Bootloader unlock / Root / Custom Recoveries / ROMs

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
ONLY PROCEED IF YOU KNOW WHAT YOU'RE DOING
DON'T ATTEMPT TO RE-LOCK THE BOOTLOADER WHEN YOU MODIFIED THE BOOT IMAGE (Flashed Magisk)
I'M NOT RESPONSIBLE FOR ANY OF YOUR ACTIONS

Bootloader unlocking Guide

Preamble

Unlocking the Bootloader is required for modifying partitions on the device. This is required for gaining root access or flashing a custom recovery/ROM.
THIS PROCESS WILL WIPE ALL YOUR DATA

Prerequisites

  • a Linux/Mac/Windows PC (this Guide is intended for Windows 10 users)
  • USB Cable
  • SDK Platform Tools
  • USB Driver
  • Fastboot Driver - those install automatically via Windows Update when the device is attached while in Fastboot mode (make sure you have internet connection and enabled "Give me updates for other Microsoft produectes when I update Windows." in the Windows Update settings.

Guide

  1. download and extract the SDK Platform Tools into a folder on your drive root (e.g. C:\adb)
  2. download and extract the USB Drivers into a folder, open it and install the drivers via right clicking on the android_winusb.inf -> install
    1624050900315.png
  3. boot up your device
  4. open the settings app
    1. go to About phone
      About phone.jpg
    2. tap on the Buildnumber 7 times
      enable dev.jpg
    3. go to System
      System.jpg
    4. go to Developer options
      access dev.jpg
    5. enable Advanced restart and OEM unlocking
      enable dev settings.jpg
  5. hold the power button to bring up the power menu, tap on Restart and choose Bootloader
    reboot.jpg
  6. navigate inside the folder you extracted the SDK Platform Tools to and bring up the cmd (click inside the navigation bar, type cmd and hit enter)
    1605915353542.png
  7. type fastboot flashing unlock and hit enter
    1605915529901.png
  8. on your device, select the "UNLOCK THE BOOTLOADER" option with the volume buttons and confirm with the power button
    1605915767210.png
  9. your device should reboot and the bootloader is unlocked

Rooting Guide

Preamble

Rooting is the method of gaining the opportunity to modify partitions (from within the userspace).
Requires an unlocked bootloader, follow "Bootloader unlocking Guide"

Prerequisites

  • The same as for the "Bootloader unlocking Guide"
  • Magsik - download it and copy it onto your device
  • a Magisk-Patched boot.img
    • get it from this post - make sure the image is matching the OS Version!
    • Patch it yourself using the following guide

Bootimage patching Guide

Prerequisites

Guide

  1. install the Magisk-v*.apk on your device
  2. Start Magisk
  3. Tap on "install"
  4. choose "Select and Patch a File" and select your downloaded boot.img
  5. Wait for patching to finish, grab the patched boot.img and proceed with the Rooting Guide

Guide

  1. install the Magisk-v*.apk on your device
  2. boot into the bootloader (by using Advanced restart / holding down the volume-lower button and power-button together)
  3. navigate inside the folder you extracted the SDK Platform Tools to, copy the Magisk-Patched boot.img into and name it magisk_boot.img
  4. bring up the cmd inside this folder (click inside the navigation bar, type cmd and hit enter) type fastboot flash boot magisk_boot.img and hit enter
    1. if the process is stuck and won't display SUCCESS after about 30 Seconds, abort it in the cmd by pressing Ctrl + C and press the volume-down button on the device to select "Reboot Bootloader". Confirm buy a press on the power-button and try again.
    2. after it displayed SUCCESS you can type in fastboot reboot and hit enter
  5. your device should reboot is now rooted
    1606204690627.png

Custom Recoveries

Custom ROMs

Honorable Mentions

  • 👨‍💻 Shift Staff for the Device/OS
  • 🔓 @7usr7local for the first unlocked bootloader
  • 👏 @mispecht for the first rooted device
  • 👑 @Lhotze for the extracted OS-L Bootimage
 
Zuletzt bearbeitet:

Martin S.

SHIFT Friend
Alpha Tester
15 Februar 2020
1.112
@Ene

Hi,

which version of beta testing did you choose? Guessing OS-L?

As far as I know there aren't any guides/links to unroot/recovery/rom the 6mq yet.

If you've chosen OS-G, rooting/custom rom etc is prohibited until successful Google certification (y)
 

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
@Ene

Hi,

which version of beta testing did you choose? Guessing OS-L?

As far as I know there aren't any guides/links to unroot/recovery/rom the 6mq yet.

If you've chosen OS-G, rooting/custom rom etc is prohibited until successful Google certification (y)

I'm running OS-L, because I aim to install microG anyway (which requires an unlocked bootloader...)

(btw, how big is the international community here? Shall we continue in English like most Forums do or is deutsch the go-to? 🤔)
 

Martin S.

SHIFT Friend
Alpha Tester
15 Februar 2020
1.112
Still at work, I've seen 3(?) beta testers speaking english, so, a bit of a minority, at least for the 6mq test.

But let's keep english, Shift staff members are responding in english as well, so, not a problem (y)
 

7usr7local

Alpha Tester
Beta Tester
23 Oktober 2020
10
Hi @Ene,

fastboot flashing unlock worked for me (got my 6mq yesterday, Build number QQ2A.200501.001.B3 release-keys, ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113, Kernel Version 4.9.206-shift #1 Fri Nov 13 13:43:46 CET 2020, Build Date Fri Nov 13 13:54:24 CET 2020)
Code:
~ $ fastboot flashing unlock
                                                   OKAY [  0.038s]
Finished. Total time: 0.040s
~ $ fastboot --version
fastboot version 29.0.5-5949299
Installed as [...]
~ $
To know what you may have missed, we need to know more details: Was your phone in fastboot mode? Did you allow unlocking in the system settings?

Alas, myself I am stuck at the point after unlocking: How do I root the phone with neither a custom recovery nor a OTA flash image available? Or did I miss one of them?

Cheers

Edit: Corrected Kernel/Build dates - thanks to @Ene.
 
Zuletzt bearbeitet:
  • Like
Reaktionen: Martin S.

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
Hi @Ene,

fastboot flashing unlock worked for me (got my 6mq yesterday, Build number QQ2A.200501.001.B3 release-keys, ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113, Build date Nov 13th 2020 13:43:46)
Code:
~ $ fastboot flashing unlock
                                                   OKAY [  0.038s]
Finished. Total time: 0.040s
~ $ fastboot --version
fastboot version 29.0.5-5949299
Installed as [...]
~ $
To know what you may have missed, we need to know more details: Was your phone in fastboot mode? Did you allow unlocking in the system settings?

Alas, myself I am stuck at the point after unlocking: How do I root the phone with neither a custom recovery nor a OTA flash image available? Or did I miss one of them?

Cheers

Wow nice, these are good news! I unlocked about 50 different devices yet and never ran into such a problem, I have no idea what could have missed 🤔
I'll check back later this evening and provide all possible details. I used the newest fastboot (and successfully ran fastboot devices, so fastboot should be working) and enabled OEM Unlocking in the developer options tho.
And I'll try to extract the boot image from an OTA Update (https://downloads.shiftphones.com/axolotl), patch it with magisk and flash it via fastboot:
 
  • Like
Reaktionen: Martin S.

Uli

SHIFT Friend
Alpha Tester
23 August 2018
503
I think ist Important to use an full update not an incremental othervice it will not work.
 
  • Like
Reaktionen: blackcat

Jonny1797

Alpha Tester
Beta Tester
21 Oktober 2020
1
So, after 13 Months after preordering my 6mq it now arrived but until now I had no luck with unlocking the bootloader.
fastboot devices lists the device but fastboot oem unlock fails (FAILED (remote: 'Command not supported in default implementation')). fastboot flashing unlock also produces an error, FAILED (remote: 'Unrecognized command flashing unlock').
What am I missing? Shouldn't the "Lovephones" stay true to the product description?


Also, I haven't found any threads about a Custom Recovery for the 6mq yet, nor ROMs (which aren't possible with a locked bootloader anyways).

As of now, my 800€ device is nothing more than expensive electrical waste.

Pinging @amartinz if there is a solution in sight.

Best Regards

Hi,

just wanted to add that I have the same response like @Ene and am also very interested to root the device to restore backups (Titanium backup). I have just the same OS-Version and build number as @7usr7local.

Cheers
 
Zuletzt bearbeitet:

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
  • Build number QQ2A.200501.001.B3 release-keys
  • ShiftOS version SHIFT6MQ, SOS.30.0.L.20201113
  • Build date Fri Nov 13 13:54:24 CET 2020
In comparison to @7usr7local, my Build date differs.
Also I use fastboot version 30.0.5-6877874 on Windows 10

EDIT:
@7usr7local probably posted the build date of his kernel, not system image because the his posted timestamp matches my kernel version. So I think it's safe to assume, that our devices software is identical.
 
Zuletzt bearbeitet:

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
For clarification: How to boot into fastboot? I did it over the "enhance restart menu" developer option as well as the recovery menu and adb. It only boots the userspace fastbootd, I think this device doesn't feature the old fashioned fastboot anymore?

EDIT: Seems like I was on the wrong page. You have to boot into the bootloader, not fastbootd. I tried booting into the bootloader before, but my device wasn't detected by fastboot. I now tried again and fastboot worked in the bootloader mode. I'll edit the OP accordingly.
 
Zuletzt bearbeitet:

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...

>fastboot flash boot magisk_patched.img fastboot: error: Failed to identify current slot

>fastboot flash boot magisk_patched.img fastboot: error: cannot get boot partition size

I attached the image for you to try...(it also shrunk from 66Mb to 13Mb tho)

EDIT: removed the faulty boot.img
 
Zuletzt bearbeitet:

Martin S.

SHIFT Friend
Alpha Tester
15 Februar 2020
1.112
I wouldn't necessarily use system images not intended for the 6mq running OS-L..

Someone else tried something similar (Ok, he used stuff from the 6m :ROFLMAO: ) very early, I think it was even one of the first posts in the beta forum.

He soft bricked his 6mq (y) and needed "some help".
During the OS-G beta, unlocking/rooting/custom recoveries and roms were and still are prohibited, but that wouldn't irritate that user 😁
 
Zuletzt bearbeitet:
  • Like
Reaktionen: blackcat

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
I wouldn't necessarily use system images not intended for the 6mq running OS-L..

Someone else tried something similar (Ok, he used stuff from the 6m :ROFLMAO: ) very early, I think it was even one of the first posts in the beta forum.

He soft bricked his 6mq (y) and needed "some help".
During the OS-G beta, unlocking/rooting/custom recoveries and roms were and still are prohibited, but that wouldn't irritate that user 😁
I seriously doubt that the bootimage differs between the OS-G and OS-L variant.
Pinging @amartinz again, he could provide the OS-L bootimage and give advises how to flash it.
 
Zuletzt bearbeitet:
  • Like
Reaktionen: Uli und Martin S.

Wolf

Beta Tester
12 Februar 2019
7
grüß euch,
wir haben nun auch unser 6mq bekommen,

wo bitte kann ich die ShiftOS-Light Version dafür bekommen ?

danke sagt der Wolf
 

Martin S.

SHIFT Friend
Alpha Tester
15 Februar 2020
1.112
Hallo,

bist du Google oder OS-L Vorab-Tester?
Das jeweilige Test-Betriebssystem ist schon aufgespielt (y)
Es gibt noch keine offiziellen Links/Guides zum 6mq OS-L, soweit ich weiss.
 

Wolf

Beta Tester
12 Februar 2019
7
hi,
wir wurden als Betatester für OS-L genommen und haben ein 6mq mit Google erhalten.
eigentlich dachten wir auch das richtige sei vorinstalliert.
 
  • Wow
Reaktionen: Martin S.

Wolf

Beta Tester
12 Februar 2019
7
vor einiger Zeit haben wir ein 5me gekauft, da konnten wir dann selbst die Lite-Version installieren.
Wir haben kein Goggleaccount auf unseren Geräten
 

Martin S.

SHIFT Friend
Alpha Tester
15 Februar 2020
1.112
Ui, dann ist da was schief gelaufen.. fragt doch einfach mal beim Support nach, vielleicht bekommt ihr die OS-L Variante gegen euere 6mq eingetauscht?
 

mispecht

Alpha Tester
Beta Tester
23 Oktober 2020
14
I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...

>fastboot flash boot magisk_patched.img fastboot: error: Failed to identify current slot

>fastboot flash boot magisk_patched.img fastboot: error: cannot get boot partition size

I attached the image for you to try...(it also shrunk from 66Mb to 13Mb tho)

I tried the same:
I was able to flash the patched magisk_patched.img
Bash:
<hostname>:/<dir> # fastboot --slot a flash boot magisk_patched.img
target reported max download size of 805306368 bytes
Sending 'boot_a' (12736 KB)...
OKAY [  0.545s]
Writing 'boot_a'...
OKAY [  0.256s]
Finished. Total time: 0.808s
but after booting I could not switch on wifi ...
magisk manager showed me that magisk is installed
After that I flashed the extracted unpatched boot.img
but also with that wifi didn't work ....
Also my magisk_patched.img was much smaller than extracted unpatched boot.img

Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...
 
Zuletzt bearbeitet:
  • Like
Reaktionen: Martin S.

Ene

Original poster
Alpha Tester
Beta Tester
21 Oktober 2020
60
Germany / Bavaria
I tried the same:
I was able to flash the patched magisk_patched.img
Bash:
<hostname>:/<dir> # fastboot --slot a flash boot magisk_patched.img
target reported max download size of 805306368 bytes
Sending 'boot_a' (12736 KB)...
OKAY [  0.545s]
Writing 'boot_a'...
OKAY [  0.256s]
Finished. Total time: 0.808s
but after booting I could not switch on wifi ...
magisk manager showed me that magisk is installed
After that I flashed the extracted unpatched boot.img
but also with that wifi didn't work ....
Also my magisk_patched.img was much smaller than extracted unpatched boot.img

Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...

Those are great news! So it's possible to flash the boot image. Tbh, it's just my second time working with an A/B partitioned device, seems kinda tricky. I guess it didn't work for me because I didn't specify the slot I wanna flash to.
You only flashed the bootimage on Slot A, so if you can switch back to Slot B, WiFi should be working again. But the fastboot command to switch slots (--set-active=b) didn't work for me.
I would try to nail down the OTA Update Server by network traffic sniffing and hope I can pull an update image from there. But because there haven't been any updates released for OS-L yet, I'm not sure this will be successful. And also it's strange, that your WiFi still doesn't work after you flashed back the extracted boot image, I didn't thought the OS-G and OS-L kernels would differ. Maybe because the WiFi search service on the OS-G is based on GAPPS Location Services?
 
Zuletzt bearbeitet:

mispecht

Alpha Tester
Beta Tester
23 Oktober 2020
14
Hi Ene, yes I agree, direction is promising. I hope Shift will provide an image also for OS-L. I expect with that I can at least "repair" my phone and perhaps than the patch with magisk will also work ...
Do you know a way to extract boot.img from a working device?
Switch to slot B also didn't worked for me, I assume because I never applied an update slot B is empty.

With
fastboot getvar all
I get
Code:
...
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x4000000
...
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x4000000
...
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:7
(bootloader) slot-unbootable:b:yes
(bootloader) slot-successful:b:no
(bootloader) slot-retry-count:a:7
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2
...

It seems that B was never booted, but I can only see partition size and I don't know how to see whether there is any content in partition.
 

danielp

SHIFT Friend
Alpha Tester
22 September 2019
2.201
I'm running OS-L, because I aim to install microG anyway (which requires an unlocked bootloader...)

(btw, how big is the international community here? Shall we continue in English like most Forums do or is deutsch the go-to? 🤔)
Are you sure microG requires an unlocked bootloader? Afaik the only requirement is support for signature spoofing and I hope it is enabled in the ShiftOS-L builds already. If not well then root is required to enable signature spoofing. However the instructions for previous versions of ShiftOS-L do not mention that signature spoofing needs to be explicitly enabled.
 
  • Like
Reaktionen: Doobie

@Lhotze

Alpha Tester
Beta Tester
21 Oktober 2020
320
Do you know a way to extract boot.img from a working device?

If the bootloader is unlocked there is a method you can extract phone-partitions using the emergency-flash-mode from the qualcomm-chipset.


but this need an qualcomm-device-specific
"firehose-programmer-file" and i think here it fails again.
Greetz
____
Wenn der Bootloader entsperrt ist, gibt es eine Methode, mit der Telefonpartitionen mithilfe des Notfall-Flash-Modus aus dem Qualcomm-Chipsatz extrahieren können.
Dies erfordert jedoch eine qualcomm-gerätespezifische
"firehose-programmer-file" und ich denke hier scheitert es wieder
.
Greetz
 
Zuletzt bearbeitet:

danielp

SHIFT Friend
Alpha Tester
22 September 2019
2.201
I successfully extracted and patched the bootimage from the initial ShiftOS-3.0.G-20200721-RELEASE-axolotl.zip Update. But I can't get it flashed (flashing the original boot doesn't work either)...
Any idea how to get back the original boot.img?
In https://downloads.shiftphones.com/axolotl are only builds for ShiftOS-G ...
You guys are either very brave or very ...

I did rooting the past, it was some time ago, but I always checked, are there instructions and all the required stuff available for my specific device?
For the L-Version everything is available is the software running on the devices shipped to the Beta testers. No instructions which may be device specific, no software, nothing to switch back in case something goes wrong.

Now you played with the new devices without a strategy if things go wrong :confused:
 
  • Like
Reaktionen: Martin S.