The attached archive includes 3 tools for those of you with .3.2.3.2 (or earlier) bootloaders.
Since other tools (and earlier version of these very tools) are available and working well,
this is mostly meant as an entry to an imaginary beauty contest. (JOKING!!!)
cuber.py
a generic gmpy2-free reimplementation of @vortox's signature.py
use this to generate your unlock.img
cuboot.py (uses cuber.py)
a Python-only reimplementation of @vortox's cuber
includes fixes to the kernel command-line and the device-tree
use this to convert a standard Amazon boot.img (>=.4.x.x)
upHDX (uses cuboot.py)
bash script to repack Amazon updates for TWRP
could be DANGEROUS, use with care
tested on Apollo for both 14.4.5.2 and 14.4.5.3
my unit is fully 14.4.5.3 now, except for aboot (which is 3.2.3.2)
should work on Thor as well
Those with bootloader .3.2.6 and lower can downgrade to .3.1.0
and upgrade the bootloader to the latest vulnerable version .3.2.3.2.
Those with .3.2.7 and higher appear to be out of luck with forged signatures, but I hear there's progress on rooting .4.5.2.
The python scripts have been tested on the following OS / Python combinations:
Windows: 2.7.9 and 3.4.3
Linux: 2.7.9 and 3.3.4
OSX: 2.6.? (cannot quite remember)
In addition to the tools themselves, I also included "educational" examples
(examples.sh for Linux/OSX, examples.bat for Windows).
These make use of the split.py script, which is otherwise unnecessary.
(The Windows example also shows that simply echoing your manfid/serial
combo to cuber.py -the way one does in Linux/OSX- won't work due to
the carriage-return character introduced by the echo command.
You'll need to handcraft a file matching the '0x%02x%08xn' format...)
Another batch file py..bat is meant as an extra aid for Windows users
to avoid trouble with setting paths and such. You should be able to simply
download and install your preferred Python version.
Open a command shell (cmd.exe), navigate to wherever you extracted the
archives, and type 'py PYTHON-SCRIPT ARGS' to run the Python scripts.
(This handholding intentionally does NOT work for the upHDX script.)
Hopefully, someone will find these simple tools useful.
EDIT: To unlock your bootloader (<=.3.2.3.2), you'll need adb and fastboot.
On Linux, most distributions package these separately. Look for android-tools-{adb,fastboot} or some such.
For Windows, you can get these from the official Android SDK (which is a **large** download,
with a lot more tools you won't need, if you don't already use them, but it's safe).
Alternatively, there's a very legit-looking project here an XDA, with a much smaller
download, fast install, and exactly the tools you need. I haven't used either... (-;
The actual unlock procedure is described here and here.
EDIT#2: I added another script 'cublock.py' to make unlock.img generation super easy both on Windows and Linux.
MD5( tools.zip) = c17fc91344bd3b4b040129a79a39741f
EDIT#3: Fixed issues with older versions of certain tools on Debian 7.
MD5( tools.zip) = 4f93ab667fd61db26c83675ce0bd6d9f
EDIT#4: Fixed a bug when 'cuber.py' is used directly from the command line.
MD5(tools.zip) = 67b4a6d65aa2b0aa3500b122c8a25290View attachment 3210856
XDA:DevDB Information
HDXtools, Tool/Utility for the Amazon Kindle Fire HDX 7" & 8.9"
Contributors
draxie
Version Information
Status: Alpha
Created 2015-03-13
Last Updated 2015-03-13
Thank for your works.
Can I use upHDX to remove bootloader, recovery from 4.5.3 and flash via TWRP?
Thanks
tuanda82 said:
Thank for your works.
Can I use upHDX to remove bootloader, recovery from 4.5.3 and flash via TWRP?
Thanks
Click to expand...
Click to collapse
Let's hope so. That's what I did, in any case.
I'm an adventurer; so, I ran './upHDX fw update-kindle-14.4.5.3_user_453011120.bin',
pushed the resulting update-kindle-14.4.5.3_user_453011120-upHDXfw.zip to my HDX 8.9
and installed it with TWRP.
Worked for me, but I cannot provide any guarantees, unfortunately.
It may be wise to omit 'fw', and doublecheck that you're happy with the contents of the
updater-script in the newly generated archive.
AND, -of course- make sure your bootloader version is at most .3.2.3.2!!!
draxie said:
Let's hope so. That's what I did, in any case.
I'm an adventurer; so, I ran './upHDX fw update-kindle-14.4.5.3_user_453011120.bin',
pushed the resulting update-kindle-14.4.5.3_user_453011120-upHDXfw.zip to my HDX 8.9
and installed it with TWRP.
Worked for me, but I cannot provide any guarantees, unfortunately.
It may be wise to omit 'fw', and doublecheck that you're happy with the contents of the
updater-script in the newly generated archive.
AND, -of course- make sure your bootloader version is at most .3.2.3.2!!!
Click to expand...
Click to collapse
Thanks. But your upHDX scripts is for linux user only. I am on Windows .
If you have time could you upload your xxxx_14.4.5.3_xxxx.zip? Thanks
draxie said:
The attached archive includes 3 tools for those of you with .3.2.3.2 (or earlier) bootloaders.
Since other tools (and earlier version of these very tools) are available and working well,
this is mostly meant as an entry to an imaginary beauty contest. (JOKING!!!)
cuber.py
a generic gmpy2-free reimplementation of @vortox's signature.py
use this to generate your unlock.img
cuboot.py (uses cuber.py)
a Python-only reimplementation of @vortox's cuber
includes fixes to the kernel command-line and the device-tree
use this to convert a standard Amazon boot.img (>=.4.x.x)
upHDX (uses cuboot.py)
bash script to repack Amazon updates for TWRP
could be DANGEROUS, use with care
tested on Apollo for both 14.4.5.2 and 14.4.5.3
my unit is fully 14.4.5.3 now, except for aboot (which is 3.2.3.2)
should work on Thor as well
Those with bootloader .3.2.6 and lower can downgrade to .3.1.0
and upgrade the bootloader to the latest vulnerable version .3.2.3.2.
Those with .3.2.7 and higher appear to be out of luck with forged signatures, but I hear there's progress on rooting .4.5.2.
The python scripts have been tested on the following OS / Python combinations:
Windows: 2.7.9 and 3.4.3
Linux: 2.7.9 and 3.3.4
OSX: 2.6.? (cannot quite remember)
In addition to the tools themselves, I also included "educational" examples
(examples.sh for Linux/OSX, examples.bat for Windows).
These make use of the split.py script, which is otherwise unnecessary.
(The Windows example also shows that simply echoing your manfid/serial
combo to cuber.py -the way one does in Linux/OSX- won't work due to
the carriage-return character introduced by the echo command.
You'll need to handcraft a file matching the '0x%02x%08x\n' format...)
Another batch file py..bat is meant as an extra aid for Windows users
to avoid trouble with setting paths and such. You should be able to simply
download and install your preferred Python version.
Open a command shell (cmd.exe), navigate to wherever you extracted the
archives, and type 'py PYTHON-SCRIPT ARGS' to run the Python scripts.
(This handholding intentionally does NOT work for the upHDX script.)
Hopefully, someone will find these simple tools useful.
EDIT: To unlock your bootloader (<=.3.2.3.2), you'll need adb and fastboot.
On Linux, most distributions package these separately. Look for android-tools-{adb,fastboot} or some such.
For Windows, you can get these from the official Android SDK (which is a **large** download,
with a lot more tools you won't need, if you don't already use them, but it's safe).
Alternatively, there's a very legit-looking project here an XDA, with a much smaller
download, fast install, and exactly the tools you need. I haven't used either... (-;
The actual unlock procedure is described here and here.
EDIT#2: I added another script 'cublock.py' to make unlock.img generation super easy both on Windows and Linux.
MD5( tools.zip) = c17fc91344bd3b4b040129a79a39741f
Click to expand...
Click to collapse
Thanks a lot for the good work but id like to let tell you that it will be great if you can explain all the entire work in layman's terms because there would be many people having hundreds of questions and concerns.
Just an advice if you feel worthy... No disrespect intended...
I would like it in layman terms...
And how to do it on Windows. This seems like confusion for me. I have no idea where to start.
I did it all in windows 8.1 64 bit edition.
With help from this post:
http://forum.xda-developers.com/showpost.php?p=58897784&postcount=67
get Python 2.7 for windows and install it >>https://www.python.org/download/releases/2.7/
btw I installed the 64 bit edition for both
get GMPY2 for Python 2.7 https://code.google.com/p/gmpy/downloads/list
Follow the post for step by step. I encountered some trouble with fast boot driver, I had to remove the driver and install a generic one I selected from windows then I manually installed it. Ran the fast boot command to unlock and I was unlocked. a lot easier than it looks.
Reckerr said:
I would like it in layman terms...
And how to do it on Windows. This seems like confusion for me. I have no idea where to start.
Click to expand...
Click to collapse
Appreciate it. Will attempt Saturday after a read through.
Works on Windows...
tuanda82 said:
Thanks. But your upHDX scripts is for linux user only. I am on Windows .
If you have time could you upload your xxxx_14.4.5.3_xxxx.zip? Thanks
Click to expand...
Click to collapse
Actually, I tested upHDX in Windows using Cygwin.
I had to select zip and unzip in the Archive group and python in the Python group
in the installer to get all the dependencies in place, and the only issue I faced was a few filename collisions
in the /system/media/audio/ringtones folder (case-sensitivity problem).
Code:
[COLOR="Lime"]>[/COLOR] diff -ru cygwin/ linux/
Only in linux/system/media/audio/ringtones: ANDROMEDA.ogg
Only in linux/system/media/audio/ringtones: CANISMAJOR.ogg
Only in linux/system/media/audio/ringtones: Hydra.ogg
Only in linux/system/media/audio/ringtones: PERSEUS.ogg
Only in linux/system/media/audio/ringtones: URSAMINOR.ogg
These could just be copied from the original update-*.bin after installation.
Reckerr said:
I would like it in layman terms...
And how to do it on Windows. This seems like confusion for me. I have no idea where to start.
Click to expand...
Click to collapse
If you could spell out what you mean by 'it', I might be able to help.
yujikaido79 said:
I did it all in windows 8.1 64 bit edition.
With help from this post:
http://forum.xda-developers.com/showpost.php?p=58897784&postcount=67
get Python 2.7 for windows and install it >>https://www.python.org/download/releases/2.7/
btw I installed the 64 bit edition for both
get GMPY2 for Python 2.7 https://code.google.com/p/gmpy/downloads/list
Follow the post for step by step. I encountered some trouble with fast boot driver, I had to remove the driver and install a generic one I selected from windows then I manually installed it. Ran the fast boot command to unlock and I was unlocked. a lot easier than it looks.
Click to expand...
Click to collapse
Of course, if you want to make it more difficult for yourself,
you can use the older version of my tool as well.
The new one is not limited to Python 2.7, but works on both current Python versions;
and does NOT require GMPY2.
Also, if you are looking to unlock your bootloader, the 'cublock.py' script is your friend.
You just pass in the manfid and serial (separately; no need to fuse them).
Whether you choose to install Python standalone or as part of Cygwin is up to you.
The latter also includes 'bash' and lets you convert the Amazon update to a TWRP-friendly ZIP.
draxie said:
Of course, if you want to make it more difficult for yourself, you can use the older version of ny tool as well.
The new one is not limited to Python 2.7, but works on both current Python versions; and does NOT require GMPY2.
Also, if you are looking to unlock your bootloader, the 'unlock.py' script is your friend.
You just pass in the manfid and serial (separately; no need to fuse them).
Whether you choose to install Python standalone or as part of Cygwin is up to you.
The latter also includes 'bash' and lets you convert the Amazon update to a TWRP-friendly ZIP.
Click to expand...
Click to collapse
I have Windows 7 and Nexus 2.0.5 with bootloader from http://forum.xda-developers.com/kin...p-flashable-3-2-3-bootloader-upgrade-t3025504 installed Python 2.7 and the adb and fastboot and driver package from post 1
Using
adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial
And unlock.py and then
adb reboot-bootloader
And
Fastboot -i 0x1949 devices
fastboot -i 0x1949 flash unlock <unlock file>
fastboot -i 0x1949 reboot
IT was very easy, I only had some driver problems in fastboot mode
Uphdx don't work on debian 7
Bruder Torgen said:
I have Windows 7 and Nexus 2.0.5 with bootloader from http://forum.xda-developers.com/kin...p-flashable-3-2-3-bootloader-upgrade-t3025504 installed Python 2.7 and the adb and fastboot and driver package from post 1
Using
adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial
And unlock.py and then
adb reboot-bootloader
And
Fastboot -i 0x1949 devices
fastboot -i 0x1949 flash unlock <unlock file>
fastboot -i 0x1949 reboot
IT was very easy, I only had some driver problems in fastboot mode
Click to expand...
Click to collapse
FYI - followed this process on an identical environment with identical results. Struggled a bit more with Windows drivers; if you're having trouble this might help (posts 8-10).
im running this version 13.3.0.2 and im a newbe with kindle what should I do
benyo8990 said:
im running this version 13.3.0.2 and im a newbe with kindle what should I do
Click to expand...
Click to collapse
Welcome to the HDX forums. How to proceed depends on what you want to accomplish. Read through the various threads to see what is available and the effort required. If your goal is to root and/or install custom roms you MUST disconnect from WiFi as Amazon will attempt to upgrade your tablet to the lastest Fire OS. Should that happen your options will be severely limited.
Two words of caution:
1) Kindles are not like other devices. Tough to tame and easy to brick. If you approach modding with a casual attitude you'll probably end up with a non-recoverable brick. READ, READ, READ before doing anything. Ask questions when you are ready.
2) There are no tidy fail-safe tutorials for the HDX. There is work and risk involved. You have to do your homework first. No one is going to hold your hand (sorry for the lecture - just trying to set expectations early).
More info please!
dpeddi said:
Uphdx don't work on debian 7
Click to expand...
Click to collapse
Given that it worked for me even in Cygwin on Windows 7, this sounds odd.
Nevertheless, I'd appreciate more info on how it fails (and which flavor of Debian 7
you are using; so, that I have a chance to reproduce your issue).
UPDATE: Nevermind. I fired up a VM with Debian 7.8.0-amd64-standard,
and found out for myself. Apparently, 'df' in 'coreutils 8.13' used here
doesn't support the '--output' option; AND, python 2.7.3 is more strict
about the input types to 'unpack'. I fixed these and the script worked.
I'll post the new version in a second.
DF --optional not supported, $m seems to not be set
Thank you for posting this awesome tool. I am running 13.4.5.2 with a twrp recovery and the most recent available (without breaking twrp) kernel.
My question is, if worst case scenario happens and I try to use cygwin to upHDX, it does not work, but I think it did, and I install a partially working update, am I bricked? Or, will it just write over my kernel and recovery with no hope of going back. As I type this, I am thinking the answer is, both are possible, but thought I would ask before breaking things.
Sent from my KFTHWI using Tapatalk
[Edit] If you know what you are doing, this script is very helpful. I especially enjoy how it explains everything it does as it does it. So, you can see the files it changes. I used cygwin and it worked perfectly. If you understand the Unix command tools, it is a piece of cake. I do not mean to belittle the risk involved, it is significant, however, if you read what is happening, and know this worked, and can be assured there is no issue with your recovery, you can still roll back if something goes wrong. Do not take this comment as minimal risk, the risk is substantial, and you need to wipe to go back. One of my devices did not take the update well (My fault), and, I had to go back. These devices do not handle wipes well. So, the moral of the story.
-This is an excellent and versatile tool,
-There is significant risk
-If you do your research, follow directions, and meet the requirements, you can get success. Have your cake and eat it too on your terms!!
-With this tool, I have the most recent update, root, and twrp (Amazon apps work too).
Thanks again for the tools.
[/Edit]
lekofraggle said:
My question is, if worst case scenario happens and I try to use cygwin to upHDX, it does not work, but I think it did, and I install a partially working update, am I bricked? Or, will it just write over my kernel and recovery with no hope of going back. As I type this, I am thinking the answer is, both are possible, but thought I would ask before breaking things.
Click to expand...
Click to collapse
I saw you managed fine, but just in case anybody else wonders,
the script will bail at the first sign of error and you'll know it.
Of course, this won't guarantee that things cannot go wrong,
but minimizes the chances that they go unnoticed.
NOTE, HOWEVER that:
This has only been tested on 4.5.2 and 4.5.3; and, I would strongly recommend against blindly running it on newer releases (as the pattern matching that's being relied upon for what to throw away --including the anti-rollback fuse stuff-- might easily get broken with relatively minor changes.
A good sanity check is to unzip both the original update and the newly created "sanitized" version, and compare them (e.g. via a recursive diff) to doublecheck if the changes are sensible.
Background
Okay so the glass on my 2013 Moto X broke on September 27th I ordered a new one and while changing it I accidentally broke the digitizer so I disconnected the digitizer and the phone turned on while my digitizer with disconnected then i had no way of turning it off while my digitizer was disconnected the phone started to vibrate every 3 seconds until the battery died... so I was forced to switch over to my Nexus 6 because at the time that was my backup phone because I love the performance of my Moto X.. now a few months later yesterday to be exact my new digitizer arrived and I brought my Moto X back to life powers on and performs just fine
Problem
My wrist twitch to activate camera doesn't work
My dual chop to activate led doesn't work
Whenever I make a phone call or receive a phone call my screen turns off automatically but the phone call works just fine once the phone call has ended my screen does not turn back on I have to reboot the phone to turn on the display again
Phone info
2013 moto x on 5.1.1 stock rom locked bootloader rooted using crashes method with ultra slim root
any help or tip is greatly appreciated
Maybe, but it really depends what's actually wrong. The Moto has a TI MSP430 chip that handles all that 'motion, wave-to-wake, chop-chop' stuff and it's loaded from a /firmware folder or partition (have forgotten at this point). @masterifla figured out which files it was on 4.4.4 & 5.1 that got uploaded to the 430 and wrote a .zip file to change from 4.4.4's "wave to wake" to 5.1 "chop chop" or vice versa. I fixed some little bug in it, and stuck the working .zips up in this post although they may be elsewhere as well: (so :: these zips contain the firmware that actually does the wave-to-wake stuff and can be 'recovery-flashed')
http://forum.xda-developers.com/showpost.php?p=63616790&postcount=17
At least if that works, you'll know that it was the firmware for that chip, and if not, it might actually be the 430 chip(which you can see in the teardown). The post by me and anything by masterifla should be pretty well explained.
Cheers.
but have a locked bootloader I can't flash anything...but you gave hope maybe if I use rsd lite to flash stock I can fix this
BADDINOROX99 said:
but have a locked bootloader I can't flash anything...but you gave hope maybe if I use rsd lite to flash stock I can fix this
Click to expand...
Click to collapse
There still might be a way. I keep trying to have people get this to work, but I'm not sure of the outcome yet, so give it try if you like: Here's some steps:
1) Locked bootloader / no root means mostly that you can't write system, but I'm pretty sure you should be able to temporarily boot into a PC-based copy of twrp. Once in twrp (for one time say) you are root, and you have access to anything on your gizmo. In theory, you should be able to mount system read-write and change something in the file system.
2) Get the correct copy of twrp and adb (from dev forum for this box) and put it on a PC with fastboot in the same folder. To make this easy, called twrp "twrp.img" and call "fastboot" or "mfastboot" fastboot.exe (I am for some reason assuming you've got a PC, not a mac or linux, but the ideas are similar.
3) quick explain of the files in the .zip from above ^^ : 8 files prefixed by MSP that are located when on the moto in /system/etc/firmware. Unzip them and stick them in that same folder.
4) Tricky part : (I think) : reboot into the twrp.img on your PC by getting your device into fastboot / bootloader mode: (so .. volume-up&down&power keys all held down for ~10 seconds perhaps, then if you've gotten it right (it's touchy), you'll be in the bootloader where it has a small tiny text list of stuff like "continue, recovery, etc).
5) you're good with the phone if you've made it here: now on the PC from that folder, type in "fastboot boot twrp.img" and good luck. If it works, your phone will be in TWRP with root access. If not, I don't know another option at the moment.
6) Probably the rest is most easily done from the PC command (or shell) window where the files are. Since your device is in the bootloader and awaiting further instruction, you should be able to use adb to talk to recovery now. so carry on:
7) (get the files from your PC (the MSP prefixed ones) onto the device, so first remount system r/w):
Code:
a) "adb remount" // supposedly should remount system toggling the read attribute to write
b) "adb push msp* /system/etc/firmware/" // copies files to device unless I've got syntax wrong, try one at a time if doesn't work.
c) "adb shell ls -al /system/etc/firmware/" // list all files, and post them back here to see if it even worked.
d) "adb remount" // system partition back to normal ro state.
d) "adb reboot" // moment of truth, a reboot.
8) after things settle post-reboot, check out "wave-to-wake" , camera twist, etc. This works on 4.4.4 or 5.1 (if this other stuff above works).
Note: I could be way off on my idea that rebooting into recovery will give you enough functionality to do this, but I'm not sure what other choices you've got without being able to root. I guess another thing I'm wondering about is why you wouldn't be able to root the phone from recovery regardless of how you booted into it. You still can't unlock bootloader, but I'm not clear on what difference it makes at the moment.
Good luck. It's a "hail mary" pass.
thanks I got my stuff working again ? I screwed up in the file install part freaked out and reflashed stock and rerooted so everything is good now once again thanks
tl;dr Use the fastboot executable that comes with adb-tools instead of the one that comes with CF-Auto-Root
I decided to upgrade the N6 to Marshmallow today, and everything was going smoothly until I tried to regain root with CF-Auto-Root. Every time I ran the .bat file I got he error:
Code:
...
We will now attempt to boot CF-Auto-Root. You should see a red Android on the
screen of your device in a minute, with scrolling white text on top of it.
downloading 'boot.img'...
FAILED (command write failed (Unknown error))
finished. total time: 5.004s
...
I hunted around google for a bit but couldn't find any real answer. I opened the .bat file to see what it was doing and maybe try to pinpoint the command that was failing. I saw that it was calling the fastboot that came in the CF-AutoRoot zip (tools\fastboot-windows.exe) On a hunch I copied in the fastboot.exe I had from adb-tools into the CF-AutoRoot directory, and changed all references of 'tools\fastboot-windows.exe' to 'fastboot.exe' in the .bat file.
I ran the .bat file again, and everything worked as it should. Booted into the OS and had root again.
Hopefully this can help someone in the future!
even better.. don't use toolkits to root, especially when you are not knowing much about the processes. learn to do it properly. its easier than using the toolkit for sure, and faster. if you know what you are doing already, then its fine to use a toolkit. but if you are clueless(like most that use toolkits), then learn the right way first, because toolkits mess up, and often.
I have run into the same error while attempting CF Auto Root on my 3 day old Nexus 6. I dont know exactly how to move my fastboot.exe into the windows bat file but I am pretty sure I can figure it out with some reading and research. I agree with simms22 as well. I dont like using toolkits because I dont know what the toolkit is doing when it executes. I would rather perform the steps myself so I have a better understanding of what is happening during the process. I have a good understanding of adb and fastboot even though I am new to the Nexus 6. I am not new to Android though. @CleanSanchez, if there is any information you wouldnt mind passing on about how you modified the bat file I would appreciate it. Thanks for the quick little guide. I will get it figured out for sure. It may just take some time and some research. Thats all I have been doing for the first 3 days I have owned the device. I have read post after post and forum after forum here on XDA. I dont mind being a noob when it comes to a new device but Ill be damned if Im gonna make noob mistakes by getting in a hurry.
Edit:
I followed @CleanSanchez quick guide in the OP and wouldnt ya know, it worked for me too. I read a short Microsoft guide about editing Windows batch files and gave it a shot and it worked like a charm. Thanks for the guide.
Rename the fastboot.exe is a bit easier than editing the bat. Thanks for the guide
Some clarification for anyone needing more details.
Copy the fastboot.exe. file in the tools folder, into the zip CF-Auto-Root-shamu-shamu-nexus6.
Right click on the root-windows file and then click edit.
Change all 'tools\fastboot-windows.exe' to 'fastboot.exe' should be 6 lines of changes needed to be made
Make sure your Nexus 6 is in the bootloader
Click on fastboot.exe to root your phone
I must thank you @CleanSanchez because I got this phone a couple of days ago and this is only guide that actually worked. Hours spent got me continuously failing the fastboot windows. Even though it is years after the fact, you have my thanks.:good:
Verified Downgraded from ZVA to ZV6 with full root access
LS991 Sprint Only.
QUICK GUIDE & TESTING
(Please read the entire guide before trying anything.)
I nor anyone at XDA is responsible for anything that may happen to your device.
Simply, by taking incentive to change the stock setup provided by the manufacturer for your device; you assume all responsibility for anything that happens.
download LGUP
http://forum.xda-developers.com/g4/help/lgup-install-kdz-mm-lp-t3249803
(Thanks to shakeyabooti)
download LS991ZV6_00.zip and extract to get .tot file with winrar/7zip or any other unzipping program
http://downloads.codefi.re/autoprime/LG/LG_G4/LS991/LS991ZV6/LS991ZV6_00.zip (or google/xda search for mirrors) (Thanks to autoprime)
download LGROOT
http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772
(Thanks to Unjustified Dev)
download LG Drivers
http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772 (or google)
(Thanks to Unjustified Dev)
download rootedsystem.ls991.zip and extract to get .img file with winrar/7zip or any other unzipping program
http://forum.xda-developers.com/sprint-g4/general/zv6-root-success-t3205963/page3
(scroll down to parin11's post. #29 and thank you to both parin11 and mswlogo)
-install drivers
-enable oem unlock in developer settings
-plug device in as charge only, switch to mtp to verify drivers are working correctly, then disconnect
--if on mtp then switch to charge only to verify drivers are working correctly, then disconnect
-enable usb debugging
-reconnect and drivers auto install
-disconnect after 2 minutes.
--while you wait;
-for LGUP extract and install _dll version then the second msi.
-for LGROOT extract to a folder to keep things organized
-remove the back cover of your device and leave it off for access to battery pulls.
-power off device
-hold volume up key and plug in your device and keep holding the volume down key until it passes the screen that says download mode.
-open LGUP
-make sure UPGRADE is checked/has a little circle/bullet point
-click in the empty space directly to the right of where it says BIN with the checkmark
-3 dots will appear to the right of the program in the same row that says BIN; which is your browse option
-navigate to LS991ZV6_00.tot and select
-reconfirm your UPGRADE option is checked
-press start and allow the device to fully complete the process.
-your device will boot to the loading screen right before showing the android desktop and "freeze"
-In most if not all new flash scenarios; your device will not boot up until a factory restore and clear cache is done.
-To do this you must simply remove the battery and usb cable from your device AFTER it has hung on the logo for about 3 minutes / 180 seconds.
(Most new devices average a first time boot of up to 150 seconds maximum to be considered fully "loaded")
-With the battery and cable removed; hold the power and volume DOWN button together at the same time.
-insert the battery while holding these buttons together and just wait while holding them and you will see it says booting into recovery.
-once your in the recovery you use the power key to select and the volume keys to navigate.
-navigate to factory restore/reset hit the power button, navigate to "yes" out of all the "no's" and hit the power button again
-it will say its complete and either ask you to go back reboot or return to menu. RETURN TO THE MENU, do not boot up yet.
-Once returned to the main menu you will see it says clear cache. Select and press yes and now you can select reboot; or return to menu then reboot.
Your device will be on ZV6 stock and fully booted after this.
Now this is where it gets kind of odd because my device never actually loaded the rootedsystemls991.img file nor did I run a root script
when attempting to flash it with the steps listed in the other root guides BUT i followed this guide from step one to step 9 (and outlined continuing through the guide)
http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772
this allowed all the necessary rooting files to be in the places necessary to execute the root but I did one extra step
I did an adb.exe push rootedsystem.ls991.img /data/local/tmp command as well while the device was on the home screen.
This was so I could basically emulate the command listed by |Unjustified Dev| as it also states to do in the ZV5 guide.
So this is what I did,
-After my device booted up and loaded to the home screen on stock zv6, I opened the LGROOT folder
-held shift and clicked "open command prompt here"
-when cmd opened I ran the following command
adb.exe devices
This allowed me to see that my device was connected to the PC with its generated serial number.
-then i ran the following command
adb.exe push busybox /data/local/tmp/ && adb.exe push lg_root.sh /data/local/tmp && adb.exe push UPDATE-SuperSU-v2.46.zip /data/local/tmp
-After this I applied the command to push the .img file to the same location. This was the "emulated command" I spoke of.
adb.exe push rootedsystem.LS991.ZV6.img /data/local/tmp
-I then added the .img file directly to the Internal Storage / Stock Phone MTP storage
-Afterwards I simply powered off my device, removed the usb cable, held the volume up button, then plugged it back in still holding the volume button until
the text download mode was gone again; and no this is not a timing thing im just saying that again incase anyone forgot how to get into download mode. lol.
-I then ran the ports.bat file included in LGROOT to find the COM port drivers.
-Followed up with this command
Send_Command.exe \\.\COM8 (<--Replace number here with the COM port listed for the "DIAG" portion of the device.)
-Now, still in download mode I executed this command about three times with no avail.
dd if=/data/media/0/rootedsystem.LS991.ZV6.img bs=8192 seek=65536 count=557312 of=/dev/block/mmcblk0
(Which by the way I had the file in both the MTP side of root and in the data/local/tmp)
or you could change it to /data/local/tmp/ like
dd if=/data/local/tmp/rootedsystem.LS991.ZV6.img bs=8192 seek=65536 count=557312 of=/dev/block/mmcblk0
This would possibly solve the issue I was having. So you would have root now.
THIS PART REQUIRES TESTING.
BUT continue reading you'll be shocked.
sidenote:
They state that all you have to do is put the .img file into the root of your Internal Storage / Stock Phone MTP storage
and run the command in download mode but this failed when I tried to execute it.
dd if=/data/media/0/rootedsystem.LS991.ZV6.img bs=8192 seek=65536 count=557312 of=/dev/block/mmcblk0
The command above was the command they listed to be able to restore the device from stock to stock with root access. Please note I tried this command while the phone was turned on in debugging with enable oem unlock on, while in download mode and while in recovery mode all with debugging and enable oem unlock checked with either no response / device detected, or attempts causing the command prompt to show the # symbol after a few seconds of executing the line above which shouldn't happen,
since the size of the file is 4GB... The ENTIRE SYSTEM PARITION. -_-. There is a considerable amount of hangtime here is what I'm saying.
If the dd if=/data/media/0/rootedsystem.LS991.ZV6.img bs=8192 seek=65536 count=557312 of=/dev/block/mmcblk0 command worked for you then great, boot up and enjoy root! BUT.
For those who didnt have luck doing so with the command that failed me above, for some odd reason after pushing both the SuperSU bundle and the entire .img file to /data/local/tmp/ with the files in the internal storage /data/media/0/ as well
trying to only execute the command for the .img (/media/0/ not /local/tmp/) | (not the "fixed" command") and NOT for the SuperSU
eg.
-This was for the image which was the only one I used. (USED)
dd if=/data/media/0/rootedsystem.LS991.ZV6.img bs=8192 seek=65536 count=557312 of=/dev/block/mmcblk0
This was for root only which I did not touch. (NOT USED)
sh /data/local/tmp/lg_root.sh dummy 1 /data/local/tmp/UPDATE-SuperSU-v2.46.zip /data/local/tmp/busybox
-This caused the device to simply show the # sign almost immediately as I spoke of above.
-I typed in LEAVE and the device booted back up.
-The odd thing I'm speaking about is when I turned the device back on it showed that SuperSU was installed and was requesting to be "updated".
-I chose normal and it asked for a reboot. Rebooted started back up and it asked for root access when I clicked on it.
-Granted and successful.
-Went to the playstore.
-It said update next to SuperSU which was even odder.
-Clicked it and updated it and it got the latest version, asked for one more reboot, started back up, then I opened the app. Everything was normal.
-Downloaded root checker basic, titanium backup, and greenify immediately.
All passed with flying colors.
-There is an error that pops up in titanium backup regarding adding underscores or slashes into modified file directories for backup purposes assumed but
opening greenify ended up picking up this issue and requesting to fix it.
Why not right?
-Heh. It worked.
I have never experienced this type of latency within programming so this is extremely odd and without executing the SuperSU script command or,
a sucessful flash of the .img it just seems too odd, but; there you have it! All of the mods / developers working on this device I would like to hear
your insight on this.
So you have two options. Follow what I did or test the command with /data/local/tmp/ and try your luck flashing stock with root again or just run the root script on stock instead of trying to flash from stock to stock rooted.
Thank you and enjoy your root!
P.S. I didn't end up experiencing this issue since it works perfectly but in the event that SuperSU does not install after trying to flash the .img and getting
the 2 second delay with the # sign appearing immediately and rebooting after 3 attempts I would have personally tested the original adb SuperSU script command recommended for the ZV5 users
which was listed above and is
sh /data/local/tmp/lg_root.sh dummy 1 /data/local/tmp/UPDATE-SuperSU-v2.46.zip /data/local/tmp/busybox
And for the love of your device. Don't try to update your device from an older version using this method. Ayeeeyiyiy
I will re-test what I stated and make a completely organized guide and video for everyone.
I just wanted to let you all know now to assist the entire community in understanding this device's root process a little more.
Will this work with brand new phone?
This method looks exactly like what I would need if I were to sign up with Sprint and get a brand new G4 from them. I just want to make sure that this method would work on the brand new phone to get root access and possibly flash new ROMs to the device. I have gotten burned before by getting devices that I think would work only to find out I had gotten an unsupported variant. Any knowledge would be greatly appreciated. Thank you.
wow, thanks!
Thanks for all your hard work. This phone has been one of my best and the only thing missing has been root, etc. Chewing over your instructions and thoughts. My confidence level is not quite there to pull the trigger, but i'm getting close. Hoping this is a promising method for those of us on Sprint ZVA. I will continue to do research and watch this thread. Thanks so much for your time, tips and expertise.
brpaaron said:
This method looks exactly like what I would need if I were to sign up with Sprint and get a brand new G4 from them. I just want to make sure that this method would work on the brand new phone to get root access and possibly flash new ROMs to the device. I have gotten burned before by getting devices that I think would work only to find out I had gotten an unsupported variant. Any knowledge would be greatly appreciated. Thank you.
Click to expand...
Click to collapse
As long as its not been updated to zvb. Antirollback implemented on zvb
Still running zv6
I am still running zv6 and never updated. Do I need to update to downgrade to root or can I just skip to after the downgrade?
i am running zv9 i can not stock zv6
I have ZVC can i downgrade to ZV6?
LG G4 LS991.
LG G3 D850 ROM Fulmics 6.6
Recovery TWRP v2.8.7.0 bumped
LS991 ZVD
Hi there does anyone know whether or not it will work on the ls991 zvd update??? Sprint variant
Ls 991 ZVD
Will this method work on ls991 zvd i havent found anything on it
Expo6810 said:
Will this method work on ls991 zvd i havent found anything on it
Click to expand...
Click to collapse
No. Zva or lower. You will brick it.
---------- Post added at 02:28 AM ---------- Previous post was at 02:28 AM ----------
No zva or lower
TheMadScientist420 said:
No. Zva or lower. You will brick it.
---------- Post added at 02:28 AM ---------- Previous post was at 02:28 AM ----------
No zva or lower
Click to expand...
Click to collapse
Is there anything i can do for my zvd
Expo6810 said:
Is there anything i can do for my zvd
Click to expand...
Click to collapse
as far as i know. nothing
new root methods and tweaks come out everyday.
all the good devs as far as i know have stopped developing g4 and moved on due to the locked bootloader d other issues
---------- Post added at 09:24 AM ---------- Previous post was at 09:17 AM ----------
Expo6810 said:
Is there anything i can do for my zvd
Click to expand...
Click to collapse
a root method has been exposed on the g5
intime it may come for the g4 also but not adapted rite now
Expo6810 said:
Is there anything i can do for my zvd
Click to expand...
Click to collapse
Right now i have ZVC software version can i downgrade zv6????
hawzsth said:
Right now i have ZVC software version can i downgrade zv6????
Click to expand...
Click to collapse
no u will brick
TheMadScientist420 said:
no u will brick
Click to expand...
Click to collapse
its already brick any solution...... now its show 9008 no power on ...
hawzsth said:
its already brick any solution...... now its show 9008 no power on ...
Click to expand...
Click to collapse
octoplus box with jtags the only fix
thats a hardbrick
---------- Post added at 08:30 AM ---------- Previous post was at 08:29 AM ----------
Expo6810 said:
Is there anything i can do for my zvd
Click to expand...
Click to collapse
as of rite now no
If I downgrade my zva will it allow me to sim unlock it
Somebody know if can downgrade ZVI to another version
Pls any update on locked bootloader?
Thank you!
Just learned here enough. Thank you!
I just head through UsU thread after reading this; Respectively thanks for the post again! ??