yashsingh1/xdaforums huggingface dataset:
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Migration from 9.0.3 fw to 9.0.4 fw :

Before :

==> OnePlus 3T / FW 9.0.3 / TWRP 3.3.1-0 / ext4 / unencrypted / BL locked / LOS 16.0 build / open gapp pico / LOS addon su

How to proceed:

- Boot to TWRP 3.3.1-0

- Flash oxygenos-9.0.4-firmware-3T.zip (credit: [MENTION=4405529]nvertigo67[/MENTION])

==> https://github.com/nvertigo/firmware-3t/blob/master/archive/op3t/oxygenos-9.0.4-firmware-3T.zip

- Reboot to System

After :

==> OnePlus 3T / FW 9.0.4/ TWRP 3.3.1-0 / ext4 / unencrypted / BL locked / LOS 16.0 build / open gapp pico / LOS addon su

Right now:

No issue. Note I don't use NFC.

FYI, the updating from 20190629 to 20190701 with Lineage Downloader app (Play Store) worked as expected ... (9.0.4 fw).

If needed, oxygenos-9.0.4-firmware-3.zip ... https://github.com/nvertigo/firmware-3t/blob/master/archive/op3/oxygenos-9.0.4-firmware-3.zip

As reminder : Modded fw ... https://xdaforums.com/oneplus-3t/how-to/guide-cope-9-0-3-5-0-8-firmware-barrier-t3941164

He who doesn’t fail, doesn’t try... but reading and understanding a thread... It always pays off!

Edit: my 9.0.3 fw was unmodified (https://www.celsoazevedo.com/files/android/oneplus3t-modem-firmware/)
[OnePlus 3 & 3T Cross Device Development] defi231:
the mesage is the first thing that shows up on device...it let me move volume up down to to enter power off, restart, bootloader, recovery

what unlock setting? dont understand the question.. i just took my phone like it was ..put it on USB start fastboot / fastboot oem lock

then the phone was asking me - Lock device( may void warranty) yes/no. after that i entered twrp through vol/down installed FW+Modem. reboot, installed LOS....thats all i did
[OnePlus 3 & 3T Cross Device Development] :
Again: can you boot to twrp? Can you boot to fastboot mode? Don't let me beg for information - I'm trying tomhelp you...
[OnePlus 3 & 3T Cross Device Development] defi231:
sry vertigo, yes it is all working

recovery,fastboot, LOS
[OnePlus 3 & 3T Cross Device Development] Dirk:
The OEM Unlock setting is in Developer options.

It sounds like the 'Bootloader Unlocked' message has been replaced by the one you are getting. That should help narrow down where the message is coming from. Don't worry, we will get to the bottom of it but we will need you to answer questions. Still need these answered:

Does the ROM pass Safetynet out of the box right now? (If you don't mind checking it would be interesting to many of us).

Were you encrypted or unencrypted through this process?

His phone is working normally. TWRP and Fastboot included.

---------- Post added at 19:34 ---------- Previous post was at 19:24 ----------

Nice to see you!

So you've been running your own experiment with a relocked Bootloader? Some questions:

Do you have the "device has loaded a different operating system" message at Boot instead of the Bootloader Unlocked screen?

What was the OEM Unlock setting throughout?

Does the ROM pass Safetynet with the Bootloader Locked? (Would have to be checked without the SU Addon as that would surely break Safetynet regardless)

You're using the modified firmware right? As far as i know there's no problem updating using that under any condition. Encrypted, unencrypted, BL Locked or unlocked, clean or dirty flash. Official firmware is another matter.

I wonder what is generating the "device has loaded a different operating system" message.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
I was out of my lab ...

OEM unlocking setting (Dev opts):

Before (i.e. unlocked BL) : OEM unlocking was enabled but shaded (https://xdaforums.com/showpost.php?p=79740194&postcount=2421)

After locking BL : enabled but not shaded

I never experienced the "device has loaded a different operating system" message

What was the OEM Unlock setting throughout? ... OEM unlocking = enabled

SafetyNet Test and LOS su addon:

Root access = disabled or (ADB only) ==> safetyNet Test = Passed

Root access = (Apps only) or (Apps and ADB) ==> safetyNet Test = Failed

I'm using the un-modified firmware ==> oxygenos-9.0.4-firmware-3T.zip ... not oxygenos-9.0.4-bl-km-5.0.8-firmware-3T.zip

As long as the official firmware will not be fixed at the encryption level, I will remain unencrypted... I know this is not an optimal security situation

FYI, the FW updating (from 9.0.3 to 9.0.4) removed/erased my fingerprints. I've added new ones.
[OnePlus 3 & 3T Cross Device Development] :
If los is working now: ok. Forget the rest of this posting.

If it's still NOT working, try the steps recommended by [MENTION=9708417]Eric_Lev[/MENTION]. If that also fails, try this fw: https://xdaforums.com/oneplus-3t/how-to/guide-cope-9-0-3-5-0-8-firmware-barrier-t3941164, and clean flash. (for 9.0.3 use this: op3t: https://github.com/nvertigo/firmwar...3t/oxygenos-9.0.3-bl-km-5.0.8-firmware-3T.zip or fpr op3: https://github.com/nvertigo/firmwar...op3/oxygenos-9.0.3-bl-km-5.0.8-firmware-3.zip ; the links in the modded fw thread are updated to 9.0.4)
[OnePlus 3 & 3T Cross Device Development] Dirk:
Nicely done as always Eric. Just the man we needed for relocking tests! :good:

So we do have a third option for Safetynet pass now. That's useful.

Wonder why you don't get the message mentioned before. The setup seems the same. Locked BL, official firmware.

I wonder if it's some dm_verity thing? I still don't know if the other chap was encrypted. Perhaps that's the difference.
[OnePlus 3 & 3T Cross Device Development] defi231:
oh dam..plz dont be angry, i forgot that i rooted my phone

i restore my phone and did all again step by step and found out that this message was caused by magisk 19.3/ by rooting my phone
[OnePlus 3 & 3T Cross Device Development] :
I've not expirienced that, either.

This message should only show, if the bootloader is locked and the boot image is signed with the wrong signature or not signed at all. I.e.: you flash somethimg altering the original boot image (like custom kernels or magisk) without resigning the boot image before writing back (I don't know if custom kernels or magisk are doing so, though I guess magisk is resigning the altered boot image, because I think I've seen repprts using magisk with locked boot loader).

As explained before, I suspect some bootloader settings to be the culprit. There is a trick to dismiss the dm-verity message by flashing 4.0.2 fw, disable dm-verity in fastboot and immidiatly enable it again, and then flash 5.0.x again. This means, something is changed in the bl (or fastboot for that matter) settings, that persists fw updates. I don't say it's the dm-verity trick, but the dm-verity trick proofs, that there is a "persistent bl memory" that contains more information then the locked/unlocked state, and which isn't reset by relocking the bl.

I guess something in this "persistent bl memory" makes the same update process working on one device, but failing with different symptoms (decryption failure, selinux, other os, perhaps more) on another device, depending on the set of "persistent bl memory".

Though I can't proof this theory yet, it would explain all the wonderfull effects, we've read about the last weeks.

---------- Post added at 22:14 ---------- Previous post was at 22:09 ----------

Obviously, magisk is NOT resigning.

New rule: bl locked -> don't use any boot image altering zips!
[OnePlus 3 & 3T Cross Device Development] ceanth:
I also have the NFC issue, I renamed the file to .bak, rebooted but no new file is generated. Am I missing a step?

---------- Post added at 09:59 PM ---------- Previous post was at 09:53 PM ----------

I flashed 20190629 via updater from 20190614 which gave me rescue party error. I didn't reflash the rom, I restored nandroid backup and manually flashed 20190629 and it worked
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
How to relock your BootLoader ?

Optional: backup your data, perform a Nandroid backup .... etc.

How to proceed (tested on an unencrypted device):

1. Boot to TWRP (3.3.1-0)

Only for Magisk: Uninstall Magisk ... via https://github.com/topjohnwu/Magisk/releases/download/v19.3/Magisk-uninstaller-20190604.zip

2. Delete the lock screen files (using TWRP terminal or file manager if rooted)

/data/system/gatekeeper.*

/data/system/locksettings.*

(see this post: https://xdaforums.com/showpost.php?p=79111125&postcount=1204 - Credit: [MENTION=2911853]BillGoss[/MENTION])

if using fingerprints,

/data/system/users/0/fpdata

/data/system/users/0/settings_fingerprint.xml

(see this post: https://xdaforums.com/showpost.php?p=79742341&postcount=2438 - Credit: [MENTION=2911853]BillGoss[/MENTION])

3. Boot to System for checking

4. Boot to Bootloader

5. Lock your BL

==> fastboot oem lock and select (Vol+/-) No (if 9.0.3 fw ... a bug !) or Yes (if 5.0.8 fw) and validate (Power) ... Your device will boot to TWRP.

6. Boot to System

Only for Magisk: Boot to TWRP, Flash Magisk + VerifiedBootSigner-v8.01-aosp-key.zip (press vol down) + Boot System ... Credit: [MENTION=4405529]nvertigo67[/MENTION]

7. Enjoy ... hope so.

NB : if issue, unlock BT via fastboot oem unlock

Edit: My 9.0.4 fw is unmodified/unmodded ... oxygenos-9.0.4-firmware-3T.zip (credit: [MENTION=4405529]nvertigo67[/MENTION])
[OnePlus 3 & 3T Cross Device Development] Dirk:
Thanks Eric. :good:

It seems like relocking really is a valid option. Especially for folks who want a simple and secure setup. Safetynet out of the box. Worth consideration!
[OnePlus 3 & 3T Cross Device Development] defi231:
i just tried it, doing this step by step , the moment i reinstall magisk again the boot option are open again even the BL is locked

relocking BL with the uninstaller works
[OnePlus 3 & 3T Cross Device Development] Galiis:
Thank you for your test:)

Two days ago, I tried to lock bootloader for testing fingerprint payment. Result: Failed to lock bootloader.

My op3t: twrp 3.3.1-0/9.0.3 fw/lineageos-6-29 build/encrypted device/magisk 19.3

Steps:

1. Remove fingerprint and screen lock, uncheck OEM unlocking settings.

2.Boot to twrp, uninstall magisk then flash lineageos ROM.

3.Boot to bootloader, lock the bootloader (fastboot oem lock)

4.What I've done is choose yes, rebooting shows my device still unlocked.

I'll select NO after locking the bootloader to verify.

Edit:Select NO will lock your bootloader.

With data encryption, re-locking your bootloader then boot to twrp required password. Unfortunately, decrypting data failed.

Booting to system, it warns data is corrupted. Full backup is important!
[OnePlus 3 & 3T Cross Device Development] :
Only if you don't fall into the selinux trap: if your bl is locked, but sepolicy is permissive or disabled, safetynet will fail.

[MENTION=9350973]All[/MENTION]:

I've lost track of magisk with locked bl: is it working like [MENTION=9708417]Eric_Lev[/MENTION] is suggesting,

or does it break booting, like [MENTION=4811328]defi231[/MENTION] is reporting (I guess "the boot option are open again" means the selection after the other os installed message)

?

In other words: does magisk still works with locked bl?

---------- Post added at 11:04 ---------- Previous post was at 11:00 ----------

I've understood that already. I tried to be polite. My question is:

Why do you restore a nandroid, instead of manually flashing the rom, which is recommended many times in this thread? Just because of a lack of reading, or because manually reflashing doesn't work?
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
I never experienced the selinux trap... So be careful... as suggested by [MENTION=4405529]nvertigo67[/MENTION].

Very good question... I never used Magisk on my device... So I didn't test.
[OnePlus 3 & 3T Cross Device Development] rg_gapa:
My bootloader is unlocked but LineageOS (2019.06.15) has OEM Unlocking disabled, somehow. Will it be a problem? Trying to enable it gives me this warning and I'm not sure should I touch this.
[OnePlus 3 & 3T Cross Device Development] Dirk:
There's no harm either way. As far as i can tell you'd enable it if you wanted to relock your Bootloader. Still not 100% sure why some people are finding the setting greyed out, or disabled when it was previously enabled.
[OnePlus 3 & 3T Cross Device Development] :
*lol* Since I've always used an unlocked bootloader, I completely belived in your locked guide...*lol*

[MENTION=4811328]defi231[/MENTION]:

Did I understand your last posting corectly, when stating "locked bl boots the rom just fine WITHOUT magisk installed, but fails to boot the rom WITH magisk installed"?

If the answer is "yes", would you be willing to test a flashable zip, resigning the boot image after magisk install?

I found this posting on signing partition images and android verfied boot (aka dm-verity) by [MENTION=631273]Chainfire[/MENTION]:

https://xdaforums.com/android/software-hacking/signing-boot-images-android-verified-t3600606

If I get that right, we just need to convert https://github.com/LineageOS/android_build/blob/lineage-16.0/target/product/security/verity.x509.pem to der encoding and place the result and https://github.com/LineageOS/android_build/blob/lineage-16.0/target/product/security/verity.pk8 as custom.x509.der and custom.pk8 in the zip and we get an universal aosp key signer...

On converting key encodings: https://support.ssl.com/Knowledgeba...r-vs-pem-certificates-and-how-to-convert-them .

Just some thoughts - only relevant if magisk doesn't work out of the box with a locked bl.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
*lol* ... https://xdaforums.com/showpost.php?p=79829810&postcount=2724 ... *lol*
[OnePlus 3 & 3T Cross Device Development] ceanth:
I flashed nandroid because I wanted to restore my LOS backup after flashing OOS Pie.

---------- Post added at 02:28 PM ---------- Previous post was at 02:25 PM ----------

Hi,

As my system is not generating the file, is there anyway of manually creating it with required "nq-nci" name? Is that the file name or is that a name within the file (if that makes sense)
[OnePlus 3 & 3T Cross Device Development] :
Sorry, dude, I thought we were talking of recovering from failed ota automatic flashing - completely misunderstood the context.
[OnePlus 3 & 3T Cross Device Development] defi231:
I tried the VerifiedBootSigner but without result

when i flash the zip it is asking me "resigning the image because the image is already signed" (yes/no) , i resigned it but the startup message is still there
[OnePlus 3 & 3T Cross Device Development] :
Of course, not. You signed with the included SuperSU keys, or have you added the pk8 and der file from los/aosp after converting pem to der?

Would you try with the attached zip, please: flash the magisk uninstaller and reboot to recovery. Then flash Magisk and directly after Magisk falsh the attached zip. Wipe caches from the flashing output page, go back to the twrp main screen, from there: Advanced->Copy Log->uncheck "include Kernel Log->Swipe and put the resulting recovery.log in your answer. Thanx in advance.
[OnePlus 3 & 3T Cross Device Development] defi231:
ok that zip did it. ty
[OnePlus 3 & 3T Cross Device Development] :
I'm happy it's working for you!

[MENTION=9708417]Eric_Lev[/MENTION]: before you update your marvelous guides: Gimme some time till tommorow. I'll setup a nice posting and inform [MENTION=631273]Chainfire[/MENTION] that I use his work. I'll drop you a note.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Useful guides, hope so ! ... Marvelous guides, only a developer can do it.... :p

I haven't had time to flash Magisk on a locked BT.... ASAP.

OK

---------- Post added at 21:10 ---------- Previous post was at 20:41 ----------

I just checked the re-installation of Magisk unlocks the bootloader!

==> https://xdaforums.com/showpost.php?p=79829810&postcount=2724
[OnePlus 3 & 3T Cross Device Development] :
Flashing magisk unlocks the bl for your setup without even entering fastboot?

Honestly, if this would come from someone else but you, I wouldn't even belive that. But since it's you, and because what different kinds of trouble relocking the bl has given to some people....

This is the opposite of [MENTION=4811328]defi231[/MENTION]. Sadly we have no logs for both issues [MENTION=4811328]defi231[/MENTION]: the log you've posted doesn't contain a magisk flash and a VerifiedBootSigner-v8.01-aosp-key.zip flash, but a restore session without any flash; [MENTION=9708417]Eric_Lev[/MENTION]: I guess you've realized the automatic unlocking after rebooting, and therefor after you would have been able to get a log of the automatic unlocking twrp session).

In deed Magisk is resignimg the bootimage with chromeos keys (https://github.com/topjohnwu/Magisk/tree/v19.3/chromeos , https://xdaforums.com/showpost.php?p=79836764&postcount=319), that's why [MENTION=4811328]defi231[/MENTION] is expirience "image already signed, [...] press vol down to forece[...]". If resigning with aosp keys make the system boot again, I would guess those are different keys (https://xdaforums.com/showpost.php?p=79837419&postcount=320 )...

The automatic unlocking is a complete mystery to me. As far as I know, you can't unlock the bl without a device specific fastboot command... Though it would be great, if the bl status would be changable from inside twrp. As stated: if this would come from anybody else the Eric, I wouldn't belive that.

Folks, I'm lost. For now my only conclusion is: locked bootloader suckz - unlocked bootloader rulez... :( :silly: :confused:
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Some quick information because I have little time at the moment...

Setup: OnePlus 3T / FW 9.0.4 / TWRP 3.3.1-0 / ext4 / unencrypted / BL locked / LOS 16.0 build / open gapp pico / LOS addon su

Boot to TWRP

Remove LOS su addon

Reboot to TWRP

Flash Magisk (the latest)

Copy logs to SD card (in attached files)

Boot to recovery ... BL locked ... (Not tested last evening)

Boot to system ... BL unlocked (see "screenshot") and unlocking the lock screen fails ... (this last point must be confirmed)

Restart and boot to recovery ... BL locked

Reboot to Sytem ... BL unlocked and unlocking the lock screen fails

Boot to recovery ... BL locked

Uninstall Magisk and install LOS su addon

Boot to Sytem ... BL locked and no issue.

No time to do more ...

Edit: my 9.0.4 fw is unmodified/unmodded ... oxygenos-9.0.4-firmware-3T.zip
[OnePlus 3 & 3T Cross Device Development] :
No need to do more atm. After reading the above, I've checked my office for hidden cams... ...my face would have been worth a video...

Oh, one more test (not urgent! take your time!) would be great: resign the boot image with the VerifiedBootSigner-v8.01-aosp-key.zip directly after flashing Magisk.

Also: [MENTION=9708417]Eric_Lev[/MENTION] and [MENTION=4811328]defi231[/MENTION]: please give us the exact link to the fw package you are using, when the (different) issues show up.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
My 9.0.4 fw is unmodified/unmodded ... oxygenos-9.0.4-firmware-3T.zip (credit: [MENTION=4405529]nvertigo67[/MENTION])
[OnePlus 3 & 3T Cross Device Development] :
ROFL

I've just seen, that the voting counter of the poll is still increasing...

Kids, we use the pie fw since two weeks - no reason to vote since then... *lol*
[OnePlus 3 & 3T Cross Device Development] Not-Aus:
They'll know in 4 or 5 days when they read through the thread. :cool:
[OnePlus 3 & 3T Cross Device Development] An68:
Hi, I can't send and receive SMS, I tried to chance app but nothing. I don't know how long this has been happening

OnePlus3T, FW 9.0.3, TWRP 3.3.1.0, encrypted, BL unlock, last build, open gapp pico, Magisk19.3

Thanks

Clean installation has fix
[OnePlus 3 & 3T Cross Device Development] realtos:
what will happen if i lock it? tried all options, nothing worked, it was the unlock that was the problem, not root ( even the app say "phone is root so dont work" )

if i lock it, i cant use magisk and its modules and los updates right? or has that changed?
[OnePlus 3 & 3T Cross Device Development] :
Did you read the last pages?

We don't know, yet. Tere are - at least - two different reports.

The ota issue is something completely different and not related to fw/bl! Since nobody is interested in helping sorting this out, I don't care anymore.

---------- Post added at 12:17 ---------- Previous post was at 12:15 ----------

"when they read through the thread." is an euphemism for "never", isn't it? *lol*
[OnePlus 3 & 3T Cross Device Development] ceanth:
Further update on my NFC issue.

For a while now I have been using Caesium Kernal to bypass Safteynet to allow me to use Google Pay. I have been flashing this after every nightly build and everything was working fine.

Since flashing PIE OOS and using latest nightly, 20190629 I was experiencing NFC issue where by the toggle does not remain on. I tried renaming nfaStorage.bin1 and was hoping a new file would generate but it didn't.

Last night I flashed latest nightly 20190701 and noticed that NFC toggle was working, I also had a new nfaStorage.bin1 file generated so all was well but when I went to use Google Pay, NFC worked but Google Pay failed. I later checked and confirmed that Safteynet did fail since flashing 20190701.

I flashed Caesium Kernal which broke NFC giving me the issue where I can't turn it on.

Looks like my issue is specifically around Caesium, guessing that its not compatible with the NFC changes introduced as part of OOS PIE.

My question is, can anybody recommend a Kernal which will allow me to pass Safteynet but also support latest NFC changes? I understand that Franco Kernal doesn't have a new build for custom roms.

I am not too concerned about Kernal features, main requirement is to pass Safteynet :)
[OnePlus 3 & 3T Cross Device Development] Dirk:
Magisk with a relocked Bootloader isn't advised right now, but you can still do updates with it locked. (Manually at least).

If you use Magisk it just needs to be configured properly for Safetynet to pass. You shouldn't need anything else. Any custom Kernel by itself will pass Safetynet too. How do you have Magisk configured, particularly with regards to the 'Hide' features?
[OnePlus 3 & 3T Cross Device Development] :
Already answerd! A kernel working with nfc pie blobs needs this patch: https://github.com/LineageOS/androi...mmit/2a0205e5f875ed69f88338bf3021dea7cd605513

Otherwise nfc will not work.
[OnePlus 3 & 3T Cross Device Development] Viper The Ripper:
Franco has a version for custom Pie ROMs (fk-r45)... btw you can try madkernel or HDK
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Works fine after resigning the boot image with the VerifiedBootSigner-v8.01-aosp-key.zip (directly after flashing Magisk)

==> Boot to system ... BL locked.

My 9.0.4 fw is unmodified/unmodded ... oxygenos-9.0.4-firmware-3T.zip (credit: [MENTION=4405529]nvertigo67[/MENTION])
[OnePlus 3 & 3T Cross Device Development] morphvale:
Just to chip in, I've tried the attached boot signer, but on a different ROM and result was quite satisfactory.

I've not tried on LOS, as my banking app started blocking LOS by name, presumably.

What I did from stock OOS with locked BL was:

1. Reboot to fastboot, OEM unlock

2. Reboot to fastboot directly and install TWRP 3.3.1-0 official

3. Reboot to fastboot OEM lock

4. Reboot to TWRP, format data, reboot to TWRP

5. Install other ROM, install GAPPS, install Magisk, flash VerifiedBootSigner attached, reboot to system

6. Boot to ROM, go through setup process without logging in Google account to speed things up

7. Encrypt ROM. Now everything was still fine, ROM and TWRP are able to decrypt, no warning message on boot

8. As I had an old backup, I decided to restore it. So I restored only data, and flashed the disable-lockscreen-fingerprints

9. Reboot to system, made sure all was working. Reboot to TWRP, make sure all was working

10. Setup new fingerprints, did step 9 again, and now I am running other ROM with locked bootloader and encrypted data