Instructions below assume lap/desktop OS is recent MS Windows.

Pre-install:

1.) Download and install "Flash Tools" from https://androidfilehost.com/?fid=4349826312261641937

This compressed archive contains,

fh_loader.exe GPTConsole.exe prog_emmc_firehose_8920.mbn

prog_emmc_ufs_firehose_Sdm660_ddr.elf

QC.QMSLPhone.dll

QMSL_MSVC10R.dll

QSaharaServer.exe

SubSysSwDownload.DLL

Download the FlashTools archive and unpack it to C:\ drive.

2.) Download Android Debug Bridge (ADB) from here, https://developer.android.com/studio/releases/platform-tools.

Install ADB on your desktop. Update Windows PATH, (life is short).

3.) Download and install QDLoader HS-USB Driver.zip from here, https://androidfilehost.com/?fid=24459283995295983

In the installation menu, always click "Next" and do not select anything else. Reboot your PC.

4.) Download and install "XP8 drivers" from here, https://www.androidfilehost.com/?fid=4349826312261641909

5.) Secure copies of Magisk.zip and MagiskManager.apk for installation on Android device. Website is https://github.com/topjohnwu/Magisk

6.) On your Sonim XP8 handset, enable developer settings and,

-allow OEM (bootloader) unlocking,

-allow USB debugging,

-allow verify apps over USB, and

-download and install Root Browser Classic (JRummy apps).

PHASE I.) BACKUP YOUR ROM-

1.) Put the smartphone in EDL (Emergency Download) mode. Phone can be put into EDL manually by turning it off, then hold down both Volume buttons and press the Power button: Sonim will appear, then screen will go blank. Phone is now in EDL mode. Another option is via ADB. Open a command prompt window by right-clicking in an empty space while holding the Shift key on the keyboard, then select "open command window here" type in, "adb reboot edl". Connect the phone to the PC, the phone will be identified as " Qualcomm HS-USB QDLoader 9008" in the Device Manager, under Ports (COM and LPT). Remember the port number (COM) displayed here to which the phone is connected. This is very important.

2. Create a backup. In the unpacked FlashTools folder, on an empty space, right-click while holding the Shift key on the keyboard and select "open command window here". Execute the following commands:

2a.) "QSaharaServer.exe -p \\. \ COM<X> -s 13: prog_emmc_ufs_firehose_Sdm660_ddr.elf"

<X> is the port number your phone is connected to, becomes COM1 or COM2 (hard brackets go away)

2b.) Create a backup XML file named "backup.xml". This grabs much of the ROM for a backup. Contents of this .xml are:

<?xml version="1.0"?>

<!--NOTE: This is an ** Autogenerated file **-->

<!--NOTE: Sector size is 512bytes-->

<data>

<program start_sector="24286840" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="abl_a" filename="abl_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="24288888" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="abl_b" filename="abl_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="131072" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="7168" label="xbl_a" filename="xbl_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="138240" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="7168" label="xbl_b" filename="xbl_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="145408" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8192" label="tz_a" filename="tz_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="153600" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8192" label="tz_b" filename="tz_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="161792" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="rpm_a" filename="rpm_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="162816" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="rpm_b" filename="rpm_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="163840" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="hyp_a" filename="hyp_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="164864" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="hyp_b" filename="hyp_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="165888" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="pmic_a" filename="pmic_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="166912" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1024" label="pmic_b" filename="pmic_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="24294024" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="66848" label="splash" filename="splash.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23592960" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="keymaster_a" filename="keymaster_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23595008" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="keymaster_b" filename="keymaster_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23597056" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="cmnlib_a" filename="cmnlib_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23599104" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="cmnlib64_a" filename="cmnlib64_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23601152" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="cmnlib_b" filename="cmnlib_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23603200" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="cmnlib64_b" filename="cmnlib64_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23605248" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8192" label="mdtpsecapp_a" filename="mdtpsecapp_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23613440" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8192" label="mdtpsecapp_b" filename="mdtpsecapp_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23621632" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="65536" label="mdtp_a" filename="mdtp_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23687168" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="65536" label="mdtp_b" filename="mdtp_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23752704" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="225280" label="modem_a" filename="modem_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="23977984" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="225280" label="modem_b" filename="modem_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="393216" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_b" filename="boot_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="boot_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="24718360" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="devcfg_a" filename="devcfg_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="24720408" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2048" label="devcfg_b" filename="devcfg_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="524288" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8388608" label="system_a" filename="system_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="8912896" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="8388608" label="system_b" filename="system_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="21495808" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1048576" label="oem_a" filename="oem_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="22544384" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="1048576" label="oem_b" filename="oem_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="17301504" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2097152" label="vendor_a" filename="vendor_a.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

<program start_sector="19398656" sparse="true" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="2097152" label="vendor_b" filename="vendor_b.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

</data>

2c.) Enter this in a terminal window to create the backup, "fh_loader.exe --convertprogram2read --port=\\.\COM<X> --sendxml=backup.xml" .

<X> is the port number your phone is connected to, becomes COM1 or COM2 (hard brackets go away).

Note: To restore the backup, execute the commands: "QSaharaServer.exe -p \\. \ COM<X> -s 13: prog_emmc_ufs_firehose_Sdm660_ddr.elf",

and "fh_loader.exe --port = \\. \ COM <X> --sendxml = Backup.xml"

Remember <X> is the port number,to which your phone is connected!

PHASE II.) ESTABLISHING ROOT. This is done via MagiskManager and boot patching.

1.) Pull Boot.img. We need a copy of the stock boot image for MagiskManager to patch. It's also good to keep a backup copy of the stock boot image on hand should you need to restore for any reason.

1a.) Create an XML file named "bootbackup.xml" in C:\FlashTools using below code. This will create a backup of boot_a from the Sonim XP8 and save it as "backup_boot.img" in C:\FlashTools.

<?xml version="1.0"?>

<data>

<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="backup_boot.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

</data>

1b.) Boot to EDL mode using methods in Phase I, step 1. Remember the COM port in use. Run the following commands.

A) Load the firehose programmer, "QSaharaServer.exe -p \\.\COM<X> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf"

Remember <X> is the port number,to which your phone is connected.

B) Run the bootbackup.xml file to create backup_boot.img in C:\FlashTools using the following command.

"fh_loader.exe --convertprogram2read --port=\\.\COM<X> --sendxml=bootbackup.xml --lun=0 --memoryname=emmc --noprompt --reset"

2.) Magisk Manager and boot patch

2a.) Transfer "backup_boot.img" to /downloads on the device. MagiskManager will access it here and modify it.

Do this by using Android Debug Bridge (ADB) thus: "adb push C:\FlashTools\backup_boot.img /storage/self/primary/Download/". Note device is NOT in EDL mode.

2b.) On the handset, install magiskmanager.apk. Do this either via ADB, or put the .apk file on the device sdcard, browse to it using RootBrowser, and install.

2c.) Open MagiskManager application, follow presented instructions and apply patch to backup_boot.img in device /downloads directory.

2d.) Run, "ADB pull /storage/self/primary/Download/magisk_patched.img". File should be in whatever directory command was called from (C:\FlashTools\magisk_patched.img).

3.) Apply patched boot.img to device operating system by pushing a copy of magisk_patched.img to the device and overwriting boot_a with it as follows,

3a.) Create an XML file named "magiskoverwrite.xml"

<?xml version="1.0"?>

<data>

<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

</data>

3b.) Boot back into EDL mode and load firehose programmer, "QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf"

3c.) Apply magisk_patched.img using the following command, "fh_loader.exe --port=\\.\COM<#> --sendxml=magiskoverwrite.xml --lun=0 --memoryname=emmc --noprompt --reset"

Post install notes: Phone asked for password upon reboot following completion of step 3. Screenlock pin did not resolve this.

Did factory reset. Reinstalling MagiskManager.apk from copy on device sdcard, followed by "install" in the application, granted root privileges.

Phase III.) ENABLING WIFI HOTSPOT.

1.) Download and install Root Browser Classic (JRummy apps). Open Root Browser Classic and browse to /system/build.prop. Open with a text editor. Scroll down to "#property to enable entitlement check". Change att.service.entitlement= from "true" to "false". Below this add "net.tethering.noprovisioning=true". Hit save. Close the text editor, then reboot the phone. Note: In Android 10 I was unable to open build.prop on the device. Ended up moving this file to a laptop and opening with a text editor there. Then pasted edited file back on the device.