[Upgrading, Modifying and Unlocking] jcul:
NOTE: This guide is for rooting your Cat S22 that is already updated to V30!

For rooting V29 see this post: https://xdaforums.com/t/root-for-the-cat-s22-review.4388131/#post-88959025

This is a simplified guide to rooting for V30, following more or less the same steps for V29 by getting the stock V30 boot.img and patching with magisk.

Note these instructions are for linux, but should be adaptable to windows etc.

Requires unlocking the bootloader.

We will patch the V30 boot.img from the OTA update.

The V30 update is incremental, it only provides a boot image patch, so you must download V29 to get the base boot.img.

v0.029.04: https://ota.googlezip.net/packages/ota-api/package/8e554ecf6fdc8c1963d45068e956c7b2a82a6d96.zip

v0.030.03: https://ota.googlezip.net/packages/ota-api/package/9a3aee53e9065364e1ddd01d373c0ba9229c27ed.zip

Mirror:

v0.029.04: https://mega.nz/file/QWJzULDJ#LAMXNoMzZxdK3iUs8NzleJ4uSoPzS0IpfoUdJIcM6uw

v0.030.03: https://mega.nz/file/0XgSFaQC#vqN0x7U2pBWgZOG1vglcI4OJL4lsGgTE9dHKUyQrXCE

1. Extract boot.img from the V29 update and check the size and sha1sum is correct

$ stat -c "%s %n" boot.img
33554432 boot.img
$ sha1sum boot.img
ee07c75d51068a497f194b2acfd2af9f5b54e957 boot.img

2. Extract the boot patch file "boot.img.p" from the V30 update.

$ stat -c "%s %n" boot.img.p
9160067 boot.img.p

$ sha1sum boot.img.p
2268831e8585b0abeb91b53054430a6e13a1e869 boot.img.p

3. Copy boot.img and boot.img.p to a new folder

4. Download / build https://github.com/erfanoabdi/imgpatchtools

5. Patch the V29 boot.img with the V30 boot.img.patch

Note, the values for the sha1sum and file sizes come from "META-INF/com/google/android/updater-script" in the V30 update.

This will patch the boot.img in place.

Verify the file size and sha1sum after.

$ ApplyPatch boot.img - 2781175354d624db73f6a172b796c2c563058e66 33554432 ee07c75d51068a497f194b2acfd2af9f5b54e957 boot.img.p
creating cache dir cache
cache dir: cache
patch boot.img:
now 27811753
Done

$ stat -c "%s %n" boot.img
33554432 boot.img

$ sha1sum boot.img
2781175354d624db73f6a172b796c2c563058e66 boot.img

Now we have the V30 boot.img, we can follow the steps here for V29: https://xdaforums.com/t/root-for-the-cat-s22-review.4388131/#post-88959025

6. Copy stock V30 boot.img to the device

$ adb push boot.img /storage/self/primary/Download
boot.img: 1 file pushed, 0 skipped. 87.2 MB/s (33554432 bytes in 0.367s)

7. Install Magisk App

Releases · topjohnwu/Magisk

The Magic Mask for Android. Contribute to topjohnwu/Magisk development by creating an account on GitHub.

github.com

8. Patch V30 boot.img that was just copied to the device

Open Magisk, select "Install", "Select and Patch a File", Locate boot.img in Downloads, "Let's Go", Wait for it to finish patching the V30 boot.img.

View attachment 6001363

9. Copy the patched boot.img back from Downloads folder.

$ adb ls /storage/self/primary/Download/ | grep magisk
000081b0 02000000 65018342 magisk_patched-26300_MTAeG.img

$ adb pull /storage/self/primary/Download/magisk_patched-26300_MTAeG.img
/storage/self/primary/Download/magisk_patched-26300_MTAeG.img:...1 file pulled, 0 skipped. 28.8 MB/s (33554432 bytes in 1.110s)

10. Unlock bootloader, if not already unlocked

Go to settings, about phone, tap build number ~7 times, developer options, enable OEM unlock.

Boot to fastboot (adb reboot fastboot or hold volume down when powering on) run:

fastboot flashing unlock

11. Boot to fastboot if not already in fastboot from step 10.

Hold volume down key while powering on, or run:

adb reboot fastboot

12. Flash the patched boot.img

$ fastboot flash boot magisk_patched-26300_MTAeG.img
Sending 'boot' (65536 KB) OKAY [ 3.200s]
Writing 'boot' OKAY [ 1.093s]
Finished. Total time: 4.377s

13. Disable verification on vbmeta

Note: I was able to boot and had root without performing this step, so it may not be necessary.

Patch the V29 vbmeta.img with the V30 patch, as we did in step 5 for boot.img.

$ stat -c "%s %n" vbmeta.img
8192 vbmeta.img

$ sha1sum vbmeta.img
49059dbb9ab6c32f749d8f597866ece5673c0135 vbmeta.img

$ ApplyPatch vbmeta.img - 315d000c56aa46b91f334a1d8100556f145f060c 8192 49059dbb9ab6c32f749d8f597866ece5673c0135 vbmeta.img.p
creating cache dir cache
cache dir: cache
patch vbmeta.img:
now 315d000c
Done

$ sha1sum vbmeta.img
315d000c56aa46b91f334a1d8100556f145f060c vbmeta.img

Boot to fastboot.

Note: Needs to be fastboot, not fastbootd.

Screenshots of fastboot vs fastbootd are in my post below.

If you can't get to fastboot, remove the battery and then power on while holding volume down.

$ fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (8 KB) OKAY [ 0.003s]
Writing 'vbmeta' OKAY [ 0.004s]
Finished. Total time: 0.028s

14. Reboot

fastboot reboot

15. Phone should now be rooted

View attachment 6001381

To unroot, just reflash the V30 boot.img and the V30 vbmeta, without the "--disable-verity --disable-verification" options.

Note: If you'd like to avoid the hassle of downloading the V29 and V30 updates and doing the patching, I have uploaded the V30 versions here:

V30 boot.img (2781175354d624db73f6a172b796c2c563058e66): https://mega.nz/file/5SQXwJzC#jLVc-MHOqoT2qPZsdO0BIWdTaz9rv5ybPzbrbs6oSfQ

V30 vbmeta.img (315d000c56aa46b91f334a1d8100556f145f060c): https://mega.nz/file/sCwEVDST#fiPDHn6lfpUvdNDqUhF2PD4g6pB-xnXEbCZVvJ4KlkI

You can download this boot.img and continue from step 6.

Note, make sure you verify the sha1sums, they should match what is in "META-INF/com/google/android/updater-script" from the V30 update.