How To Guide Unlocking and Rooting Xiaomi 12S Ultra (Twrp/Magisk) - Xiaomi 12S Ultra

A very well known disclaimer : your warranty is void after doing this. And I am not responsible for any damage caused on your device. It's all on you.
Make sure to have your google play store apk downloaded somewhere.
Unlocking the bootloader will wipe all data AND your play store.
but you don't have to use xiaomi google play service installer or such.
This phone has built in google service, and just the play store goes away by factory reset.
1.Mi Unlock - link​Download the tool on pc, enable developer options on your phone
(My device - All specs - tap miui version 7 times).
Go to dev options(Additional Settings) and enable OEM unlocking.
Right below, there is Mi Unlock Status.
Link the device to your Mi account.
From this moment, you have to wait 168 hours
WITHOUT logging out Mi account on your phone
or adding another device on your Mi account.
Else, the counter will reset.
The counter is server-sided.
No need to worry about restarting or turning off the device during this period.
Goto Mi account and add your PHONE NUMBER to the account.
Else, you will face loading loop on Mi unlock tool after typing in the verification code.
Once that is done, boot to fastboot
(turn off device, then hold power and volume down, or use 'adb reboot fastboot')
and use Mi unlock tool to make sure you see
"try again after 168 hours" message.
That's it. Come back after 168 hours(1 week) and unlock your phone using the tool.
Your bootloader will be unlocked now.
ADB/Fastboot - just in case you don't have it
go setup fastboot for later steps.
2.Rooting​There are two ways of rooting now that we have a twrp.
/
Method A : (TWRP Root) way easier.​TWRP - please refer to my post
download twrp, and use fastboot.
fastboot boot twrp-3.6.2_A12-thor-unofficial.img
(or your img name)
Once you boot into twrp,
go to "Advanced" and "flash this twrp."
when it's done, do not reboot,
go back and in the same Advanced menu, install magisk(not alpha). That's it!
Now reboot to the system,
you will see brown magisk app that basically does nothing but infinite download,
ignore the app and get yourself a magisk app below,
once installed and opened it, magisk will tell you to reboot once more.
Now you are fully rooted!
Magisk - link​/
Method B : (Magisk root)​if you are going to use twrp, just follow method A else you have to go back to the bootloader again and do all that stuff. Twrp method does all at once.
Magisk patched boot img - 13.0.7 Latest (Magisk original 25.2)
or the same file attached below.
Magisk Patched boot.img - 13.0.5(Magisk canary)
Basically download the ROM, get boot.img out of it, and use Magisk to patch it.
Now put your device to fastboot mode, place boot.img to your ADB folder (C:/adb) and type these one by one.
fastboot flash boot_ab boot.img
fastboot reboot
now you have a rooted device!
3. Safetynet Fix -link updated.​Apply this patch via Magisk
Enable Zygisk, enforce DenyList,
and then toggle these options in cofiguration.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now you should be able to pass the Safetynet test.
Also add you banking apps or anything it shouldn't detect root and Magisk.
Feel free to leave any questions below.
For advanced Users, I am testing out Konabess since they added SD 8+ gen 1 support. Let me know your thoughts! I can confirm that the tool works, but havent tested enough to verify if it acutally works.
Go use KonaBess if you are into serious tweaking! It works

Excellent share! Thank you.

Wondering why in your ADB commands guy flashed 2 boot images. Can you expand on why? Shouldn't it be fine just flashing the patched boot?

GodKingKnight said:
Wondering why in your ADB commands guy flashed 2 boot images. Can you expand on why? Shouldn't it be fine just flashing the patched boot?
Click to expand...
Click to collapse
The 2 commands are there to ensure that the patched image is flashed on both the A and B slots of the device. Mismatched boot images on the 2 partitions often cause bootloops or related issues.

Much appreciate the clarification. Thanks again!
oddlyspaced said:
The 2 commands are there to ensure that the patched image is flashed on both the A and B slots of the device. Mismatched boot images on the 2 partitions often cause bootloops or related issues.
Click to expand...
Click to collapse

Thanks for sharing but without safetynetfix I don't pass safetynet test...others can confirm or not? Thanks.

Nabicook said:
A very well known disclaimer : your warranty is void after doing this. And I am not responsible for any damage caused on your device. It's all on you sir.
Unlock bootloader - patch boot.img - fastboot flash.
These are the steps.
Make sure to have your google play store apk downloaded somewhere. Unlocking the bootloader will wipe all data AND your play store.
1.Mi Unlock - link
Download the tool on pc, enable developer options on your phone(My device - All specs - tap miui version 7 times).
Go to dev options(Additional Settings) and enable OEM unlocking.
Right below, there is Mi Unlock Status.
Link the device to your Mi account.
From this moment, you have to wait 168 hours WITHOUT logging out Mi account on your phone or adding another device on your Mi account. Else, the counter will reset. The counter is server-sided so you dont have to worry about restarting or turning off the device during this period.
Goto Mi account and add your PHONE NUMBER to the account. Else, you will face loading loop on Mi unlock tool after typing in the verification code. Once that is done, boot to fastboot(turn off device, then hold power and volume down, or use 'adb reboot fastboot') and use Mi unlock tool to make sure you see "try again after 168 hours" message.
That's it. Come back after 168 hours(1 week) and unlock your phone. Your bootloader will be unlocked now.
ADB/Fastboot - just in case you don't have it,
go setup fastboot for later steps.
2. Magisk - link
Magisk patched boot img - 13.0.7 Latest (original 25.2)
or the same file attached below.
Magisk Patched boot.img - 13.0.5(canary)
Basically download the ROM, get boot.img out of it, and use Magisk to patch it.
Now put your device to fastboot mode, place boot.img to your ADB folder (C:/adb) and type these one by one.
fastboot flash boot_a boot.img
fastboot flash boot_b boot.img
after you see success each time,
fastboot reboot
now you have a rooted device!
3. Safetynet Fix -link
Apply this patch via Magisk
Enable Zygisk, enforce DenyList,
and then toggle these options in cofiguration.
View attachment 5678797
Now you should be able to pass the Safetynet test.
Feel free to leave any questions below.
For advanced Users, I am testing out Konabess since they added SD 8+ gen 1 support. Let me know your thoughts! I can confirm that the tool works, but havent tested enough to verify if it acutally works.
Click to expand...
Click to collapse
I have to login to download you patched file

GodKingKnight said:
I have to login to download you patched file
Click to expand...
Click to collapse
Hi, I changed to google drive. Now you can download without logging in

I got Magisk and root successfully. Thanks a lot. Also using your patched twrp.
By the way how did you get safety net pass?
Nabicook said:
Hi, I changed to google drive. Now you can download without logging in
Click to expand...
Click to collapse

GodKingKnight said:
I got Magisk and root successfully. Thanks a lot. Also using your patched twrp.
By the way how did you get safety net pass?
Click to expand...
Click to collapse
basically step 3.
download and install universal safetynet fix magisk module.
Then enable Zygisk, add deny list, then reboot.
you should be able to pass

did you fix netflix l1 after root ?

hoangtu2410 said:
did you fix netflix l1 after root ?
Click to expand...
Click to collapse
not yet, miui seems to be difficult to edit build prop or at least there are other ways to do.
simply editing build prop with root permission won't work btw

Updated
1. TWRP method
2. Safetynet fix

Brown-Magisk does infinite download because it is being blocked by MIUI Optimizations, which can be disabled in dev settings.

linamus said:
Brown-Magisk does infinite download because it is being blocked by MIUI Optimizations, which can be disabled in dev settings.
Click to expand...
Click to collapse
Does it still have the infinite loop issue? I don't want to disable the miui optimization

arinpsycho said:
Does it still have the infinite loop issue? I don't want to disable the miui optimization
Click to expand...
Click to collapse
You can enable it right back after installing third party apps. But id recommend eu rom anyway.

Guys, I *probably* screwed up and need advice:
After update to latest MIUI stable I've lost root and decided to regain it.
(1. but, I've messed up with cmd prompt and flashed twrp image for recovery while in fastboot
2. Later on I've flashed correct fastboot image of twrp)
After twrp loads, it requires me to enter password to mount data. I fogot/never set it (used graphics lock all way long).
When I press cancel and reboot - I get constant bootloop
Default passwords don't work, deciphering graphic password into numbers also
TWRP doesn't offer me to use graphic password
Flashing stock boot.img and recovery doesn't help, I just get boot to stock recovery.
Pls help me get out of this constant bootloop
Obviously, I don't want to wipe data and do clean reflash

Use the twrp from the EU forum here https://sourceforge.net/projects/recovery-for-xiaomi-devices/files/thor/
You need to boot twrp, not flash it. fastboot boot twrp.img
Hope it helps

Sathelp said:
fastboot boot twrp.img
Click to expand...
Click to collapse
Thanks, but if I use that command I get
FAILED (remote: 'Failed to load/authenticate boot image: Bad Buffer Size')

joiliko said:
Thanks, but if I use that command I get
FAILED (remote: 'Failed to load/authenticate boot image: Bad Buffer Size')
Click to expand...
Click to collapse
Oh, and when I use MiFlash to flash recovery rom latest v.11, it gets stuck at 4.99% and then reboots
So I guess there's only fastboot flash option left?

Related

[TWRP][RECOVERY][PIE] TWRP 3.3.1-0+ for the LG G7 ThinQ

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
TWRP 3.3.1-0+ for the LG G7 ThinQ​
**WARRANTY VOIDED***
I am not and neither is TWRP Team responsible for any damages you or someone does using this software or hardware.
That includes phone bricking, levitation, world war 3 etc.
Click to expand...
Click to collapse
Warning: This TWRP Recovery is only useful for installing custom ROMs.
Currently there's no way to use this recovery on stock in any meaningful way without future addons
(Data partition cannot be read because of LG default encryption)
You cannot install or backup anything while you have LG Encryption enabled. A future addon can disable it.
<-- Requirements​
An Bootloader unlocked LG G7 ThinQ by any means. (official or unofficial) (G710TM Models are impossible to be supported, sorry)
More information on officially unlocking the LG G7 here: https://developer.lge.com/resource/mobile/RetrieveBootloader.dev
Running minimum LG Stock Android 9 Pie (AOSP GSI does not count)
A PC and ADB + Fastboot
The temper to read twice
<-- Needed files​
You only need this boot image:
https://drive.google.com/open?id=1FcIBNfL3_72cQwuxd2TyZSjnC-ItnNTt
For developers who want to build their own TWRP Boot image here's the device-tree for it
https://github.com/LameMonster82/android_device_lge_judyln-twrp
<-- Installation​
Step 1: Enter Fastboot mode
Connect your phone to your PC with a USB Cable
Restart the phone
While the phone is restarting hold Volume down button.
Note: Make sure you hold Volume down button before you see the black and white "LG G7 ThinQ" text
If you see the red LG Logo you either messed up or you don't have access to fastboot mode witch is another problem i can't solve easily.
If done correctly you should be in Fastboot now
Step 2: Install the boot image
Open the command prompt or your terminal (depending on what PC Platform you are)
Type:
Code:
fastboot boot [B][TWRP Boot image location][/B]
Click to expand...
Click to collapse
Note: This TWRP is only temporarily (it does not overwrite the bootimage). When you reboot it will dissapear and you will need to redo the fastboot command.
You're done. Now you can use TWRP to install custom ROMs
------------------------------------------------------------------------------------------------------------------------​Legacy tutorial. Do not use unless you use TWRP older than Feb 2020.​↓
Code:
[SIZE="5"][B][I][CENTER]<-- Needed files[/CENTER][/I][/B][/SIZE]
[LIST]
[*]You only need this boot image:
[url]https://drive.google.com/open?id=1n2wKdwARddx_KCIdLi10KawY_THlcRi4[/url]
[*]For developers who want to build their own TWRP Boot image here's the device-tree for it
[url]https://github.com/LameMonster82/android_device_lge_judyln-twrp[/url]
[/LIST]
[SIZE="5"][B][I][CENTER]<-- Installation[/CENTER][/I][/B][/SIZE]
[QUOTE][SIZE="3"][B]Step 1: Enter Fastboot mode[/B][/SIZE]
[LIST]
[*]Connect your phone to your PC with a USB Cable
[*]Restart the phone
[*]While the phone is restarting hold Volume down button.
[B]Note[/B]: Make sure you hold Volume down button before you see the [U][B]black and white[/B][/U] "LG G7 ThinQ" text
If you see the red LG Logo you either messed up or you don't have access to fastboot mode witch is another problem i can't solve easily.
[*]If done correctly you should be in Fastboot now :)
[/LIST]
[SIZE="3"][B]Step 2: Install the boot image[/B][/SIZE]
[LIST]
[*]Open the command prompt or your terminal (depending on what PC Platform you are)
[*]Type:
[/LIST]
[CODE]fastboot flash boot_a [B][TWRP Boot image location] --set-active=a[/B]
The best way you can set the TWRP Boot image location is to manually "drag and drop" the file itself in your command prompt
Also make sure you "drag and drop" the TWRP Boot image before you type --set=active=a
Don't forget --set-active=a has 2 little lines at the beginning. No space between them.
Step 3: Enter Recovery mode
Restart the phone (using power button if you're still in fastboot)
Before the phone turns off hold Volume down and power button
The moment you see the black and white "LG G7 ThinQ" Text start clicking the power button as much as you can without letting the Volume down button.
If done correctly you should see a white screen with "Factory reset" text on top.
If you done step 2 correctly clicking yes on both prompts on the phone will get you to TWRP
For people who still have trouble getting into recovery mode here's a visual example of how to enter recovery mode (youtube) https://youtu.be/_0yoFEvIods
Note: You don't have to be in system. Rebooting from bootloader will still work
[/QUOTE]
Congratulations you now have TWRP Recovery on your LG G7 ThinQ :highfive:[/CODE]​
​Join our Telegram Group here:
>> t.me/lgg7thinqmain <<​
I would like to thank:
@Sellerie_ and @J0SH1X for their help on the TWRP Project for LG G7 ThinQ
Here be dragons!
Reserve for more info and changelogs
Another reserve because why not
I see you compiled twrp with crypt enabled, are the blobs not located in the vendor partition for encryption?
loonycgb2 said:
I see you compiled twrp with crypt enabled, are the blobs not located in the vendor partition for encryption?
Click to expand...
Click to collapse
Nope. The problem is there are no blobs to use. Yeah keymaster is there but keystore module is missing from the vendor and the system. The closest thing I found was lgkm module that looks like a proprietary keystore module for lg
LameMonster82 said:
Nope. The problem is there are no blobs to use. Yeah keymaster is there but keystore module is missing from the vendor and the system. The closest thing I found was lgkm module that looks like a proprietary keystore module for lg
Click to expand...
Click to collapse
My G7 is not bootloader unlocked so cant really help with dev, but any reason it wouldnt use the same same as the v30?
loonycgb2 said:
My G7 is not bootloader unlocked so cant really help with dev, but any reason it wouldnt use the same same as the v30?
Click to expand...
Click to collapse
Can't get it to work
Can g710ulm use this trwp to flash lineage OS?
cartman56 said:
Can g710ulm use this trwp to flash lineage OS?
Click to expand...
Click to collapse
As long as you have an unlocked bootloader
Can i update TWRP trough TWRP by installing it as image into boot?
bongster said:
Can i update TWRP trough TWRP by installing it as image into boot?
Click to expand...
Click to collapse
Yes
Can i flash magisk zip for this twrp?
simodf91 said:
Can i flash magisk zip for this twrp?
Click to expand...
Click to collapse
Yes but only useful for custom ROMs
according to the page you linked regarding the bootloader unlocking process, only the LMG710EM is supported... have you successfully done this with any other model?
dode417 said:
according to the page you linked regarding the bootloader unlocking process, only the LMG710EM is supported... have you successfully done this with any other model?
Click to expand...
Click to collapse
Myself no but it's possible to unlock the bootloader in other ways and multiple people already have done that
Hello, I am not very educated about this as I would like...
Is this recovery "persistent"? Why it is not possible to use this recovery to flash/root magisk on stock roms?
Thank you.
is it needed for magisk?
hello,
stock LG Pie (v20c) with bootloader unlocked. do i need to install this (TWRP) in order to root it with the magisk file from your drive, or will it work without?
(sorry for the noob/stupid/uninitiated/etc question, i'm really new at this)
louie_yo said:
hello,
stock LG Pie (v20c) with bootloader unlocked. do i need to install this (TWRP) in order to root it with the magisk file from your drive, or will it work without?
(sorry for the noob/stupid/uninitiated/etc question, i'm really new at this)
Click to expand...
Click to collapse
No need to install TWRP for root. Just follow the guide there and you should be fine.
How strict is the Android Pie requirement before installing TWRP?
I have a G710VM that I'm trying to get LineageOS onto. I've already gotten the bootloader unlocked, but it seems like, so far, I can only get bootloader access by using the ULM 8.0 ROM (ULM11g). If I try the European 9.0 (EM20b) or ULM 9.0 (ULM20d) ROMs, I lose bootloader and fastboot access.
Also, is this TWRP a persistent TWRP, or semi- or non-persistent.
I also apologize in advance if I use the wrong terminology or make the wrong assumptions as this is my first attempt at unlocking a phone and putting a custom OS on it.
Halogen_03 said:
How strict is the Android Pie requirement before installing TWRP?
Click to expand...
Click to collapse
briccked my g7 running android 8.0 following this guide, so i'd say its important. stuck at "enter sahara mode"

Install custom recovery and root on Cubot J5?

I have tried for a few days to install a custom recovery but no luck. Perhaps someone can give me some advice?
I have tried Mediatek (MTK) Auto TWRP recovery porter, version 1.5 but it didn´t work.
This aswell twrp-recovery-cubot-j5-root from getdroidtips but nope...
Chip on phone Mtk6580 and android 9.
Updated to the latest firmware release via spflashtool from cubot own site.
I guess that im to much of a newbie to get this done...
But atleast its updated, my main goal is to root the phone so thats why i need a custom recovery.
Thx in advance, and sorry for my english grammar, not my main language. :laugh:
jimboo80 said:
I have tried for a few days to install a custom recovery but no luck. Perhaps someone can give me some advice?
I have tried Mediatek (MTK) Auto TWRP recovery porter, version 1.5 but it didn´t work.
This aswell twrp-recovery-cubot-j5-root from getdroidtips but nope...
Chip on phone Mtk6580 and android 9.
Updated to the latest firmware release via spflashtool from cubot own site.
I guess that im to much of a newbie to get this done...
But atleast its updated, my main goal is to root the phone so thats why i need a custom recovery.
Thx in advance, and sorry for my english grammar, not my main language. :laugh:
Click to expand...
Click to collapse
My dear friend did you try:
https://www.cyanogenmods.org/how-to-root-cubot-j5-and-install-twrp-recovery/
btw why didn't Mediatek Auto TWRP recovery porter work? what was the issue?
I have the same problem the thread starter indicates in the title: I can install the TWRP recovery image that gopikrishnanrmg linked, but the installation of Magisk doesn't work. It says it installs successfully, but I can't get root rights and if I install the Magisk app, it says that Magisk is not installed. Magisk canary doesn't work either. Does someone have an idea what I might have done wrong? Or does that mean that the device is not supported by Magisk?
gopikrishnanrmg said:
My dear friend did you try:
btw why didn't Mediatek Auto TWRP recovery porter work? what was the issue?
Click to expand...
Click to collapse
Sorry for the late answer, life happens
I get it installed with that guide after unlocking flash state, but when it reboots it give me a message "orange state" and the phone resets.
and the recovery porter did not work for me, maybe i´m to old for this hehe was a while since i rooted a device, and i´m defenitly no hacker
btw if you need to look on the firmware cubot(dot)net has a downloadable link for the j5.
I have the same problem and I can't do anything about it, maybe some specific source or a hint in the form of YT
Has anyone figured out how to upload Twrp recovery to Cubot J5 ????
I was able to root Cubot J5.
CUBOT_J5_9061C_V14_20200506
Magisk 23.0(23000)
Cubot J5 is "Ramdisk No".
Must be booted in recovery mode.
Magisk in Recovery
Installation
The Magic Mask for Android
topjohnwu.github.io
Steps
1. Patch your boot.img and recovery.img with magisk
Img file can be downloaded
CUBOT FILE DOWNLOAD
Cubot Offical Website for Smartphones and Wearables. Simple and Trust, Cubot aims to be a credit worthy high-tech corporation in the world.
www.cubot.net
2.Edit the boot.img file with a hex editor.
Change 「736B69705F696E697472616D6673」 to 「77616E745F696E697472616D6673」
3.flashing the boot.img recovery.img and vbmeta.img .
vbmeta.img file can be downloaded
331 Cubot J5
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com
fastboot flash boot magisk_patched-23000_boot_binay_edit.img
fastboot flash boot magisk_patched-23000_boot.img
fastboot flash recovery magisk_patched-23000_recovery.img
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
4.Must be booted in recovery mode to enter root state.
adb reboot recovery
or
Press and hold the Power key and the Volume UP key when booting.
たろう said:
I was able to root Cubot J5.
CUBOT_J5_9061C_V14_20200506
Magisk 23.0(23000)
Cubot J5 is "Ramdisk No".
Must be booted in recovery mode.
Magisk in Recovery
Installation
The Magic Mask for Android
topjohnwu.github.io
Steps
1. Patch your boot.img and recovery.img with magisk
Img file can be downloaded
CUBOT FILE DOWNLOAD
Cubot Offical Website for Smartphones and Wearables. Simple and Trust, Cubot aims to be a credit worthy high-tech corporation in the world.
www.cubot.net
2.Edit the boot.img file with a hex editor.
Change 「736B69705F696E697472616D6673」 to 「77616E745F696E697472616D6673」
3.flashing the boot.img recovery.img and vbmeta.img .
vbmeta.img file can be downloaded
331 Cubot J5
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com
fastboot flash boot magisk_patched-23000_boot_binay_edit.img
fastboot flash recovery magisk_patched-23000_recovery.im
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
4.Must be booted in recovery mode to enter root state.
adb reboot recovery
or
Press and hold the Power key and the Volume UP key when booting.
Click to expand...
Click to collapse
I tried flashing your files but unfortunately got a bootloop again . I was on the same stock software, unlocked bootloader and tried to flash as you described.
weeman45 said:
I tried flashing your files but unfortunately got a bootloop again . I was on the same stock software, unlocked bootloader and tried to flash as you described.
Click to expand...
Click to collapse
Cause of bootloop.
1. vbmeta.img is not flushed.
2. The firmware version is different.
The version of this file is "CUBOT_J5_9061C_V14_20200506".
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
たろう said:
Cause of bootloop.
1. vbmeta.img is not flushed.
2. The firmware version is different.
The version of this file is "CUBOT_J5_9061C_V14_20200506".
Click to expand...
Click to collapse
Thanks for your reply! When i woke up today i thought i can just as well restore the stock rom but found the phone booting.
The boot was just taking way longer because of the factory reset (through oem unlock).
I just installed the root checker and it is working fine!
After years of having this phone and trying to root it you just saved it. Thank you!
Do you have plans to install GSI images on it as well?
*update* i'm able to boot a lineageos 18.1 GSI with your images. I flashed the system and afterwards your boot, recovery and vbmeta and it worked.
*update2* I wanted gApps so i tried the lineageos 19.1 image which was too big. After that i tried an AOSP one with lite gApps.
I think i messed up badly. I can't get back into fastboot and not even the spflash tool is able to flash something. When pressing Volume down+power it briefly detects it but won't write the firmware. I'll try different versions later and report back but for now it's dead
*uodate3* It's back again. I had to re-install the mediatek drivers for the tool to work. After a stock boot i was able to unlock the bootloader and install LOS again. I will go for an image with gapps next.
Thank you again for providing your images and support!
weeman45 said:
Thanks for your reply! When i woke up today i thought i can just as well restore the stock rom but found the phone booting.
The boot was just taking way longer because of the factory reset (through oem unlock).
I just installed the root checker and it is working fine!
After years of having this phone and trying to root it you just saved it. Thank you!
Do you have plans to install GSI images on it as well?
*update* i'm able to boot a lineageos 18.1 GSI with your images. I flashed the system and afterwards your boot, recovery and vbmeta and it worked.
*update2* I wanted gApps so i tried the lineageos 19.1 image which was too big. After that i tried an AOSP one with lite gApps.
I think i messed up badly. I can't get back into fastboot and not even the spflash tool is able to flash something. When pressing Volume down+power it briefly detects it but won't write the firmware. I'll try different versions later and report back but for now it's dead
*uodate3* It's back again. I had to re-install the mediatek drivers for the tool to work. After a stock boot i was able to unlock the bootloader and install LOS again. I will go for an image with gapps next.
Thank you again for providing your images and support!
Click to expand...
Click to collapse
I'm so glad to hear that.
I have no plans to install GSI images.
たろう said:
I'm so glad to hear that.
I have no plans to install GSI images.
Click to expand...
Click to collapse
You really helped a lot. I'm always glad to tinker with spare phones.
For anyone else stumbling upon this thread trying to install a GSI image: Here is how i succeeded.
1. Enable unlocking in your developer settings
2. Use "fastboot flashing unlock" to enable flashing (this performs a factory reset)
3. wipe your system partition with "fastboot erase system"
4. Flash your GSI image wizh "fastboot flash system 'path-to-your-GSI' "
5. flash the provided vbmeta with "fastboot --disable-verity --disable-verification flash vbmeta 'path-to-vbmeta.img' "
I had success with lineageos 18 A/B with gapps. Make sure that it's not too big in size or else you will get an error message stating it is too big.
If you have troubles getting into recovery/fastboot, use the SPflashtool to revover your stock firmware (be sure to NOT format all because you will lose your IMEI information in that process!) and try again
Hi,
i tried to root my Cubot J5 by doing the following:
flash system system.img (from CUBOT_J5_9061C_V14_20200506 .zip)
fastboot flash boot magisk_patched-23000_boot.img
fastboot flash recovery magisk_patched-23000_recovery.img
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
reboot in recovery mode
When check for root with root checker basic, systems says, that magisk is crashed several times. And after this root checker states that no root is granted.
Any idea?
pat2858 said:
Hi,
i tried to root my Cubot J5 by doing the following:
flash system system.img (from CUBOT_J5_9061C_V14_20200506 .zip)
fastboot flash boot magisk_patched-23000_boot.img
fastboot flash recovery magisk_patched-23000_recovery.img
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
reboot in recovery mode
When check for root with root checker basic, systems says, that magisk is crashed several times. And after this root checker states that no root is granted.
Any idea?
Click to expand...
Click to collapse
I have no idea.
if possible to initialize with flash tool and then try again.
Tried it, but no luck.
Don't know why magisk is crashing all the time.
pat2858 said:
Tried it, but no luck.
Don't know why magisk is crashing all the time.
Click to expand...
Click to collapse
Is the Magisk version 23?
I have not confirmed the latest version(24~)

Stock rom of Doogee S96 pro

Dear community,
I have a doogee S96 pro, I'm from Italy, and I installed TWRP from the unofficaltwrp guide.
Now I'm no more able to boot, the phones goes directly to the recovery.
Probably magisk was no able to patch the system and to disable the tm verity (avb). I have a super partition, and from what I saw the fstab is inside the vendor partition inside super.
Doogee does not provide stock roms, so I cannot restore the phone as factory settings, that's why I open this thread.
Is someone available to help me booting into Android or available to give me the stock boot/recovery img? It's a fast and safe procedure, I can give more details on how to do.
Thank you!
Dear @giubenez I had a similar problem. But after I got in touch with doogee support they sent me the firmware. I want to share it with you and with any other person that wants to ROOT THE DOOGEE S96 PRO
The following link is the firmware and upgrade tool. Please open and download.
Please note that if your computer system is French you need to change the name of the downloaded file.
Spoiler: Link
ZN129(S96)
Folder
1drv.ms
When upgrading the firmware, please do not select the 'Format All+Download' option
When flashing the phone, please set up the software first, turn off the phone, and then connect the phone to the computer.
Best wishes
Wow! thank you!!!
You saved... us!
Why doogee does not respond to me? why they not post the firmware on the forum? WTF
@giubenez Im very happy to contribute something. IDK why doogee doesnt list this firmware in their website. I was very lucky to receive an answer to my emails.
Also I successfully rooted my S96 PRO, but I learned a few things in the process that might be helpful to you or anyone trying to root this model.
1) After flashing the boot.img (using magisk method). The device went into a boot loop. I could not enter into recovery mode either. I discovered vbmeta was responsible for the boot loop.
Google introduced vbmeta which is also a verity check. An option to bypass this check is to flash an empty vbmeta.img before attempting to flash TWRP recovery.
Click to expand...
Click to collapse
I solved this by flashing an empty vbmeta file.
Code:
fastboot flash vbmeta vbmeta.img
You can download the vbmeta.img file I used HERE
2) After flashing vbmeta, the device finally booted and the root was done. But the first time, I noticed all the internal storage folders and files were encrypted. (I know this is normal when you browse files through TWRP, but it happened to me while using the phone in the first boot)
I solved that by wiping > Format Data in TWRP
3) Here you can find the files I used to install TWRP and remove the orange state notification on boot: LINK "Credits to www.getdroidtips.com"
Ankiseth said:
@giubenez Im very happy to contribute something. IDK why doogee doesnt list this firmware in their website. I was very lucky to receive an answer to my emails.
Also I successfully rooted my S96 PRO, but I learned a few things in the process that might be helpful to you or anyone trying to root this model.
1) After flashing the boot.img (using magisk method). The device went into a boot loop. I could not enter into recovery mode either. I discovered vbmeta was responsible for the boot loop.
I solved this by flashing an empty vbmeta file.
Code:
fastboot flash vbmeta vbmeta.img
You can download the vbmeta.img file I used HERE
2) After flashing vbmeta, the device finally booted and the root was done. But the first time, I noticed all the internal storage folders and files were encrypted. (I know this is normal when you browse files through TWRP, but it happened to me while using the phone in the first boot)
I solved that by wiping > Format Data in TWRP
3) Here you can find the files I used to install TWRP and remove the orange state notification on boot: LINK "Credits to www.getdroidtips.com"
Click to expand...
Click to collapse
GOD BLESS YOU, Ankiseth!
YOU SAVE MY PHONE! SPFLASH AND EVERYTHING WORKS!
Hi guys : I need help. Since the last firmware update (settings/about phone/update) DOOGEE-S96Pro-EEA-Android10.0-20210128, my Ir Camera don't work anymore
Video : https://oracle.tuxme.net/s/Xng63Ej3kJoJhOj
When I used the dial mode *#*#8613#*#* SINGLE TEST
* INFRAED LIGHT : i see the IR light
* Night Vision camera : app crash like the camera when i switch to the night vision mode.
Doggee mail me :
Good day, I would like to ask you to help us. Please use the following link: https://1drv.ms/u/s!AvX9KABcpSV1kTOgCMsUkLyXY-we?e=nMchxl Download the previous version of the S96pro firmware and follow the tutorial to return the phone to OTA The previous version (ver3.02) was upgraded. The tutorial has been included in the firmware compression package. Please test the night vision camera after flashing the camera and let me know if it can be used normally. Thank you very much.
Click to expand...
Click to collapse
But the documentation is .... you know ...
Have you a step by step tutorial or tools to do that ?
Beanpod_ActiveTool is a tool to modified serials, Imei ?
Have i to used SP Flash tool ?
Thanks guys !!
by the way @Ankiseth :
Please note that if your computer system is French you need to change the name of the downloaded file.
Click to expand...
Click to collapse
which file ?
berzerking said:
Hi guys : I need help. Since the last firmware update (settings/about phone/update) DOOGEE-S96Pro-EEA-Android10.0-20210128, my Ir Camera don't work anymore
Video : https://oracle.tuxme.net/s/Xng63Ej3kJoJhOj
When I used the dial mode *#*#8613#*#* SINGLE TEST
* INFRAED LIGHT : i see the IR light
* Night Vision camera : app crash like the camera when i switch to the night vision mode.
Doggee mail me :
But the documentation is .... you know ...
Have you a step by step tutorial or tools to do that ?
Beanpod_ActiveTool is a tool to modified serials, Imei ?
Have i to used SP Flash tool ?
Thanks guys !!
by the way @Ankiseth : which file ?
Click to expand...
Click to collapse
There Is Hope Brother... I Just Downloaded The Files And Used The SCATTER-LOADING FILE From 3.02 on SP-FlashTools 5.2 Switched It To Download Only And Hit Download .. Plugged In My Phone To USB While OFF And aftyer the loading was complete .. Phone Reboot As If NEW. ( HARD RESET) EVERYTHING LOST WARNING.. But IR CAMERA is Working AGAIN!!!!! Now i Just Have To ReLoad All Apps And Accounts .. And Wait For The oukitel WP7 i ordered out of frustration. Will Be Doing A Review Comparison On Both Cameras !!!!! You Can Follow Me Here If Interested https://www.youtube.com/channel/UCYOpd4yooYgKS-0xe63jnCw
Hi all. Thanks for the information. I was in touch with doogee and they say to me that there is an update during this WE (S9S88A7.DGE.DOOGEE.EEA.HB.HJAYYDVFAZ.0128.V3.03820210313-2312.
Nothing change IR camera don't work
I will flash my S96pro during the week with S9S88A7.DGE.DOOGEE.EEA.HB.HJ.AYYDVFAZ.1130.V3.02.zip and I'll post here what happened
HouseOwl said:
) EVERYTHING LOST WARNING.. But IR CAMERA is Working AGAIN!!!!!
Click to expand...
Click to collapse
Yes !!!!! it s alive !!!!
Thank you dude ! my ir works again !!!!!
btw a couple of days after your post, another user posted the same folder on https://4pda.ru/forum/index.php?showtopic=1010578&st=340.
I rooted the phone by using the 4pda method (i.e. flashing super.img, boot.img, vbmeta.img). After that I flashed twrp and it was fine. Everything was working.
After that I downloaded the OTA update and the phone is no more able to boot, simply goes to TWRP. I tried formatting data, dalvik and cache but the situation is always the same: when i try to boot i go to the recovery. Any idea? Thank you
berzerking said:
But the documentation is .... you know ...
Have you a step by step tutorial or tools to do that ?
Beanpod_ActiveTool is a tool to modified serials, Imei ?
Have i to used SP Flash tool ?
Thanks guys !!
by the way @Ankiseth : which file ?
Click to expand...
Click to collapse
Can you write a tutorial? Have you used SP flash tool?
Thank you!
giubenez said:
btw a couple of days after your post, another user posted the same folder on https://4pda.ru/forum/index.php?showtopic=1010578&st=340.
I rooted the phone by using the 4pda method (i.e. flashing super.img, boot.img, vbmeta.img). After that I flashed twrp and it was fine. Everything was working.
After that I downloaded the OTA update and the phone is no more able to boot, simply goes to TWRP. I tried formatting data, dalvik and cache but the situation is always the same: when i try to boot i go to the recovery. Any idea? Thank you
Click to expand...
Click to collapse
I solved in this way:
>fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
(with the empty vbmeta
>fastboot.exe flash recovery recovery.img
(with the stock recovery)
>fastboot reboot
after that the update attempted to start and failed, the phone then boot to android.
The updates always failes after that, so I disabled them.
this is why the update fails..is it because I used the the Russian super img?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
#edit: it was because I flashed the wrong recovery. With the correct one, i still have issues with the update: md5 chechsum controll is not passed and the update aborts.
I don't care, I prefer a rooted phone without the updates.
your device has not passed the test and may not work properly - Here is a message on the screen . Constantly overloaded is not included in the recovery. The firmware doesn't help.
Could someone repost the S96Pro stock firmware... I can't find it anywhere online, thanks in advance
I'm uploading them.
https://bit.ly/3en9EZY
Thanks giubenez ,u saved me but now I have the watermark from formatting Google Key State : Fail, I don't see a factory mode file to freeze, tried ADB and couldn't find the build prop values, has anyone else ran into this with a fix?
I can't get what problem are you facing. I unlocked and rooted my s96 pro.
If you describe your issue i can help you solving it.
However, i found very risky to root the phone, if you plan to do the ota updates avoid TWRP since it'll make you bootloop at the moment you try to install the update.
The only way to solve it is to flash the stock recovery through adb.
So.. yeah.
I have recently procured this device and want to install twrp, and stock and/or test a gsi and in what capacity the phone works with one of those.
Enabled both developer mode & the usb debug mode and adb devices lists the device.
N.B; the supplied s96pro cable does not seem to carry data, "presumably" because doogee is cheapskates on cables, as well in the support department. I had to use my sony headphone cable. Go figure, its consequential at least, so there's that.
In any case, read this thread and have downloaded all files, including the apparently new stock rom that is listed since yesterday in the evidently wholesome user Ankiseth's link above.
Questions:
In the 4pda link there are some instructions, specifically the adb command with the boot.img, however.. the links seems to be dead. What to do?
A) Can I first do the vbmeta command and then use our lord and savior Ankiseth's twrp recovery file and follow a generic "Case II: Devices with A/B partition scheme" mentioned in this xda twrp guide?
B) Hope that some other wholesome user share the boot.img file?
(Or, can I use the one in the zip file 'S9S88A7.DGE.DOOGEE.HB.HJ.AYYDVFAZ.1203.V3.04' ?)
-
After twrp is accessible can I use twrp/adb and install either the mentioned shared rom and any gsi for that matter?
I use linux and sure there is spflash, but the adb & twrp combo "subjectively feels" as a more stable way of doing things.
Update 2. Got both twrp and magisk going. Now to figure out if I can install a gsi.
Update, got spflashtool working and used the latest stock rom mentioned in my previous post.
However.
I patched the boot.img from said stock rom in magisk and also flashed twrp-recovery with fastboot.
No luck. Magisk seems not to be installed and the usual twrp gui does not show, seems to be the stock recovery. Got a orange state though.

How To Guide Global/US unbricking guide.

Global/US OnePlus 9 Unbricking Guide
Tested and used on a LE2115 variant device.
YOU SHOULDN'T USE THIS GUIDE UNLESS YOU ARE ABSOLUTELY SURE YOUR PHONE IS BRICKED. PLEASE TRY POWER COMBOS FIRST! THERE ARE NO GUARANTEES, AND THIS SHOULD BE A LAST DITCH ATTEMPT BEFORE SENDING IT TO ONEPLUS (THEY WILL FIX IT FOR YOU, UNLOCKED BOOTLOADER OR NOT)
Step 1: Boot your device into EDL mode. (If it's not already), then plug it in.
If it isn't, and you're in fastboot, you can boot into it via fastboot oem edl (correct me if I'm wrong here)
Step 2: Download the MSM tool.
The proper MSM tool can be found here.
I'd recommend using Internet Download Manager to speed it up.
Unzip it using something like 7-zip into the root folder of any drive (the root folder meaning the topmost, any subdirectories may have issues).
Some AVs may flag MSM, so please make an exception (it's safe, you can ask basically anyone)
Step 3: Install the right drivers. (If they aren't installed)
The proper drivers can be found here.
Use the readme.txt file in the driver zip, it'll explain how to do everything.
Step 4: Run the "MsmDownloadTool V4.0.exe"
Set the dropdown to "Others" and click next.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Check the "Use Lite Firehose" box, and uncheck the "Sha256 check" box.
Click on "Start" once your phone is detected.
Step 5: Let it run for around 300-350 seconds (that's how long it took mine). Once it says "Completed" (if it errors, see below), congrats! You've unbricked your OnePlus 9!
Errors
If an error occurs, don't worry! See here for the potential errors and how to solve them.
Sahara Communication Failed
When this happens, try using a different cable (one included in box is best), and try a different port. If both fail, try on another computer.
Device not match image!
Okay, this one WILL take much longer than the previous one, but this is still fixable.
Download this MSM tool instead following the same guidelines as above. (I am aware it is the wrong version, however this is the only working fix to the extent of my knowledge.)
Close the old one.
Flash using the above guidelines aswell.
Once finished (you have to wait the 300 seconds), hope that it works lol.
If it does, it'll reboot into OxygenOS. Go through setup as normal (the cursed camera cutout is also normal), finish it, and then you will have to:
Set up Magisk (too many guides for it, not going to explain it here.
Flash magisk by booting into TWRP using fastboot (fastboot boot twrp-3.6.0_11-0-lemonadep.img) (install menu, then find magisk's file), then copy TWRP's image to the device and install the ramdisk via the image (should be in advanced).
Install this app.
When setting up, grant it root access, and make sure to select the Stable (Full) channel, and set your device to OnePlus 9. (NOT THE INDIA VERSION, NO MATTER WHAT IT SAYS.
Go into settings, and enable Advanced Mode (this is req'd)
Go to the main page, and click download update.
When it finishes, let it do automatic install (UNCHECK ALL BOXES OR IT WILL ERROR!)
Congrats! You fixed it!
If it doesn't work, you may have to send it off to OnePlus. They will still do repairs even on unlocked bootloaders assuming that you're in warranty.
Nice guide ! Just one question, the TWRP link is for OnePlus 9 pro, it is normal?
Other point, to be complete, you should specify how to boot in EDL mode and add fastboot commands for every operations, like flashing twrp
akboy7015 said:
Nice guide ! Just one question, the TWRP link is for OnePlus 9 pro, it is normal?
Other point, to be complete, you should specify how to boot in EDL mode and add fastboot commands for every operations, like flashing twrp
Click to expand...
Click to collapse
Yup, it's normal. I use that specific TWRP on my LE2115. I'll make the edits right away! Thanks for the suggestion!
I have a CN variant of OnePlus 9 (LE2110) running the Global version of Oxygen OS 11.2.10.10LE25AA.
I installed the latest TWRP (3.6.0_11-0-lemonade) from the TWRP website and then I rooted the phone via TWRP with Magisk v23 and everything was fine.
Today I installed a new version of the launcher which was probably buggy, and it made the phone act funny even when I rebooted the device, so I booted the phone into TWRP recovery and dirty flashed the ROM and then reflashed Magisk for root. This is how I used to do it with my 5T.
Obviously, I have done sth wrong, and now the phone boots only in fastboot mode. When I try to boot into recovery, TWRP loads with the lockscreen but it doesn’t work, you cannot do anything, whatever you press it doesn’t react.
To my understanding, I have soft-bricked the phone and need to follow your guide to unbrick it?
panoramixmeister said:
I have a CN variant of OnePlus 9 (LE2110) running the Global version of Oxygen OS 11.2.10.10LE25AA.
I installed the latest TWRP (3.6.0_11-0-lemonade) from the TWRP website and then I rooted the phone via TWRP with Magisk v23 and everything was fine.
Today I installed a new version of the launcher which was probably buggy, and it made the phone act funny even when I rebooted the device, so I booted the phone into TWRP recovery and dirty flashed the ROM and then reflashed Magisk for root. This is how I used to do it with my 5T.
Obviously, I have done sth wrong, and now the phone boots only in fastboot mode. When I try to boot into recovery, TWRP loads with the lockscreen but it doesn’t work, you cannot do anything, whatever you press it doesn’t react.
To my understanding, I have soft-bricked the phone and need to follow your guide to unbrick it?
Click to expand...
Click to collapse
This guide is for phones stuck in edl mode. This won't work on CN phones to the extent of my knowledge. If you can get into fastboot, you can try and recover via a tool. I'm not sure why twrp is doing that, but can you try booting the twrp image instead of booting the flashed one? Sorry about the late response, by the way
@winterfoxx,
thanks for this very useful guide, a curiosity, when you use the zip file linked from "OnePlus_9_Pro_India_OxygenOS_11.2.4.4", you flash the file inside the zip, "lemonadep_22_I.07_210412" which is for the Pro model? right? thanks
winterfoxx said:
This guide is for phones stuck in edl mode. This won't work on CN phones to the extent of my knowledge. If you can get into fastboot, you can try and recover via a tool. I'm not sure why twrp is doing that, but can you try booting the twrp image instead of booting the flashed one? Sorry about the late response, by the way
Click to expand...
Click to collapse
It worked perfectly for the CN variant (LE2110) that I have. The CN variant is running the Global version of OxygenOs (AA) so the only difference was that I had all three options checked (Sha256 check, Auto reboot and Use Lite Firehose).
The first few times I got the Sahara Communication Failed message but I followed your suggestion and changed USB port and cable and it worked flawlessly.
Thank you for the very helpful guide!
I managed to do as described step by step in the guide, after the flash of the original rom via "oxygen updater" but on restart there is actually the stock rom but the touch remains blocked, I also tried to do a factory reset but nothing changes, my phone gets stuck on the first screen and the touch does not respond, any advice? Thank you
iaio72 said:
I managed to do as described step by step in the guide, after the flash of the original rom via "oxygen updater" but on restart there is actually the stock rom but the touch remains blocked, I also tried to do a factory reset but nothing changes, my phone gets stuck on the first screen and the touch does not respond, any advice? Thank you
Click to expand...
Click to collapse
So sad , I am in the same situation!
Did you figured it out ??
from oxygen updater, I also tried to flesh the Open beta 1, but same result, the touchscreen does not respond, strange but with the rom for the pro version the touchscreen works fine, I'm looking for a way to solve but still nothing new....
iaio72 said:
I managed to do as described step by step in the guide, after the flash of the original rom via "oxygen updater" but on restart there is actually the stock rom but the touch remains blocked, I also tried to do a factory reset but nothing changes, my phone gets stuck on the first screen and the touch does not respond, any advice? Thank you
Click to expand...
Click to collapse
i had to do this with the latest a12 update broke the screen like your saying and this is the steps i had to take to fix it
Device not match image!
Okay, this one WILL take much longer than the previous one, but this is still fixable.
Download this MSM tool instead following the same guidelines as above. (I am aware it is the wrong version, however this is the only working fix to the extent of my knowledge.)
Close the old one.
Flash using the above guidelines aswell.
Once finished (you have to wait the 300 seconds), hope that it works lol.
If it does, it'll reboot into OxygenOS. Go through setup as normal (the cursed camera cutout is also normal), finish it, and then you will have to:
Set up Magisk (too many guides for it, not going to explain it here.
Boot into TWRP using fastboot (fastboot boot twrp-3.6.0_11-0-lemonadep.img
Flash 11.2.10.10 ota zip in twrp via adb sideload and reboot and you will have working screen and everything else.
at this point do not update to A12 update aka the c36 ota in settings or you will face the same issue and have to redo this process
Congrats! You fixed it!
panoramixmeister said:
It worked perfectly for the CN variant (LE2110) that I have. The CN variant is running the Global version of OxygenOs (AA) so the only difference was that I had all three options checked (Sha256 check, Auto reboot and Use Lite Firehose).
The first few times I got the Sahara Communication Failed message but I followed your suggestion and changed USB port and cable and it worked flawlessly.
Thank you for the very helpful guide!
Click to expand...
Click to collapse
Congrats! I'm glad I was able to help
iaio72 said:
I managed to do as described step by step in the guide, after the flash of the original rom via "oxygen updater" but on restart there is actually the stock rom but the touch remains blocked, I also tried to do a factory reset but nothing changes, my phone gets stuck on the first screen and the touch does not respond, any advice? Thank you
Click to expand...
Click to collapse
Erm, try factory resetting it in twrp
winterfoxx said:
Erm, try factory resetting it in twrp
Click to expand...
Click to collapse
even with twrp flashed the device is frozen in recovery same as on the main screen even for me i had todo it the way i listed above to be able to even do anything on the phone and it was the only way for it to work correctly for me
the one downside to this method that ive found is i am still unable to flash stock OP9 msm even after fixing i still get the device not match image error even after using the param from my stock msm backup files and flashing it directly to my device.
i verified before i even had this issue that my device was in fact a le2115 and backed up all partitions using msm.

			
				
i figured out the best way to flash stock global to device and not have a frozen screen if you update to a12
i can verify that you can shorten this down by a few steps also and it will still work .
At step 4 just flash global msm with step 2 options unchecked and device set as o2 and start
Although i would advise against taking the a12 update for multiple reasons
papad13 said:
So sad , I am in the same situation!
Did you figured it out ??
Click to expand...
Click to collapse
now i try to: at the step where you installed twrp, now i try to flash (adb sideload...) indian fw to downgrade from openbeta, stay tuned!!
allenjthomsen said:
i figured out the best way to flash stock global to device and not have a frozen screen if you update to a12
i can verify that you can shorten this down by a few steps also and it will still work .
At step 4 just flash global msm with step 2 options unchecked and device set as o2 and start
Although i would advise against taking the a12 update for multiple reasons
Click to expand...
Click to collapse
"a12" you talked aboit open beta? or we have official oxygen android 12? thx
iaio72 said:
now i try to: at the step where you installed twrp, now i try to flash (adb sideload...) indian fw to downgrade from openbeta, stay tuned!!
Click to expand...
Click to collapse
Can you help finding the “param bin file global”
Please ?

How To Guide Gaining root access on New Oxygen OS A12 for the op9.

Root OnePlus 9, 9 Pro, 9R Android 12 ColorOS 12 via Magisk
Thi guide will show you how to root the OnePlus 9, OnePlus 9 Pro, and OnePlus 9R running ColorOS 12 Android 12 via Magisk Patched Boot.img
www.droidwin.com
Just sharing what I've learned. Have to patch boot.img and vendor boot.img and flash out of folder in sdk on desktop.Then use vb_meta.img to disable verity flash. Guide above has to be followed to a T. Even though it's for the Chinese version Color os works fine on Oos... Patch boot.img /vendor_boot with magisk 23.0. This way magisk hide and modules work. If you patch with canary version of magisk you loose both. I'm attaching stock boot, vb_meta vendor_boot.img files for the Global unlocked op9. Files are from new A12 os. Btw 23.0 works perfectly on A12. If this helps hit the like button; it's free.
0p9 partitions..A 12 - Google Drive
drive.google.com
This method is overkill for rooting both versions of A12 that were released ,
The best method for a12 with unlocked bootloader is this:
Patch boot.img & copy to adb folder on pc
Reboot to bootloader
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash boot *nameofpatchedbootimagehere.img*
IF YOUR DOING A CLEAN FLASH OF A12 BEFORE SETUP = fastboot-w
fastboot reboot
Worst case scenario you will have to wipe all data for it to register correctly and boot fully.
The vendor_boot does not need to be patched with the A12 update, you have to disable verity and verification instead of just verification for any device running A12.
allenjthomsen said:
This method is overkill for rooting both versions of A12 that were released ,
The best method for a12 with unlocked bootloader is this:
Patch boot.img & copy to adb folder on pc
Reboot to bootloader
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash boot *nameofpatchedbootimagehere.img*
IF YOUR DOING A CLEAN FLASH OF A12 BEFORE SETUP = fastboot-w
fastboot reboot
Worst case scenario you will have to wipe all data for it to register correctly and boot fully.
The vendor_boot does not need to be patched with the A12 update, you have to disable verity and verification instead of just verification for any device running A12.
Click to expand...
Click to collapse
I do know that just patching boot.img and flashing it breaks boot and build. Found that out the hard way. Could only reach fastboot no stock recovery . And couldn't fastboot --set-active=other. Wipe data and boot into old oos on opposite slot. I've had msm tool on my desktop and have heard horror stories of people using and it throwing errors and failing. Plugged mine right in booted edl from adb and 512 sec later had a booting device in oxygen oos
mattie_49 said:
I do know that just patching boot.img and flashing it breaks boot and build. Found that out the hard way. Could only reach fastboot no stock recovery . And couldn't fastboot --set-active=other. Wipe data and boot into old oos on opposite slot. I've had msm tool on my desktop and have heard horror stories of people using and it throwing errors and failing. Plugged mine right in booted edl from adb and 512 sec later had a booting device in oxygen oos
Click to expand...
Click to collapse
I can verify that my method works 100% on build C.36 of A12, because i am currently running it and have redone the steps multiple times to make sure nothing happens that could be bad ,the steps i have listed above in the previous post work perfectly and still let me have root currently, and i have only patched the stock boot.img.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If your wondering how i have come to this doing it the way i did it.
I downloaded and copied the update to desktop and extracted the stock boot and patched it in magisk from the device.
I then i extracted the stock vbmeta image and after flashing the full update via local install from system settings i booted to bootloader and disabled verity and verification and then flash the patched boot image.
I then rebooted into full stock C.36 with root.
I can tell you i did this 5 times before i made the reply to you earlier and verified that it booted every time no issue without patching vendor_boot.
allenjthomsen said:
If your wondering how i have come to this doing it the way i did it.
I downloaded and copied the update to desktop and extracted the stock boot and patched it in magisk from the device.
I then i extracted the stock vbmeta image and after flashing the full update via local install from system settings i booted to bootloader and disabled verity and verification and then flash the patched boot image.
I then rebooted into full stock C.36 with root.
I can tell you i did this 5 times before i made the reply to you earlier and verified that it booted every time no issue without patching vendor_boot.
Click to expand...
Click to collapse
How does one undo the disable verity with stock vb_meta after flashing back stock boot.img and vendor boot.img ,I still couldn't take internal Google ota today. Failed after I tried restoring both of those.
Anyone knows if the new oos12 is actually "stable"? Haha
infamousvincci said:
Anyone knows if the new oos12 is actually "stable"? Haha
Click to expand...
Click to collapse
Yes all the small issues I had are corrected in today's am build.
mattie_49 said:
Yes all the small issues I had are corrected in today's am build.
Click to expand...
Click to collapse
I talk to you in TG bro. Its me, the one that has a op9 that doesnt read sim on oos12. Hahaha
mattie_49 said:
I do know that just patching boot.img and flashing it breaks boot and build. Found that out the hard way. Could only reach fastboot no stock recovery . And couldn't fastboot --set-active=other. Wipe data and boot into old oos on opposite slot. I've had msm tool on my desktop and have heard horror stories of people using and it throwing errors and failing. Plugged mine right in booted edl from adb and 512 sec later had a booting device in oxygen oos
Click to expand...
Click to collapse
Oh maan, that was my last night. Lost weeks worth of data with no back up
And I've bricked and recovered before but the way this one acted was scary as hell. A few times it said "die" at the crashdump.
mizarddo said:
Oh maan, that was my last night. Lost weeks worth of data with no back up
And I've bricked and recovered before but the way this one acted was scary as hell. A few times it said "die" at the crashdump.
Click to expand...
Click to collapse
Hello, please can you give me more details about what causes you the loss, how you did it because I'm about to do the same process and I'm afraid to get my onePlus 9 bricked
mooadeer said:
Hello, please can you give me more details about what causes you the loss, how you did it because I'm about to do the same process and I'm afraid to get my onePlus 9 bricked
Click to expand...
Click to collapse
Well first of all, at the time my version of magisk did not support android 12 for patching boot.img
But that has been long fixed, just get the latest magisk version.
And for the next part, if you are trying to root first time, do NOT use the command "fastboot flash boot boot.img" instead use "fastboot boot boot.img" to temporarily boot the patched version of boot image. That will temporarily give you root access on next power on until you restart. And while you have that temporary root, you can use magisk app to direct install that patched boot image and gain permanent root access.
Also from there after every OTA update BEFORE RESTARTING THE PHONE you can use magisk and "install to inactive slot" to retain your root with the update.
Hope that helped.
mizarddo said:
Well first of all, at the time my version of magisk did not support android 12 for patching boot.img
But that has been long fixed, just get the latest magisk version.
And for the next part, if you are trying to root first time, do NOT use the command "fastboot flash boot boot.img" instead use "fastboot boot boot.img" to temporarily boot the patched version of boot image. That will temporarily give you root access on next power on until you restart. And while you have that temporary root, you can use magisk app to direct install that patched boot image and gain permanent root access.
Also from there after every OTA update BEFORE RESTARTING THE PHONE you can use magisk and "install to inactive slot" to retain your root with the update.
Hope that helped.
Click to expand...
Click to collapse
It helps a lot thank you I just got my oneplus 9 and it's on the latest update C.47 and I don't have too much experience with onePlus or even the new android devices I'm a little bit outdated didn't use root and stuff sins the android 5 that's why I'm a little bit confused I don't want to break it
mizarddo said:
Well first of all, at the time my version of magisk did not support android 12 for patching boot.img
But that has been long fixed, just get the latest magisk version.
And for the next part, if you are trying to root first time, do NOT use the command "fastboot flash boot boot.img" instead use "fastboot boot boot.img" to temporarily boot the patched version of boot image. That will temporarily give you root access on next power on until you restart. And while you have that temporary root, you can use magisk app to direct install that patched boot image and gain permanent root access.
Also from there after every OTA update BEFORE RESTARTING THE PHONE you can use magisk and "install to inactive slot" to retain your root with the update.
Hope that helped.
Click to expand...
Click to collapse
Update following your instructions everything is Ok done with rooting thank you
LE2113 on C.47
mizarddo said:
Well first of all, at the time my version of magisk did not support android 12 for patching boot.img
But that has been long fixed, just get the latest magisk version.
And for the next part, if you are trying to root first time, do NOT use the command "fastboot flash boot boot.img" instead use "fastboot boot boot.img" to temporarily boot the patched version of boot image. That will temporarily give you root access on next power on until you restart. And while you have that temporary root, you can use magisk app to direct install that patched boot image and gain permanent root access.
Also from there after every OTA update BEFORE RESTARTING THE PHONE you can use magisk and "install to inactive slot" to retain your root with the update.
Hope that helped.
Click to expand...
Click to collapse
from where can I download boot.img for version:
LE2113_11.C.47: LE2113_11.C.47_1470_202203102118
Thanks and best regards
Lol patching the boot image then flashing it with simple "fastboot flash boot patchedboot.img" works for me. It does not require any other images or patches.
_MartyMan_ said:
Lol patching the boot image then flashing it with simple "fastboot flash boot patchedboot.img" works for me. It does not require any other images or patches.
Click to expand...
Click to collapse
you mean boot image from OP? My question is how I get that file
aldoc01 said:
you mean boot image from OP? My question is how I get that file
Click to expand...
Click to collapse
Yep, stock boot images can be extracted from full zips with tools (payload extractor).
Also, i have a collection, check it out.
_MartyMan_ said:
Lol patching the boot image then flashing it with simple "fastboot flash boot patchedboot.img" works for me. It does not require any other images or patches.
Click to expand...
Click to collapse
So you think the same way the 9 Pro does it would work? The guide there says to grab the stock image, install Magisk app on the phone, patch the image with the app, boot (not flash) the image, then have Magisk direct install. I came here and saw all of this other stuff and was like... nahhh...
EtherealRemnant said:
So you think the same way the 9 Pro does it would work? The guide there says to grab the stock image, install Magisk app on the phone, patch the image with the app, boot (not flash) the image, then have Magisk direct install. I came here and saw all of this other stuff and was like... nahhh...
Click to expand...
Click to collapse
If you don't jump magisk across from A11 you have to disable verity with vb_meta partition as well to gain permanent root on A12. This I know it's my post.

Categories

Resources