Sonim XP8 (Root?)

Search This thread

smokeyou

Senior Member
Dec 27, 2008
64
20
ok c:\flashtools>fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile.xml --lun=0 --memoryname=emmc --noprompt --reset

Base Version: 17.07.28.15.44
Binary build date: Jul 28 2017 @ 18:08:54
Incremental Build version: 17.07.28.18.08.54

20:19:38: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile.xml --lun=0 --memoryname=emmc --noprompt --reset
************************************************

20:19:38: INFO: Current working dir (cwd): c:\flashtools\
20:19:38: INFO: Showing network mappings to allow debugging
20:19:38: INFO:



20:19:38: INFO: Trying to store 'xmlfile.xml' in string table
20:19:38: INFO: Looking for file 'xmlfile.xml'
20:19:38: INFO: User wants to talk to port '\\.\COM11'
20:19:38: INFO: Took 0.00000000 seconds to open port
20:19:38: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:19:38: INFO: If you don't want this, use --dontsorttags

20:19:38: INFO: Sending <configure>

20:19:38: INFO: TARGET SAID: 'Binary build date: Aug 6 2018 @ 20:55:38'

20:19:38: INFO: TARGET SAID: 'Chip serial num: 0 (0x0)'

20:19:38: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '

20:19:38: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
20:19:38: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
20:19:38: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
20:19:38: INFO: In handleProgram('boot_b.img')
20:19:38: INFO: Looking for file 'boot_b.img'
20:19:38: INFO: =======================================================
20:19:38: INFO: {<program> FILE: 'boot_b.img'}
20:19:38: INFO: {<program> (64.00 MB) 131072 sectors needed at location 393216 on LUN 0}
20:19:38: INFO: =======================================================


20:19:38: INFO: TARGET SAID: 'start 393216, num 131072'

20:19:40: INFO: Overall to target 2.016 seconds (29.27 MBps)
20:19:40: INFO: Overall to target 2.219 seconds (28.84 MBps)

20:19:40: INFO: TARGET SAID: 'Finished programming start_sector 524288 and TotalSectorsToProgram 131072'
20:19:40: INFO:
20:19:40: INFO: =======================================================
20:19:40: INFO: ==================== {SUCCESS} ========================
20:19:40: INFO: =======================================================


20:19:40: INFO: Sending <power>

20:19:40: INFO: TARGET SAID: 'Inside handlePower() - Requested POWER_RESET'

20:19:40: INFO: TARGET SAID: 'Issuing bsp_target_reset() after 10 seconds, if this hangs, do you have WATCHDOG enabled?'
20:19:40: INFO: ==============================================================
20:19:40: INFO: Files used and their paths
20:19:40: INFO: 1 'c:\flashtools\port_trace.txt'
20:19:40: INFO: 2 'c:\flashtools\xmlfile.xml'
20:19:40: INFO: 3 'c:\flashtools\boot_b.img'

20:19:40: INFO: _ (done)
20:19:40: INFO: | |
20:19:40: INFO: __| | ___ _ __ ___
20:19:40: INFO: / _` |/ _ \| '_ \ / _ \
20:19:40: INFO: | (_| | (_) | | | | __/
20:19:40: INFO: \__,_|\___/|_| |_|\___|
20:19:40: INFO: {All Finished Successfully}

20:19:40: INFO: Overall to target 2.453 seconds (26.09 MBps)

Writing log to 'c:\flashtools\port_trace.txt', might take a minute


Log is 'c:\flashtools\port_trace.txt'


c:\flashtools>


that from re flashing from this xml

<?xml version="1.0"?>
<data>
<program filename="boot_b.img" label="boot_b" num_partition_sectors="131072" partofsingleimage="false" physical_partition_number="0" readbackverify="false" sparse="false" start_sector="393216" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>

</data>


i re downloaded the boot. re patched it from the already installed magisk and re downloaded it to flash thru the terminal wich showed success above.... still no root ;| i had to install magisk from in android aswell.. the adb returned me an invalid apk but it installed in android

That looks like we re-flashed the original boot_b?
 

uberdude420

Member
Oct 25, 2017
23
1
actually just seen that and re did with

<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_b" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>


succeeded.... still no root :/ lol

c:\flashtools>fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile1.xml --lun=0 --memoryname=emmc --noprompt --reset

Base Version: 17.07.28.15.44
Binary build date: Jul 28 2017 @ 18:08:54
Incremental Build version: 17.07.28.18.08.54

20:58:16: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile1.xml --lun=0 --memoryname=emmc --noprompt --reset
************************************************

20:58:16: INFO: Current working dir (cwd): c:\flashtools\
20:58:16: INFO: Showing network mappings to allow debugging
20:58:16: INFO:



20:58:16: INFO: Trying to store 'xmlfile1.xml' in string table
20:58:16: INFO: Looking for file 'xmlfile1.xml'
20:58:16: INFO: User wants to talk to port '\\.\COM11'
20:58:16: INFO: Took 0.00000000 seconds to open port
20:58:16: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:58:16: INFO: If you don't want this, use --dontsorttags

20:58:16: INFO: Sending <configure>

20:58:16: INFO: TARGET SAID: 'Binary build date: Aug 6 2018 @ 20:55:38'

20:58:16: INFO: TARGET SAID: 'Chip serial num: 0 (0x0)'

20:58:16: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '

20:58:16: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
20:58:16: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
20:58:16: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
20:58:16: INFO: In handleProgram('magisk_patched.img')
20:58:16: INFO: Looking for file 'magisk_patched.img'
20:58:16: INFO: =======================================================
20:58:16: INFO: {<program> FILE: 'magisk_patched.img'}
20:58:16: INFO: {<program> (47.31 MB) 96883 sectors needed at location 262144 on LUN 0}
20:58:16: INFO: =======================================================


20:58:16: INFO: TARGET SAID: 'start 262144, num 96883'

20:58:18: INFO: Overall to target 2.031 seconds (19.20 MBps)
20:58:18: INFO: Overall to target 2.531 seconds (18.69 MBps)

20:58:18: INFO: TARGET SAID: 'Finished programming start_sector 359027 and TotalSectorsToProgram 96883'
20:58:18: INFO:
20:58:18: INFO: =======================================================
20:58:18: INFO: ==================== {SUCCESS} ========================
20:58:18: INFO: =======================================================


20:58:18: INFO: Sending <power>

20:58:18: INFO: TARGET SAID: 'Inside handlePower() - Requested POWER_RESET'

20:58:18: INFO: TARGET SAID: 'Issuing bsp_target_reset() after 10 seconds, if this hangs, do you have WATCHDOG enabled?'
20:58:18: INFO: ==============================================================
20:58:18: INFO: Files used and their paths
20:58:18: INFO: 1 'c:\flashtools\port_trace.txt'
20:58:18: INFO: 2 'c:\flashtools\xmlfile1.xml'
20:58:18: INFO: 3 'c:\flashtools\magisk_patched.img'

20:58:18: INFO: _ (done)
20:58:18: INFO: | |
20:58:18: INFO: __| | ___ _ __ ___
20:58:18: INFO: / _` |/ _ \| '_ \ / _ \
20:58:18: INFO: | (_| | (_) | | | | __/
20:58:18: INFO: \__,_|\___/|_| |_|\___|
20:58:18: INFO: {All Finished Successfully}

20:58:18: INFO: Overall to target 2.750 seconds (17.20 MBps)

Writing log to 'c:\flashtools\port_trace.txt', might take a minute


Log is 'c:\flashtools\port_trace.txt'


c:\flashtools>
 

smokeyou

Senior Member
Dec 27, 2008
64
20
actually just seen that and re did with

<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_b" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>


succeeded.... still no root :/ lol

c:\flashtools>fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile1.xml --lun=0 --memoryname=emmc --noprompt --reset

Base Version: 17.07.28.15.44
Binary build date: Jul 28 2017 @ 18:08:54
Incremental Build version: 17.07.28.18.08.54

20:58:16: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
fh_loader.exe --port=\\.\COM11 --sendxml=xmlfile1.xml --lun=0 --memoryname=emmc --noprompt --reset
************************************************

20:58:16: INFO: Current working dir (cwd): c:\flashtools\
20:58:16: INFO: Showing network mappings to allow debugging
20:58:16: INFO:



20:58:16: INFO: Trying to store 'xmlfile1.xml' in string table
20:58:16: INFO: Looking for file 'xmlfile1.xml'
20:58:16: INFO: User wants to talk to port '\\.\COM11'
20:58:16: INFO: Took 0.00000000 seconds to open port
20:58:16: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:58:16: INFO: If you don't want this, use --dontsorttags

20:58:16: INFO: Sending <configure>

20:58:16: INFO: TARGET SAID: 'Binary build date: Aug 6 2018 @ 20:55:38'

20:58:16: INFO: TARGET SAID: 'Chip serial num: 0 (0x0)'

20:58:16: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '

20:58:16: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
20:58:16: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
20:58:16: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
20:58:16: INFO: In handleProgram('magisk_patched.img')
20:58:16: INFO: Looking for file 'magisk_patched.img'
20:58:16: INFO: =======================================================
20:58:16: INFO: {<program> FILE: 'magisk_patched.img'}
20:58:16: INFO: {<program> (47.31 MB) 96883 sectors needed at location 262144 on LUN 0}
20:58:16: INFO: =======================================================


20:58:16: INFO: TARGET SAID: 'start 262144, num 96883'

20:58:18: INFO: Overall to target 2.031 seconds (19.20 MBps)
20:58:18: INFO: Overall to target 2.531 seconds (18.69 MBps)

20:58:18: INFO: TARGET SAID: 'Finished programming start_sector 359027 and TotalSectorsToProgram 96883'
20:58:18: INFO:
20:58:18: INFO: =======================================================
20:58:18: INFO: ==================== {SUCCESS} ========================
20:58:18: INFO: =======================================================


20:58:18: INFO: Sending <power>

20:58:18: INFO: TARGET SAID: 'Inside handlePower() - Requested POWER_RESET'

20:58:18: INFO: TARGET SAID: 'Issuing bsp_target_reset() after 10 seconds, if this hangs, do you have WATCHDOG enabled?'
20:58:18: INFO: ==============================================================
20:58:18: INFO: Files used and their paths
20:58:18: INFO: 1 'c:\flashtools\port_trace.txt'
20:58:18: INFO: 2 'c:\flashtools\xmlfile1.xml'
20:58:18: INFO: 3 'c:\flashtools\magisk_patched.img'

20:58:18: INFO: _ (done)
20:58:18: INFO: | |
20:58:18: INFO: __| | ___ _ __ ___
20:58:18: INFO: / _` |/ _ \| '_ \ / _ \
20:58:18: INFO: | (_| | (_) | | | | __/
20:58:18: INFO: \__,_|\___/|_| |_|\___|
20:58:18: INFO: {All Finished Successfully}

20:58:18: INFO: Overall to target 2.750 seconds (17.20 MBps)

Writing log to 'c:\flashtools\port_trace.txt', might take a minute


Log is 'c:\flashtools\port_trace.txt'


c:\flashtools>

I thought we had validated the Telus images. Or we did have 1 success reported however I'm not sure what build version the guy was running.

This seems to be an issue on the return side. If Telus used a different GPT layout for example then Magisk manager would fail patching - so we know it's a valid image at least.

We can try to erase boot_a & boot_b before flash back. If that fails I would probably ask if you could send over an image backup for testing.

Code:
<?xml version="1.0"?>
<data>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="262144" physical_partition_number="0" label="boot_a"/>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="393216" physical_partition_number="0" label="boot_b"/>
</data>
 
Last edited:

eleotk

Senior Member
Apr 3, 2014
117
42
I thought we had validated the Telus images. Or we did have 1 success reported however I'm not sure what build version the guy was running.

This seems to be an issue on the return side. If Telus used a different GPT layout for example then Magisk manager would fail patching - so we know it's a valid image at least.

We can try to erase boot_a & boot_b before flash back. If that fails I would probably ask if you could send over an image backup for testing.

Code:
<?xml version="1.0"?>
<data>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="262144" physical_partition_number="0" label="boot_a"/>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="393216" physical_partition_number="0" label="boot_b"/>
</data>

No XP5S Debug Images? XP8 battery baffle is too broken
 
Last edited:

albert.r

Senior Member
Oct 25, 2010
70
2
@smokeyou, thank you for sharing AT&T android 8.1.0 userdebug build. I have my phone now flashed with AT&T 7.1.1 userdebug build and testing it. Android 8.1.0 gave me alot of grieve, since many customizations I got used to don't work anymore and developers don;t have any desire to port them to Oreo.

-albertr
 

smokeyou

Senior Member
Dec 27, 2008
64
20
@smokeyou, thank you for sharing AT&T android 8.1.0 userdebug build. I have my phone now flashed with AT&T 7.1.1 userdebug build and testing it. Android 8.1.0 gave me alot of grieve, since many customizations I got used to don't work anymore and developers don;t have any desire to port them to Oreo.

-albertr

There we go!! I haven't done much testing on that early AT&T image so this is good news.

I wont try to talk you out of running on such an old security patch level :). It's good that your making a contentious decision between vulnerabilities and customization even if not recommended.
 

albert.r

Senior Member
Oct 25, 2010
70
2
So what would be a "good" way to install SuperSU on top of userdebug build?

Should I use magisk to massage the boot image and then flash it back via fastboot?

adb reboot bootloader
fastboot flash boot magisk_patched.img
fastboot reboot

I'm on 7.1.1, so I don't think I have dual boot partitions...

-albertr
 

smokeyou

Senior Member
Dec 27, 2008
64
20
So what would be a "good" way to install SuperSU on top of userdebug build?

Should I use magisk to massage the boot image and then flash it back via fastboot?

adb reboot bootloader
fastboot flash boot magisk_patched.img
fastboot reboot

I'm on 7.1.1, so I don't think I have dual boot partitions...

-albertr


The tested way is essentially the same as applying magisk to a standard user image. It feels like we would give up main the benefits of having userdebug though because userdebug contains native su binaries tied to adb root.

Fastboot may work also if your unlocked. I personally had mixed results where some would flash and some would fail. You can also move back to a user build and retain the unlock.
 

uberdude420

Member
Oct 25, 2017
23
1
I thought we had validated the Telus images. Or we did have 1 success reported however I'm not sure what build version the guy was running.

This seems to be an issue on the return side. If Telus used a different GPT layout for example then Magisk manager would fail patching - so we know it's a valid image at least.

We can try to erase boot_a & boot_b before flash back. If that fails I would probably ask if you could send over an image backup for testing.

Code:
<?xml version="1.0"?>
<data>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="262144" physical_partition_number="0" label="boot_a"/>
<erase SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="131072" start_sector="393216" physical_partition_number="0" label="boot_b"/>
</data>




well it flashed.... but.......
now i seem to be hanging on loading the firehose to re install boots :/ c:\flashtools>QSaharaServer.exe -p \\.\COM11 -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
Binary build date: Jul 28 2017 @ 18:09:01
QSAHARASERVER CALLED LIKE THIS: 'QSaharaServer.ex'Current working dir: c:\flashtools
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: prog_emmc_ufs_firehose_Sdm660_ddr.elf

23:45:22: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

23:45:22: ERROR: function: sahara_main:924 Sahara protocol error

23:45:22: ERROR: function: main:303 Uploading Image using Sahara protocol failed




no boot :(

edit

i got it restored from my origonal full backup... should i send you that? if so wich img files are needed or do you need my whole backup folder zipped?

also i tried flashing the magisk boot. one at a time on each partition... both times i came up un able to boot with a boot warning of system being corrupted and nothing passed it. :(
 
Last edited:

smokeyou

Senior Member
Dec 27, 2008
64
20
well it flashed.... but.......
now i seem to be hanging on loading the firehose to re install boots :/ c:\flashtools>QSaharaServer.exe -p \\.\COM11 -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
Binary build date: Jul 28 2017 @ 18:09:01
QSAHARASERVER CALLED LIKE THIS: 'QSaharaServer.ex'Current working dir: c:\flashtools
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: prog_emmc_ufs_firehose_Sdm660_ddr.elf

23:45:22: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

23:45:22: ERROR: function: sahara_main:924 Sahara protocol error

23:45:22: ERROR: function: main:303 Uploading Image using Sahara protocol failed




no boot :(

edit

i got it restored from my origonal full backup... should i send you that? if so wich img files are needed or do you need my whole backup folder zipped?

also i tried flashing the magisk boot. one at a time on each partition... both times i came up un able to boot with a boot warning of system being corrupted and nothing passed it. :(

Pretty much everything aside from userdata. The files produced are large as they include all free space however they should zip up to a fairly reasonable size.

Typically we would provide all XML's in a single command or incrementally without rebooting until all actions are complete. For example "--sendxml=erase.xml,rawprogram0.xml".

Generally speaking it's not a good idea to leave EDL without having all critical partitions populated. I'm glad we were able to restore!!
 

uberdude420

Member
Oct 25, 2017
23
1
Pretty much everything aside from userdata. The files produced are large as they include all free space however they should zip up to a fairly reasonable size.

Typically we would provide all XML's in a single command or incrementally without rebooting until all actions are complete. For example "--sendxml=erase.xml,rawprogram0.xml".

Generally speaking it's not a good idea to leave EDL without having all critical partitions populated. I'm glad we were able to restore!!

following the edl backup. tutorial in the threads here.. i dont have a user data. just alot of img files and xmls and such in my flashtools folder as it was my working directory

should i zip and send that folder? or is there another backup method i should use eg adb backup... if so.. any chance you could send the proper command for the right type of bakup lol.. im still noobish with the terminal. :p
 
Last edited:

smokeyou

Senior Member
Dec 27, 2008
64
20
smokeyou coud you make a video tutorial for rooting xp8 will be very appreciate
Hey there Profy_X!

That's a tough one for me. I'm just a developer - Not even a good developer :).

I wanted to share root with others since the topic was pending on XDA for about a year when I happened to randomly acquire a couple used XP8's that were included in the same box with an S660 dev kit I got from a local auction. Rooting the XP8 was really a side effect as I needed something to do one night while waiting for a GSI build (for a different device) to compile.

Typically I don't encourage blindly modifying devices though. Research and education is a great thing however video tutorials usually leave out critical points allowing for modifications without holding a valid understanding of the greater topic including any underlying requirements. When it comes to content creation around rooting the focus is primarily on the aspect of easily replicating steps as this is good way to generate traffic(/revenue). The down side is that only leads to more people bricking their device and that would make me feel pretty horrible.

I would be supportive if someone else wanted to do this however I would not want to be the person to do it.

following the edl backup. tutorial in the threads here.. i dont have a user data. just alot of img files and xmls and such in my flashtools folder as it was my working directory

should i zip and send that folder? or is there another backup method i should use eg adb backup... if so.. any chance you could send the proper command for the right type of bakup lol.. im still noobish with the terminal. :p

Perfect!! If you copied it from me then it should exclude user data already yeah. Google drive or anything that works for you should be fine for transfer. The image files are the main items needed for testing but feel free to capture the whole folder as that is probably easier then sifting through all the files.

There is a lot of images that are actually empty however it can be difficult to sift through them to get everything sorted. If it gave you all the .img files then it sounds like you gave it the right command already :).
 
Last edited:

uberdude420

Member
Oct 25, 2017
23
1
Hey there Profy_X!

That's a tough one for me. I'm just a developer - Not even a good developer :).

I wanted to share root with others since the topic was pending on XDA for about a year when I happened to randomly acquire a couple used XP8's that were included in the same box with an S660 dev kit I got from a local auction. Rooting the XP8 was really a side effect as I needed something to do one night while waiting for a GSI build (for a different device) to compile.

Typically I don't encourage blindly modifying devices though. Research and education is a great thing however video tutorials usually leave out critical points allowing for modifications without holding a valid understanding of the greater topic including any underlying requirements. When it comes to content creation around rooting the focus is primarily on the aspect of easily replicating steps as this is good way to generate traffic(/revenue). The down side is that only leads to more people bricking their device and that would make me feel pretty horrible.

I would be supportive if someone else wanted to do this however I would not want to be the person to do it.



Perfect!! If you copied it from me then it should exclude user data already yeah. Google drive or anything that works for you should be fine for transfer. The image files are the main items needed for testing but feel free to capture the whole folder as that is probably easier then sifting through all the files.

There is a lot of images that are actually empty however it can be difficult to sift through them to get everything sorted. If it gave you all the .img files then it sounds like you gave it the right command already :).

dude to me... your a top notch developer lol... nobody has done **** with this phone...and for a guy like me.. its an ultimate phone.. the only thing it lacked was root for a few things. lol. love my viper audio... drive droid.. a few other goodies and you my friend.. are the one finally getting a ball rolling on this phone lol. so again.. ty .
 
Last edited:
So I got my XP8 from ebay with android 7 still on it. Today I managed to get a ATT sim(its the ATT branded phone) and updated it to android 8. Before getting the sim I tried to update via android recovery and the downloaded OTA updates but android recovery would fail to mount a partition so it would not update via sideload or sd card.

I had hoped that the newer version of android would actually allow both sim cards to function correctly but I was wrong.

I also tried to use the backup method before getting the ATT sim card but it was also failing, I was able to backup just the boot image but not the full system image.

Before I start trying to dig into the userdebug images does anyone know if they offer the true dual standby of the sim slots as it appears maybe only the european version supports?

I say maybe as looking at all the user guides the Euro Generic user guide is the only one to reference 2 sims active and shows a VoLTE symbol on page 17
Page 15 also indicates the settings page I would see on my LG v20 to select sim cards

I use T-mobile as my primary carrier but with the wal mart plan that only gives you 100min of voice, I also have xfinity mobile which this phone also seems to support as it actually connected to the network unlike on LG V20 dual sim phone. My ultimate goal is to setup this phone to use T-mobile for data and xfinity/verizon for voice.
 
Last edited:

CuongDang

New member
Dec 1, 2019
1
0
Hi smokeyou

I have just got an AT&T Sonim XP8, I'm not live in US.
I followed your bellow guide and my Sonim can start XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00
But I am having a big problem now, the mobile network does not work anymore. *#06# doesn't work => Phone has stopped and It doesn't recognize my sim. Android OS cant read IMEI!
I don't know what to do next! could you help me?

Enjoy!

XP8 Android Root Theory - DEBUG or Magisk over EDL
EDL is a must since Fastboot cannot be unlocked initially from standard "user" builds.

One option is flash a userdebug image (below) allowing for adb root, fastboot unlocking, and other useful features.
or
Without unlocking the bootloader - Similar flashing methods remain valid when standard magisk powered root is desired. This method allows preservation of all current system data aside from boot.img. All is covered since Magisk works with AVB and we have EDL as a flashing alternative. Please see Android Boot Flow > LOCKED Devices with Custom Root of Trust for more information.

Recommend method ..
It's up to you.. If you want OTA updates and your planning to use root apps then go with Magisk. As of today we have current debug images available and I personally prefer isolated adb root access only however future availability of updated Debug images cannot be guaranteed.

Disclaimer
-Devices with locked bootloaders will display a custom OS warning at boot
-Tested on AT&T branded devices only - please provide system dump for validation on other builds
-I have not identified any JTAG procedures and I can not help if you hard brick your device!
-This guide only touches boot_a and should be relatively safe since boot_b remains unmodified. I'm pretty sure this is enough to restore the original boot.img to boot_a under a failure scenario.. But I'm not really qualified enough to say definitively either.
-Take great caution - this is raw emmc access and critical system data! You are proceeding at your own risk!

Magisk Root

Step 1 - Pull Boot.img
We need to pull the boot.img in order to feed it to magisk later for patching. It's also good to keep on hand for if/when you need to restore for any reason.
1. Create an XML file with the data below
Code:
<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="boot.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>
2. Boot to EDL mode and load firehose programmer
Code:
QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
3. Backup boot.img using the following command
Code:
fh_loader.exe  --convertprogram2read --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0  --memoryname=emmc --noprompt --reset
Or visit the XP8 carrier firmware thread for full system backup steps.
https://xdaforums.com/showpost.php?p=80465045&postcount=6

Step 2 - Magisk Patch
1. ADB push boot.img /storage/self/primary/Download/
2. Install Magisk Manager and apply patch to boot.img
2a. Download from https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
2b. Extract and run adb install magisk.apk
2c. Open Magisk app and apply patch to boot.img
3. ADB pull /storage/self/primary/Download/magisk_patched.img

Step 3 - Restore
1. Change the filename attribute in the XML to reflect newly created magisk_patched.img as shown below
Code:
<?xml version="1.0"?>
<data>
<program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
</data>
2. Boot back into EDL mode and load firehose programmer
Code:
QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
3. Apply magisk_patched.img using the following command
Code:
fh_loader.exe --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0  --memoryname=emmc --noprompt --reset

USERDEBUG Flash

Step 1 - Backup
1. Boot to EDL mode and load firehose programmer
2. Generate rawprogram0.xml - Run GPTConsole <COM Number>
Example: GPTConsole 19
3. Initiate backup
Code:
fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=rawprogram0.xml --lun=0  --memoryname=emmc --noprompt --reset
4. Wipe all partitions
Code:
fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=erase.xml --lun=0  --memoryname=emmc --noprompt --reset
5. Restore new image
Code:
fh_loader.exe --port=\\.\COM<#> --sendxml=rawprogram0.xml --lun=0  --memoryname=emmc --noprompt --reset --search_path=<extracted image file directory>
// rawprogram0_unsparse.xml for some images

Images and OTA Files

Full 8.1 System Image
XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00
XP8A_ATT-user-8A.0.5-10-8.1.0-10.49.00

USERDEBUG Images
XP8A_ATT_userdebug_8A.0.5-11-8.1.0-10.54.00
XP8A_ACG-userdebug-8A.0.0-00-7.1.1-32.00.12
XP8A_USC-userdebug-8A.0.0-00-7.1.1-34.00.10
(ATT 7.1 pending upload. Please check back or use other links available further in thread.)

OTA Updates
XP8_ATT_user_N10.01.75-O10.49.00
XP8_ATT_user_O10.49.00-O10.54.00
XP8_TEL_user_N12.00.24-O12.23.00

Flash Tools - programmer (elf) file provided by eleotk!
XP8 Drivers

Firmware Carrier Codes
Code:
    None = 0,
    ATT = 10
    Bell = 11
    Telus = 12
    Sasktel = 13
    Harris = 14
    Verizon = 15
    Ecom = 16
    NAM = 17
    Rogers = 18
    T_Mobile = 19
    EU_Generic = 20
    MSI = 21
    CISCO = 22
    NAM_Public_Safety = 23
    Vodafone_Global = 24
    Orange = 25
    Southern_Linc = 26
    OPTIO = 27
    India = 28
    SPRINT = 29
    JVCK = 30
    AUS = 31
    ACG = 32
    CSPIRE = 33
    USC = 34
    SB = 35
    Multi = 99

Automatic OTA without AT&T service:
Purchase a blank AT&T SIM card ($5)
Start online prepaid activation - complete pages 1 & 2
**SIM Card is now partially active without funding - do not complete page 3 (payment)***
*#*#368378#*#* > Clear UI > Check for updates in settings

XP5s
Sprint Image: XP5SA.0.2-03-7.1.2-29.03.00
Works the same. Tested with unmodified Sprint firmware. Like most other apps, the Magisk manager app is unusable since the XP5s has no touch screen - I had to patch the boot image on another device. You can plug in a USB mouse however the cursor does not seem to invoke in-app tap's.

Need to use the appropriate Firehose loader (prog_emmc_firehose_8920.mbn) and replace the boot image location according to the XP5s GPT (start_sector="790528").
 
Last edited:

smokeyou

Senior Member
Dec 27, 2008
64
20
So I got my XP8 from ebay with android 7 still on it. Today I managed to get a ATT sim(its the ATT branded phone) and updated it to android 8. Before getting the sim I tried to update via android recovery and the downloaded OTA updates but android recovery would fail to mount a partition so it would not update via sideload or sd card.

I had hoped that the newer version of android would actually allow both sim cards to function correctly but I was wrong.

I also tried to use the backup method before getting the ATT sim card but it was also failing, I was able to backup just the boot image but not the full system image.

Before I start trying to dig into the userdebug images does anyone know if they offer the true dual standby of the sim slots as it appears maybe only the european version supports?

I say maybe as looking at all the user guides the Euro Generic user guide is the only one to reference 2 sims active and shows a VoLTE symbol on page 17
Page 15 also indicates the settings page I would see on my LG v20 to select sim cards

I use T-mobile as my primary carrier but with the wal mart plan that only gives you 100min of voice, I also have xfinity mobile which this phone also seems to support as it actually connected to the network unlike on LG V20 dual sim phone. My ultimate goal is to setup this phone to use T-mobile for data and xfinity/verizon for voice.

Userdebug variants use the same modem as far as I know. The experience related to dual SIM would likely be the same. I have only seen this work for Active-Standby configurations. I'm not sure if Active-Active is supported from the hardware level but someone else may know more I do here.


Hi smokeyou

I have just got an AT&T Sonim XP8, I'm not live in US.
I followed your bellow guide and my Sonim can start XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00
But I am having a big problem now, the mobile network does not work anymore. *#06# doesn't work => Phone has stopped and It doesn't recognize my sim. Android OS cant read IMEI!
I don't know what to do next! could you help me?

This sounds like an issue with the modem image applied. What image did you have before moving to XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00?

One thing about the user images is they are backups where the debug images have been provided by Sonim. It may be worth downloading the debug variant and only flashing the modem (HLOS) for both sides A and B. If your previous firmware was on 8.x then we can also restore the 2 images from your backup without modifying the system or anything else.
 
Last edited:
So I asked Sonim about the dual sim capability of the XP8 and about getting firmware images:

This is not information available for the XP8. The XP8's dual SIM features have been provided for future developments on the carrier versions of the model. At this time they have been provisioned for use with one SIM card at a time. The "NAM" or manufacturer version straight from Sonim, located at (sonim store link), is different and has Dual SIM features active currently if this part is important to you. Thank you for choosing Sonim and we hope you have a great rest of your day.

So if I am reading this correctly the hardware is capable of using the dual sims properly but it is ATT/the carrier disabling this.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    Enjoy!

    XP8 Android Root Theory - DEBUG or Magisk over EDL
    EDL is a must since Fastboot cannot be unlocked initially from standard "user" builds.

    One option is flash a userdebug image (below) allowing for adb root, fastboot unlocking, and other useful features.
    or
    Without unlocking the bootloader - Similar flashing methods remain valid when standard magisk powered root is desired. This method allows preservation of all current system data aside from boot.img. All is covered since Magisk works with AVB and we have EDL as a flashing alternative. Please see Android Boot Flow > LOCKED Devices with Custom Root of Trust for more information.

    Recommend method ..
    It's up to you.. If you want OTA updates and your planning to use root apps then go with Magisk. As of today we have current debug images available and I personally prefer isolated adb root access only however future availability of updated Debug images cannot be guaranteed.

    Disclaimer
    -Devices with locked bootloaders will display a custom OS warning at boot
    -Tested on AT&T branded devices only - please provide system dump for validation on other builds
    -I have not identified any JTAG procedures and I can not help if you hard brick your device!
    -This guide only touches boot_a and should be relatively safe since boot_b remains unmodified. I'm pretty sure this is enough to restore the original boot.img to boot_a under a failure scenario.. But I'm not really qualified enough to say definitively either.
    -Take great caution - this is raw emmc access and critical system data! You are proceeding at your own risk!

    Magisk Root

    Step 1 - Pull Boot.img
    We need to pull the boot.img in order to feed it to magisk later for patching. It's also good to keep on hand for if/when you need to restore for any reason.
    1. Create an XML file with the data below
    Code:
    <?xml version="1.0"?>
    <data>
    <program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="boot.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
    </data>
    2. Boot to EDL mode and load firehose programmer
    Code:
    QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
    3. Backup boot.img using the following command
    Code:
    fh_loader.exe  --convertprogram2read --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0  --memoryname=emmc --noprompt --reset
    Or visit the XP8 carrier firmware thread for full system backup steps.
    https://xdaforums.com/showpost.php?p=80465045&postcount=6

    Step 2 - Magisk Patch
    1. ADB push boot.img /storage/self/primary/Download/
    2. Install Magisk Manager and apply patch to boot.img
    2a. Download from https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
    2b. Extract and run adb install magisk.apk
    2c. Open Magisk app and apply patch to boot.img
    3. ADB pull /storage/self/primary/Download/magisk_patched.img

    Step 3 - Restore
    1. Change the filename attribute in the XML to reflect newly created magisk_patched.img as shown below
    Code:
    <?xml version="1.0"?>
    <data>
    <program start_sector="262144" sparse="false" readbackverify="false" physical_partition_number="0" partofsingleimage="false" num_partition_sectors="131072" label="boot_a" filename="magisk_patched.img" file_sector_offset="0" SECTOR_SIZE_IN_BYTES="512"/>
    </data>
    2. Boot back into EDL mode and load firehose programmer
    Code:
    QSaharaServer.exe -p \\.\COM<#> -s 13:prog_emmc_ufs_firehose_Sdm660_ddr.elf
    3. Apply magisk_patched.img using the following command
    Code:
    fh_loader.exe --port=\\.\COM<#> --sendxml=<xmlfile.xml> --lun=0  --memoryname=emmc --noprompt --reset

    USERDEBUG Flash

    Step 1 - Backup
    1. Boot to EDL mode and load firehose programmer
    2. Generate rawprogram0.xml - Run GPTConsole <COM Number>
    Example: GPTConsole 19
    3. Initiate backup
    Code:
    fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=rawprogram0.xml --lun=0  --memoryname=emmc --noprompt --reset
    4. Wipe all partitions
    Code:
    fh_loader.exe --port=\\.\COM<#> --convertprogram2read --sendxml=erase.xml --lun=0  --memoryname=emmc --noprompt --reset
    5. Restore new image
    Code:
    fh_loader.exe --port=\\.\COM<#> --sendxml=rawprogram0.xml --lun=0  --memoryname=emmc --noprompt --reset --search_path=<extracted image file directory>
    // rawprogram0_unsparse.xml for some images

    Images and OTA Files

    Full 8.1 System Image
    XP8A_ATT_user_8A.0.5-11-8.1.0-10.54.00
    XP8A_ATT-user-8A.0.5-10-8.1.0-10.49.00

    USERDEBUG Images
    XP8A_ATT_userdebug_8A.0.5-11-8.1.0-10.54.00
    XP8A_ACG-userdebug-8A.0.0-00-7.1.1-32.00.12
    XP8A_USC-userdebug-8A.0.0-00-7.1.1-34.00.10
    (ATT 7.1 pending upload. Please check back or use other links available further in thread.)

    OTA Updates
    XP8_ATT_user_N10.01.75-O10.49.00
    XP8_ATT_user_O10.49.00-O10.54.00
    XP8_TEL_user_N12.00.24-O12.23.00

    Flash Tools - programmer (elf) file provided by eleotk!
    XP8 Drivers

    Firmware Carrier Codes
    Code:
        None = 0,
        ATT = 10
        Bell = 11
        Telus = 12
        Sasktel = 13
        Harris = 14
        Verizon = 15
        Ecom = 16
        NAM = 17
        Rogers = 18
        T_Mobile = 19
        EU_Generic = 20
        MSI = 21
        CISCO = 22
        NAM_Public_Safety = 23
        Vodafone_Global = 24
        Orange = 25
        Southern_Linc = 26
        OPTIO = 27
        India = 28
        SPRINT = 29
        JVCK = 30
        AUS = 31
        ACG = 32
        CSPIRE = 33
        USC = 34
        SB = 35
        Multi = 99

    Automatic OTA without AT&T service:
    Purchase a blank AT&T SIM card ($5)
    Start online prepaid activation - complete pages 1 & 2
    **SIM Card is now partially active without funding - do not complete page 3 (payment)***
    *#*#368378#*#* > Clear UI > Check for updates in settings

    XP5s
    Sprint Image: XP5SA.0.2-03-7.1.2-29.03.00
    Works the same. Tested with unmodified Sprint firmware. Like most other apps, the Magisk manager app is unusable since the XP5s has no touch screen - I had to patch the boot image on another device. You can plug in a USB mouse however the cursor does not seem to invoke in-app tap's.

    Need to use the appropriate Firehose loader (prog_emmc_firehose_8920.mbn) and replace the boot image location according to the XP5s GPT (start_sector="790528").
    4
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Sonim XP8 is officially Rooted with TWRP
    replace downloaded boot.img with your boot.img in firmware folder from the link below
    tested on android 7x-8x USERDEBUG builds.
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    =======================================================================
    Bugs -
    cant flash system.img
    wipe/format data wipes phone completely
    ive tested both functions its the way this phone is setup its pretty weird.

    =======================================================================
    Updates -
    will be working on figuring out how to build a custom OS
    any help would be greatly appreciated

    =======================================================================
    NEW LINK with sonim flash tool , boot.img , magisk , and no verity
    I dont ! take any credit for the mentioned applications just the
    TWRP port
    ==========
    Thank you to all who kept this thread in motion lets keep it going !!
    ========================================================================
    ADB -
    adb reboot
    bootloader - takes you to fastboot where you can select recovery mode
    adb reboot
    edl - takes you to flash mode.
    adb reboot recovery doesnt work !
    ========================================================================


    NEW LINK - GDRIVE
    3
    Instructions ROOT easy way

    1. Download ROM/Userdebug image (you can find it on first page)
    XP8A_ATT_userdebug_8A.0.5-11-8.1.0-10.54.00
    XP8A_ACG-userdebug-8A.0.0-00-7.1.1-32.00.12
    XP8A_USC-userdebug-8A.0.0-00-7.1.1-34.00.10

    2. Unpack archive of the userdebug image
    3. Install XP8 Drivers ( also on first page)
    4. Connect your phone to PC
    5. Copy Boot.img from the unpacked zip to your phone in Downloads folder
    6. Install Magisk Manager to your phone (first page)
    7. Open Magisk and patch the boot.img you just copied in Downloads folder
    8. Copy the magisk_patched.img that you have created to the unpacked archive of the ROM
    9. Rename boot.img from ROM folder to boot_backup.img
    10. Rename magisk_patched.img to boot.img
    11. Download Sonim+Software+Update+Tool.zip and unpack & install it to your PC
    12. Open Sonim Software Update Tool (username: 1, password: 1) and guide XML PATH and Build Path to the ROM folder
    13. Click Start
    3
    After flash some devices stuck on logo. Just make factory reset,any help can ask me
    3
    Hey guys, been a while and I'm glad to share some updates with the community!

    Main post here has been updated according to the progress made in the previous posts. Much thanks to everyone for providing early debug images, files, and knowledge!

    Updates
    - Torrent file hosting moved to Android FIle Host
    - Current 8.1.0 AT&T Debug image uploaded
    - 8.1.0 Debug image verified to retain dm-verity! At least on current AT&T builds.
    - Additional factory images uploaded
    - All basic flash tools, elf files, drivers, and GPTConsole executable uploaded
    - More images will be uploaded in the following days. Ran out of time to upload everything tonight.

    Full Android File Host Repository - Here

    We continue to welcome new images for the file collection.