Bootloader/Installation
In order to flash any third party system images to your device, it is essential to unlock the bootloader first.
Documented here are many different methods in order to do so.
WARNING!¶
- Unlocking your bootloader will wipe your device!
- Locking your bootloader on most newer (2016) devices will also wipe your device!
- Please backup all of your contacts, photos, files, apps, keys, etc. first!
Prerequisites¶
You are strongly encouraged to read, or at least skim, through the entire website. It has an abundance of information that will answer many questions and help set expectations of what is and is not provided. Failure to do so will only be a detriment to yourself and waste the time of others.
Research for information surrounding your specific device model.
It is strongly recommended to be running the latest factory images before switching, especially if relocking. However notably some devices must be running an old version to allow installation of alternative systems.
Run the below fastboot
commands at the bootloader menu (via key combination), not to be confused with fastbootd which is part of the recovery.
You must backup your device.
On your computer¶
- Arch Linux:
sudo pacman -S android-tools android-udev
- Fedora:
sudo dnf install android-tools
- Debian (severely outdated):
sudo apt install android-tools-adb android-tools-fastboot
- NixOS:
nix-shell -p android-tools
as root to have proper access to USB devices or follow docs for persistent installation of adb with proper udev configuration. - Linux:
curl -O https://dl.google.com/android/repository/platform-tools_r33.0.3-linux.zip
echo 'ab885c20f1a9cb528eb145b9208f53540efa3d26258ac3ce4363570a0846f8f7 platform-tools_r33.0.3-linux.zip' | sha256sum -c
bsdtar xvf platform-tools_r33.0.3-linux.zip
- macOS:
curl -O https://dl.google.com/android/repository/platform-tools_r33.0.3-darwin.zip
echo 'SHA256 (platform-tools_r33.0.3-darwin.zip) = 84acbbd2b2ccef159ae3e6f83137e44ad18388ff3cc66bb057c87d761744e595' | shasum -c
tar xvf platform-tools_r33.0.3-darwin.zip
- Windows:
curl -O https://dl.google.com/android/repository/platform-tools_r33.0.3-windows.zip
(Get-FileHash platform-tools_r33.0.3-windows.zip).hash -eq "1e59afd40a74c5c0eab0a9fad3f0faf8a674267106e0b19921be9f67081808c2"
tar xvf platform-tools_r33.0.3-windows.zip
- Credit to GrapheneOS for the above commands to download and verify the platform tools.
On your phone¶
- These steps are only necessary for devices that don't use fastboot-based install methods!
- Open the 'Settings' app
- Navigate to the 'About' page
- Tap on the field labeled 'Build number' 7 times
- A toast should appear saying that developer mode has been enabled
- There should now be an screen in the 'Settings' app labeled 'Developer options'
- Under 'Developer options', enable 'Android debugging'
If your device isn't detected via USB¶
- USB C: try flipping the cable to the other side
- USB C to USB C: try reversing the cable
- USB 3: try a USB 2 port, or a USB 2 hub dongle if your computer only has USB 3
- Try another cable, preferably shorter, but longer may work too
- Try a USB port that is directly on your motherboard, not on the front panel if it is a tower machine
- It is possible for the device to work for fastboot but not work for adb, try the above
- If fastboot is stuck at 0% for more than a few seconds, try the above
- Try running fastboot or adb as administrator or root
Fastboot (generic)¶
- Backup your device.
- Open the Phone app and type
*#*#2432546#*#*
, do not hit call - Enable 'Allow OEM unlocking' under 'Developer options' in Settings if available
- Did you backup your device?
- Reboot to the bootloader via key combination or
$ adb reboot bootloader
$ fastboot oem unlock
or$ fastboot flashing unlock
- Reboot the device, then reboot back to bootloader
- If 'AVB Key' (avb_pkmd.bin) is available:
$ fastboot erase avb_custom_key
$ fastboot flash avb_custom_key avb_pkmd-device.bin
- Reboot to the bootloader
- If fastboot.zip available:
$ fastboot update divested-version-date-dos-device-fastboot.zip
- If you receive a board mismatch and are absolutely sure you have the right file:
- First try: using
$ fastboot update --force [...].zip
- If that doesn't work: edit the android-info.txt file in the .zip file to match your board
- If recovery.img available:
$ fastboot flash recovery divested-version-date-dos-device-recovery.img
- Reboot to recovery (use volume buttons to navigate if on or key combination if off)
- If 'A/B Sync' (copy-partitions.zip) is available and NOT striked out:
$ adb sideload copy-partitions-device.zip
- Choose "Apply update", then "Apply from ADB", and
$ adb sideload divested-version-date-dos-device.zip
- While still in the recovery perform a factory reset
- Reboot into DivestOS. If it takes more than 10 minutes to boot then something is wrong. Do not let it sit for more than 10 minutes!
- There are monthly updates. You MUST read the News page and backup your device before each update.
- Locking your bootloader with an incorrectly signed system image or on unsupported device can result in a permanent brick!
- Locking your bootloader may be irreversible on some devices, such as: bacon, oneplus2
- Do not attempt to lock your bootloader on an untested device unless you are absolutely OKAY with it potentially being destroyed!
- On A/B systems firmware in both slots must be in sync/latest! Or else next installed update might be unbootable, and potentially brick.
- Some devices must be locked with extreme caution, see: Fairphone 4
- After install of a properly signed system you must verify boot, verify functionality, verify update support, and verify the ability to factory reset.
- Reboot to the bootloader via key combination or
$ adb reboot bootloader
- AVB devices only: flash the custom key slot if you didn't earlier.
- Ensure
$ fastboot flashing get_unlock_ability
is NOT zero, it MUST be one! Do NOT continue if zero! $ fastboot oem lock
or$ fastboot flashing lock
- It is recommended to keep 'Allow OEM unlocking' checked under 'Developer options' in Settings for recovery purposes (broken update, broken touchscreen, etc.).
Unlock & Install¶
Device specific steps are available via the "Install Method" link on the Device Downloads page.
Re-locking¶
WARNING!¶
WARNING!¶
From here on all of the following methods can very easily and irreversibly destroy your device!
Heimdall¶
- Devices Supported: Select Samsung devices
- This is not a bootloader unlock, but a way to get a custom recovery installed.
- [TO BE COMPLETED]
LG UP¶
- Devices Supported: Select LG devices
- This is not a bootloader unlock, but a way to get a custom recovery installed.
- Windows is required for this. KVM USB passthrough has been confirmed to work.
- [TO BE COMPLETED]
LG LAF¶
- Devices Supported: Select LG devices
- This is not a bootloader unlock, but a way to get a custom recovery installed.
- [TO BE COMPLETED]
Bulk Mode¶
- Devices Supported: Kindle Fire HDX 7/8 2014 (apollo/thor)
- Credit/Source: @draxie
- This is not a bootloader unlock, but a way to get a custom recovery installed.
- Windows is required for this. KVM USB passthrough has been confirmed to work
- Download dd from here
- Backup your device.
- Connect your device
> wmic partition where index=22 get diskindex
> wmic partition where (index=17 and numberofblocks=20480) get diskindex
> wmic partition where (index=5 and numberofblocks=4096) get diskindex
- The above 3 commands should all return the same DiskIndex
- Reboot to the bootloader via key combination or
$ adb reboot bootloader
> fastboot -i 0x1949 erase aboot
> fastboot -i 0x1949 reboot
> dd of=\\?\Device\Harddisk[DiskIndex]\Partition6 if=aboot_vuln.mbn
> dd of=\\?\Device\Harddisk[DiskIndex]\Partition18 if=divested-version-date-dos-device-recovery.img
- If you get the error "Error reading file: 87 The parameter is incorrect", ignore it
- Wait two minutes
- Force the device off by holding the power button
- Reboot to recovery (use volume buttons to navigate if on or key combination if off)
- Choose "Apply update", then "Apply from ADB", and
$ adb sideload divested-version-date-dos-device.zip
- While still in the recovery perform a factory reset
- Reboot into DivestOS. If it takes more than 10 minutes to boot then something is wrong. Do not let it sit for more than 10 minutes!
- There are monthly updates. You MUST read the News page and backup your device before each update.
Kernel Exploit¶
- This method works by first getting root, then overriding the recovery.
- This is not a bootloader unlock, but a way to get a custom recovery installed.
- Download the following apps: GingerBreak (CVE-2011-1823), Towelroot (CVE-2014-3153), croowt (CVE-2016-5195)
- Backup your device.
$ adb install *.apk
$ adb push divested-version-date-dos-device-recovery.img /sdcard/recovery.img
- Attempt to gain root using each app
$ adb shell
$$ su
$$ dd if=/sdcard/recovery.img of=/dev/block/bootdevice/by-name/recovery
- The output path in the above command may be different.
- Reboot to recovery (use volume buttons to navigate if on or key combination if off)
- Choose "Apply update", then "Apply from ADB", and
$ adb sideload divested-version-date-dos-device.zip
- While still in the recovery perform a factory reset
- Reboot into DivestOS. If it takes more than 10 minutes to boot then something is wrong. Do not let it sit for more than 10 minutes!
- There are monthly updates. You MUST read the News page and backup your device before each update.