Bootloader unlock / Root / Custom Recoveries / ROMs / Mods

[Ene]

ONLY PROCEED IF YOU KNOW WHAT YOU'RE DOING
DON'T ATTEMPT TO RE-LOCK THE BOOTLOADER WHEN YOU MODIFIED THE BOOT IMAGE (Flashed Magisk)
I'M NOT RESPONSIBLE FOR ANY OF YOUR ACTIONS

Bootloader unlocking Guide​

Spoiler: SHOW

Preamble​

Unlocking the Bootloader is required for modifying partitions on the device. This is required for gaining root access or flashing a custom recovery/ROM.
THIS PROCESS WILL WIPE ALL YOUR DATA

Prerequisites​

• a Linux/Mac/Windows PC (this Guide is intended for Windows 10 users)
• USB Cable
• SDK Platform Tools
• USB Driver
• Fastboot Driver - those install automatically via Windows Update when the device is attached while in Fastboot mode (make sure you have internet connection and enabled "Give me updates for other Microsoft produectes when I update Windows." in the Windows Update settings.

Guide​

1. download and extract the SDK Platform Tools into a folder on your drive root (e.g. C:\adb)
2. download and extract the USB Drivers into a folder, open it and install the drivers via right clicking on the android_winusb.inf -> install
   
3. boot up your device
4. open the settings app
   1. go to About phone
      
   2. tap on the Buildnumber 7 times
      
   3. go to System
      
   4. go to Developer options
      
   5. enable Advanced restart and OEM unlocking
      
5. hold the power button to bring up the power menu, tap on Restart and choose Bootloader
   
6. navigate inside the folder you extracted the SDK Platform Tools to and bring up the cmd (click inside the navigation bar, type cmd and hit enter)
   
7. type fastboot devices and hit enter
   • if the device shows up continue
   • if the device doesn't show up, open the Device Manager (devmgmt.msc) and look for an not correctly recognized Device (labeled "Android" or similar)
     • right click -> Update driver -> search on my PC -> select from a list -> Have Disk... -> choose the downloaded android_winusb.inf -> Android Bootloader Interface
8. type fastboot flashing unlock and hit enter
   
9. on your device, select the "UNLOCK THE BOOTLOADER" option with the volume buttons and confirm with the power button
   
10. your device should reboot and the bootloader is unlocked

Rooting Guide​

Spoiler: SHOW

Preamble​

Rooting is the method of gaining the opportunity to modify partitions (from within the userspace).
Requires an unlocked bootloader, follow "Bootloader unlocking Guide"

Prerequisites​

• The same as for the "Bootloader unlocking Guide"
• Magsik - download it and copy it onto your device
• a Magisk-Patched boot.img
  • get it from this post (perhaps outdated) - make sure the image is matching the OS Version! -search in this thread for different Versions
  • Patch it yourself using the following guide

Bootimage patching Guide​

Spoiler: SHOW

Prerequisites​

• matching boot image for your OS version (latest version here)

Guide​

1. install the Magisk-v*.apk on your device
2. Start Magisk
3. Tap on "install"
4. choose "Select and Patch a File" and select your downloaded boot.img
5. Wait for patching to finish, grab the patched boot.img and proceed with the Rooting Guide

Guide​

1. install the Magisk-v*.apk on your device
2. boot into the bootloader (by using Advanced restart / holding down the volume-lower button and power-button together)
3. navigate inside the folder you extracted the SDK Platform Tools to, copy the Magisk-Patched boot.img into and name it magisk_boot.img
4. bring up the cmd inside this folder (click inside the navigation bar, type cmd and hit enter) type fastboot flash boot magisk_boot.img and hit enter
   1. if the process is stuck and won't display SUCCESS after about 30 Seconds, abort it in the cmd by pressing Ctrl + C and press the volume-down button on the device to select "Reboot Bootloader". Confirm buy a press on the power-button and try again.
   2. after it displayed SUCCESS you can type in fastboot reboot and hit enter
5. your device should reboot is now rooted
   

Custom Recoveries​

• TWRP: https://forum.shiftphones.com/threads/twrp-recovery-3-5-v-10-for-shift-6mq.3389/
• Lineage Recoverey: https://forum.shiftphones.com/threads/shift6mq-lineageos-18-1-android-11-vorabtest.3991/

Custom ROMs​

• LineageOS 18.1: https://forum.shiftphones.com/threads/shift6mq-lineageos-18-1-android-11-vorabtest.3991/
• LineageOS 19.1: https://forum.shiftphones.com/threads/shift6mq-lineageos-19-1-android-12l.4468/

Mods​

• Improved Camera App: https://forum.shiftphones.com/threa...mera-app-koennt-ihr-empfehlen.3517/post-42763

Honorable Mentions​

• Shift Staff for the Device/OS
• @7usr7local for the first unlocked bootloader
• @mispecht for the first rooted device
• @Lhotze for the extracted OS-L Bootimage

 

[Martin S.]

@Ene

Hi,

which version of beta testing did you choose? Guessing OS-L?

As far as I know there aren't any guides/links to unroot/recovery/rom the 6mq yet.

If you've chosen OS-G, rooting/custom rom etc is prohibited until successful Google certification

 

[Ene]

@Ene

Hi,

which version of beta testing did you choose? Guessing OS-L?

As far as I know there aren't any guides/links to unroot/recovery/rom the 6mq yet.

If you've chosen OS-G, rooting/custom rom etc is prohibited until successful Google certification

I'm running OS-L, because I aim to install microG anyway (which requires an unlocked bootloader...)

(btw, how big is the international community here? Shall we continue in English like most Forums do or is deutsch the go-to? )

 

[Martin S.]

Still at work, I've seen 3(?) beta testers speaking english, so, a bit of a minority, at least for the 6mq test.

But let's keep english, Shift staff members are responding in english as well, so, not a problem

 

[7usr7local]

Hi @Ene,

fastboot flashing unlock worked for me (got my 6mq yesterday, Build number QQ2A.200501.001.B3 release-keys, ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113, Kernel Version 4.9.206-shift #1 Fri Nov 13 13:43:46 CET 2020, Build Date Fri Nov 13 13:54:24 CET 2020)

~ $ fastboot flashing unlock
                                                   OKAY [  0.038s]
Finished. Total time: 0.040s
~ $ fastboot --version
fastboot version 29.0.5-5949299
Installed as [...]
~ $

To know what you may have missed, we need to know more details: Was your phone in fastboot mode? Did you allow unlocking in the system settings?

Alas, myself I am stuck at the point after unlocking: How do I root the phone with neither a custom recovery nor a OTA flash image available? Or did I miss one of them?

Cheers

Edit: Corrected Kernel/Build dates - thanks to @Ene.

 

[Ene]

Hi @Ene,

fastboot flashing unlock worked for me (got my 6mq yesterday, Build number QQ2A.200501.001.B3 release-keys, ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113, Build date Nov 13th 2020 13:43:46)

~ $ fastboot flashing unlock
                                                   OKAY [  0.038s]
Finished. Total time: 0.040s
~ $ fastboot --version
fastboot version 29.0.5-5949299
Installed as [...]
~ $

To know what you may have missed, we need to know more details: Was your phone in fastboot mode? Did you allow unlocking in the system settings?

Alas, myself I am stuck at the point after unlocking: How do I root the phone with neither a custom recovery nor a OTA flash image available? Or did I miss one of them?

Cheers

Wow nice, these are good news! I unlocked about 50 different devices yet and never ran into such a problem, I have no idea what could have missed
I'll check back later this evening and provide all possible details. I used the newest fastboot (and successfully ran fastboot devices, so fastboot should be working) and enabled OEM Unlocking in the developer options tho.
And I'll try to extract the boot image from an OTA Update (https://downloads.shiftphones.com/axolotl), patch it with magisk and flash it via fastboot:

Extract Android OTA Payload.bin File using Payload Dumper Tool

Learn how to dump and extract Android OTA Payload.bin file to get the boot.img (for rooting with Magisk), vendor.img, and other other partition images.

www.thecustomdroid.com

 

[Uli]

I think ist Important to use an full update not an incremental othervice it will not work.

 

[Jonny1797]

So, after 13 Months after preordering my 6mq it now arrived but until now I had no luck with unlocking the bootloader.
fastboot devices lists the device but fastboot oem unlock fails (FAILED (remote: 'Command not supported in default implementation')). fastboot flashing unlock also produces an error, FAILED (remote: 'Unrecognized command flashing unlock').
What am I missing? Shouldn't the "Lovephones" stay true to the product description?


Also, I haven't found any threads about a Custom Recovery for the 6mq yet, nor ROMs (which aren't possible with a locked bootloader anyways).

As of now, my 800€ device is nothing more than expensive electrical waste.

Pinging @amartinz if there is a solution in sight.

Best Regards

Hi,

just wanted to add that I have the same response like @Ene and am also very interested to root the device to restore backups (Titanium backup). I have just the same OS-Version and build number as @7usr7local.

Cheers

 

[Ene]

• Build number QQ2A.200501.001.B3 release-keys
• ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113
• Build date Fri Nov 13 13:54:24 CET 2020

In comparison to @7usr7local, my Build date differs.
Also I use fastboot version 30.0.5-6877874 on Windows 10

EDIT:
@7usr7local probably posted the build date of his kernel, not system image because the his posted timestamp matches my kernel version. So I think it's safe to assume, that our devices software is identical.

 

[Ene]

For clarification: How to boot into fastboot? I did it over the "enhance restart menu" developer option as well as the recovery menu and adb. It only boots the userspace fastbootd, I think this device doesn't feature the old fashioned fastboot anymore?

EDIT: Seems like I was on the wrong page. You have to boot into the bootloader, not fastbootd. I tried booting into the bootloader before, but my device wasn't detected by fastboot. I now tried again and fastboot worked in the bootloader mode. I'll edit the OP accordingly.

 

[Ene]

I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...

>fastboot flash boot magisk_patched.img fastboot: error: Failed to identify current slot

>fastboot flash boot magisk_patched.img fastboot: error: cannot get boot partition size

I attached the image for you to try...(it also shrunk from 66Mb to 13Mb tho)

EDIT: removed the faulty boot.img

 

[Martin S.]

I wouldn't necessarily use system images not intended for the 6mq running OS-L..

Someone else tried something similar (Ok, he used stuff from the 6m ) very early, I think it was even one of the first posts in the beta forum.

He soft bricked his 6mq and needed "some help".
During the OS-G beta, unlocking/rooting/custom recoveries and roms were and still are prohibited, but that wouldn't irritate that user

 

[Ene]

I wouldn't necessarily use system images not intended for the 6mq running OS-L..

Someone else tried something similar (Ok, he used stuff from the 6m ) very early, I think it was even one of the first posts in the beta forum.

He soft bricked his 6mq and needed "some help".
During the OS-G beta, unlocking/rooting/custom recoveries and roms were and still are prohibited, but that wouldn't irritate that user

I seriously doubt that the bootimage differs between the OS-G and OS-L variant.
Pinging @amartinz again, he could provide the OS-L bootimage and give advises how to flash it.

 

[Wolf]

grüß euch,
wir haben nun auch unser 6mq bekommen,

wo bitte kann ich die ShiftOS-Light Version dafür bekommen ?

danke sagt der Wolf

 

[Martin S.]

Hallo,

bist du Google oder OS-L Vorab-Tester?
Das jeweilige Test-Betriebssystem ist schon aufgespielt
Es gibt noch keine offiziellen Links/Guides zum 6mq OS-L, soweit ich weiss.

 

[Wolf]

hi,
wir wurden als Betatester für OS-L genommen und haben ein 6mq mit Google erhalten.
eigentlich dachten wir auch das richtige sei vorinstalliert.

 

[Wolf]

vor einiger Zeit haben wir ein 5me gekauft, da konnten wir dann selbst die Lite-Version installieren.
Wir haben kein Goggleaccount auf unseren Geräten

 

[Martin S.]

Ui, dann ist da was schief gelaufen.. fragt doch einfach mal beim Support nach, vielleicht bekommt ihr die OS-L Variante gegen euere 6mq eingetauscht?

 

[7usr7local]

@7usr7local problable posted the build date of his kernel

Oh sorry, you're right, @Ene! - I slipped one line in the Android Version Information. (Corrected my post above).

 

[@Lhotze]

But I can't get it flashed (flashing the original boot doesn't work either)...

Could this behavior depend on the A / B Partition of the Device?
Greetz
____
Könnte das etwas mit den A/B Partitionen des Gerätes zu tun haben?
Greetz

 

[mispecht]

I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...

>fastboot flash boot magisk_patched.img fastboot: error: Failed to identify current slot

>fastboot flash boot magisk_patched.img fastboot: error: cannot get boot partition size

I attached the image for you to try...(it also shrunk from 66Mb to 13Mb tho)

I tried the same:
I was able to flash the patched magisk_patched.img

<hostname>:/<dir> # fastboot --slot a flash boot magisk_patched.img
target reported max download size of 805306368 bytes
Sending 'boot_a' (12736 KB)...
OKAY [  0.545s]
Writing 'boot_a'...
OKAY [  0.256s]
Finished. Total time: 0.808s

but after booting I could not switch on wifi ...
magisk manager showed me that magisk is installed
After that I flashed the extracted unpatched boot.img
but also with that wifi didn't work ....
Also my magisk_patched.img was much smaller than extracted unpatched boot.img

Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...

 

[Ene]

I tried the same:
I was able to flash the patched magisk_patched.img

<hostname>:/<dir> # fastboot --slot a flash boot magisk_patched.img
target reported max download size of 805306368 bytes
Sending 'boot_a' (12736 KB)...
OKAY [  0.545s]
Writing 'boot_a'...
OKAY [  0.256s]
Finished. Total time: 0.808s

but after booting I could not switch on wifi ...
magisk manager showed me that magisk is installed
After that I flashed the extracted unpatched boot.img
but also with that wifi didn't work ....
Also my magisk_patched.img was much smaller than extracted unpatched boot.img

Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...

Those are great news! So it's possible to flash the boot image. Tbh, it's just my second time working with an A/B partitioned device, seems kinda tricky. I guess it didn't work for me because I didn't specify the slot I wanna flash to.
You only flashed the bootimage on Slot A, so if you can switch back to Slot B, WiFi should be working again. But the fastboot command to switch slots (--set-active=b) didn't work for me.
I would try to nail down the OTA Update Server by network traffic sniffing and hope I can pull an update image from there. But because there haven't been any updates released for OS-L yet, I'm not sure this will be successful. And also it's strange, that your WiFi still doesn't work after you flashed back the extracted boot image, I didn't thought the OS-G and OS-L kernels would differ. Maybe because the WiFi search service on the OS-G is based on GAPPS Location Services?

 

[mispecht]

Hi Ene, yes I agree, direction is promising. I hope Shift will provide an image also for OS-L. I expect with that I can at least "repair" my phone and perhaps than the patch with magisk will also work ...
Do you know a way to extract boot.img from a working device?
Switch to slot B also didn't worked for me, I assume because I never applied an update slot B is empty.

With
fastboot getvar all
I get

...
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x4000000
...
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x4000000
...
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:7
(bootloader) slot-unbootable:b:yes
(bootloader) slot-successful:b:no
(bootloader) slot-retry-count:a:7
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2
...

It seems that B was never booted, but I can only see partition size and I don't know how to see whether there is any content in partition.

 

[danielp]

I'm running OS-L, because I aim to install microG anyway (which requires an unlocked bootloader...)

(btw, how big is the international community here? Shall we continue in English like most Forums do or is deutsch the go-to? )

Are you sure microG requires an unlocked bootloader? Afaik the only requirement is support for signature spoofing and I hope it is enabled in the ShiftOS-L builds already. If not well then root is required to enable signature spoofing. However the instructions for previous versions of ShiftOS-L do not mention that signature spoofing needs to be explicitly enabled.

 

[@Lhotze]

Do you know a way to extract boot.img from a working device?

If the bootloader is unlocked there is a method you can extract phone-partitions using the emergency-flash-mode from the qualcomm-chipset.

How to use QFIL to backup firmware from Qualcomm Android

This is a step-by-step guide on how to use Qualcomm Flash Image Loader (QFIL) to backup or readback from Qualcomm smartphones and tablets. QPST contains this QFIL and other tools. It enables you flash

forum.hovatek.com

but this need an qualcomm-device-specific
"firehose-programmer-file" and i think here it fails again.
Greetz
____
Wenn der Bootloader entsperrt ist, gibt es eine Methode, mit der Telefonpartitionen mithilfe des Notfall-Flash-Modus aus dem Qualcomm-Chipsatz extrahieren können.
Dies erfordert jedoch eine qualcomm-gerätespezifische
"firehose-programmer-file" und ich denke hier scheitert es wieder.
Greetz

 

[danielp]

I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...

Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...

You guys are either very brave or very ...

I did rooting the past, it was some time ago, but I always checked, are there instructions and all the required stuff available for my specific device?
For the L-Version everything is available is the software running on the devices shipped to the Beta testers. No instructions which may be device specific, no software, nothing to switch back in case something goes wrong.

Now you played with the new devices without a strategy if things go wrong

 

[Martin S.]

... impatient was the word you were looking for?

 

[danielp]

... impatient was the word you were looking for?

Not sure there! I just forgot about it while writing the sentence

 

[Martin S.]

And the "F1RST!" tag goes to HydrexHD anyway, so let's maybe wait until Shift provides an OS-L full system image, at least?

 

[@Lhotze]

nailed it