Database Info

[Request] How to Create Patched Boot Image

I am looking to learn how to extract a boot image to patch. The last source for patched boot images has not updated since 9.5.10. I would like to be less dependent and be able to do it on my own.
Can someone put together a quick tutorial on how to extract a boot.img so I can run it though Magisk and create a patched one?

https://forum.xda-developers.com/showpost.php?p=79548858&postcount=6

I have the current rooted AA boot image in the guide in my signature. I extract them directly from the phone.

ozfive said:
I am looking to learn how to extract a boot image to patch. The last source for patched boot images has not updated since 9.5.10. I would like to be less dependent and be able to do it on my own.
Can someone put together a quick tutorial on how to extract a boot.img so I can run it though Magisk and create a patched one?
Click to expand...
Click to collapse
1)Download payload dumper.
2)Extract payload file from rom zip.
3)Put payload file in payload_input folder.
4)Run exe file.
5)After process complete check payload_output folder. All extracted there.
Download payload dumper from here :- https://forum.xda-developers.com/attachment.php?attachmentid=4760222&d=1558078935

Patched boot images are irrelevant and only necessary for devices without a working TWRP recovery. If you want to root, either boot TWRP once or boot and install TWRP (recommended) and then install the magisk zip from there.

larsdennert said:
I have the current rooted AA boot image in the guide in my signature. I extract them directly from the phone.
Click to expand...
Click to collapse
How do you extract the boot.img from the phone? I have the tmo version and would like to say on the stock room with root.
Sent from my GM1915 using Tapatalk

You need root to extract a partition, but if you have root then you have no need for it except to share it so someone else can get root.
In other words are you rooted already? If not, you'll need to use the other instructions or get a rooted or non rooted image from someone with a T-Mobile phone.
I'm going to guess you could fastboot boot boot.img to any rooted boot image for the one plus 7 pro, have root and then install magisk.

larsdennert said:
You need root to extract a partition, but if you have root then you have no need for it except to share it so someone else can get root.
In other words are you rooted already? If not, you'll need to use the other instructions or get a rooted or non rooted image from someone with a T-Mobile phone.
I'm going to guess you could fastboot boot boot.img to any rooted boot image for the one plus 7 pro, have root and then install magisk.
Click to expand...
Click to collapse
Not rooted yet, but everything I have read so far is that you need a patched boot.img to root, or you can create one from the boot.img in an oos package with magisk manager. The problem is, there isn't a tmo oos package out there yet, so it looks like rooting the tmo software isn't possible at the moment. Is this correct?
Sent from my SM-T550 using Tapatalk

Is your bootloader unlocked? That would be step one. Read up on the thread for that.

Not yet, but will be....trying to get my research done before I go for it... don't want to mess it up, been a few years since I rooted a phone.
Sent from my GM1915 using Tapatalk

Can't find boot.img for my phone

Hello, I'm trying to root my phone again. I have my bootloader unlocked and was able to find TWRP-3.5.0-9-0-guacamole (image and installer).
But in every tutorial they say you need to have a boot.img. I tried looking for Oneplus 7 Pro OOS 10.0.11 GM21BA but I can't find anything and I am scared to try it with the wrong files.
Does anyone know where I can find it? Or is it safe to flash Magisk only and not the TWRP recovery because I saw somewhere that that would patch your boot.img and it would be safe.
I would like to keep all the files I have on my phone currently so I am asking before I am going to attempt anything lol.
Here is some info about my phone:
Model: GM1913
Build: Oxygen OS 10.0.11.GM21BA
Android: 10
I am trying to follow this tutorial: https://www.xda-developers.com/unlock-bootloader-root-oneplus-7-pro/
In the written tutorial it doesn't say anything about needing a boot.img but in the video the guy is talking about it.
I also was wondering if I have the correct files so far.

with "payload dumper" it can be extracted from the full OTA update file

ghost323 said:
with "payload dumper" it can be extracted from the full OTA update file
Click to expand...
Click to collapse
Yeah I also saw something like this but I can't find how to find the payload.bin file OR the full OTA update file xD

I found a full OTA when putting my build into Google and then limiting search results to only this month.
Then I used payload_dumper to successfully extract the boot.img and now I can follow the tutorial again.

ƪ(ړײ)‎ƪ

BLU V50

Anyone have a root method for the BLU V50? Thanks in advance

Look inside here:
Root Spreadtrum Devices via Magisk Patched boot.img
This guide will show you the steps to root your Spreadtrum device via Magisk patched boot.img file, which we will extract from PAC firmware.
www.droidwin.com

jwoegerbauer said:
Look inside here:
Root Spreadtrum Devices via Magisk Patched boot.img
This guide will show you the steps to root your Spreadtrum device via Magisk patched boot.img file, which we will extract from PAC firmware.
www.droidwin.com
Click to expand...
Click to collapse
jwoegerbauer said:
Look inside here:
Root Spreadtrum Devices via Magisk Patched boot.img
This guide will show you the steps to root your Spreadtrum device via Magisk patched boot.img file, which we will extract from PAC firmware.
www.droidwin.com
Click to expand...
Click to collapse
I managed to find a way. Lol I'm just going to have to squeeze the old brain to to get this done it looks like. Thanks for the tip. The methods provided all require a system dump of stock firmware to patch TWRP for the phones recovery partition. I may have to cross my fingers and flash the generic unofficial boot image TWRP for android 10 and hope it fits lol. There are absolutely no custom fits at the moment. Of course I accepted the security patch update which made this a bit more tricky. QP1A.190711.020. I found a thread talking about almost the same update except it was two digits more than the version I got. It's been 6 or 7 years since I stopped theming for the galaxy s3. Course I was only changing xmls and pngs for custom roms back then. None of my old team are active anymore. Team Venum and team nOObz are long history. I even lost my log in info for my old profile. Anyways. Wish me luck. I'm going to learn how to port and develope this time around.

jwoegerbauer said:
Look inside here:
Root Spreadtrum Devices via Magisk Patched boot.img
This guide will show you the steps to root your Spreadtrum device via Magisk patched boot.img file, which we will extract from PAC firmware.
www.droidwin.com
Click to expand...
Click to collapse
Hello. Thanks again in advance. I've tried several command prompt methods to unlock this boot loader with no luck including the Magisk method. I have however managed to patch the TWRP file.
jwoegerbauer said:
Look inside here:
Root Spreadtrum Devices via Magisk Patched boot.img
This guide will show you the steps to root your Spreadtrum device via Magisk patched boot.img file, which we will extract from PAC firmware.
www.droidwin.com
Click to expand...
Click to collapse
I managed to patch the TWRP boot image using the Magisk apk and patch tools but I have no luck unlocking the boot loader..

1. find your firmware file by searching this forum for blu stock firmware repository
2. extract your boot/recovery img file using spd flash tool
3. patch img file with magisk, re-sign it with avbtools
4. patch vbmeta file with avbtools
5. re-flash both vbmeta and boot/recovery using spd research tool
rooted my blu advance l5 with these steps learned from hovatek. ymmv

luridphantom said:
1. find your firmware file by searching this forum for blu stock firmware repository
2. extract your boot/recovery img file using spd flash tool
3. patch img file with magisk, re-sign it with avbtools
4. patch vbmeta file with avbtools
5. re-flash both vbmeta and boot/recovery using spd research tool
rooted my blu advance l5 with these steps learned from hovatek. ymmv
Click to expand...
Click to collapse
Can anyone quickly tell me the easiest way to brick this device? My wife will buy me a new phone "when this one stops working"

Did anyone manage to root this device without bricking it? Firmware is not available in the Blu Repo (at least not yet). Our team would love to find a workable method for this phone. We have access to a bunch and want to be able to run Linux Deploy on them and also write app to automatically reboot the phone if the network connectivity is loss.

Hey, I was able to figure out how to deal with this bootloader stuff after many hours of work
Give this thread a look, it pretty much details every step needed to unlock the bootloader: https://forum.hovatek.com/thread-32287.html
Keep in mind that the OP of that thread is using a way older version of fastboot. For me, r26.0.1 worked best:
Windows: https://dl.google.com/android/repository/platform-tools_r26.0.1-windows.zip
Mac: https://dl.google.com/android/repository/platform-tools_r26.0.1-darwin.zip
Linux: https://dl.google.com/android/repository/platform-tools_r26.0.1-linux.zip
The above step is essential as newer versions of fastboot do NOT have the "fastboot flashing unlock_bootloader <bin>" step
again YMMV, but good luck

Me again, 6 hrs after the fact
Trial and Error enabled root on the V50 - follow these steps
1. Unlock bootloader as above
2. Create a custom signed vbmeta https://forum.hovatek.com/thread-32664.html (I used the same .pem from https://forum.hovatek.com/thread-32287.html to do this) - Make sure the VBMETA IS ANDROID 10 despite G0350WW firmware saying it's Android 9
3. Create custom boot with magisk (plenty of instructions to do this online, go with the github instructions)
4. Sign the custom magisk boot with THE SAME PUB KEY FROM STEP 2
5. Flash your new vbmeta and boot onto your phone via fastboot
6. Reboot, hope and pray it turns on
This is what worked for me, but again YMMV.

njoaquin said:
Me again, 6 hrs after the fact
Trial and Error enabled root on the V50 - follow these steps
1. Unlock bootloader as above
2. Create a custom signed vbmeta https://forum.hovatek.com/thread-32664.html (I used the same .pem from https://forum.hovatek.com/thread-32287.html to do this) - Make sure the VBMETA IS ANDROID 10 despite G0350WW firmware saying it's Android 9
3. Create custom boot with magisk (plenty of instructions to do this online, go with the github instructions)
4. Sign the custom magisk boot with THE SAME PUB KEY FROM STEP 2
5. Flash your new vbmeta and boot onto your phone via fastboot
6. Reboot, hope and pray it turns on
This is what worked for me, but again YMMV.
Click to expand...
Click to collapse
to be clear, the v50 uses the same firmware as the g50 plus?

dtingley11222 said:
to be clear, the v50 uses the same firmware as the g50 plus?
Click to expand...
Click to collapse
Correct, you can see it when you go to the firmware details of the v50 itself. You can get the firmware files when you search this forum for blu stock firmware repository
V50 is essentially a re-wrapped g50

njoaquin said:
Correct, you can see it when you go to the firmware details of the v50 itself. You can get the firmware files when you search this forum for blu stock firmware repository
V50 is essentially a re-wrapped g50
Click to expand...
Click to collapse
Hey, is there any way you could get me a rooted image and signed vbmeta? I have all the information that you would need, I just can't do the steps because im stupid. I would pay you to do it if you wanted

If the BLU V50 uses the same stock rom as the blu g50, if someone were to give out their patched vb meta and boot img, wouldn't it work for anyones BLU V50 if they just flashed it?

dtingley11222 said:
If the BLU V50 uses the same stock rom as the blu g50, if someone were to give out their patched vb meta and boot img, wouldn't it work for anyones BLU V50 if they just flashed it?
Click to expand...
Click to collapse
you need to patch recovery flash it back using the spreadtrum research tool and use the key combo to boot into root

luridphantom said:
you need to patch recovery flash it back using the spreadtrum research tool and use the key combo to boot into root
Click to expand...
Click to collapse
If I unlock the Bootloader, could I just flash it back with Fastboot?

Just tried flashing recovery and it bricked my phone

dtingley11222 said:
If I unlock the Bootloader, could I just flash it back with Fastboot?
Click to expand...
Click to collapse
you cant unlock the bootloader. follow this tutorial or you'll keep bricking your v50
How to create a custom signed vbmeta.img for Unisoc using AVBtool
If you're into rooting and flashing custom recoveries then Android Verified Boot (AVB) or dmverity is something you should be aware of. We'd dropped a blog post on why dmverity could be causing your p
forum.hovatek.com

luridphantom said:
you cant unlock the bootloader. follow this tutorial or you'll keep bricking your v50
How to create a custom signed vbmeta.img for Unisoc using AVBtool
If you're into rooting and flashing custom recoveries then Android Verified Boot (AVB) or dmverity is something you should be aware of. We'd dropped a blog post on why dmverity could be causing your p
forum.hovatek.com
Click to expand...
Click to collapse
Actually you can unlock the Bootloader. I already did. I don't know how to follow that tutorial. If I gave you my boot and vbmeta could you do it for me?

https://drive.google.com/file/d/1q1vt6f6-0Wg6iF4prOJS2o9ZauWM4qNy/view?usp=sharing : vbmeta
https://drive.google.com/file/d/1gEV2jxhnmmjKuUaqVhqPnH9oZNmzZBGi/view?usp=sharing : boot

dtingley11222 said:
Actually you can unlock the Bootloader. I already did. I don't know how to follow that tutorial. If I gave you my boot and vbmeta could you do it for me?
Click to expand...
Click to collapse
oh weird i thought blu doesnt even support bootloader unlocking
can you access fastboot? with an unlocked bootloader you can flash an empty vbmeta and dont have to go through the above steps

Question help: SM-a125U stuck in Hash of data does not match digest in descriptor

Previous android version: Android 11
Previous base-band version: A125USQU2BUG5
company: wireless cricket
In the context of flashing with the new firmware I used :
- Odin version: 3 v3.14
- Firmware used: Samfw.com_SM-A125U_USC_A125USQU2BUL1_fac_2

The error is related to the vbmeta check. Did you used a sock firmware or you have patched it with magisk? Btw i reccomend to use frija to download the firmware.
If i can suggest I would make this steps:
1) download latest firmware with frija
2) Flash the stock and see if it work
Otherwise if this not help:
1) download latest firmware with frija
2) patch the whole ap and not only boot.img with magisk
3) open odin and flash it using the patched ap on the ap slot
If nothing above works, I think you can try this... not sure it will work. Replace inside the ap the vbmeta.img with the attached one that have the disabled verified boot.

Oneplus# said:
The error is related to the vbmeta check. Did you used a sock firmware or you have patched it with magisk? Btw i reccomend to use frija to download the firmware.
If i can suggest I would make this steps:
1) download latest firmware with frija
2) Flash the stock and see if it work
Otherwise if this not help:
1) download latest firmware with frija
2) patch the whole ap and not only boot.img with magisk
3) open odin and flash it using the patched ap on the ap slot
If nothing above works, I think you can try this... not sure it will work. Replace inside the ap the vbmeta.img with the attached one that have the disabled verified boot.
Click to expand...
Click to collapse
Thanks for the reply.ok
1- The firmware is stock.
2- I didn't patch any of the files I got ( any recommended guide on how to proceed>?)
3- I' so new at this
But anyways, yesterday I kind of sorted out the stuck by adding BL file, and CSC file along the AP file to ODIN, the phone restarted ok but found out it hasn't been unlocked from the carrier yet, so I guess that by judging what u just said, there are few thing I need a guide to
- Flashing the stock
- Patching the AP file
Ps Frija opens up when executed, but it closes in less than 1 second. (Pc 's OS: win 10 enterprise 64 bits)

leonardo07746 said:
Thanks for the reply.ok
1- The firmware is stock.
2- I didn't patch any of the files I got ( any recommended guide on how to proceed>?)
3- I' so new at this
But anyways, yesterday I kind of sorted out the stuck by adding BL file, and CSC file along the AP file to ODIN, the phone restarted ok but found out it hasn't been unlocked from the carrier yet, so I guess that by judging what u just said, there are few thing I need a guide to
- Flashing the stock
- Patching the AP file
Ps Frija opens up when executed, but it closes in less than 1 second. (Pc 's OS: win 10 enterprise 64 bits)
Click to expand...
Click to collapse
When you flash with Odin you always need to use all the files provided on the stock firmware ap, bl, csc and cp. If u are upgrading you can use the home_csc instead of the csc file that will let you keep your data.
Are you sure you have installed the framework that Frija need?
For the ap patching, is only meant if you want root your phone, flashing the whole ap instead of the boot.img only will let you fix the vbmeta checks too.
Install the magisk app.
Open it and tap Install, it will ask for a file to patch, chose the ap file of the stock firmware you downloaded.
Final step, flash ap patched and the others (bl,csc,cp).
When you say unlocked by the carrier what do you mean? You have any sort of sim block? Or you only want remove your carrier apps and configs?

Oneplus# said:
When you flash with Odin you always need to use all the files provided on the stock firmware ap, bl, csc and cp. If u are upgrading you can use the home_csc instead of the csc file that will let you keep your data.
Are you sure you have installed the framework that Frija need?
For the ap patching, is only meant if you want root your phone, flashing the whole ap instead of the boot.img only will let you fix the vbmeta checks too.
Install the magisk app.
Open it and tap Install, it will ask for a file to patch, chose the ap file of the stock firmware you downloaded.
Final step, flash ap patched and the others (bl,csc,cp).
When you say unlocked by the carrier what do you mean? You have any sort of sim block? Or you only want remove your carrier apps and configs?
Click to expand...
Click to collapse
thanks for all that
- it s sim block

Oneplus# said:
When you flash with Odin you always need to use all the files provided on the stock firmware ap, bl, csc and cp. If u are upgrading you can use the home_csc instead of the csc file that will let you keep your data.
Are you sure you have installed the framework that Frija need?
For the ap patching, is only meant if you want root your phone, flashing the whole ap instead of the boot.img only will let you fix the vbmeta checks too.
Install the magisk app.
Open it and tap Install, it will ask for a file to patch, chose the ap file of the stock firmware you downloaded.
Final step, flash ap patched and the others (bl,csc,cp).
When you say unlocked by the carrier what do you mean? You have any sort of sim block? Or you only want remove your carrier apps and configs?
Click to expand...
Click to collapse
Mannn thanks!
I rooted my tab 5Se a long time ago and deleted the firmware files except the AP.
I got stuck on the same screen today when I re-locked my bootloader after a stock AP-only flash
Then I saw your reply here and got the rest of the files flashed and it worked and booted
And for those who are reading if you don't have a SIM on your tablet you don't need a CP that's why you won't find it in your firmware zip file
Cheerios

Question Extracting boot.img

I use Magisk for rooting the phone, and it requires patching boot.img, which I obtained from the global ROM's zip file available here on XDA. It works fine, but I would prefer patching the current boot.img, keeping it up to date at the same time.
How to extract boot.img from the firmware without root and with the stock recovery only (fastboot is available)? Or is it possible to dump the whole firmware, and get boot.img from the dump?

tigers2 said:
I use Magisk for rooting the phone, and it requires patching boot.img, which I obtained from the global ROM's zip file available here on XDA. It works fine, but I would prefer patching the current boot.img, keeping it up to date at the same time.
How to extract boot.img from the firmware without root and with the stock recovery only (fastboot is available)? Or is it possible to dump the whole firmware, and get boot.img from the dump?
Click to expand...
Click to collapse
I think not. But you can search for your machine's software updates in realme ui 4.0 downgrade program rom on that site official and extract payload.bin