?[ROOT][XT1607][XT1609][XT1625][XT1254] auto#initroot tethered jailbreak??

Search This thread

kenoni

Member
Nov 11, 2014
9
2
Just finish root. how to use magisk to delete verizon And Amazon apps ??

Just run these in a console when connected with adb to the phone :
pm disable com.amazon.phoenix
rm /data/data/com.android.systemui/files/boot.ad*

pm disable com.gotv.nflgamecenter.us.lite
pm disable com.vznavigator.Generic

pm disable com.amazon.widgets
pm disable com.amazon.clouddrive.photos
pm disable com.amazon.kindle
pm disable com.amazon.dee.app
pm disable com.amazon.drive
pm disable com.imdb.mobile
pm disable com.goodreads
pm disable com.audible.application

It is mentioned in the first comment of this thread.
 

DuringSummer

Senior Member
Dec 28, 2016
69
14
At this point, your best option is SunShine. Unless you can survive on temp root, then that's fine as well.

You won't get free bootloader unlocked or permanent root. Why? Because developers are not interested in this device anymore.
The exploit exists, the CVE paper has detailed information on how to make it work. The exploit for Bootloader unlock exists. The developers of sunshine made it public a while back.
And to be honest, if there was going to be a permanent root tool, we would have it by now. Auroprime could've done it quite easily by simply modifying the current autoinit root. It's not difficult if you know what you're doing.
But he didn't. Because he simply has no interest in it.

So the chances of us getting permanent root or bootloader unlock are close to zero. So don't hold your breath. It won't happen. Unless a known developer picks the project up, which seems unlikely since SunShine already exists.
 
  • Like
Reactions: DB126

DAAH•HACK247

New member
Dec 31, 2017
1
0
That really sucks but all take is few us who r truly ready step up get few together put work in an piss everybody off add few R own tweaks an run it
 

Voltz100999

Senior Member
Jun 10, 2017
155
79
24
Enigma
This may not be what you want to hear right now, according to @DuringSummer, but I have left it. I'm tired, I'm annoyed, and quite frankly, almost to the point of insanity. It pisses me off that I have to say this, but I'm done with working on this. Trying to juggle this and real life is quite literally impossible. I'll tell you what I have managed to figure out in the month I have been absent, the bootloader is unlockable, it just requires modifications to the aboot file, which won't work, the bootloader will see this and reject it. I have also figured out that root for the other devices could be possible by taking their respective boot images and compressing them with magisk injected. I never claimed to be a Linux developer, I just know a bit. So, if anyone else is interested in continuing this, go ahead. I'm tired, I'm annoyed, I'm quite literally insane. It hurts me to type this, it hurts me to admit that I couldn't be helpful, and most of all, it hurts me that I failed all of you on this thread. Say what you will, but just know I actually tried. Maybe someone else will get lucky and get it. But as for me, I'm done working on this, I've been at it since either August or September. Sorry to everyone who believed in me. And most of all, I'm sorry to myself. I hope you will understand my situation and be rational people about it. Goodbye, moto, Voltz100999 signing off.

---------- Post added at 11:53 AM ---------- Previous post was at 11:52 AM ----------

This may not be what you want to hear right now, according to @DuringSummer, but I have left it. I'm tired, I'm annoyed, and quite frankly, almost to the point of insanity. It pisses me off that I have to say this, but I'm done with working on this. Trying to juggle this and real life is quite literally impossible. I'll tell you what I have managed to figure out in the month I have been absent, the bootloader is unlockable, it just requires modifications to the aboot file, which won't work, the bootloader will see this and reject it. I have also figured out that root for the other devices could be possible by taking their respective boot images and compressing them with magisk injected. I never claimed to be a Linux developer, I just know a bit. So, if anyone else is interested in continuing this, go ahead. I'm tired, I'm annoyed, I'm quite literally insane. It hurts me to type this, it hurts me to admit that I couldn't be helpful, and most of all, it hurts me that I failed all of you on this thread. Say what you will, but just know I actually tried. Maybe someone else will get lucky and get it. But as for me, I'm done working on this, I've been at it since either August or September. Sorry to everyone who believed in me. And most of all, I'm sorry to myself. I hope you will understand my situation and be rational people about it. Goodbye, moto, Voltz100999 signing off.
I'm truly sorry, and it's not because I lost interest, it's simply because I'm tired of juggling life and this.
 

xblaz3x

Member
Oct 8, 2009
10
9
This may not be what you want to hear right now, according to @DuringSummer, but I have left it. I'm tired, I'm annoyed, and quite frankly, almost to the point of insanity. It pisses me off that I have to say this, but I'm done with working on this. Trying to juggle this and real life is quite literally impossible. I'll tell you what I have managed to figure out in the month I have been absent, the bootloader is unlockable, it just requires modifications to the aboot file, which won't work, the bootloader will see this and reject it. I have also figured out that root for the other devices could be possible by taking their respective boot images and compressing them with magisk injected. I never claimed to be a Linux developer, I just know a bit. So, if anyone else is interested in continuing this, go ahead. I'm tired, I'm annoyed, I'm quite literally insane. It hurts me to type this, it hurts me to admit that I couldn't be helpful, and most of all, it hurts me that I failed all of you on this thread. Say what you will, but just know I actually tried. Maybe someone else will get lucky and get it. But as for me, I'm done working on this, I've been at it since either August or September. Sorry to everyone who believed in me. And most of all, I'm sorry to myself. I hope you will understand my situation and be rational people about it. Goodbye, moto, Voltz100999 signing off.

---------- Post added at 11:53 AM ---------- Previous post was at 11:52 AM ----------


I'm truly sorry, and it's not because I lost interest, it's simply because I'm tired of juggling life and this.

Don't you dare be sorry for anything! I've been watching this thread from the beginning and you are one of the biggest contributors that has done a lot! You're the one that brought temp root and this whole new system with initroot to my attention. You've gotten me interested in systemless anything really. For all of your work I am TRULY grateful for your dedication and hard work! You deserve every last bit of praise that's coming your way.

On another note, I've been messing around with my Arduino and jtag/uart. I almost have my jtag rig completed and a serial rig will not be hard at all. I recently dropped my xt1609 so when I get another phone, I'll be tearing this one apart and playing with this phone on the chip side. I can't promise anything soon but if/when I do find anything out, I'll be sure to PM you and update this thread for sure!
 

DB126

Senior Member
Oct 15, 2013
15,362
10,174
I'm truly sorry, and it's not because I lost interest, it's simply because I'm tired of juggling life and this.
Hey, you learned a lot and left a trail of useful information that others will benefit from. Unlocking the bootloader via exploit is nearly impossible for all the reasons that you discovered. Yes, there are occasional (rare) successes when manufactures punt on due diligence and get sloppy. Leveno/Moto has been burned before (hello, Sunshine!) and likely won't make the same mistake again.

You failed no one, especially yourself. Learning is an excise in failure. Think about everything you have accomplished in life and how many tries it took to get there. Recognize you were going up against a global team of engineers with expertise cryptology. The David and Goliath fairy tale rarely plays out in real life.

So now it's time to take care of yourself, regain confidence and apply everything that you learned over the past 6 months to the next challenge. That may be a private affair or one you choose to publicly share. It may or may not have anything to do with phones, Android or technology in general. Learning, failing and picking yourself up to fight another day are what make us all a little stronger, a little wiser and ultimately a whole lot happier.

Enjoy some time off.
 

Voltz100999

Senior Member
Jun 10, 2017
155
79
24
Enigma
Don't you dare be sorry for anything! I've been watching this thread from the beginning and you are one of the biggest contributors that has done a lot! You're the one that brought temp root and this whole new system with initroot to my attention. You've gotten me interested in systemless anything really. For all of your work I am TRULY grateful for your dedication and hard work! You deserve every last bit of praise that's coming your way.

On another note, I've been messing around with my Arduino and jtag/uart. I almost have my jtag rig completed and a serial rig will not be hard at all. I recently dropped my xt1609 so when I get another phone, I'll be tearing this one apart and playing with this phone on the chip side. I can't promise anything soon but if/when I do find anything out, I'll be sure to PM you and update this thread for sure!


Hey, you learned a lot and left a trail of useful information that others will benefit from. Unlocking the bootloader via exploit is nearly impossible for all the reasons that you discovered. Yes, there are occasional (rare) successes when manufactures punt on due diligence and get sloppy. Leveno/Moto has been burned before (hello, Sunshine!) and likely won't make the same mistake again.

You failed no one, especially yourself. Learning is an excise in failure. Think about everything you have accomplished in life and how many tries it took to get there. Recognize you were going up against a global team of engineers with expertise cryptology. The David and Goliath fairy tale rarely plays out in real life.

So now it's time to take care of yourself, regain confidence and apply everything that you learned over the past 6 months to the next challenge. That may be a private affair or one you choose to publicly share. It may or may not have anything to do with phones, Android or technology in general. Learning, failing and picking yourself up to fight another day are what make us all a little stronger, a little wiser and ultimately a whole lot happier.

Enjoy some time off.
Thanks for the kind words. I hope I can enjoy some time off. But there's a guy jackhammering the road because it's frozen over right now.
 

DuringSummer

Senior Member
Dec 28, 2016
69
14
Thanks for the kind words. I hope I can enjoy some time off. But there's a guy jackhammering the road because it's frozen over right now.
The fact that you tried is what matters. And sorry? What are you sorry for?
Hey I tried too early on, but left it because it wasn't something I could do. But you kept on going for quite some time, which is something I admire.
So Good Job :)
 

fischerms

Member
Sep 21, 2010
23
3
Port Orchard
At this point, your best option is SunShine. Unless you can survive on temp root, then that's fine as well.

You won't get free bootloader unlocked or permanent root. Why? Because developers are not interested in this device anymore.
The exploit exists, the CVE paper has detailed information on how to make it work. The exploit for Bootloader unlock exists. The developers of sunshine made it public a while back.
And to be honest, if there was going to be a permanent root tool, we would have it by now. Auroprime could've done it quite easily by simply modifying the current autoinit root. It's not difficult if you know what you're doing.
But he didn't. Because he simply has no interest in it.

So the chances of us getting permanent root or bootloader unlock are close to zero. So don't hold your breath. It won't happen. Unless a known developer picks the project up, which seems unlikely since SunShine already exists.

SUNSHINE app cannot root the XT1609 variant, SUNSHINE did work on the Verizon HTC Desire 626 I have but what ever encryption used by Verizon/Lenovo overlords on the XT1609 blocks the SUNSHINE app from rooting. I have have tried every few weeks with a new version of SUNSHINE with the same failure message. With XT1609 you do not "own" the phone. Also with the XT1609 you will not see Android 7.1 from Verizon...
 

Voltz100999

Senior Member
Jun 10, 2017
155
79
24
Enigma
The fact that you tried is what matters. And sorry? What are you sorry for?
Hey I tried too early on, but left it because it wasn't something I could do. But you kept on going for quite some time, which is something I admire.
So Good Job :)
Thanks for that man. It really did get quite vexing working on it for so long. But I'm honestly glad I at least tried to do it.
 

motolio

Senior Member
Oct 27, 2008
186
72
Nexus 7 (2013)
Moto G7 Power
Need help. I rooted and got carried away. I tried editing the stock YouTube and bricked my xt1609. After reinstalling and flashing all stock firmware (also tried Verizon repair software), it refuses to ask for Sim Unlock code (for my straight talk Sim).
Could this be something I disabled via adb before? Any help is appreciated.


Update: Turns out the MEID/ IMEI got zeroed out. Is there anyway to repair it? I found aguide using MTK Engineering mode, but I beleive I have snapdragon.
 
Last edited:

mdanishas

New member
Jan 28, 2015
2
0
0X4fFHZW.jpg
 

bobturismo

Senior Member
Mar 20, 2009
142
20
I just cannot figure this out, I've spent two whole days screwing with this.

I run the autoroot, install magisk, then I made the sh file as per

I used a Windows 10 pc. Created text file copy n pasted the code from post#2, then rename boot.sh

After which I moved the file to my sdcard with USB. Then thru the terminal I used commands
Adb shell
Su

Chmod boot.sh +x

mv boot.sh magisk/.core/service.d

Sent from my LG K20 Plus using XDA Labs

but I moved the file first to service.d, and then instead of chmod boot.sh +x (which gave me errors), I did chmod +x boot.sh, but it didn't give any sort of response.

It'll boot into the bootloader with several errors about hap and boot image I think.

I flash a stock img and it then boot loops on the logo, the first time, I reran the autoroot and it booted, the second time I rant the autoroot and then uninstalled it and it booted

*Sigh* so much time wasted


EIDT Now I cant make or receive calls, just ends the call immediately, data and text work
 
Last edited:

LevanG

Member
Aug 21, 2013
31
3
hello,

I have installed #initroot successfully on my XT1254 but then I decided to uninstall it but when I rebooted my phone into the Fastboot mode it failed with the uninstallation process. I also tried to disable #initroot with this Code: fastboot oem confirm fsg-id “” , but I have received this error:
https://prnt.sc/ib3571

then I tried to reinstall #initroot but without success.


now I'm stuck in the Fastboot mode, I can't boot or factory reset my phone.

Please Help! how can I repair my phone? can I reinstall the stock rom somehow?

thanks in advance for your answer!
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 20
    thread best viewed in browser not xda app
    Code:
    [CENTER]
                       _ _                               
             _       _| | |_ _     _ _               _   
     ___ _ _| |_ ___|_     _|_|___|_| |_ ___ ___ ___| |_ 
    | .'| | |  _| . |_     _| |   | |  _|  _| . | . |  _|
    |__,|___|_| |___| |_|_| |_|_|_|_|_| |_| |___|___|_|  
    [/CENTER]

    tethered jailbreak for bootloader-locked motos

    motorola g4 play harpia amazon xt1607 + verizon xt1609
    motorola turbo quark verizon xt1254
    motorola g4 athene amazon xt1625


    feature
    double-click install
    windows/mac/linux
    disable ota updates*
    disable amazon ads*
    anti-bootloop protect*
    working wifi/cellular/nfc/bt/fm
    systemless root + mods with magisk
    *see tips in post #2

    install
    download auto#initroot to computer
    download magiskmanager apk to moto and install
    connect moto to computer with usb cable then (re)boot moto into fastboot
    double-click auto#initroot file and wait for moto to boot into jailbreak android
    double-click auto#initroot file everytime you reboot moto to regain jailbreak android

    uninstall
    windows: double-click auto#initroot file and press "0" key when prompted
    mac/linux: double-click auto#initroot file and press any key when prompted
    see here for more uninstall info
    11


    what this is
    i make tethered jailbreak for moto using cve-2016-10277 and initroot ideas
    designed for bootloader locked motos with no root jailbreak
    tethered jailbreak require computer to jailbreak

    what this is not
    how to use fastboot/adb/drivers
    lazy posting before search
    bootloader unlock

    install step by step
    steps 1 and 2 run only once steps 3 and 4 needed each jailbreak after

    1. download auto#initroot [here] to computer
    • download then unzip auto#initroot zip file
    • be sure auto#initroot file matches moto model#/software#

    2. download magiskmanager apk [here] to moto and install
    • on moto enable : settings - security - “unknown sources”
    • on moto d/l latest magiskmanager 5.x apk and install
    3. connect moto to computer with usb cable then (re)boot moto into fastboot
    • enter fastboot : “adb reboot bootloader” or
    • volume down + power at boot
    4. double-click auto#initroot script and wait for moto to boot into jailbreak android
    • open folder unzipped in step 1-1
    • mac/linux users : may need to chmod +x auto#initroot script or fastboot binary
    • run script for computer OS and moto boot into jailbreak android
    • unplug usb cable and enjoy root jailbreak
    • run script every time moto boot into jailbreak android
    • read tip section for more
    tips
    double-click auto#initroot to boot jailbreak android
    windows : double-click auto#initroot bat file
    linux : set *.sh to execute on double-click or make *.desktop file
    mac : double-click auto#initroot command file

    use /magisk/.core/service.d/ folder to run script at boot
    use example below to make custom *.sh file(s) then put in /magisk/.core/service.d/ folder and chmod +x it​
    • anti-bootloop
    • stop ota update
    • stop amazon ad
    • stop bloat app and services
    • and more...
      Code:
      [/LIST]
      #!/system/bin/sh
      
      #move this to /magisk/.core/service.d/ folder after factory resets
      
      #anti-bootloop -- allow harpia to reboot without computer
      printf '\x31' | dd of=/dev/block/platform/msm_sdcc.1/by-name/utags bs=1 seek=90
      
      #disable ota so #initroot not patched
      pm disable com.motorola.ccc.ota
      
      #disable bloat after factory reset
      if [ ! -e "/cache/firstrun" ]; then
      
        #disable amazon ad
        pm disable com.amazon.phoenix
        rm /data/data/com.android.systemui/files/boot.ad*
      
        #add verizon xt1609 bloat
        pm disable com.gotv.nflgamecenter.us.lite
        pm disable com.vznavigator.Generic
      
        #add amazon xt1607 bloat
        pm disable com.amazon.widgets
        pm disable com.amazon.clouddrive.photos
        pm disable com.amazon.kindle
        pm disable com.amazon.dee.app
        pm disable com.amazon.drive
        pm disable com.imdb.mobile
        pm disable com.goodreads
        pm disable com.audible.application
      
        #create firstrun so only run once
        touch /cache/firstrun
      
      #end if statement
      fi
      
      #add new commands here
      
      #end of script
      exit 0

    • pfaq (probable frequent asked questions)
      q : why no bootloader unlock
      a : need 0 days bug to set unlock qfuse

      q : why jailbreak need tether
      a : #initroot exploit stored in memory and gone after reboot

      q : i need computer always to jailbreak android
      a : yes but if no reboot always jailbreak android

      q : i need computer always to boot moto
      a : no use command in tips for anti-bootloop

      q : i can reboot phone without computer and jailbreak android
      a : no no use anti-bootloop to boot without computer but also lose jailbreak

      q : must install magiskmanager before auto#initroot
      a : no you can install before or after does not matter

      q : must double-click only for jailbreak
      a : double-click is easy but can also run script from terminal

      q : must use script for jailbreak
      a : no you can manually type fastboot commands in terminal

      q : i put script in /magisk/.core/service.d/ why no run
      a : chmod +x file.sh and it will run on jailbreak android boot

      q : why no auto#initroot for my moto
      a : cant do everything

      q : i do everything right why no work
      a : sometimes you must pull battery out moto and try again

      q : auto#initroot work on non-moto
      a : no moto only

      q : how to disable #initroot
      a : boot to fastboot run command below and #initroot never happen
      Code:
      fastboot oem config fsg-id “”
      #initroot-able versions
      Code:
      [COLOR="green"]XT1254 MCG24.251-5-5[/COLOR] <- do not upgrade past this version
      
      [COLOR="green"]XT1607 MPIS24.241-2.35-1-13[/COLOR] <- do not upgrade past this version
      [COLOR="green"]XT1607 MPI24.241-2.35-1[/COLOR]
      
      [COLOR="green"]XT1609 MPIS24.241-2.35-1-17[/COLOR] <- do not upgrade past this version
      [COLOR="green"]XT1609 MPIS24.241-2.35-1-13[/COLOR]
      [COLOR="green"]XT1609 MPIS24.241-2.35-1-3[/COLOR]
      [COLOR="green"]XT1609 MPI24.241-2.35-1[/COLOR]
      
      [COLOR="green"]XT1625 NPJS25.93-14-4[/COLOR] <- do not upgrade past this version
      [COLOR="Green"]XT1625 MPJ24.139-64[/COLOR]
      
      [COLOR="Red"]XT1687 NPNS25.137-35-5[/COLOR] <- blocks #initroot
      [COLOR="Green"]XT1687 NPN25.137-35[/COLOR] <- do not upgrade past this version
      my comments
      make use of the custom scripts you can add to /magisk/.core/service.d/
      even though bootloader lock systemless magisk help makes many mods
      i hope people come up with creative ways to make these locked phones fun again
      i only have xt1609 so cannot test everything myself
      things may be broken for non-xt1609 moto and user must test
      i thought using jailbreak sounded funny and since the root is tethered...
      tethered jailbreak = tethered root
      tethered root lasts until you reboot
      dont reboot for month and you have root for month
      initial #initroot poc was limited to root thru adb shell only
      initial #initroot poc required you to be at computer for every reboot
      auto#initroot gives us the ability to do system-edit like mods with magisk
      auto#initroot is just a double-click away any time you need to re-root
      this seems like the best possible case for bootloader-locked phone
      other than bootloader unlock itself of course
      changelog
      july 19 2017 - initial release
      august 3 2017 - added uninstall option to auto#initroot script + added amazon g5 play xt1687
      august 6 2017 - added support for all windows versions
      error reporting

      users reporting issue should make report detailed as possible to increase chance of getting response.

      details required:
      1. on your phone go to settings > about phone and list:
      • model number
      • software variant/channel
      • android version
      • android security patch level
      • build number

      2. which auto#initroot file are you using?
      • full name of auto#initroot folder or *.initroot file

      3. what is the output from the auto#initroot script/command/bat file?
      • copy/paste the entire output log of command prompt/terminal window
      • screenshot would work if you are unable to copy/paste text

      4. what os is on your computer?
      • windows 10 64-bit, windows 8.1 32-bit, os x 10.8.5, etc..

      your report should answer all possible variables.
      if error report already answered previously in thread then report will likely be ignored.
      if more questions must be asked before it's possible to give you answer then report will likely be ignored.
    9
    Ok, I did a thread cleanup. Please stay on topic.
    7
    August 3, 2017 Update:
    • Added Amazon G5 Plus XT1687 NPN25.137-35
    • Added uninstall option in auto#initroot scripts
      -Windows: double-click auto#initroot-*.bat and press "0" key when prompted
      -Mac/Linux: double-click auto#initroot sh/command file and press any key when prompted
      -auto#initroot script will INSTALL when no key is pressed and UNINSTALL when key is pressed
      -updated auto#initroot bat file fully supports Windows Vista and up. Windows 98/XP may have issues.​

    XT1687 Note:
    XT1687 NPNS25.137-35-5 apparently patches the #initroot bug even though it has a "2017-05-01" patch and #initroot wasn't patched until the second May security patch, 2017-05-05. Can anyone that is already on XT1687 NPNS25.137-35-5 confirm that the following command fails in fastboot? If confirmed, XT1687 NPN25.137-35 will be the last update working with #initroot
    Code:
    fastboot oem config fsg-id "a androidboot.bar=1"

    Error Reporting:
    users reporting issues should make the report as detailed as possible to increase chances of getting a response.
    although I am likely to not respond since just about everything has been explained in this thread already.

    Details required:
    1. on your phone go to settings > about phone and list:
    • model number
    • software variant/channel
    • android version
    • android security patch level
    • build number

    2. which auto#initroot file are you using?
    • full name of auto#initroot folder or *.initroot file

    3. what is the output from the auto#initroot script/command/bat file?
    • copy/paste the entire output log of command prompt/terminal window
    • screenshot would work if you are unable to copy/paste text

    4. what OS is on your computer?
    • Windows 10 64-bit, Windows 8.1 32-bit, OS X 10.8.5, etc..

    Your report should answer all possible variables.
    If more questions have to be asked before it's possible to give you an answer then your report will likely be ignored.
    If your question has already been answered somewhere in the thread then your report will likely be ignored.
    5
    Thank you so much for getting this to work with the XT1687! the hope for root is back :)
    Thanks man, I'll try my best, should be done within a month or so.