FORUMS
Remove All Ads from XDA

[GUIDE][ROOT][Moto G6][ALI] TWRP, Root, and Magisk installation guide.

223 posts
Thanks Meter: 260
 
By dejello, Senior Member on 15th July 2018, 02:32 AM
Post Reply Email Thread
Update March 23, 2019: I'd like to apologize to everyone. It looks like I am not going to be able to actively keep this thread updated like I used to. I have had too much going on at home an work and it doesn't look like it's going to settle down any time soon. The thread is still usable so I will leave it open for discussion.

Code:
 * Your warranty is now void.
 *
 * I am not responsible for bricked devices, dead SD cards, fires, rigged elections,
 * thermonuclear war, or you getting fired because the alarms failed and you
 * could not call in.
 *
 * Please ensure you have an advanced understanding of this device before
 * flashing it! YOU are choosing to make these modifications or your own free will.
Thread Notes:
  • I cannot stress this enough--Please READ EVERY STEP FULLY to be sure of what you need to do.
  • Some steps listed in this process WILL wipe your userdata. If you have anything you need to save back it up first. While flashing via bootloader you should see it say "(bootloader) Image not signed or corrupt" - (and can show "bad key" or "N/A" while booting) this is normal expected behaviour as the image is no longer properly signed by motorola (I had to repack as our dtb's are compressed inside the boot image)
  • This thread is not about custom roms - You may be able to run them using the boot images provided, but this thread does NOT cover that
  • This guide assumes your are on COMPLETELY STOCK (FACTORY) FIRMWARE. If you have previously flashed *any* other firmware, system images, kernels, or anything else I cannot say for sure that this guide will work for you
  • This WILL affect your ability to get OTA's if/when they come. This thread does not cover getting back to stock. It's up to you to figure out how to get back to stock if you want the update. You're best bet to avoid issues (boot-loops, non-booting, failed updates, etc) is to go completely back to stock first!
  • Android GSI's - For the record, I have booted GSI's made (Aonly-32bit) however there are some issues I've noticed regarding sounds while using them. Again, this thread is NOT the place to discuss problems with this.
  • TWRP - We can now use official twrp! Please click this link to see details. I have edited the first post to reflect the current state of our twrp images. If you see an error or run across an issue please let me know and I"ll see about fixing it. I have linked an unofficial build I made in the official thread to fix some issues with the official build. When I get a chance to properly verify the new test-build (made by the twrp gerrit) I will see about having the official one updated.
  • PIE - These instructions were made using Oreo, not Pie. There are differences in the boot images at the very least (you may not need a modified boot image for Magisk). I have not flashed Pie yet to test things. If you want to test, please let me know how things work out for you.

Working Images:
The variant models below have been verified working using one of the firmware versions listed.
XT1925-2, XT1925-3, XT1925-4, XT1925-5, XT1925-6, XT1925-13
  • OPS27.82-19-4 (Build Date: Fri Mar 9 11:04:39 CST 2018)
  • OPS27.82-41 (Build Date: Sat Mar 24 01:37:45 CDT 2018)
  • OPS27.82-72 (Build Date: Sun May 27 02:13:41 CDT 2018)
  • OPS27.82-87 (Build Date: Mon Jul 16 14:54:23 CDT 2018).
  • OPSS27.82.87-3 (Build Date: September 2018 Security Update)
  • OPSS27.82-87-6 *Provided by @Jleeblanch
  • OPS27.104-15-10 (Build Date: Wed Mar 28 21:13:40 CDT 2018)
  • OPSS27.104-15-10-4 (Build Date: July 2018 Security Update) *Provided by @Jleeblanch
  • OPS27.104-92 (Build Date: September 2018 Security Update)
  • OPSS27.104-92-2 (Build Date: November 2018 Security Update) *Provided by @Jleeblanch
*
*Waiting for confirmation:
*OPS27.82-57
*

Prerequisites:
  • Unlocked bootloader.
  • ADB/Fastboot installed on your machine ( https://developer.android.com/studio...platform-tools ) If you have issues with commands make sure you have a current build of ADB and fastboot.
  • At least some knowledge of how to use ADB and fastboot, this guide does not cover that.
  • Some knowledge of how TWRP/custom recoveries work.


Finally, the guide:


Step 1) Downloading TWRP and modified boot image

Download TWRP and a modified boot image that matches your factory firmware version to the ADB/Fastboot folder on your computer. The boot image downloads are based on the premise of the firmware you are running. If yours is not listed please back up (next step) and provide a link for me to edit.Reboot to your bootloader. You can do this by turning on your device while holding the power and volume down buttons at the same time. Once the device reboots to the bootloader connect your phone to your computer.



Step 2) Backing up your stock boot and recovery images and fstab.qcom file--if you have these already you can safely skip to step 3.

Open a terminal/command prompt on your computer and type the following to boot into TWRP (If your filename is different, please replace the filename below with yours):
Code:
fastboot boot twrp-v3.2.3-ali.img
Once TWRP boots (it may take a bit to boot because it is trying to decrypt your userdata. It will fail as TWRP--at least for now--needs to be flashed to decrypt properly. Swipe to allow modifications if you want if asked), type the following in your computer's terminal/command prompt to back up your boot and recovery images:
Code:
adb pull /dev/block/bootdevice/by-name/boot stockboot.img
Code:
adb pull /dev/block/bootdevice/by-name/recovery stockrecovery.img
If you intend to remove encryption you'll want a backup of your fstab.qcom file:
To back up your fstab.qcom file (modified in a later step) we need to mount Vendor in TWRP first if it's not already mounted. From TWRP's main menu press 'Mount'. You can see if the vendor partition is mounted (check mark next to the word 'Vendor') . If it isn't mounted just press 'Vendor' and it should mount. Next type the following:
Code:
adb pull /vendor/etc/fstab.qcom factory-fstab.qcom
Reboot to the bootloader.



Step 3) Installing TWRP and modified boot images

Run the following command from your computer's terminal/command prompt to install the TWRP image to your device (If your filename is different, please replace the filename below with yours).
Code:
fastboot flash recovery twrp-v3.2.3-ali.img
Run the following command from your computer's terminal/command prompt to install the boot image to your device.
usage:
Code:
fastboot flash boot <insert-boot-image-name-here>.img
example:
Code:
fastboot flash boot OPS27.104-92_no-verity_boot.img


Step 4) Wiping your data on your phone to remove the current encryption. Ensure you have a backup beforehand if you want it.
This step is only needed if you intend to remove your current encryption, if you don't want to do this please skip to the next step

Boot into TWRP by using the volume keys on your phone to select "recovery mode" and then press the power button and TWRP will boot up (it may take a bit to boot because it is trying to decrypt your userdata or if you have a screen lock it may ask for it--enter it and proceed. Please read the thread linked above for help if you enter it incorrectly.)

Swipe to allow system partition modifications if you want and are asked. If you wish to backup your data and restore it after formatting then do so now. Next click the "Wipe" button in TWRP and then "Swipe to Factory Reset". This step should have formatted data as it was encrypted (removing internal storage ) however if it didn't and data is still not mountable in TWRP you can use the "Format Data" button above "Swipe to Factory Reset", this will format data and remove EVERYTHING from the internal storage as well. You may need to format data again and reboot into TWRP. DON'T REBOOT TO SYSTEM YET.



Step 5) Removing forced-encryption upon first boot (you may still choose to encrypt after booting--Moto's firmware defaults to saying it's encrypted, at least on mine, in the security tab of settings but it's not and the option to encrypt still exists within that menu)
This step is only needed if you intend to remove forced encryption, if you don't want to do this please skip to the next step

**THIS STEP DOES NOT REMOVE CURRENT ENCRYPTION--IT ONLY REMOVES FORCED ENCRYPTION DURING THE FIRST BOOT: YOU MUST HAVE COMPLETED STEP 4 ABOVE TO REMOVE CURRENTLY ENCRYPTED DATA**

This file has been verified working on Oreo and may not function correctly on Pie, please be aware of this: see HueyT's Post.
Download the force-encryption disabler zip to your ADB/Fastboot folder: [AFH] Force_Encryption_Disabler_For_ALI_Oreo_v2.zip

Now push that zip file to your phone. The example uses the /tmp directory. From your computer's terminal/command prompt type the following into your command prompt/terminal from your adb/fastboot folder:
Code:
adb push Force_Encryption_Disabler_For_ALI_Oreo_v2.zip /tmp
Flash the zip you just pushed by pressing the Install button in the TWRP main menu, select the folder where you pushed the zip to and install it. We can verify it flashed by mounting vendor manually if it's not mounted and using the following command from your computer's terminal/command prompt and checking the line that mounts /data says "encryptable" instead of "forceencrypted":
Code:
adb shell "cat /vendor/etc/fstab.qcom"
The result should include this line:
Quote:

/dev/block/bootdevice/by-name/userdata /data f2fs rw,discard,nosuid,nodev,noatime,nodiratime,nobarri er,inline_xattr,inline_data wait,check,formattable,encryptable=/dev/block/bootdevice/by-name/metadata

Note where it says "encryptable". That means we now have the choice to do so vs. being forced to. If for whatever reason it still says "forceencrypted" mount vendor manually and try again.



Step 6) Rooting via Magisk
This step is only needed if you intend to have root access, if you don't want to do this or wish to do this later please skip to the next step
To be safe, you may need to reboot back into TWRP to make sure it sees the data partition mounted correctly and again swipe to allow system partition modifications if you want. (I've seen Magisk say forced-encryption was still detected even though it actually wasn't if I didn't reboot)

Download Magisk from the linked thread to your ADB/Fastboot folder: https://forum.xda-developers.com/app...mless-t3473445

Run the following command to push the Magisk zip to your device (v17.3 (beta) is current as of the last edit of this post, if it changes please put your version number instead).
The example uses the /tmp folder:
Code:
adb push Magisk-v17.3.zip /tmp
Flash the Magisk zip from TWRP by pressing the Install button in the main menu and navigate to the /tmp (or wherever you pushed it) folder to select and install it. Magisk should show success without any mention of verity or encryption. If it does, something hasn't gone right and you may need to start again.



Step 7) Almost finished!

Reboot your device. If you installed Magisk it will say "N/A" in the top corner of your device for a few seconds (otherwise it should say "bad key"). This is normal. It may look like it bootloops that screen, just let it go and and it should boot the Motorola boot screen and you can setup your device as a new phone.

Once booted, if you installed Magisk, verify Magisk Manager is installed and the root functionality works.



Step 8) ???



Step 9) Profit





Credits:
@kwiksi1ver - getting things going for us, work with twrp and verity and allowing me to use his thread as base for this guide.
@CodyF86 and his Moto E5 thread for clues as to what it would take to turn off DM-Verity (per kwik)
@Dadud - testing and constantly nuking said device
@AngryManMLS - testing and communications
@Vache - Provided us the fix for sdcards in TWRP.
@Xennet's thread regarding verity and encryption and the disabler zip and everyone there: Disable [DM-Verity]/[Force Encryption] [OnePlus 3T/3] for [Oreo] Oxygen OS
@likemiketoo - Having had TWRP built for us for testing purposes
@Jleeblanch - Helping provide various no-verity images and other help/advice like....everywhere
Everyone else who I am forgetting because let's be honest, I'm sure I have. If you feel like mention is owed please let me know and I'll be happy to add.
The Following 35 Users Say Thank You to dejello For This Useful Post: [ View ] Gift dejello Ad-Free
 
 
15th July 2018, 02:34 AM |#2  
dejello's Avatar
OP Senior Member
Thanks Meter: 260
 
More
Extras:

THE BOOT IMAGE LINKS IN THIS POST HAVE BEEN REMOVED TO AVOID CONFUSION: THEY WERE OLD DOWNLOADS WITH IMPROPERLY LABELED NAMES.


The following is provided for backup purposes only in case you forgot to back up. When pulled from the phone, the images are the full partition size, not actual size.

XT1925-6 (OPS27.104-15-10) Factory pulled files
These files will get you back to stock as far as this guide is concerned. Remember though, 'bad key' will be displayed as they were pulled from a device instead of being provided by Motorola
Factory boot image - *link removed*
Factory recovery image - *link removed*
Factory fstab.qcom file - factory-fstab.qcom - You can push this file to /vendor/etc/ to go back to stock vendor parition if you need. You'll need to rename it to 'fstab.qcom' to make it work right. Factory boot images will probably have an issue booting without vendor being completely stock.


The following images have been provided by other XDA members:
XT1925-2
Factory boot image - *link removed*
XT1925-4
Factory boot image - *link removed*
XT1925-5
Factory boot image - *link removed*
The Following 4 Users Say Thank You to dejello For This Useful Post: [ View ] Gift dejello Ad-Free
15th July 2018, 02:34 AM |#3  
dejello's Avatar
OP Senior Member
Thanks Meter: 260
 
More
Notes regarding editing the boot images
First off, this is not going to be a "guide" like the first post. Different devices may have different needs, and at this time I am not changing this thread to answer questions about the editing process. Maybe that'll change in the future.

It took me a minute to realize that the G6 (ALI) dtb's are compressed and this is why directly hex editing the boot images (like the G6 Play (jeter)) initially resulted in non-booting. I'd think anyone could decompress the lz4 archive and edit the necessary info, recompress (I used max compression) and then repack the boot image and it should boot. Before that realization I had at one time built the kernel from source code (OPS27-104.15.10) with verity support disabled there so I could get around verity.

Story time!
I'll keep it shorter than it really was so be happy!

So the last time I was into building roms and such was several years ago. If the dtb's existed then, I didn't remember them I started off with some of the various "kitchens" unpacking the boot image I pulled and was getting no where. Even simply unpacking and repacking seemed like it was causing issues. I saw the results kwiksi1ver was having with the G6 Play and asked for advice: Hex edits, don't unpack..
Not sure where to go from there I searched around for posts regarding verity and at some point came across Xennet's thread: Disable [DM-Verity]/[Force Encryption] [OnePlus 3T/3] for [Oreo] Oxygen OS. Within that thread there was a link for another post in that thread that spoke a more in detail about what needed to change (post #3). Please read up on that if you want to know more.

Details:
Basically, if we're not rebuilding from source, etc etc, then we need to hex edit the dtb file (ours is actually I believe 6 dtb files combined into one, other devices can vary). On some devices these files are not-compressed and we can just edit them and go. For ours, I found the need to unpack them with a kitchen (AIK). Once there, I decompress the dtb archive (it's in 'lz4' format, max compression) and make the edits. The lines we are looking for contain "wait,verify". Under normal circumstances these will mount the system and vendor partitions with verity enabled (verify) to be sure they aren't modified. We need to REPLACE the ",verify" portion of the "wait,verify" with zeros. We can't just delete them, replace with zeros so we don't change the overall file size. We have to make sure we get all references to ",verify" replaced. It'll just say "wait" now. After I've edited the dtb file I recompress in 'lz4' format with max compression and then repack the boot image. After that, we should be good to go!


Please reference Xennet's thread if you want more details of how the lines actually look in code, just be aware ours may not be 100% the same. I may add or change stuff here later.
The Following 2 Users Say Thank You to dejello For This Useful Post: [ View ] Gift dejello Ad-Free
15th July 2018, 02:57 AM |#4  
Senior Member
Thanks Meter: 69
 
Donate to Me
More
Great guide!
15th July 2018, 03:53 AM |#5  
Member
Thanks Meter: 5
 
More
thanks, can't try it yet but i will soon.
15th July 2018, 08:32 AM |#6  
Senior Member
Thanks Meter: 125
 
More
Excellent work broski, sweet guide. Really looking forward to testing some stuff out, I'm off for the next two days... so gotta get to a computer [I know pathetic, I don't have one] ... Jeez you couldn't make a one click solution for all this? 😝
For real though, super big thanks to all of you for
enduring the grueling task of cracking this bad boy
How bout some donate links? ... and @kwiksi1ver, I'm not sure if you're into developing ROMs or Kernels, but I say more is always better, so there's still good cause for you to get a G6.
15th July 2018, 03:21 PM |#7  
Senior Member
Thanks Meter: 42
 
More
Quote:
Originally Posted by dejello

Extras:

The following is provided for backup purposes only in case you forgot to back up. When pulled from the phone, the images are the full partition size, not actual size.

Moto G6 (Ali - OPS27.104-15-10) Factory pulled files
Factory boot image - MotoG6-ali-factory-boot.img
Factory recovery image - MotoG6-ali-factory-recovery.img
Factory fstab.qcom file - factory-fstab.qcom

it serves for XTI 1925-4?
OPS 27.82-72

Enviado desde mi moto g(6) mediante Tapatalk
15th July 2018, 03:33 PM |#8  
Member
Thanks Meter: 7
 
More
Quote:
Originally Posted by dejello

Extras:

The following is provided for backup purposes only in case you forgot to back up. When pulled from the phone, the images are the full partition size, not actual size.

Moto G6 (Ali - OPS27.104-15-10) Factory pulled files
Factory boot image - MotoG6-ali-factory-boot.img
Factory recovery image - MotoG6-ali-factory-recovery.img
Factory fstab.qcom file - factory-fstab.qcom

First off thank you for the work, this is incredible and I would love to donate.
And second, I am running the RetBr firmware as I softbricked my retus version, do you know how or where I could get the us firmware?

Quote:
Originally Posted by stifmaster81

it serves for XTI 1925-4?
OPS 27.82-72

Enviado desde mi moto g(6) mediante Tapatalk

This is for the US version xt1925-6, but seems that it may work for you depending on the files
15th July 2018, 03:37 PM |#9  
Senior Member
Thanks Meter: 42
 
More
Quote:
Originally Posted by bird412

First off thank you for the work, this is incredible and I would love to donate.
And second, I am running the RetBr firmware as I softbricked my retus version, do you know how or where I could get the us firmware?



This is for the US version xt1925-6, but seems that it may work for you depending on the files

I just want to install magic, I do not want to decrypt it at the moment, what I'm scared if it's boot.img will be useful for me, anyway if it goes wrong, installing the factory image

Enviado desde mi moto g(6) mediante Tapatalk

---------- Post added at 04:37 PM ---------- Previous post was at 04:35 PM ----------

anyway if something goes wrong, installing the factory image by adb is solved everything not?

Enviado desde mi moto g(6) mediante Tapatalk
15th July 2018, 03:41 PM |#10  
Member
Thanks Meter: 7
 
More
Quote:
Originally Posted by stifmaster81

I just want to install magic, I do not want to decrypt it at the moment, what I'm scared if it's boot.img will be useful for me, anyway if it goes wrong, installing the factory image

Enviado desde mi moto g(6) mediante Tapatalk

---------- Post added at 04:37 PM ---------- Previous post was at 04:35 PM ----------

anyway if something goes wrong, installing the factory image by adb is solved everything not?

Enviado desde mi moto g(6) mediante Tapatalk

I believe you are correct, that if you fastboot the original boot img it should fix any issues. Of course you should back up your data in the case that you need to completely reflash
15th July 2018, 04:30 PM |#11  
Senior Member
Thanks Meter: 42
 
More
someone could do this same but for the version OPS27.82-72 XTI 1925-4 ??

This did not work for me, I had to reinstall everything again, I would be very grateful
Post Reply Subscribe to Thread

Tags
moto g6

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes