Max 3 Rooted

[diabl0w]

Magisk is now quite stable on our devices. I am currently trying to open an AndroidFileHost account, where I will be hosting OTA's along with a patched magisk image to flash for each update to our devices.

This should make it safe and easy to upgrade.

That being said, I still don't recommend using this unless you either:
1) Know what your doing when in comes to rooting and messing with Android devices.
OR
2) Are willing to completely factory reset your device if something goes wrong (which means losing any files/data on the device)

If you are okay with either of these two things, you will be perfectly fine, as the latest updates for our devices fix the issue of possible brick.

[diabl0w]

updated OP

[shunf4]

Thanks for your work! I wonder how you extracted the recovery.img of 2.2.2 update provided EDL mode is no longer available.

Did you boot into a patched old version's recovery and run dd to dump it out? If so, we should expect each update in the future to be compatible with the patched recovery from the previous version. Is it true?

[diabl0w]

Originally Posted by shunf4

Thanks for your work! I wonder how you extracted the recovery.img of 2.2.2 update provided EDL mode is no longer available.

Did you boot into a patched old version's recovery and run dd to dump it out? If so, we should expect each update in the future to be compatible with the patched recovery from the previous version. Is it true?

I've had magisk installed since the original firmware, and I've been able to use root capabilities to intercept the encrypted update in an unencrypted form for each new update. then I get extract the zip and grab the new recovery.img and patch it. that being said, I am not sure if the recovery.img has even changed between firmwares. so you may be right. I dont really care to investigate it for the time being, since patching the new one is easy.

I will actually probably start patching the boot.img instead, because I have recently found that we can do that with our devices and it makes things more straightforward. The current method in OP actually patches the boot.img anyway once you hit "install" in magisk manager. Whether you originally "fastboot boot" with a patched recovery or patched boot is sort of irrelevant at the moment.

all these things can change if onyx pushes updates to the bootloader or kernel or recovery. so for your last statement I would say the answer is usually yes, but not necesarily. but I will always be able to provide a patched version for the latest update so its a non issue

[shunf4]

Originally Posted by diabl0w

and I've been able to use root capabilities to intercept the encrypted update in an unencrypted form for each new update

How did you "intercept"? I'm curious about this. Is it complicated hack or just dumping it out after the update completes?

[diabl0w]

Originally Posted by shunf4

How did you "intercept"? I'm curious about this. Is it complicated hack or just dumping it out after the update completes?

just before the tablet reboots, the zip is available in /data/local/assets, so you have to bind that folder so the file isn't lost since there isnt a way to stop the device from rebooting without making an xposed module

[bel3atar]

does this work on the poke pro?

[diabl0w]

Originally Posted by bel3atar

does this work on the poke pro?

no, max3 only

[SleepWithMachine]

i just checked my nova 2, it also has an unlocked bootloader and uses "system as root" . And its a NON-A/B partitioned device running on android 9. So its the same scenario

because the firmware is available, i can use magisk apk to patch the recovery.img , is that right ?

the only thing i am missing is a fastboot driver for the nova 2, where can i get it from ?

edit: managed to get the adb & fastboot driver to work, just waiting for someones reply to give it a go

edit2: it fails because I cant unpack the firmware (upx file) , getting the recovery.img directly from the device in edl mode isnt possible. i have no clue ..

[diabl0w]

Originally Posted by SleepWithMachine

i just checked my nova 2, it also has an unlocked bootloader and uses "system as root" . And its a NON-A/B partitioned device running on android 9. So its the same scenario

because the firmware is available, i can use magisk apk to patch the recovery.img , is that right ?

the only thing i am missing is a fastboot driver for the nova 2, where can i get it from ?

edit: managed to get the adb & fastboot driver to work, just waiting for someones reply to give it a go

edit2: it fails because I cant unpack the firmware (upx file) , getting the recovery.img directly from the device in edl mode isnt possible. i have no clue ..

You're on the right track. Unfortunately because the upx is encrypted, the only way to get the recovery and boot images are through EDL. I believe your device uses the same chipset, so you should be able to use the tools linked in reply #15 to this thread.

You'd get the images by 'emmcdl.exe -p COM7 ***(or your COM port here) -f prog_emmc_firehose_8953_ddr.mbn -d boot -o boot.img'

I don't know how to get your device in EDL mode, but they sell special cables to force a device into EDL mode.

[SleepWithMachine]

i think without the special cable we will not get into edl mode. I also tried the patched edl-fastboot from xda-developers, but it didn't work either, thanks anyway diabl0w

[diabl0w]

Originally Posted by SleepWithMachine

i think without the special cable we will not get into edl mode. I also tried the patched edl-fastboot from xda-developers, but it didn't work either, thanks anyway diabl0w

No problem, seems like you know what your doing. If you are interested there are guides to making your own EDL cable with a normal charging cable. its simple... Ive done it with this device before ordering a cable, just shorting out a wire, you can google it

[SleepWithMachine]

i only find shaky yt videos, but if the picture corresponds to the procedure, I can build it quickly

[SleepWithMachine]

ok, preparing the cable was very easy. Now i have a dump of 3 files, boot, system and userdata.

will continue with magisk manager later, i found this guide:


You would want to choose this method if either your device does not have custom recoveries, your device is A/B and you don’t want to mix recovery and boot images, or your device is using system-as-root without A/B partitions.

To use this method, you are required to obtain a copy of the stock boot/recovery image, which can be found by extracting OEM provided factory images or extracting from OTA update zips. If you are unable to obtain one yourself, you might be able to find it somewhere on the internet. The following instructions will guide you through the process after you have the copy of boot/recovery image.

Copy the boot/recovery image to your device
Download and install the latest Magisk Manager
If you are patching a recovery image, manually check “Recovery Mode” in Advanced Settings!
Press Install → Install → Select and Patch a File, and select your stock boot/recovery image file
Magisk Manager will patch the image, and store it in [Internal Storage]/Download/magisk_patched.img
Copy the patched image from your device to your PC. If you can’t find it via MTP, you can pull the file with ADB:
adb pull /sdcard/Download/magisk_patched.img
Flash the patched boot/recovery image to your device and reboot. For most devices, here is the fastboot command:
fastboot flash boot /path/to/magisk_patched.img or
fastboot flash recovery /path/to/magisk_patched.img if you are patching a recovery image


is there something else i have to consider?

[SleepWithMachine]

Originally Posted by SleepWithMachine

ok, preparing the cable was very easy. Now i have a dump of 3 files, boot, system and userdata.

will continue with magisk manager later, i found this guide:


You would want to choose this method if either your device does not have custom recoveries, your device is A/B and you don’t want to mix recovery and boot images, or your device is using system-as-root without A/B partitions.

To use this method, you are required to obtain a copy of the stock boot/recovery image, which can be found by extracting OEM provided factory images or extracting from OTA update zips. If you are unable to obtain one yourself, you might be able to find it somewhere on the internet. The following instructions will guide you through the process after you have the copy of boot/recovery image.

Copy the boot/recovery image to your device
Download and install the latest Magisk Manager
If you are patching a recovery image, manually check “Recovery Mode” in Advanced Settings!
Press Install → Install → Select and Patch a File, and select your stock boot/recovery image file
Magisk Manager will patch the image, and store it in [Internal Storage]/Download/magisk_patched.img
Copy the patched image from your device to your PC. If you can’t find it via MTP, you can pull the file with ADB:
adb pull /sdcard/Download/magisk_patched.img
Flash the patched boot/recovery image to your device and reboot. For most devices, here is the fastboot command:
fastboot flash boot /path/to/magisk_patched.img or
fastboot flash recovery /path/to/magisk_patched.img if you are patching a recovery image


is there something else i have to consider?

edit: success, root access !

patched boot image for Nova 2, latest firmware 2.2.3
https://anonfiles.com/b1H6Vbpaoe/magisk_patched_img