yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] CCloak:
You cannot do "adb disable-verity" without unlocking the bootloader first, locked bootloaders in production hardware do not normally accept such adb commands. And I believe the question is basically asking if it is still possible to get root without unlocking, and the very simple answer is no.

All current legitimate methods to get root access requires unlocking the bootloader as the first step, and that means userdata wipe, so backup phone before doing it. One thing didn't point out here, is that you can remain using the stock rom after unlocking the bootloader so just restore userdata thereafter, just expect some minor functions may not work correctly.

Relocking a bootloader (may not be possible on some phones) requires complete verify of stock rom, and root is a modification (albeit small) of the stock rom, root access cannot stay if one relocks the bootloader.

Note, my last experience of unlock and relock bootloaders was with the Nexus 5, so take the above with a grain of salt :D.
[General Questions and Answers] maintanosgr:
So the first step is done and bootloader is unlocked via the normal routes of the manufacturer of the phone.

I still don't see how the above instructions work.

However still the command adb disable-verity will fail

The commands may be overly simplified but still what's the next step after unlocking?

C:\adb>adb disable-verity

verity cannot be disabled/enabled - USER build
[General Questions and Answers] Skorpion96:
I should try also, I'm trying to get disabled the dm-verity, I'm on a zte phone (A5 2019) which not have a root method, I've made a twrp and trying to flash vbmeta custom to disable dm verity, I should try the commands but it's too simple, why every time you need an exploit to root if you can push the su binary to the system partition? I don't think is so simple.
[General Questions and Answers] JhinCuatro:
No. Your reply is relatively recent and utterly false. Unlocked bootloader is necessary for root, as modern day phones simply don't have universal or blatant security flaws that would allow modifying system partition/s without unlocked bootloader. An old phone with very old android MAYBE. But it's generally impossible or very difficult. Magisk is pretty much the only real root solution since it enables hiding that status and root* (via zygisk).
[General Questions and Answers] Kelexine:
Please what does this mean
[General Questions and Answers] WoKoschekk:
GitHub - tytydraco/LADB: A local ADB shell for Android!

A local ADB shell for Android! Contribute to tytydraco/LADB development by creating an account on GitHub.

github.com
[General Questions and Answers] Kelexine:
Ok thanks for the reference
[General Questions and Answers] seif.101:
Now how do I root without unlocking the bootloader then
[General Questions and Answers] Fooking Rekt:
Use an app like Kingroot
[General Questions and Answers] seif.101:
It's not safe every place on the internet says it's not safe
[General Questions and Answers] alecxs:
except for XDA

KingRoot Malware / Adware root !!

There has been a lot of discussion about this topic and opinions. But lets be clear about a few things that are facts: KingRoot now installs a ton of Adware on your device KingRoot takes over your lock screen now and splatters ads on it...

xdaforums.com
[General Questions and Answers] Fooking Rekt:
Kingroot ever since Android 6 has basically been malware because such root methods no longer exist.

But on older Android versions this works fine.
[General Questions and Answers] seif.101:
Idk can't risk it because if it turned out to be malware and bricked my phone no firmware for it exists anymore
[General Questions and Answers] Fooking Rekt:
Phones running Android 5 or older are practically valueless anyways, and you can reflash the stock rom very easily.
[General Questions and Answers] alecxs:
The proper way is to unlock bootloader first and then root your device. You can do this with mtkclient. If you want have root without unlocking, use official mtk-su (or try the unofficial one-click wrapper JunioJsv/mtk-easy-su)
[General Questions and Answers] BeardedPegasus2:
Here's my issue, I got given two older demo units from a friend who works at a cell shop one is an SM-G986U1 With Android ten, the second is a SM-A715X. neither has the option of oem unlocking or bootloader unlocking. Which is a shame, I was hoping to flash stock firmware and see about trying to fix/restore the IEMI number so they can be used, if not I still wanna root them just to **** around
[General Questions and Answers] Fooking Rekt:
Because they're American Snapdragon phones, they're not unlockable and not rootable. The only American Samsung phones that are rootable have Mediatek chips.

International Exynos and Snapdragon variants can be rooted just fine.
[General Questions and Answers] BeardedPegasus2:
From my research turns out the A75 is a FULL physical demo unit, eh I might just keep it for parts. The S20+ according to what I saw inside taking the back off to replace the battery apparently it is a SM-G986U1/B, not just a 986U. That B probably doesn't help much though. And when I turn it on after Disabling the Retail Demo mode the IEMI was 15 zeros and Null, but other than that it functioned like a normal phone.... Full power saving mode, could download third party APKs, turn of DEV options. Where the A75 couldn't do **** and reset itself after a couple minutes. And of course since I can't unlock the bootloader I can't even attempt to flash a different version of the firmware that I can Root on either of them.
[General Questions and Answers] Fooking Rekt:
U1, U are all locked US versions yes
[General Questions and Answers] BeardedPegasus2:
So my assuming the B didint make a different was right cool
[Android General] Meetoul:
How to install:

Unlock bootloader:

Boot your device into the official OS.

Go to Settings > About phone, tap the "build number" several times to enable developer settings.

Go to Settings > System > Developer Settings, enable OEM unlocking and ADB debugging.

Connect your phone to your PC and open a terminal or a command line window.

Run adb reboot bootloader on your PC (there is no way to enter bootloader directly, only possible through adb).

Once your device has finished booting run fastboot flashing unlock and comfirm unlock on device (THIS WILL WIPE ALL DATA!).

Run fastboot reboot to reboot your device and now you should see an unlocked warning during boot screen.

Disable AVB:

Download vbmeta.img from the latest release page of your device.

Connect your phone to your PC and open a terminal or a command line window.

Run adb reboot bootloader on your PC to put your device in bootloader mode.

Once your device has finished booting run fastboot flash --disable-verification --disable-verity vbmeta vbmeta.img

Then run fastboot flash --disable-verification --disable-verity vbmeta_system vbmeta.img

Also run fastboot flash --disable-verification --disable-verity vbmeta_vendor vbmeta.img

Flash recovery image:

Connect your phone to your PC and open a terminal or a command line window.

Run adb reboot bootloader on your PC to put your device in bootloader mode.

Once your device has finished booting run fastboot erase recovery. For some reason, image may be not actually flashed, even if fastboot reported success (at least over the stock recovery image), so in order make sure that the custom image is always flashed it's better to always erase the partition before flashing. After the erasing run fastboot flash recovery recovery.img

Run fastboot reboot and after the screen goes dark press volume up until you see the TWRP logo. Also you can type fastboot reboot recovery to boot to recovery mode immediately.

Please note that booting in stock ROM will bring stock recovery back.

This recovery image is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare an image based on EEA binaries.

Source code https://github.com/Meetoul/twrp_device_Unihertz_Jelly2
[Android General] TerAnYu:
Thanks!

This fantastic!

its work on EEA!
[Android General] Die Bruine:
I just received my Jelly 2. It was on 2020 and I went straight through your files. Your TWRP does not respond on my European Jelly 2. Meaning, the touch screen does not respond. But I connected an USB trackball and switched in between adb sideloads. So I finally got it working.

For some reason during reboot TWRP warns me that there is no OS installed. But LoS 18.1 (yours) booted fine. Also flashed opengapps 2707 nano.

After a reboot (phone is still restoring apps) there is a "serial console is enabled" message "performance is impacted, check bootloader". Any instructions on how to get rid of that?.
[Android General] kkazakov13:
I cannot seem to mount system as R/W with GSI image from https://github.com/phhusson/treble_experimentations/releases from within TWRP. I guess that's a more general problem, though :(

Any ideas?
[Android General] Die Bruine:
Dave you tried the latest release a suggested by Meetoul?

https://xdaforums.com/t/rom-unofficial-lineage-os-17-1-unihertz-jelly-2.4281501/post-85371763

Release Fix gt1151qm touch in recovery · Meetoul/twrp_device_Unihertz_Jelly2_TEE

Recovery image based on new kernel image with patches for both gt1x and gt1151qm touch panel drivers.

github.com
[Android General] karoooo:
Great Job!

I have Jelly2_JP.

I tried your recovery.img for Jelly2_TEE.

It can boot my Jelly2_JP, and it can enable adb shell, but it looped the splash screen.

But I execute following command in adb shell, twrp starts gui("Keep System Read only?" screen)

Jelly2_TEE:/ # mount -o ro /dev/block/mapper/system /

Touchscreen works fine.

Next, I tried to build twrp for Jelly2_JP using your device tree.

But it has same problem. (It looped the splash screen until I mount system partition.)

Do you have any advice?

Attachments

recovery_tee.log is pulled file from /tmp/recovery.log in your twrp for Jelly2_TEE. Line 1119 is after I mount system partition by adb shell.

recovery_jp.log is pulled file from /tmp/recovery.log in my twrp for Jelly2_JP. Line 1356 is after I mount system partition by adb shell.

My build instructions

$ cd ~/twrp

$ repo init -u https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git -b twrp-10.0

$ vi .repo/local_manifests/roomservice.xml

$ repo sync --force-sync

$ cd device/Unihertz

$ cp -r Jelly2_TEE Jelly2_JP

$ cd Jelly2_JP

$ mv omni_Jelly2_TEE.mk omni_Jelly2_JP.mk

$ grep -l Jelly2_TEE * | xargs sed -i 's/Jelly2_TEE/Jelly2_JP/g'

$ grep -l g55v71c2k_dfl_tee * | xargs sed -i 's/g55v71c2k_dfl_tee/g55v71c2k_dfl_jp_felica/g'

$ ./extract-files.sh ~/stock_jp/extracted

$ unpack_bootimg --boot_img ~/stock_jp/recovery.img --out ~/stock_jp/recovery

$ cp ~/stock_jp/recovery/kernel prebuilt/Image.gz

$ cp ~/stock_jp/recovery/dtb prebuilt/dtb/mt6771.dtb

$ cp ~/stock_jp/recovery/recovery_dtbo prebuilt/dtbo.img

$ cd ~/twrp

$ source build/envsetup.sh

$ lunch omni_Jelly2_JP-eng

$ mka recoveryimage

$ ls out/target/product/Jelly2_JP/recovery/root/vendor

bin etc

$ cp -r vendor/Unihertz/Jelly2_JP/proprietary/reovery/root/vendor out/target/product/Jelly2_JP/recovery/root

$ mka recoveryimage
[Android General] karoooo:
file upload again.

Sorry, I can't upload Attach files.

I clicked "Attach files" button and choose file.

I clicked "Save" button, but file link did not inserted.

I uploaded recovery.log to github.
[Android General] Three knife:
How to get vbmeta.img
[Android General] karoooo:
Direct Link

Google Drive: Sign-in

Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).

drive.google.com

See Also

https://xdaforums.com/t/jelly-2-firmware-made-available-by-unihertz.4200193/

Or

https://xdaforums.com/t/howto-flash-a-blank-vbmeta.4136509/
[Android General] karoooo:
I'm sorry for the continuous posting.

I solved the decryption by modifying omni_Jelly2_JP.mk as follows.

PRODUCT_NAME := omni_Jelly2_JP
PRODUCT_DEVICE := Jelly2_JP
PRODUCT_MODEL := Jelly2_JP
PRODUCT_BOARD := g55v71c2k_dfl_jp_felica
BUILD_FINGERPRINT := "Unihertz/Jelly2_JP/Jelly2_JP:10/QP1A.190711.020/root.20210422.092852:user/release-keys"
PRODUCT_BUILD_PROP_OVERRIDES += \
TARGET_DEVICE=Jelly2_JP \
PRODUCT_NAME=Jelly2_JP \
PRIVATE_BUILD_DESC="Jelly2-user 10 QP1A.190711.020 root.20210422.092852 release-keys"

My mistake was that I only replaced "Jelly2_TEE" with "Jelly2_JP".

I had to replace "Jelly2" with "Jelly2_JP".

Anyway, now I can display the decryption screen.

Next, I tried HOW-TO-PATCH.md.

However, the touch screen does not respond on the patched kernel.

$ head -n 1 symbl_tee.txt
ffffff81dd680800 T do_undefinstr

$ grep get_boot_mode symbl_tee.txt
ffffff81ddda5b30 T get_boot_mode

$ zcat twrp/device/Unihertz/Jelly2_TEE/prebuilt/Image.gz > Image
$ aarch64-linux-android-objdump -D -b binary -m aarch64 --adjust-vma=0xffffff81dd680000 --start-address=0xffffff81ddda5b30 Image| head
ffffff81ddda5b30: d0009cc8 adrp x8, 0xffffff81df13f000
ffffff81ddda5b34: b947ad09 ldr w9, [x8,#1964]
ffffff81ddda5b38: 7100093f cmp w9, #0x2

I think you are using a different technique to enable the touch screen, because "cmp w9, #0x2" is not patched to "cmp w9, #0x0".

Please teach me your technique after you are not busy with work.
[Android General] Three knife:
谢谢你,我用的是中国的没有Google Play的版本,按照你的步骤成功了,不过在安装完recovery.img之后,内部存储有可能无法写入,需要在recovery里删除data分区,然后就可以了
[Android General] zxczxc4:
Thanks for this!

I flashed this TWRP, then installed AOSP 11, v313 of this GSI: https://github.com/phhusson/treble_experimentations/releases/tag/v313

Things seem good, except:

the battery seems to drain a little quickly

no IR blaster (ZaZa remote does not recognize it)

TWRP cannot decrypt the phone's contents, so I cannot flash gapps.

Is TWRP not able to decrypt because I'm using Android 11 and the TWRP was built for 10?
[Android General] Meetoul:
@karoooo

Sorry for not responding to you, for some reason email notifications from XDA were stopped. Please tell me if you still need patched kernel, I will try to patch it explain you the technique.
[Android General] Meetoul:
Actually, data decryption on MTK SoCs is very painful thing. I'm still waiting for stable release of Android 11 from Unihertz, but they are in no hurry...

I know that beta 11 available. Unfortunately, I was not able to update using the official way. The bootloader was locked and the moment of updating, but probably the reason is that it was unlocked before (it possible to relock bootloader using SP Flash Tool). But I manager to fetch zip update package and install it via TWRP :) After that I even managed to make package for SP Flash Tool based on this package, so I can to flash pure FW without updating and have locked bootloader!

UPD. I see that Unihertz have published Android 11 SW package for SP Flash Tool on their Google Drive! Soon I will try to make recovery based on this package.
[Android General] karoooo:
@Meetoul

Thank you for your response.

Yes, yes, yes!

I want to know your technique.

Best Regards.
[Android General] kendzhi:
HI.

Summary: FRONT CAMERA not working after Bootloader Unlock

I am using Jelly2_JP (on latest Android 10) and I was wondering,

has anyone has experinced the Front Camera not working after Bootloader Unlock, and possibly the three " --disable-verification --disable-verity" commands?

The stock camera app won't recognize the front camera (not front/back switch button where there should be one), and other apps cant use the front camera either.

I can confirm that the front camera worked before unlocking the bootloader.

Reflashing stock image using SP Flash Tool and relocking Bootlader did not fix the issue.

Is anyone else experiencing the same issue?
[Android General] Meetoul:
Since Unihertz has released Android 11, I think that there is no sense to work on patching the old kernel.

Btw, now I'm working on TWRP based on Android 11 binaries from the latest FW, but no luck so far, it seems that kernel doesn't even start to boot...
[Android General] karoooo:
@Meetoul

I wanted to learn your technique so that I could work on my own when Android 11 was released.

If Android 11 is formidable, prioritize working with Android 11.

Unfortunately, Android 11 for Jelly2_JP has not been released yet.

@kendzhi

I unlocked the bootloader with Jelly2_JP, but the front camera is still working.
[Android General] kendzhi:
@karoooo

Thank you for the reply!

May I ask, was your Jelly2_JP shipped before the latest Andorid 10 update (2021051912_g55v71c2k_dfl_jp_felica), meaning did your phone come with the previous Firmware (2020101915_g55v71c2k_dfl_jp_felica)?

I have two Jelly2_JP from Japan which came preshipped with the latest andorid Andorid 10 update (there was no need for OTA update). And in both phones, upon executing "fastboot flashing unlock" (without disableling AVB & without Rooting), the the front camera stopped working (not recognized by the system).

I even went into the Debug/Diagnostic? mode that was in Chinese (Booting by Vol down + Connecting to PC via USB), and peformed a hardware test for the Front Camera and the test froze the phone.

So I'm suspecting that Jelly2_JP that was shipped to Japan with the latest Firmware has some issues with Bootloader Unlocking breaking the Front Cam...
[Android General] Meetoul:
@karoooo

Actually, what I did is patched "cmp w9, #0x2" to "cmp w9, #0x0". Also, since there are different touch panels with different drivers, tpd_i2c_probe function may be defined multiple times in kernel, so may need to patch several functions. In my case it was 2 drivers, so I patches kernel in 2 places.

Could you please provide symbl.txt collected from your device on JP kernel, so I can find addresses of tpd_i2c_probe functions and try to patch the kernel?

I flashed JP FW and tried to collect it by myself, but my TEE Jelly is not booting after patching boot.img for root access....
[Android General] karoooo:
@Meetoul

Thank you for teaching me your technique!

I've patched "get_boot_mode" in the past, but it failed.

Today I patched "tpd_i2c_probe" and it was successful.

There were also two tpd_i2c_probe in symbl.txt of Jelly2_JP.

$ grep tpd_i2c_probe symbl.txt
ffffff9ee8a5e150 t tpd_i2c_probe
ffffff9ee8a663b4 t tpd_i2c_probe

When Android 11 for Jelly2_JP is released, I will try this method and report it.

@kendzhi

I got Jelly2_JP from Kickstarter.

Therefore, my Jelly2_JP was shipped before the latest Andorid 10 update.
[Android General] Meetoul:
@karoooo

I hope you will be able to boot recovery on based on Android 11 binaries :)

Because currently it seems quite a challenge for me.
[Android General] karoooo:
@Meetoul

As the Android version goes up, the restrictions become more stringent.

If it's difficult for my teacher, it means it's more difficult for me.

Even if it doesn't work on Android 11, a successful experience on Android 10 is my property.

The good news is that TWRP 3.6.0 has been released!

TWRP 3.6.0 released with support for devices that launched with Android 11

TWRP 3.6.0 is here, and it finally brings support for Android 11. The new release also improves the installation process. Check it out!

www.xda-developers.com
[Android General] Meetoul:
Hi guys,

Sorry for no updates for a long time, but still no good news...

It seems that something is really changed either in Unihertz binaries or in Android 11 recovery. I tried dozens of parameters combinations in BoardConfig.mk, but still no luck. If some of you guys have successful experience with running Android 11 based recovery on MT6771 or saw corresponding device tree, please share this sacred knowledge.

Btw, I used Jelly 2 with stock Android 11 and it worked like a charm for me. There are some bloat crap in firmware, but there is no problem to debloat stock FW via ADB.
[Android General] JoachimO:
Hi Meetoul,

bad news but thx for your work. I use your Android 11 beta Version.

How can I flash the original Version? Can I use the zip File from Unihertz with your TWRP?

thx
[Android General] Meetoul:
@JoachimO

You can flash official SW from Unihertz https://drive.google.com/drive/fold...ourcekey=0-KHJPIYVPw2iHL--cceWyaw&usp=sharing using SP FlashTool.

Unihertz recommends to use their version of SP Flash Tool, but I just used the latest version of tool from official website and it was OK.
[Android General] JoachimO:
OK thx, I will try :)
[Android General] Gon112:
There is progress with twrp for android 11, very much waiting, I am still using with Android 10 just because it has twrp, and I have partition backup and install zip and img
[Android General] Meetoul:
Sorry guys, but there will be no updates from me...

My father liked the Jelly2 so much, so I presented it to him. But if some are working on the recovery or custom ROM for Jelly2 I'm ready to help in any possible way.
[Android General] Die Bruine:
Thank you for the in between time. Glad I jumped to official 11!
[Android General] DocMAX:
There are some MediaTek TWRP "porters" out there. Maybe they work?
[Android General] Melkor3era:
Hello. Thanks for the guide. I cannot get twrp working on my jelly2 , if i flash it to recovery an try to load it, my phone reboots again and again without entering the recovery, the only thing i can do is to us spflash to restore original recovery. i am using android 11 but is the same with android 10, could you help me?
[Android General] DocMAX:
11 and 10 is not the same. You need 10 to make it work. Doesn't work with 11.
[Android General] Melkor3era:
Thank you for your reply! Why it works only with 10? Please could tell me where i can get twrp img for European jelly 2?
[Android General] DocMAX:
You can use this TWRP here. It works with EU too.
[Android General] Melkor3era:
Thank you! Where could i downlaod a working with the twrp version of European android 10 for this phone?
[Android General] Melkor3era:
hello. just flashed android 10, flashed twrp i got in this thread, but endless bootloop, what could i do?

ok i just reflashed via spflashtool the stock recovery and now it boots but a red watermark appeared on the screen it says

TEE: chinese words

Google : chinese words
[Android General] Melkor3era:
hello. I successfully installed twrp but i cannot access /data to make backup ( that is the only reason i need twrp) i think is for data encryption, i tried flash disable verity opt encryption zip than format /data but still phone encrypted, any tip? thank you
[Android General] DocMAX:
I can confirm TWRP is almost useless for backup on Jelly2. How can we push TWRP development on Jelly2? (Mabye version 3.6.x?)
[Android General] karoooo:
Hi, Jelly2_JP has been updated to android 11.

So I tried to build TWRP for android 11.

However, my PC was too poor and the PC went down during the build.

(This is the PC which I built TWRP for android 10.)

Is the option -j used incorrectly?

My build operation

$ cd ~/twrp11

$ repo init -u https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git -b twrp-11

fatal: couldn't find remote ref refs/heads/twrp-11

$ repo init -u https://github.com/minimal-manifest-twrp/platform_manifest_twrp_aosp.git -b twrp-11

$ repo sync --force-sync

$ cp -r ~/twrp10/device/Unihertz ~/twrp11/device

$ vi device/Unihertz/Jelly2_JP/omni_Jelly2_JP.mk

$(call inherit-product, vendor/twrp/config/common.mk)

#$(call inherit-product, vendor/omni/config/common.mk)

#$(call inherit-product, vendor/omni/config/gsm.mk)

$ export ALLOW_MISSING_DEPENDENCIES=true

$ . build/envsetup.sh

$ lunch omni_Jelly2_JP-eng

$ mka -j 1 recoveryimage

************************************************************

You are building on a machine with 7.38GB of RAM

The minimum required amount of free memory is around 16GB,

and even with that, some configurations may not work.

If you run into segfaults or other errors, try reducing your

-j value.

************************************************************