[General Questions and Answers] iksw:
I may have missed something or misspelled something in this guide. Be warned that this may soft or hardbrick your phone. This guide is aimed at people with at least rudimentary experience of cmd/terminal use. Search the internet for answers to any bumps in the road, i wont be able to support you, but I aim towards keeping the guide updated if anyone notices any issues in the code or instructions.

Always keep a backup of important files. By rooting the phone it's possible to access the stock ROM and back up partitions from the phone. I'm in no way experienced with this. This is some of what I've come up with by experimenting on my own. I've had no other help than this forum, searching the internet and sheer trial-and-error.

So I've been experimenting and I've found a way to root this phone. The obvious reasons for rooting it beeing debloating and adding apt-x support, although the latter did not succeed as expected (only AptX, no HD in stock rom. In Lineage both LDAC and Apt-X HD worked). I've also been able to change to a language other than English or French, which was nice. I started experimenting with GSI-images and Lineage builds but i think the battery drain was insane, the outer display was unlit but always showed the T-mobilelogo, which i guess was part of the battery drain issue, the backlight of the keyboard was off etc.

I've found while experimenting with this post write-up that the --disable-verity --disable-verification may not be needed in the final setup, where you have a stock rom and a patched boot image. I'm not sure where, if at all it is i needed. I remember having some issues with booting, where the phone would get stuck at the bootlogo screen when verity and verification was not disabled in the vbmeta. If anyone knows or find anything out about this, let me know. I don't know if there are any implications of having verity and verification off anyway, the system is inherently insecure because of both a. old security updates and b. the unlocked bootloader and the root...

Observe that this all requires for your firmware to be pre version 29! I take no responsibility for data loss or bricking of the phone, and don't expect me to be able to assist you in any way.

Do a complete backup of everything you need from your phone if it has been in use. You will loose it all.

Download:

a. Get fastboot and adb and install it to your computer.

b. Magisk (where v26.x didn't show ramdisk yes, so i used 25.2) Magisk-v25.2.apk from https://github.com/topjohnwu/Magisk/releases/tag/v25.2. You may update Magisk to later versions (tested up until version 26.1) but i suggest you do this after everything else is done.

c. Create a folder somwhere on your computer and put your downloads there. Use that as a working directory while you do the following steps.

cd /path/to/downloads

Over the air update:

To get the OTA you have to have USB-debugging enabled and be able to trigger a download of the OTA. Execute this code:

adb logcat > ota.txt

then trigger the download.

Open the ota.txt and search for .zip. You should find a URL that you can copy, download to computer, unpack and then find a guide somwhere online on how to create .img's from dat.br files. You need all three (product, vendor and system) to restore stock firmware.

Flash magisk to the v29 boot image:

In the OTA-file downloaded above is a boot.img-file. Copy that to your phone by activating USB-debugging in Developer options.

1. Execute

adb push boot.img /storage/emulated/0/Download

2. Execute

adb install Magisk-v25.2.apk

3. Open Magisk on your phone

4. Press Install, then Select and Patch a File and find the boot.img you pushed to the Downloads directory in step 1. Press Let's Go and wait for the patch to apply.

5. Pull the patched boot.img to your computer. Find the name by executing

adb shell 'ls /storage/emulated/0/Download'

there will be a list of files present in your Downloads folder, one will be called magisk_patched-25200_*****.img. Copy that name, including the unique five-letter code before the .img-extension. Execute a pull to copy that file to your computer:

adb pull /storage/emulated/0/Download/<your unique magisk_patched-25200_*****.img>

6. Unlock the bootloader by either going into Developer options and enabling OEM unlock or simply by booting to fastboot: power off, press volume down and power at the same time, connect phone to computer and execute:

fastboot flashing unlock

Follow the instructions on the screen (select unlock with volume down and confirm with power-button).

7. You now have a rooted boot image, and if you want to update further to v30 (which i guess that i suggest) you may skip these next steps and go to the part of the guide for updating to v30. If you dont want to update to v30 (which is a hassle), you need to unlock the bootloader in Developer options and continue with steps 9 through 11.

9. Rename the magisk_patched-25200_*****.img to bootv29_magisk.img

10. Start the bootloader again by powering down, then pressing volume down and power on.

10. Execute

fastboot flash boot bootv29_magisk.img
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
fastboot reboot

10. Start up your phone, open magisk and complete the installation. You are now rooted on v29 and it is an entirely usable system. If you try to do the OTA update to v30 it will fail verification, but nothing other than that will happen. Disable notifications about Android updates and use your phone as you please.

Update to v30+root:

If you want to update the phone to v30 the process is definately more complicated. I've tried and succeeded but it was a hassle. First of all follow the steps above, they're crucial for the following steps to work.

Download a generic android system image with root preinstalled:

I prefer phhussons builds without Google (for faster first boot, since the start up wizard is absent). Say system-squeak-arm32_binder64-ab-vndklite-vanilla.img.xz from https://github.com/phhusson/treble_experimentations/releases/tag/v416 and unpack it.

1. Start a root shell through adb:

adb shell
su

You should after the su-command see a leading hash (#) in your terminal, instead of a dollar sign.

You will have to answer the prompt on your phone to allow root access for the shell.

2. Find your system, product and vendor partitions. I think there are two copies of each partition, where i guess one of each is "untouched" by the system and used for factory resetting. We want these untouched partitions and we can find them by looking at the output from our dumping of them.

To find the partitions do a listing of all partitions by executing:

ls /dev/block/ | grep dm

3. Make dumps of each one of these partitions by executing:

dd if=/dev/block/dm-<number> of=/storage/emulated/0/Download/dm-<number>.img

Look at the output (that looks something like this "278876160 bytes (266 M) copied, 32.372033 s, 8.2 M/s") and compare the number of bytes to this list:

system	1066520576
product	1221832704
vendor	283435008

Write down which dm-<number>.img that corresponds to each of those. You should have three different images each matching one of the numbers above. If the output of the dd of dm-0 is "283435008 bytes (270 M) copied, 24.344875 s, 11 M/s", that means dm-0 is the vendor partition, etc.

4. Dump vbmeta (and if you want to i recommend dumping modemst1 and modemst2, fsg and possibly some other that would be sad to loose (look up EFS backup). You can list the partitions with ls /dev/block/by-name.

dd if=/dev/block/by-name/vbmeta of=/storage/emulated/0/Download/vbmetav30.img

5. Exit the phone-shell:

exit # this will exit the root shell
exit # this will exit back to the computer shell

6. Execute this for each of the dm's dumped and identified as either system, product or vendor. Replace the number of the partition that you've dumped and replace the name with the corresponding partition name identified in the table in step 3. Repeat for each of the three images.

adb pull /storage/emulated/0/Download/dm-<number>.img <system/product/vendor>v30.img

Pull the vbmeta too (and any of the other partitions you dumped):

adb pull /storage/emulated/0/Download/vbmetav30.img

7. Reflash the v29 boot and v29 vbmeta by restarting your phone, putting it in fastboot-mode (volume down + power) and executing:

fastboot flash boot boot.img
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img

8. Wipe user data for a clean install:

fastboot -w

9. Restart to fastbootd-mode and flash the GSI downloaded before you started this whole guide:

fastboot reboot fastboot
fastboot delete-logical-partition product
fastboot erase system
fastboot flash system system-squeak-arm32_binder64-ab-vndklite-vanilla.img
fastboot reboot

10. Wait for the phone to restart. Then execute:

adb shell
su

This time there wont be any root access prompt because the root package is preinstalled with the gsi.

11. Dump the v30 boot.img

dd if=/dev/block/by-name/boot of=/storage/emulated/0/Download/bootv30.img

12. Pull the bootv30.img

exit
exit
pull /storage/emulated/0/bootv30.img

13. Reflash stock system (v30) but with the v29 Magisk patched boot.img and the v29 vbmeta (not sure if this matters as long as --disable-verity and --disable-verification is used:

fastboot flash boot bootv29_magisk.img
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
fastboot -w
fastboot reboot fastboot
fastboot flash system systemv30.img
fastboot flash vendor vendorv30.img
fastboot create-logical-partition product 1
fastboot flash product productv30.img
fastboot reboot

14. Go through the wizard, this time do the actual setup (Wi-Fi, Google account, say no to all the tracking and usage data-collecting).

15. Enable Developer mode and then enable USB-debugging. Install Magisk:

adb install Magisk-v25.2.apk

16. Push the bootv30.img to the phone:

adb push bootv30.img /storage/emulated/0/Download/bootv30.img

17. Open Magisk, select cancel when you're prompted for completion of the installation, press Install, then Select and Patch a File and find the bootv30.img you pushed to the Downloads directory in step 16. Press Let's Go and wait for the patch to apply.

18. Pull the patched bootv30.img to your computer. Once again, find the name by executing

adb shell 'ls /storage/emulated/0/Download'

there will be a list of files present in your Downloads folder, one will be called magisk_patched-25200_*****.img. Copy that name, including the unique five-letter code before the .img-extension. Execute a pull:

adb pull /storage/emulated/0/Download/<your unique magisk_patched-25200_*****.img>

19. Rename the magisk_patched-25200_*****.img to bootv30_magisk.img

20. Power down the phone, reboot to fastboot (volume down+power) and then execute:

fastboot flash boot bootv30_magisk.img

21. Power up, open magisk and complete the installation. I tried updating Magisk to 26.1 without an issue earlier, i think it's safe.

To reflash stock boot and stock system, choose either v29 or v30. Flash each file accordingly, I suggest a clean install with reflash of vbmeta and boot in fastboot, and then reflash of system, product, and vendor in fastbootd.

fastboot flash boot bootv30.img
fastboot flash vbmeta vbmeta30.img
fastboot reboot fastboot

fastboot flash system systemv30.img
fastboot flash product productv30.img
fastboot flash vendor vendorv30.img
fastboot flashing lock

I've tried reflashing and locking the bootloader with v30 install pulled according to the steps in this guide with success. Always backup your files before tampering with any of this obviously.