[General Topics] breakingspell:
Hello all! I rooted my Retroid Pocket 4 Pro using this post as a guideline, but there are key differences.

-The bootloader is unlockable (and re-lockable) via platform-tools, no need for Chrome/unisoc unlock. Mediatek USB drivers are available here

-Partition mappings have changed. Internal storage /dev/block/mmcblk0 is now /dev/block/sdc.

-We don't need to sign vbmeta, by disabling verity (cannot dump the same keys as the RP3+ image anyway). This doesn't seem to have any immediate consequences, and comes from Magisk's docs.

Disclaimer that I have only personally tested this on one device, be wary of OTA, verify your backups, etc etc. Big reminder that Retroid does not provide recovery packages!

___

Unlock Bootloader​

- Settings -> About -> tap Build Number to enable Developer Settings -> Enable OEM Unlocking.

- Reboot to bootloader (not fastbootd). You can get there via Recovery Mode -> Reboot to Bootloader (hold Vol Up during reboot), or by enabling ADB and issuing "adb reboot bootloader " with your PC.

- Unlock bootloader using platform-tools, this wipes the device. While you're here, verify the device is using slot A. If you're on slot B, use boot_b.img for magisk.

fastboot getvar current-slot
fastboot flashing unlock
fastboot reboot

- After the wipe, disable OTA: Handheld Settings -> Advanced -> Disable apps -> Show system apps -> Updater (com.baidu.ota)

Backup​

- Determine your SD card label (B2B4-D140 or similar) and create a folder named "img" at the root (/mnt/media_rw/B2B4-D140/img/). Ensure the path is correct or the script will fail.

- Save this script on the device as backup_all_partitions.sh, replace ####-#### with your SD label. This will dump every partition from /dev/block/sdc to separate img files.

-- It's worth verifying for yourself that these mappings match your device. Run this in Termux or ADB shell to make sure sdc30 matches boot_a, etc.

ls -ld /dev/block/by-name/*

- Settings -> Handheld Settings -> Advanced -> Run script as root -> backup_all_partitions.sh.

-- This is a full backup and will take a while. If you are tight on SD space, you can omit userdata.img from the script at your own risk. Ensure that super.img is backed up, this is required for a full restore!

- Copy everything to PC. The images you dumped are as close to a recovery package as you're likely going to get for this device so keep them safe. It's a good idea to dump them again and compare checksums.

Patch and Flash​

- Install Magisk apk -> Select and Patch a File -> boot_a.img. Rename the output to magisk.img.

- Run with fastboot:

fastboot flash boot_a magisk.img
fastboot flash boot_b magisk.img
fastboot flash vbmeta_a --disable-verity --disable-verification vbmeta_a.img
fastboot flash vbmeta_b --disable-verity --disable-verification vbmeta_a.img
fastboot reboot

- If anything fails DO NOT PROCEED! Flash your stock images back and examine the console output before rebooting.

- If successful, Magisk should now be active on reboot back into the system. You can now copy savegames to those pesky protected Android/data folders!

Unroot/OTA update​

Disclaimer that OTAs are sparsely tested and you may likely run into a (safe) failure! Be ready to use adb/logcat to examine log output from the updater.

A full factory reset is required in order to perform an OTA update, so ensure your data is backed up to SD (Titanium or Neo backup).

-- Tested OTAs:

1.0.0.16 -> 1.0.0.28 -> 1.0.0.58

- Run with fastboot:

fastboot flash boot_a yourbackup/boot_a.img
fastboot flash boot_b yourbackup/boot_b.img
fastboot flash vbmeta_a yourbackup/vbmeta_a.img
fastboot flash vbmeta_b yourbackup/vbmeta_b.img
fastboot flash super yourbackup/super.img
fastboot reboot

NOTES:

If your boot_b.img is blank and returns an error in fastboot (inspect with hex editor to confirm), flash your boot_a.img into this slot. This is apparently due to the stock ROM not populating both slots by default, until the first OTA is applied.

- Perform factory reset via Settings -> System -> Reset options. This must be done from within the ROM, a factory reset from Recovery mode will still fail to apply an OTA.

- Walk through the setup wizard and check the updater app in Settings -> System -> Update. Proceed if an update is available.

-- If the OTA is successful, it will take about 30-40 minutes with no progress meter, and will prompt to reboot when done. You can then re-root your device and restore data, but ensure you are patching the active boot slot (boot_b after first OTA, boot_a on the next, etc).

-- If the OTA fails within the first few minutes, you may need to inspect the system logs with logcat to determine the cause. An option is given to Retry but will likely fail with the same condition.

It seemed in two different cases that system_b was failing validations during the update pre-check, and re-flashing super.img with a reset afterwards was the solution.

Restore to stock (WIP)​

Similar fastboot syntax to unrooting, but you must flash every partition in your /img backup folder accordingly. Successfully downgraded from 1.0.0.58 to 1.0.0.28 this way.

Untested restore script: https://pastebin.com/iTKiEzUn - Your backup should have the exact same files, run one command at a time. Ensure the proper boot slot is set. Working on a restore package to automate this process for the stable 1.0.0.28 version.