[Android Software Development] shadow460:
EDIT: Instructions for updating the ROM are in the third message and they work for everyone, rooted or not.

This is specifically for the RFinder B1+ with 6 GB of system RAM and 128GB of built in ROM but with or without the First Responder designation or Band 14. It will likely work with all three RFinder B1+ radios as they use the same MediaTek chipset.

***THE B1 CLASSIC ROOT METHOD IS TOTALLY DIFFERENT***

***I AM NOT RESPONSIBLE IF YOU DAMAGE OR DESTROY YOUR DEVICE***

***I AM ALSO NOT RESPONSIBLE IF YOU VIOLATE FCC RULES OR WHATEVER THE EQUIVALENT AGENCY US IN YOUR COUNTRY***

In a nutshell, if something goes wrong, it's up to you to fix it. Though there are very few ways to brick the RFinder, keep in mind it's also a two way radio, so don't blame me if yours falls apart, you burn yourself on an exposed part of the antenna, the family cat runs off, you manage to summon security on their local DMR channel, or if it gets stuck in an infinite loop showing sample Pac Man footage.

For those unfamiliar, there are a few combo radio and Android units. The RFinder B1+ is one of them. I see no advantage to rooting on the radio side; most amateur radios offer you as much access as you need. AnyTone offers access to *everything*, they're completely unlocked. Motorola Solutions (not the Motorola seen most often here) keeps strict control of what you can access. Analog only devices vary but have a lot of access through the program Chirp.

Now that we've worked out you're here to root the Android part instead of the radio, let's dive on in.

Here's what I used:

A laptop running Windows 11

My Moto G7 (Mobility, not Solutions)

A typical USB-A to USB-C cable

ADB tools

MediaTek drivers

Magisk 23

The latest RFinder firmware, which can be found here:

Index of ./B1-Plus-APKs/

While there you may need to grab the latest APKs. Towards the end of this post I'll explain a bit about DMR and analog radio, this will help you understand what the B1 does and if it's worth the investment ($1,600 currently) to you.

Please be patient, it may take a couple of tries to download the firmware.

I don't see a need to change the recovery. If you have other ham radios with you, you will likely have a computer as well which can be used to reflash the ROM to the radio if need be.

First, back everything up. Files and whatnot can be backed up to SD cards, radio info is to be backed up to the cloud. Install the latest firmware (this will include the ROM) as per RFinder's instructions. It takes a little digging to find it. My B1 has the firmware I linked to, so I used that. With the latest firmware installed, shut the B1 down and either charge it or attach a fully charged battery.

Over on the G7 (you may use any phone that runs Magisk Manager 23) I extracted boot.img from the downloaded firmware. You also need to extract vbmeta and lk.bin (depending on your preferences). lk.bin can be added to clean up the boot screen. I used a blank vbmeta intended for a rooted Onn 10.1 tablet, but it's better to use the one that comes with the firmware.

Next I patched the boot.img with the Magisk Manager 23 on my rooted G7 and took note of the file name. I have several patched boot images for different devices, no need to risk flashing the wrong image and possibly turning my radiophone into a light bulb.

Then I hooked up the laptop to the phone. ADB tools are in the most basic directory I could make: c:\adb. I put the patched boot.img in there. You'll need to copy vbmeta and lk.bin as well. I disconnected the laptop from the G7 and hooked it up to the B1, then started the B1 normally. Windows 11 recognized it immediately and installed the drivers. I enabled developer options (settings->system->about phone, then tap build number several times) and enabled OEM unlocking through Developer Options.

Next I unhooked the B1 and rebooted it to the super simple MediaTek bootloader by holding power and volume UP together for a few seconds. I followed the on screen prompts to get into fastboot mode.

With the laptop and the B1 connected, I went to C:\adb on the laptop, right clicked, and opened a terminal. This may be listed as open PowerShell or command prompt depending on your version of Windows.

For the next part, we're telling certain programs to do certain things to certain partitions within the radiophone with certain files. Imagine giving someone a command: "Fastboot, please flash the boot partition with the boot.img. file." That's the flow of each command.

The first command was to verify the laptop and PC could communicate, so I typed (without quotes)

"fastboot devices"

The RFinder put a number up on the laptop screen. All good so far.

Next

"fastboot flashing unlock"

This unlocks the bootloader and frees up every bit of storage on the radio's installed ROM storage.

Next, without quotes or parentheses, I typed "fastboot flash boot (whatever Magisk named the patched boot image).img

Last was "fastboot flash vbmeta vbmeta.img"

At this point if you want to patch the lk.img file and have that nice, clean battery warning specific to the B1, patch it in a hex editor, put it into the ADB folder, and type:

"fastboot flash lk (whatever you named the patched lk.img).img

If for some reason you want to re lock the boot loader,

"fastboot flashing lock" should do it. I left mine unlocked.

Once that's done, reboot the B1. You can power cycle it or type

"fastboot reboot"

That will either get it booted to Android 9 or into a boot loop. If it boot loops, re check your work and try again. Worst case scenario you can flash the respective files from the firmware you downloaded, start with vbmeta, though!

The last step is to install Magisk Manager 23. It should recognize the Android part is rooted.

You can use a later Magisk or even a different root solution. I used 23 because it's the latest one I'm familiar with.

Now... just what exactly does this oversized, bulky piece of hardware do?

Most any radio, your cell phone included, has to connect to a central point and identify itself to be allowed to use that connection. For a cell phone, we call that a "tower", for ham radios, it's called a "repeater". Shocking idea...they both do the exact same thing: take in information and then repeat it either over the air or via physical connection (backhaul for cell, network for radio) so that other devices can receive it. Some radios can talk directly to one another without all of this.

When your radio connects to a repeater, it also sends certain information to activate that repeater. Both analog and digital modes require this, but the digital identification carries more information.

Enter DMR radio. An analog repeater has one or maybe two "channels". A DMR repeater accesses a network called Brandmeister or sometimes DMR_MARC which contains thousands of channels known as "talkgroups".

In either case, someone has to program those ID signals and the desired channels into the radio. No two repeaters are exactly the same, but someone with a lot of patience can set the radio up to automatically access each repeater on a long trip much the way a cell phone roams from tower to tower.

Most programmable two way radios have to have all this info entered at least once by hand. The B1 does it automatically.

Aside from that, there are obvious advantages to an amateur radio operator with a single device that can serve as their cell phone, their handheld radio, and possibly even their wallet. There's also an advantage to being able to simply switch out a dead battery for a charged one, the B1 is offline for perhaps a minute while this is done rather than being captive to a power bank and cable for an hour or two.