yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] RunnyYolk:
I tried the loader that @formeriphoneuser suggested, but with a similar result. (https://pastebin.com/ucMkEkeW). I also tried with the flag --memory="ufs" in case the device has UFS memory, but similar result.

But the good new is, I've just discovered a reliable way to avoid the boot loop after leaving EDL mode. So to leave EDL mode, make sure any running commands have ended, unplug the device from the computer, and press and hold the eink button (on the left of the phone), volume-up, and power button. Keep them all pressed until the first vibration (after about 15 seconds or so, then release the power button only). Keep the other two pressed while the phone boots, and even while you're entering your 6 digit pin code. When you see the main screen you can release the buttons and your phone shouldn't enter the boot loop. I have no idea how much of that is necessary, but something in there works for me.

I've added an Issue to the github repo for the EDL tool I'm using. Other than that, I think I've hit a brick wall and won't be able to do any more for now. Unless anyone knows how to check that the firehose file is correct for my device, and update it if it's not. Hopefully Hisense will release the stock firmware, or send us an OTA update or something.
[Android Q&A, Help & Troubleshooting] Arthurliao:
Does this work? if the Bootloader could be unlocked.
[Android Q&A, Help & Troubleshooting] matteqa:
The problem with a GSI is that Android doesn't have partial refresh support for the eInk display, which means a driver has to be written from scratch, otherwise the display will be verrrrrry slow.
[Android Q&A, Help & Troubleshooting] matteqa:
Bit of a long shot here, but I vaguely remember having trouble with EDL on my Oneplus 6T and I think the solution was to use a USB2 port instead of USB3.
[Android Q&A, Help & Troubleshooting] matteqa:
Also, looking at your pastebins, It seems you are running Ubuntu via a Parallels Virtual Machine. I would suggest using the LiveDVD from the EDL github repo and running it on bare metal to rule out any system related issues. Given that the pastebins show errors relating to libusb1.py, there is a good chance your issues are due to the emulated USB controller provided by Parallels.
[Android Q&A, Help & Troubleshooting] RunnyYolk:
I tried booting the liveDVD from the repo in Parallels, but it wouldn't boot, saying something like Ubuntu was missing. But I'll try it as a bootable USD drive. I won't be able to do it until next weekend at the earliest, but I'll report back when I've tried that method. Thanks for your suggestions!
[Android Q&A, Help & Troubleshooting] RunnyYolk:
So I bought a USB drive and flashed the liveDVD from the repo to it, but my only computers are Macs and will recognise the USB drive as bootable - I've tried Fat32 / HFS+ file systems, made sure it's a GUID partition table, and used both Etcher GUI and terminal's `dd` to burn the image to the drive, but still the USB never shows up in the startup utility. Anyway, I've hit a roadblock on this for now - I think my next options are to either pick up a cheap Windows laptop, or put a bounty out for boot.img (or preferably full root! :) )
[Android Q&A, Help & Troubleshooting] matteqa:
Just checking, have you tried the macOS version of the EDL tool? All of your pastebins are from ubuntu parallels, however there is also a native macOS version in the github repo.
[Android Q&A, Help & Troubleshooting] RunnyYolk:
Ah, that's a good call! I did try the native Mac version on one machine, but it wasn't able to find libusb library, so I started using parallels / ubuntu, and then basically forgot that the native mac version existed! So thanks for the reminder :) - I tried it yesterday on an older Mac, and the native EDL client seems to be working properly. Unfortunately I think the firehose / loader files I have aren't correct. When I ran it with a loader I get sahara - [LIB]: Unexpected error on uploading, maybe signature of loader wasn't accepted ?
type object 'req' has no attribute 'image_id', and then I tried running it without any loader and got sahara - [LIB]: Couldn't find a loader for given hwid and pkhash (0014d0e100430000_56d3f3c74a52172b_[FHPRG/ENPRG].bin) :(.

So I guess we need the correct loader for the A9. I'm pretty clueless about how these files come to exist in the first place (do they have to come from the manufacturer, or can we build them ourselves?), but anyway I'll open a new issue on Github and see if the developer of the client can help.

For completeness' sake, here are logs from each attempt at reading boot_a (I tried three different loaders, each one with and without --skipresponse, and then once with no loader).

https://pastebin.com/AA9d5Tdh

https://pastebin.com/gXHS9pYN

https://pastebin.com/6e5FeWDc

https://pastebin.com/8dGWFNau

https://pastebin.com/iTd8ZsVH

https://pastebin.com/2esPvxyX

https://pastebin.com/Pvz9YxfE

https://pastebin.com/D47mPKt6

*edit* This is the issue on Github: https://github.com/bkerler/edl/issues/303
[Android Q&A, Help & Troubleshooting] matteqa:
Have you tried to read from "boot" instead of "boot_a". Maybe hisense isn't using A/B partitions since they don't care about google play certification. Also, have you tried using --memory=ufs.

Otherwise, it may be that the loader has a custom signature. As far as I know, the loader is proprietary and you have to get it from the manufacturer.
[Android Q&A, Help & Troubleshooting] matteqa:
@RunnyYolk

I've also just found a patched version of a SDM662 loader on another forum that might work.

I've reuploaded it here: https://cloud.matteqa.com/index.php/s/M6MxgPFDsYwaKP6
[Android Q&A, Help & Troubleshooting] RunnyYolk:
Thanks! I tried this loader, and also the --memory=ufs flag / "boot" alternatives as you suggested, but had the same errors as before. I'm pretty sure I saw boot_a and boot_b directories somewhere when I was exploring the filesystem in adb shell, but I'll double check again when I have time.

Are there any other avenues I could try to root this device? I wonder if there's any point trying to boot TWRP from an A7? Am I right in thinking I can `fastboot boot recover.img` without risk of bricking the phone? (Ie just booting rather than flashing.)... Maybe I'm clutching at straws...
[Android Q&A, Help & Troubleshooting] RunnyYolk:
I tried to unlock the boot loader today, but get an error:

platform-tools % ./fastboot flashing unlock
FAILED (remote: 'Unlock is not allowed!')

This is after triple-checking that OEM unlocking is turned on in the developer options (I also tried './fastboot oem unlock' but it's an unknown command). Is there another way to unlock the boot loader?

Even with the boot loader unlocked AFAIK we're still stuck without access to recovery.img or boot.img.

During my digging today I came across another fastboot command to get all the variable values, ./fastboot getvar all. Nothing particularly interesting in here, but here are the results just in case they're useful in the future:

(base) nick@Nicks-MacBook-Air platform-tools % ./fastboot getvar all(bootloade - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

(base) nick@Nicks-MacBook-Air platform-tools % ./fastboot getvar all(bootloade - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

One of these pastebins is from resetting the phone into fastboot mode, and the other is from rebooting from fastboot into the bootloader. Not really sure what the difference between these modes is– they both accept `./fastboot` commands...?
[Android Q&A, Help & Troubleshooting] RunnyYolk:
Me again 😆. I've been messing around with the phone quite a lot over the last few days, and have tried everything I can think of to get the phone to work well as a daily driver. Still no closer to root, but I've got it to a pretty good place by installing MicroG following this guide. I didn't try this before because the ROM doesn't support signature spoofing so I thought it would be pointless, but actually MicroG is pretty helpful regardless. Most non-Google apps work natively now (ie, without the 2accounts workaround) without complaining about missing Google Services, but Google apps, like Maps and Books won't log in, so for those apps I'm still using a 2accounts work around (or, for Maps, just use it without logging in). Actually I don't use 2accounts now, but instead I use F1 VM, which is basically an Android 7 virtual machine – much simpler than 2accounts. But the principle is the same.

To get push notifications to work I did have to follow this solution, after which I started getting the notifications coming in - just make sure you enable notifications in the system settings for each app! I don't know why they're disabled by default, but they always are with this ROM. Other people have said that MicroG's push notifications are inconsistent, so I'll see how it goes over the next few days.

The most obvious issue with MicroG is when you add your Google Account: everything seems to go smoothly but then when you try to authenticate a Google app, it fails. Firstly, it doesn't offer you the account you added, and when you go to add your account it says "this account has already been added to the device" (or something similar). So there's no way to use actual Google apps natively. This isn't a dealbreaker for me since most of my apps are third-party, and I'm happy to use things like Spark instead of Gmail. Still, it would be nice.

And, related to this, when I go into system settings -> accounts, and try to access my Google account, it crashes and sends my back to the previous screen. I guess this is all the same issue, so if it could be resolved then I'd probably be able to use Google apps natively. There are also still some non-Google apps which won't work with MicroG, but for those apps F1VM is good enough.

But overall the experience is much better - close to perfect: push notifications; non-Google apps recognising my Google account, authenticating and syncing data; apps detecting SMS verification codes and auto-filling them; banking apps giving me 'approve this transaction' notifications, etc, all natively. But like I say, there's still a need for 2accounts or F1VM.

Anyway, I hope this can help someone get a better experience with the phone. I'd still love to find a way to root it, but I've run out of things to try.
[Android Q&A, Help & Troubleshooting] Arthurliao:
Unlocking the Bootloader of A9 is not allowed, replied by the Hisense's technical support.
[Android Q&A, Help & Troubleshooting] formeriphoneuser:
Maybe someone could check Chinese forums to see if they can find an unlock code or something.
[Android Q&A, Help & Troubleshooting] 江湖悠悠:
Few Chinese use this phone also ，there is no much information about root in Chinese forums。
[Android Q&A, Help & Troubleshooting] RunnyYolk:
Someone has offered a reward for rooting the Hisense A9 - they're offering 0.25ETH, and I've said I'll add another 0.25ETH for a successful root.
[Android Q&A, Help & Troubleshooting] Renate:
I don't get much sense exactly what progress has been made.

I love Eink, but I don't own one of these.

Have you tried my native Windows EDL client on a real Windows machine?

It's in the sig, along with documentation.
[Android Q&A, Help & Troubleshooting] Renate:
What? Nobody could be bothered to try my suggestion in #27?
[Android Q&A, Help & Troubleshooting] xecution819:
Mine just showed up yesterday.

Using the edl.exe, Zadig to force driver WinUSB v6.1.7600.16358, and attempting to use the qualcomm default loader: https://github.com/bkerler/Loaders/...2/0014d0e100000000_d40eee56f3194665_FHPRG.bin

I get an error when running

./edl.exe /n /l0014d0e100000000_d40eee56f3194665_FHPRG.bin

This says to me that either this loader image isn't compatible with HiSense's implementation, or I've missed another flag needed (I did try /n)

I'm very new to this aspect of rooting, but I'm game for learning/trying anything to move the ball forward on this.
[Android Q&A, Help & Troubleshooting] Renate:
Thanks for trying.

The /m, /n, /u flags don't make a difference until you're actually dealing with memory in Firehose mode.

I would guess that because it's not using a default factory loader you'll have to wait until there's a leak?

Here's another 662 loader, try this.
[Android Q&A, Help & Troubleshooting] xecution819:
I get the same outcome with that loader.

Would the OTA updates for the phone contain a raw image that could be dissected?
[Android Q&A, Help & Troubleshooting] Renate:
Sure, if the boot image is in there.
[Android Q&A, Help & Troubleshooting] xecution819:
The release date of the A9 and the patching of the dirtypipe exploit are pretty close together. My device updated when I first got it, but I wonder if it's vulnerable with the shipped version. I couldn't get it to work on latest.

Does anyone know if there's a standard way to reset back to original OS? A factory reset keeps the version and just clears everything.
[Android Q&A, Help & Troubleshooting] RunnyYolk:
Oh, I didn't realise this thread was still alive (I thought I'd have been getting notifications from xda). Sorry I missed your post about trying on a Windows machine @Renate - I don't have one unfortunately, but it seems like @xecution819 has ruled that out for now any way.

I don't know of any way to get back to the original OS. Happy to start trying new things if anyone has more ideas.
[Android Q&A, Help & Troubleshooting] tommyrockr:
Love that all you guys are out there doing your magic. Have an A9 and ADHD. Would love to use it as my primary phone, but the lack of push notifications from Google

Play services is a deal breaker. Anyone with any open clues on how to crack this puppy open and have a usable OS running?
[Android Q&A, Help & Troubleshooting] biodecus:
I just came across this forum/thread via a Google search. I'm a software engineer, but with no experience with rooting phones. Can anyone point to any good resources to learn more about how to help with the process? Don't know how useful I can be compared to the more experienced people here, but as the A9 is such a niche device I imagine every little helps.
[Android Q&A, Help & Troubleshooting] aa13q:
I didn't managed to find an appropriate file, while the OTA hosting is similar to Hisense A5 (https://xdaforums.com/t/hisense-a5-pro-cc-how-to-root-unlock-bootloader.4109021/post-86496137)

For the small update L2037.6.07.03.00 here's the link: https://download-ota-phone.hismarttv.com/Content/DeviceVersionFile/166685861913600254.zip

(it looks like ro.hmct.ota.servicedomain=bas.phone.hismarttv.com but I'm not sure how to use it; http://bas.phone.hismarttv.com/upgrade/detect_version requires special post requests)
[Android Q&A, Help & Troubleshooting] aa13q:
with stupid trials I've found this incremental updates and dates:

2022-06-23: http://download-ota-phone.hismarttv.com/Content/DeviceVersionFile/165577470555800085.zip

2022-08-31: http://download-ota-phone.hismarttv.com/Content/DeviceVersionFile/166182853508900801.zip

2022-11-14: http://download-ota-phone.hismarttv.com/Content/DeviceVersionFile/166685861913600254.zip
[Android Q&A, Help & Troubleshooting] Renate:
I looked at that last file. It is incremental and not enough to do anything with.

Too bad that it's not like Onyx which loves to send out 1.5 GB "updates".
[Android Q&A, Help & Troubleshooting] xecution819:
So the first thirteen digits of the filename look like a unix timestamp in miliseconds, and then there are 5 digits on the end of some build increment value perhaps, or other form of uniqueness.

Out of curiosity, how did you unpack those .img files? I tried a tool that wouldn't work on partial files.

I'm interested in peeling them apart and seeing if there are any clues anywhere about specialized commands to unlock the bootloader or other functions.

I want to brute force their share and try to grab all zip files, but the ways I can think to do it would take a year+ to exhaustively try file combinations.
[Android Q&A, Help & Troubleshooting] RunnyYolk:
For anyone using the 2accounts or F1 workaround, I installed GBox yesterday and it's easily the best workaround for now: https://www.gboxlab.com/ - it's still a virtual environment, but it loads apps quickly and seems to pass notifications through more reliably. It also does things like letting apps automatically ready SMS auth codes, which never worked for me with 2accounts or F1. I can't get Google Assistant working still, but everything else I've tried works beautifully. I think this is as close to a native experience as we'll get until the phone is rooted.
[Android Q&A, Help & Troubleshooting] aa13q:
yet another small incremental ota:

2023-01-12: http://download-ota-phone.hismarttv.com/Content/DeviceVersionFile/167283129480000321.zip
[Android Q&A, Help & Troubleshooting] zhelan:
Maybe you guys could try with Chimera tool, this site says that they support Hisense with with this chipset Qualcomm Snapdragon 662 (SM_KAMORTA_H), which is exactly the one we find on the Hisense A9.

Below is the link :

Qualcomm Snapdragon 662 (SM_KAMORTA_H) 0014D0E1 - a supported Qualcomm model by ChimeraTool

Supported features of Qualcomm Snapdragon 662 (SM_KAMORTA_H) 0014D0E1 by ChimeraTool: Backup phone, Factory reset, FRP Remove, Update Firmware, Root.

chimeratool.com
[Android Q&A, Help & Troubleshooting] kudiep:
i have boot.img and vbmeta in stock rom, but i can not unlock bootloader. everyone have idea else?
[Android Q&A, Help & Troubleshooting] deny-bas-dns:
Is the bootloader unlock toggle in developer settings useful?

EDIT: Looks like the other thread here is more active, probably better to post there instead: https://xdaforums.com/t/hisense-a9-root-reward-offered-snapdragon-662.4495809/
[Android Q&A, Help & Troubleshooting] xecution819:
For anyone who hasn't seen:

https://xdaforums.com/t/hisense-a9-root-reward-offered-snapdragon-662.4495809/post-88983317
[OnePlus 10 Pro] Hakemblue:
I tried about 10 or more methodes and got confused alot

How to get rid of that driver installation on thr startup of viper4android

I think that i need to put audio_effect.xml to vendor/etc

Bur there to get that file and how to past in there, ... Or maybe you managed to get viper4android workong on onepöus 10??!
[OnePlus 10 Pro] toolhas4degrees:
It's selinux permissive needs to be toggled on to work from what I remember

https://xdaforums.com/t/app-root-4-2-selinuxmodechanger-v10-0-24-07-2017.2524485/
[OnePlus 10 Pro] HessNL:
Doesn't work i have tried everything because the changed the locations and the XML file should make it to work but if you change the locations in the file they say it works but i didn't get it to work best leave it like this you can download the new app of viper4android you can get it from the play stor called wavelet
[OnePlus 10 Pro] Bartx96:
I have these same problem on my Pixel 6 Perfect working but on op10 always need to install driver :/ when i use selinux mode changer my phone pass safety net ?
[Samsung Galaxy S22 Ultra] K0mraid3:
Here's where I'm at. I've got the system to give me the Mount /System option in recovery, now i just need assistance getting the build.prop pulled to my PC. What's the procedure for pulling the build.prop from the Android to PC via ADB while the system is mounted in recovery? Why am I getting one of these two ADB errors?

Error 1: Connect failed: closed.

error 2: Failed to get feature set: no devices or emulators

OR, am I approaching it wrong?

Thanks in advance,

K0mraid3
[Samsung Galaxy S22 Ultra] gav83collins:
you dont need to be in recovery to do it via adb....

adb pull /system/build.prop

that will pull it to where evr you run the adb command

which would be

C;\adb more than likely

or you can choose a destination with

adb pull /system/build.prop c:\buildprop

if you create a folder called "buildprop" in the root directory of c:\

at least thats how i remember doing it many years ago, ive been away for a while at her majesties pleasure, so i cant try it currently as im not rooted
[Samsung Galaxy S22 Ultra] K0mraid3:
Thanks, so far, its still for some reason denying me permission when OS is booted. So i just cant quite figure out where im supposed to execute these commands, is my issue. I can boot directly to BL from recovery menu, but i can also mount system. i think maybe i need sto send command for r/w.. will try that now.
[Samsung Galaxy S22 Ultra] K0mraid3:
Another question, when i mount /system in recovery, does that carry over on boot?
[Samsung Galaxy S22 Ultra] gav83collins:
no you can re mount system via adb though

$ adb shell
$ su
# mount -o rw,remount /system
[Samsung Galaxy S22 Ultra] dr.ketan:
1.Needs root for this command. If he have rooted device then why so much trouble needed. Simply use root explorer to copy

2.Since long Samsung have removed system from proc/mounts still magisk system_root can be used

3.Even with system in mounts you can't do system rw on S22 because of Samsung have implemented extra layer of protection. Even not with magisk system_root too

Indeed as of now there is no method available to make stock system/vendor/product/odm rw on S22 even with root access.

4.To copy file from system rw mount not needed, ro is fine
[Samsung Galaxy S22 Ultra] gav83collins:
im yet to root my device so i cant test but what about

adb root
adb disable-verity
adb reboot

Then

adb root
adb remount
[Samsung Galaxy S22 Ultra] dr.ketan:
Do you got what I meant?

leave it.
[Samsung Galaxy S22 Ultra] gav83collins:
look, there is no need for condescension and bad language, a simple "no" would have sufficed
[Samsung Galaxy S22 Ultra] dr.ketan:
Lol not meant to hurt you! but on which planet WTF is bad language

Here search WTF on xda

View attachment 5612495
[Samsung Galaxy S22 Ultra] K0mraid3:
So my device is strange. It doesn't have root, but it indeed shows options in recovery to apply updates from ADB, SD Card aswell as boot directly to BL and to Mount /System, but when I'm booted, the OS is denying me permission to "Su" . I have verified that USB debugging is activated. So I'm trying to see if there's a way to pull the build.prop from Recovery since the Mount /System option is available, but my computer refuses to recognize the device in while in recovery, but easily finds it in Download, BL mode. No FRP lock. No accounts on device. But also no option to unlock bootloader. This device in particular is/was a development sample so I have no clue what the current state of the bootloader etc is in terms of being unlocked prior to me working on it.
[Samsung Galaxy S22 Ultra] K0mraid3:
It'd also worth noting that this device was loaded with Android 11 when I received it. I'm not kidding. So idk what's going on with this FrankenGalaxy
[Samsung Galaxy S22 Ultra] dr.ketan:
These options are normal in stock recovery and can be used only for flashing official zip (OTA), To have root access on your recovery, you needs custom one (TWRP) which is in development stage on S22

Without twrp, You needs to root device (must have oem unlock option in development option) to access system files while you are booted to android.

Android 11 on S22? Can you show me screenshot of settings - about phone - software info?
[Samsung Galaxy S22 Ultra] K0mraid3:
Thanks for the clear answer, that's kind of what I'm working on is trying to gain root access, but like you said, I need oem unlocking, which isn't on this device. So I'm trying to find a backdoor/vulnerability that will take me even one step closer to atleast finding a way to set ro.secure. prop. Something VERY interesting I did find, is that if you put the device to Debug medium or high via device keystring activity, and play with the key combos, you can get booted into a mode called RDX, if you plug it into your dev system with the right drivers, it's treats the phone as if it were a Disk and shows a bunch of VZW upgrade software ment for PCs. I've installed it but haven't got it working quite yett.
[Samsung Galaxy S22 Ultra] dr.ketan:
No idea what you have shown in screenshot, I'd asked something else.