How to root Epson Moverio BT-300 security update 5.0

Search This thread

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Right now I am in an Optomizing apps bootloop. There seems ro be many proposed causes in android 5.1 but I had no issues in until I loaded a youtube vanced apk(...maybe???...) that I had no trouble in my gapps free build. The optomizing loop seems to have begun randomly. I am going to sleep on what to do but am planning or reverting to my gapps free backup. Very confusing, anyone know how to trouble shoot the actual cause?

This is why I think microG is the only option

I was tempted by the ease of openGapps availability

--it looks like the only way to test my idea is to boot into recovery and start an adb shell to uninstall the apps i think are the problem. Probably also wipe the dalvik/ART cache. Thoughts?
 
Last edited:

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
So it seems that the conflicting libraries of google play and youtube vanced caused continuing app optomization to boot looping. Perhaps I used the wrong version of youtube vanced? Anyways the good news is that the nandroid backup from the prototype recovery works.
 

tarkus1000

Member
Feb 24, 2018
11
2
Does anyone know where the ota updates are stored on this device? I will pull the updated boot.img and patch accordingly so the bootloader unlock is more simple if i can find the ota...OGs in the original hacking forum have fell silent on this, furthermore it seems that the epson file systems team only wants to utilize my input for their own development so I have stopped communications with the contact I had.

I can post a full nandroid backup on here if others would like to revert to software 4.0

I’ve got a zip of the OTA 1.4.0 if that’s any good to you? My moverio’s are at 1.5.0 and I can’t unlock the bootloader. I also tried to downgrade to 1.4.0 via recovery and sdcard / adb sideload but it won’t let me go back. Any pointers to unlock my bootloader and go from device-state green to amber would be greatly appreciated.
 

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
You can flash this boot.img, check it out with image kitchen if you like. (boot it first and see if you can acomplish unlock with the boot command, then the rest of the unlock protocol. You may be able to boot to the image and follow the rest of my theory to acheive unlock without acually having to downgrade versions, if you follow my logic?) https://drive.google.com/file/d/1_2qwuL85SkirnEu7bHLRigBWrJlPnYXj/view?usp=drivesdk


Then unlock the bootloader

Next boot the prototype twrp and flash the update 4.0 zip

This is how I would proceed, given my experiencece with the device and android in general. If you have problems and can acheive flashing the prototype twrp I can share the nandroid backup that I used this morning to rescue myself from a boot loop.

Alternatively I believe you could derrive all relevant .img files from my backups/ I can capture more data if needed.

-- a closing note this boot.img I shared is the boot.img I had on my device when I originally unlocked the device for the first time on version 4.0
This should not cause you issues so long as you are working from fastboot for the unlock then boot the recovery then flash the 4.0 update zip. I doubt it will boot to system with the old boot.img but I am not adept enough to know what exactly to look for in order to know that so...It could boot despite my caution. Regardless it is best practice to carry out this operation without booting to system in my oppinion.
 
Last edited:
  • Like
Reactions: tarkus1000

tarkus1000

Member
Feb 24, 2018
11
2
You can flash this boot.img, check it out with image kitchen if you like. (boot it first and see if you can acomplish unlock with the boot command, then the rest of the unlock protocol. You may be able to boot to the image and follow the rest of my theory to acheive unlock without acually having to downgrade versions, if you follow my logic?) https://drive.google.com/file/d/1_2qwuL85SkirnEu7bHLRigBWrJlPnYXj/view?usp=drivesdk


Then unlock the bootloader

Next boot the prototype twrp and flash the update 4.0 zip

This is how I would proceed, given my experiencece with the device and android in general. If you have problems and can acheive flashing the prototype twrp I can share the nandroid backup that I used this morning to rescue myself from a boot loop.

Alternatively I believe you could derrive all relevant .img files from my backups/ I can capture more data if needed.

-- a closing note this boot.img I shared is the boot.img I had on my device when I originally unlocked the device for the first time on version 4.0
This should not cause you issues so long as you are working from fastboot for the unlock then boot the recovery then flash the 4.0 update zip. I doubt it will boot to system with the old boot.img but I am not adept enough to know what exactly to look for in order to know that so...It could boot despite my caution. Regardless it is best practice to carry out this operation without booting to system in my oppinion.

Thanks for your help and assistance. Unfortunately I seem to be falling over at the 1st hurdle so any suggestions most appreciated. I have the following settings in the android (v5.1.1) Settings / Developer options:

OEM Unlocking -> On
USB Debugging -> On

The output of 'fastboot getvar all' settings for the following variables are:

device-state -> verified
boot-state -> green

The output of 'fastboot oem unlock' (after quite a long wait) is:

ERROR: usb_read failed with status e00002ed
FAILED (Status read failed (No such file or directory))
Finished. Total time: 140.740s

The output of 'fastboot boot boot.img' is:

Downloading 'boot.img' OKAY [ 0.371s]
booting FAILED (remote: 'command not allowed in verified state')
Finished. Total time: 0.382s

So can download image but not install/execute its content!!!

Things I have tried:

Change of USB lead
Change of USB port
Change of computer
Change of Operating System (macOS and Windows)
Change of ADB/Fastboot version (about 3 different versions)

My understanding of the problem I have is that I need to get the device-state to unlocked and boot-state to orange and to do that I need to use the command 'fastboot oem unlock'. However, in my case because I have v1.5.0 of bootloader I need to run command 'fastboot boot boot.img' to enable the previously stated command to be run successfully. As you can see from my output the boot.img command is failing, hence preventing me from issuing the unlock command!!! That was why I mentioned that I was trying to roll back to v1.4.0 of the bootloader in the previous post. Its looking like I've hit a brick wall!!!

As mentioned previously, any suggestions would be most welcome.
 

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Thanks for your help and assistance. Unfortunately I seem to be falling over at the 1st hurdle so any suggestions most appreciated. I have the following settings in the android (v5.1.1) Settings / Developer options:

OEM Unlocking -> On
USB Debugging -> On

The output of 'fastboot getvar all' settings for the following variables are:

device-state -> verified
boot-state -> green

The output of 'fastboot oem unlock' (after quite a long wait) is:

ERROR: usb_read failed with status e00002ed
FAILED (Status read failed (No such file or directory))
Finished. Total time: 140.740s

The output of 'fastboot boot boot.img' is:

Downloading 'boot.img' OKAY [ 0.371s]
booting FAILED (remote: 'command not allowed in verified state')
Finished. Total time: 0.382s

So can download image but not install/execute its content!!!

Things I have tried:

Change of USB lead
Change of USB port
Change of computer
Change of Operating System (macOS and Windows)
Change of ADB/Fastboot version (about 3 different versions)

My understanding of the problem I have is that I need to get the device-state to unlocked and boot-state to orange and to do that I need to use the command 'fastboot oem unlock'. However, in my case because I have v1.5.0 of bootloader I need to run command 'fastboot boot boot.img' to enable the previously stated command to be run successfully. As you can see from my output the boot.img command is failing, hence preventing me from issuing the unlock command!!! That was why I mentioned that I was trying to roll back to v1.4.0 of the bootloader in the previous post. Its looking like I've hit a brick wall!!!

As mentioned previously, any suggestions would be most welcome.
interesting, okay it seems that we have eliminated the boot command as a possibility on this bootloader in the green state it was worth a try. I would now flash the boot.img I provided that's unlockable, unlock with that one and then revert to 4.0 with twrp img we have by flashing the 4.0 update zip and boot and recovery .img backups I have provided. The fastboot unlock failure issue is due to a change in the configuration of the fstab files.

I am looking for the directory the ota download link is sent. If I find that and patch the boot.img you all will no longer have to completely downgrade


In the boot.img in the link I have provided I disabled dm-verity and user data encryption so no one gets locked out of their file systems,
I also confirmed that the unlock boot loader code lines were present. One can check my work with img kitchen

I am sorry many are experiencing difficulty with the boot loader unlock. I would appreciate the help of the community in locating "where the ota update lives" so that I can capture it and provide a simply flashable v5.0 zip with unlockable boot loader. Until then I believe fastboot will obey the flash command (rather than boot) and that the downgrade through our prototype twrp is possible.
 
Last edited:

tarkus1000

Member
Feb 24, 2018
11
2
interesting, okay it seems that we have eliminated the boot command as a possibility on this bootloader in the green state it was worth a try. I would now flash the boot.img I provided that's unlockable, unlock with that one and then revert to 4.0 with twrp img we have by flashing the 4.0 update zip and boot and recovery .img backups I have provided. The fastboot unlock failure issue is due to a change in the configuration of the fstab files.

I am looking for the directory the ota download link is sent. If I find that and patch the boot.img you all will no longer have to completely downgrade


In the boot.img in the link I have provided I disabled dm-verity and user data encryption so no one gets locked out of their file systems,
I also confirmed that the unlock boot loader code lines were present. One can check my work with img kitchen

I am sorry many are experiencing difficulty with the boot loader unlock. I would appreciate the help of the community in locating "where the ota update lives" so that I can capture it and provide a simply flashable v5.0 zip with unlockable boot loader. Until then I believe fastboot will obey the flash command (rather than boot) and that the downgrade through our prototype twrp is possible.

Well the problem of not being able to unlock the bootloader has gone away.... Gone and got my BT-300 into a boot loop... Damn!!!! Just boots the EPSON logo screen now repeatedly, so if anyone has the key presses to get it to bootloader/recovery on switch on would be very grateful.

For those wondering how I managed to screw it up..... I thought I would have a go at flashing the boot.img file in fastboot mode. Tried it 1st with v1.5.0 boot.img and that seemed to upload and install etc without any failures and it booted up as per a normal android screen. Thought I would try a stock boot.img v1.4.0 with no modifications. Didn't like that, although it seemed to upload and install ok but when I rebooted, just got the dreaded boot loop screen. I suspect the modified boot.img file provided by alecthenice was based on v1.4.0 so if anyone is thinking of giving it a go, I would advise proceeding with caution... or with a lot more knowledge than I have :) . I'll just have to keep trying different keypress combinations until I can get it booting into the other mode.

Oh and on the 'looking for the location of the OTA', I was originally thinking about looking around in the android partition but was wondering if the OTA file might get sent to the recovery partition (as in the partition booted when in recovery mode) as that is the partition that has booted up when I have manually tried to update an OTA update (installing from the sdcard or via sideloading).
 
Last edited:
  • Like
Reactions: alecthenice

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Well the problem of not being able to unlock the bootloader has gone away.... Gone and got my BT-300 into a boot loop... Damn!!!! Just boots the EPSON logo screen now repeatedly, so if anyone has the key presses to get it to bootloader/recovery on switch on would be very grateful.

For those wondering how I managed to screw it up..... I thought I would have a go at flashing the boot.img file in fastboot mode. Tried it 1st with v1.5.0 boot.img and that seemed to upload and install etc without any failures and it booted up as per a normal android screen. Thought I would try a stock boot.img v1.4.0 with no modifications. Didn't like that, although it seemed to upload and install ok but when I rebooted, just got the dreaded boot loop screen. I suspect the modified boot.img file provided by alecthenice was based on v1.4.0 so if anyone is thinking of giving it a go, I would advise proceeding with caution... or with a lot more knowledge than I have :) . I'll just have to keep trying different keypress combinations until I can get it booting into the other mode.

Oh and on the 'looking for the location of the OTA', I was originally thinking about looking around in the android partition but was wondering if the OTA file might get sent to the recovery partition (as in the partition booted when in recovery mode) as that is the partition that has booted up when I have manually tried to update an OTA update (installing from the sdcard or via sideloading).
You are correct on the firmware version one must not boot to android after the the unlockableboot.img is flashed, you must fully downgrade :cyclops:



DO NOT FEAR, you got this
Manual fastboot mode

Hold power + volume down while device is off

Epson screen will display console will vibrate (still holding)

Tap the volume down button while still holding power button

Now that is fastboot.

Flash the prototype recovery

Boot to it via fastboot command

Now that you are here you should flash the v4.0 update.zip, alternatively I linked a full image backup for firmware v4.0. As a last result I will gladly share a nandroid backup. Thank you for your contribution to the forum. Please keep me updated with your progress.



Last note. Will you please share the v5.0 boot.img? I believe I can patch that to make it unlockable so all this downgrading firmware will not be necessary. Maybe this "last note" is the cleanest fix for you?
 
Last edited:

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Thanks to tarkus1000 I now have the v5.0 boot.img. I will patch this to make it boot loader unlockable and share the link shortly!! This will likely spare you the headache he is experiencing. The key combonations for fastboot mode are trickey, it took me weeks to discover them. I will post a youtube video to provide a visual reference in the form of youtube of how to boot into fastboot mode to hopfully aleviate frustration.

The patch and youtube video will come after my work day is completed.
 
Last edited:

tarkus1000

Member
Feb 24, 2018
11
2
Thanks to tarkus1000 I now have the v5.0 boot.img. I will patch this to make it boot loader unlockable and share the link shortly!! This will likely spare you the headache he is experiencing. The key combonations for fastboot mode are trickey, it took me weeks to discover them. I will post a youtube video to provide a visual reference in the form of youtube of how to boot into fastboot mode to hopfully aleviate frustration.

The patch and youtube video will come after my work day is completed.

The video would be good thanks. I'm either pressing the wrong buttons or getting the timing wrong as I've tried many times what you have suggested but still not going into bootloader (or recovery) mode. The only other thing I can think of is my controller is faulty. What do you recon about the OTA location... In the system boot partition or the recovery like I suggested?
 

tarkus1000

Member
Feb 24, 2018
11
2
The video would be good thanks. I'm either pressing the wrong buttons or getting the timing wrong as I've tried many times what you have suggested but still not going into bootloader (or recovery) mode. The only other thing I can think of is my controller is faulty. What do you recon about the OTA location... In the system boot partition or the recovery like I suggested?

Hows the video doing? Still no joy here getting it into bootloader or recovery mode!!!
 

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Here is my video on booting into fastboot mode.

Unfortunatly the ota is not decrypted yet from wherever it was derrived. I just got gapps running stable on my build so now i will look at extracting a decrypted boot.img update. Perhaps from a temporary cache partitio. From what i can see though they made an effort to put an end to independent development.

Good luck booting into fastboot
 
Last edited:

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Here is my video on booting into fastboot mode.

I have successfully patched the v5.0 boot.img update, this can be flashed while the boot loader locked and then the boot-loader can be unlocked since I added a couple lines of code.

please see the original post for an easy up to date method to root on the latest firmware update v5.0
 
Last edited:

tarkus1000

Member
Feb 24, 2018
11
2
I have just found out why I could not boot directly into bootloader mode with the Power/Vol- sequence. I have an sdcard inserted in my bt-300 and it seems to stop it from recognising the key presses at boot (or ignores them). Removed it and the keypresses work as advertised. One other thing i have noticed is that when you boot with the Power/Vol- keys the 3 lighs on the bt-300 module are green but if you issue a 'fastboot reboot-bootloader' or 'adb reboot-bootloader' (from system or recovery boot) command when bootloader comes back up my lights are dark blue. Is there any significance in the colour of the lights???
 

tarkus1000

Member
Feb 24, 2018
11
2
Also found that when I did the 'fastboot oem unlock' command, it took about 3-5 mins to come back and gave an error message. After that could not use the power/vol- keys to enter bootloader. Managed to get the key option back though but not exactly sure of the order in which I did it. It consisted of something like going into recovery mode and formatting the cache partition and also the data partition (be aware that this will completely wipe all data in effect performing a factory reset). I also re-did the OTA v1.5.0 somewhere along the way and issued the command 'fastboot oem lock' (this just hung the system but left it like that for a few mins before ctrl-C back to the command line. Anyway, whatever I did, it seems to have restored the ability to directly enter bootloader mode using the power/vol- key combination.

Also found out some stuff about the kernel doing a search in google for 'kernelflinger'. Need to read and digest this info but there is a command 'fastboot oem reboot <target>' (replace <target> with partition you want to boot from). This is similar to 'adb reboot <target>' and allows you to get from bootloader mode to recovery without the need to go through the system partition. Getting there, albeit at a very slow pace.
 

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Also found that when I did the 'fastboot oem unlock' command, it took about 3-5 mins to come back and gave an error message. After that could not use the power/vol- keys to enter bootloader. Managed to get the key option back though but not exactly sure of the order in which I did it. It consisted of something like going into recovery mode and formatting the cache partition and also the data partition (be aware that this will completely wipe all data in effect performing a factory reset). I also re-did the OTA v1.5.0 somewhere along the way and issued the command 'fastboot oem lock' (this just hung the system but left it like that for a few mins before ctrl-C back to the command line. Anyway, whatever I did, it seems to have restored the ability to directly enter bootloader mode using the power/vol- key combination.

Also found out some stuff about the kernel doing a search in google for 'kernelflinger'. Need to read and digest this info but there is a command 'fastboot oem reboot <target>' (replace <target> with partition you want to boot from). This is similar to 'adb reboot <target>' and allows you to get from bootloader mode to recovery without the need to go through the system partition. Getting there, albeit at a very slow pace.
When you trigger the dm-verity function you have to wipe the user data partition or else you will be locked out. Are you sure you cant boot into fast boot? The key combo takes correct timing. You shouldnt have problems flashing the v5.0 bootloader and then acheiving orange status via unlocking the bootloader.
I would say your device is behaving typically asside from the key commands for fastboot being seemingly not present. I recently patched 5.0 and upgraded via the method I have described.
 
Last edited:

tarkus1000

Member
Feb 24, 2018
11
2
When you trigger the dm-verity function you have to wipe the user data partition or else you will be locked out. Are you sure you cant boot into fast boot? The key combo takes correct timing. You shouldnt have problems flashing the v5.0 bootloader and then acheiving orange status via unlocking the bootloader.
I would say your device is behaving typically asside from the key commands for fastboot being seemingly not present.

Sorry I probably have not explained my situation as well as I could have. Basically, I can now get to fastboot/bootloader mode via power/vol- key combination (as well as adb reboot bootloader when the system has booted). When you say V5.0 bootloader, do you mean v1.5.0 as this is the version that I already have loaded but when I issue the command fastboot oem unlock the system takes about 3-5 mins to come back to the prompt (as well as an error message) and then any attempt to enter fastboot mode via the key combination is ignored and just boots the android system. So just need to work out how to get from green to orange status as oem unlock command is not playing for me. Havent had a chance to read up on dm-verity but look forward to the read in the future.
 

alecthenice

Senior Member
Jul 20, 2016
307
51
San Francisco
Yes, I patched the released bootloader version from the link you shared with me, thank you. The device was allowed to auto update to version 5.0 via ota. I then flashed my patched bootloader and toggled the bootloader lock via fastboot oem lock, fastboot oem unlock. After this was successful and bootloader was in the orange state tested with fastboot getvar all I followed the root protocol outlined in my original post to acheive root with magisk.
 

thefallnn

Senior Member
Apr 21, 2018
154
273
23
Agartala
theglitchh.github.io
I have found an easier to follow way to root the version 5.0 security update, it follows basic logic for rooting with twrp and magisk after the bootloader is unlocked with the boot.img I patched based off of the most recent security update with the help of @tarkus1000

Reboot to the fastboot interface "adb reboot bootloader" or see my youtube video for the keystroke on the unit itself (useful if you break somthing, it happens)

flash the patched boot.img **see link bellow** now you must reboot to system and select the option in settings "allow oem unlocking"

reboot to fastboot using whichever method suits you, just remember this is an old boot-loader so be patient with it as always
1) enter the command "fastboot oem unlock" sometimes it reboots and you know you have success sometimes it says failed... but it is usually unlocked (The more I study this the more I think its a problem with the android 5.1 dalvik heap its interpreter sometimes skips lines of code)

reboot from the fastboot state is required for unlocking so you have to enter the command "fastboot reboot" even if you get the failed command then wait for about 30 seconds for the device to respond if it does not respond reboot using the power button

2) check for the orange state of the bootloader enter command "fastboot getvar all" if you have orange continue to flash the hacked recovery

3)if boot state is green repeat step 1 and remember to be patient and use commands like "fastboot devices"..ect we are working with android lollipop after all

The bootloader is unlocked and you can flash twrp with "fastboot flash recovery (drag and drop .img here)"

:cowboy:Now we enter the hacky recovery by either going to system and "adb reboot recovery" or with fastboot via "fastboot boot (drag and drop .img here)"
Its a little difficult to have the recovery recognize your mouse I had luck with the logitech M100 doing this;
after you hear the device disconnect from your computer (chirp or whatever) plug in the mouse so the device boots up getting input from the mouse

Twrp will tell you it needs a password (will never be able to decrypt your partition no matter what you tell it :confused: ) hit cancel and navigate to the backup tile make a backup and include the recovery.img in your nandroid backup

now to root
flash dissable dm-verity/force encrypt (find on xda)
flash magisk (find on xda)

reboot to system. you may have to download magisk manager app to detect magisk and finish the installation

When you have success remember to reboot back to recovery and make a backup before you make any changes to the system or were gonna have to work something out ;)
how to boot into fastboot manually https://youtu.be/766TR5hFEqs
patched v5.0 boot.img https://drive.google.com/open?id=1KDpLxhYBa2Nto9dTaHFOqEKCfs6B1RjV
check out the hacked recovery image (you must use mouse) https://drive.google.com/file/d/1fcLoHw0CTAs7qIYZi2xoaAgImVREHz8O/view?usp=sharing

Flash magisk via custom recovery
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    I have found an easier to follow way to root the version 5.0 security update, it follows basic logic for rooting with twrp and magisk after the bootloader is unlocked with the boot.img I patched based off of the most recent security update with the help of @tarkus1000

    Reboot to the fastboot interface "adb reboot bootloader" or see my youtube video for the keystroke on the unit itself (useful if you break somthing, it happens)

    flash the patched boot.img **see link bellow** now you must reboot to system and select the option in settings "allow oem unlocking"

    reboot to fastboot using whichever method suits you, just remember this is an old boot-loader so be patient with it as always
    1) enter the command "fastboot oem unlock" sometimes it reboots and you know you have success sometimes it says failed... but it is usually unlocked (The more I study this the more I think its a problem with the android 5.1 dalvik heap its interpreter sometimes skips lines of code)

    reboot from the fastboot state is required for unlocking so you have to enter the command "fastboot reboot" even if you get the failed command then wait for about 30 seconds for the device to respond if it does not respond reboot using the power button

    2) check for the orange state of the bootloader enter command "fastboot getvar all" if you have orange continue to flash the hacked recovery

    3)if boot state is green flash the new boot.img again and repeat step 1, remember to be patient and use commands like "fastboot devices"..ect we are working with android lollipop after all

    The bootloader is unlocked and you can flash twrp with "fastboot flash recovery (drag and drop .img here)"

    :cowboy:Now we enter the hacky recovery by either going to system and "adb reboot recovery" or with fastboot via "fastboot boot (drag and drop .img here)"
    Its a little difficult to have the recovery recognize your mouse I had luck with the logitech M100 doing this;
    after you hear the device disconnect from your computer (chirp or whatever) plug in the mouse so the device boots up getting input from the mouse

    Twrp will tell you it needs a password (will never be able to decrypt your partition no matter what you tell it :confused: ) hit cancel and navigate to the backup tile make a backup and include the recovery.img in your nandroid backup

    now to root
    flash dissable dm-verity/force encrypt (find on xda)
    flash magisk (find on xda)

    reboot to system. you may have to download magisk manager app to detect magisk and finish the installation

    When you have success remember to reboot back to recovery and make a backup before you make any changes to the system or were gonna have to work something out ;)
    how to boot into fastboot manually https://youtu.be/766TR5hFEqs
    patched v5.0 boot.img [url]https://drive.google.com/open?id=1KDpLxhYBa2Nto9dTaHFOqEKCfs6B1RjV[/URL]
    check out the hacked recovery image (you must use mouse) https://drive.google.com/file/d/1fcLoHw0CTAs7qIYZi2xoaAgImVREHz8O/view?usp=sharing
    2
    You may need to repeat the unlockable boot.img 5.0 flash then the oem unlock command.(yes again lol) I have found this makes everything respond normally. This has happened to me before for whatever reason. Others have found the boot status doesnt matter after they have issued the oem unlock command.( in other words others have found that failed response irrelevant and were able to flash anyways)

    -just a reminder make sure the problem isnt the oem unlock allowed switch in dev options


    This issue is somthing that just happens when flashing a boot.img to the device. I have once "incompletely" flashed a magisk patched boot.img also.

    Its beyond my understanding as to technically why (maybe since its technically an update flashed through boot.img so this is why its sketchy) since a repeat flash usually fixes it.

    Thank you so much for posting this clarification (and the entire thread)! I can confirm that the process does work. I started with a stock 5.1.1 BT-300 which I successfully rooted by doing the following:

    1. Installed the Intel device drivers. (I can't post URLs yet but Google BT-300 USB drivers and you'll find the Epson developer page which will direct you to the Intel drivers download page).
    2. Attached the device to my laptop (a Surface Pro). Downloaded Disable_Dm-Verity_ForceEncrypt_02.04.2019.zip and Magisk-v19.0.zip obtained from their respective sources to the root of the sdcard of the device.
    3. Opened a command line from the directory where I downloaded and extracted the "boot-v5.0.img" and "rrecovery.img" from the main page and ran "adb devices" (to make sure the device shows up) then "adb reboot-bootloader".
    Still in the command line:
    3. Ran "fastboot devices" (confirmed the BT-300 shows up). The BT-300 screen should say "MOVERIO" and below "Process is running..." or something like that. This means you are in bootloader mode as others have commented.
    4. Ran "fastboot flash boot boot-v5.0.img" downloaded from the first page. Process completes with an OKAY message.
    I initially rebooted the device with "fastboot reboot" and then went back into the bootloader and repeated the flash. Not sure if it was necessary.
    5. Run "fastboot oem unlock". The process took several minutes and eventually I got a FAILED ("too many links") message. This is okay apparently. I also ran "fastboot getvar all" and it showed the bootloader as being locked and status "GREEN" but this also apparently is okay.
    6. After running the OEM unlock command the device wouldn't accept more fastboot commands (always would time-out or not respond, even a reboot command) so I manually pushed the power button and the device rebooted into the system. I then ran "adb reboot-bootloader" to get back into the bootloader.
    7. I then ran "fastboot flash recovery rrecovery.img" (the extra "r" is in the actual extracted file name, not sure if it's intentional) extracted from the zip on the main page. The process completes with an OKAY message.
    8. I then rebooted using "fastboot reboot". Once the devices booted again, I ran "adb reboot recovery" (no dash this time) and the device rebooted successfully into the custom TWRP recovery!
    9. I then disconnected the usb cable from the computer and plugged in a mouse and keyboard using an OTG adapter. I used a pretty old keyboard-mouse combo from an office computer and it worked okay except I had to constantly unplug and re-plugin the mouse if I didn't move the cursor for a few seconds. (I also tried a gamepad/keyboard combo device which also worked but I couldn't figure out how to "hold" down the mouse button in order to swipe...)
    10. In the TWRP recovery, I clicked "Cancel" when prompted for a password. I then clicked "Wipe" and ran the default Wipe command option (cache, dalvik, data), typing "yes" when prompted.
    11. I then clicked the Back arrow button and went to "Mount" and clicked the box for "System" partition. This is important; without doing this I could not flash any zips.
    12. Back on the main menu I clicked "Install" and installed first the Disable_Dm-Verity then the Magisk zips. I then wiped the cache for good measure and clicked "Reboot system."
    I actually forgot to put the zips on the root of my sdcard before booting into recovery so what I really did was go to "Mount" and enabled MTP in the option on the bottom right, then disconnected the mouse and plugged the device back into my laptop where I was able to copy the zips over, then disconnect and reconnect the mouse/keyboard and proceed.

    And VOILA! After a (long...) first boot (like all Android devices after a fresh install) I booted into a 5.1.1 rooted ROM with Magisk Manager installed and working! Thank you all so much for your guides on this!

    After this, as recommended by someone else I downloaded the Magisk module for MagikGApps and downloaded from OpenGApps the 5.1.1 stock zip package to the root of the sdcard. This module has to be flashed in recovery so I went back to TWRP, mounted the System, flashed the zip which located the OpenGApps zip package, and --supreme awesomeness-- GApps is installed!! Still playing around with how well it works. Took forever to optimize apps on the initial boot after installing MagicGApps but seems to be working.

    NOTE: I'm noticing that sometimes when I need to reboot back into recovery via "adb reboot recovery" sometimes it won't work and will just reboot back into the main system. I've found that just repeating the process eventually gets you back into the recovery. I still need to Mount the system partition in TWRP manually every time I need to flash a zip file.
    1
    Fastboot mode and recovery fix

    Hold volume down and power

    When green light comes on click volume down while holding power and hold

    After first vibration click volume down

    Fastboot mode

    Repair
    1
    What exactly does this mean? I have the BT-300's and and planning on rooting them I've read this entire thread, and just don't understand this last post...
    :confused:
    When u get to the part where you want google services and other associated apps (u have root and made a twrp backup), instead of just using the "openGapps" package to fill this roll we use nanodroid. Nanodroid is optimal because the bromite based backround services (instead of chromium) works more smothly with the moverio SDK. Opengapps will cause a bootloop as soon as chromium needs to update. So in order to use the actual package with the backround services contained in the .zip we must flash the "nanodroid patcher.zip". This will patch the classes.dex files allowing "nanodroid" to provide backround services. Nanodroid patcher in short is just part one to the two zip install that provides google services. See the nanodroid xda thread for more info on that specifically, these guys are geniuses for reverse engineering everything the way they do. I hope this clears things up for you.