• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Armor x5 Android 10_Q Mt6765 aka Mt6762 ROOT AT LAST!

Search This thread

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
Okay readers, learners. and dev's alike, I bought a fone, but when I buy anything that can be hacked, the targeted persons list says I get the latest unhackable crap, latest updates and everything... cant buy second hand without forced updates.. and the neighbours choppin my cable tv wire think they hacked my cctv only to become bitcoin miner's, and maggie thatcher cant do nowt now she's dead lol...

Introducing the Armour X5 'A' only...

Dont buy it...

But if you got one, it's like this, this fone outright lies to you.

You buy an mt6765, check the dev menu ( - Vol ) and that's what it say's. But I notice mt6762 in some android apps. I flash every twrp recovery I can find, initially I flashed the mt6765 files, got either bootloop, or had to use sp mtd which off course wipes your serials and macs, a learning curve in itself, learning ulefone actually instruct you to wipe your macs n serials, but offer no tools to fix their fault's... sn writer took care of that, when it could...

Power! so much power... cant take battery out, so if you get a bad flash, you cant reflash until you drain the battery, I did this by hooking up the fone to a 7 port usb hub, plugged in 2 alpha wifi dongles, 2 usb 128gig drives, usbjtagnt, and it still took 48 hours to drain the fone, as it powered the aforementioned devices with nothing but a black screen... in other word's, it takes a week to drain the battery in bad flash mode. But once drained is instantly flashable. Dont miss it, cause it charges quick, so draining becomes a pain...

Now It took me a week to notice, the Armor x5 files that caused me so many bootloops, were indeed for the Armor x5, android 9, and actually use the mt6763, and this recovery is 64mb in size, not 32mb like mine! Everywhere else I was reading android 10 using pie, I dont think so... I tried every way I could..

Now here I learnt something new, and I know it's new, because folks have mentioned it in a multitude of posts, yet none have twigged, or peiced it together.

If you flash a twrp that works on your fone but shows a blackscreen, you are in recovery mode, twrp wont work because you need to slide the slider, this should actually be removed, because it cause's too much hassle, a button or tick box can guarantee screen access instead of blocked if we slip up instead of swipe... my swipe is quite pernikity, but it works.

BUT!!! If you have magisk in your boot, you can mount AND write to /system from this point!

In fact, going past recovery, while fone is booting, you cant write to /system OR / in rw mode, but as soon as the gui kicks in adb is cut off... now do su, yup, great, but no /system or / writes....even with root.

A magisk in booloader stops this at the booting past recovery bit, ie no rw, ONLY if magisk was installed in the gui... after. But just having it in bootloader without updating in gui is all you need to write to these locations, again, I've tested this countless times to know it's re-producable.

In the end, This is for those fones no one got replies to, cause those who got replies were on android 9 (PIE) and the twrp/bootloader were written thus.

And why magisk did not work I do not know, but the symptoms ares follows:

Clean slate, in gui, install canary latest, patch boot, flash boot, it wont work, ever.

It took finding a root in android kitchen, to spotting the mt6762 chipset so tried the note 9, voila, root, but no twrp, and lopestom showed what we used to do here... share cause we can...

So with lopestoms kind permission, here is root for the A ONLY ANDROID 10 ROOT.

Note: My fone is an mt6765, but only mt6762 gives this fone root, and to top it off, from what I've seen by testing, this will work on any ulefone mt6765, or mt6762.

I know all you'll need to do is check the recovery file size is 32mb, which is 'A' ONLY

NOT the 64mb which is A/B (prob dual boot like to old ambit 250 non-vol), see the same size of files in the modems and fones? hint hint ;)

Have root!

Twrp for armor x5 is for PIE.

This twrp, thanks to Lopestom, is all you need.

Unzip, I use 7z, pwd is Re-Kr8 (just to keep it safe from googles meddlin)

Do:

fastboot --disable-verity --disable-verification flash vbmeta Armor_X5_Q_EEA-V3.01-MT6762-A10-vbmetaAndroidSC_mod-Lopestrom.img

fastboot flash recovery Armor_X5_Q_EEA-V3.01-MT6762-A10-Twrp-Lopestrom.img

fastboot flash boot Armor_X5_Q_EEA-V3.01-MT6762-A10-Bootloader-Pachacouti.img

fastboot reboot-recovery

Thank Lopstom.
 

Attachments

  • Armor Mt6765-6762 root by Pachacouti+Lopestrom.zip
    34.6 MB · Views: 24

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
UPdate:

Ok, it aint as pretty as I thought, but I expected as much..

The Twrp is fine. The Bootloader is fine. the vmeta is fine, buuut....

it's as I read elsewhere...

I KNOW the point of a read only system is that it is what it is, and cant be modified, yes, i read john wu's stuff (respect), but I also think you guys are missing sumat... like why not just put an entire new flash over ther old one if you have an open bootloader voiding warranty, you know, like we do linux to get rid of windows, or apple to get rid of linux...

it's like, so many linux mods laid OVER a ro system that can in fact be completely erased as we do with our desktop machines.

Ok, so here's the problem with my fone.

Twrp can do everything, it's 100% (remove the slider in it, it causes the screen freezes) before we see it, TRY to slide it, while it races back and well, get rid of it and use a damn button, that way we can get to the screen to do at least something else...

I've tried systemrw_1.32, gave up on it, It worked for me, but would not mount the moint points.. as claimed... ok, so it works for PIE, according to those who tested it and failed.

Here's the kicker. With stock boot, I flash twrp to recovery, boot into gui, have normal shell with NO su, tried installing busybox/supersu just to see if root actually worked, with just twrp, as I reckon if we have root, either of these two will install su, but no joy with JUST the twrp. Magisk zips fail... The wonder of this twrp is all is mountable apart from the otg I never use, but I reckon the magisk module bloatware version of otg is the drivers to enable this... however, the module attempts to connect to your google account, so much so google inform you, f**k that.. ( had fn for a year, and have yet to put in a sim with credit, I'm after the gps WITHOUT the sim... ) I can do the systemrw.1.32, from twrp terminal, my 128 gig sdcard is one with the fone at last, so no space problems, Gone. So... root... works... in recovery, 100%

Apart from flashing roms... :O

None can be flashed... no system, even when mounted in twrp and viewable in twrp terminal. I can flash zips ok, just not the custom roms... even nethunter (one of my goals) wont flash the custom rom, I need to use the chroot apk, red letters saying read only come from the twrp'd zip, even though all shows a-ok...

I had no choice but to flash my own bootloader that I magisked using the note9 recovery, just to see the old magisk demand internet. I flashed the canary MagiskCanary23.0.apk because if I did not, the greyed out magisk icon wanting internet, even though flashed with the latest version... did NOT give root that's already there... flashing the apk takes care of su. Internet should be optional, I mean, hey, magisk flashing to magisk patched always fails when offline, but when online we get to use it? Surely by now they must have sussed that it would be benificial to all devs if this was the same for when offline! (Nope) - I say this because we have to be online when we're trying to do things that can and does prevent us being online at times..

The note9 is still doing something even this twrp wont... it mounts all images rw until the desktop launcher ACTUALLY kicks in, ie, you see your dial button. Very defo reminds me of the last firestick problems we had with the black screen before they wiped the twrp, tata firestick I said...

And block all amazon.

Hmm... is it even worth havin a fone nowadays...?
 

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
Update...

Can confirm only the note9 recovery allows me to load up gui, update magisk, flash magisk_patched, adb pull said image, (works for me) fastboot flash with vmeta, and it sticks.

Magisk fails at flashing the image it creates... even online... I noticed in the non-canary version that it stored a copy of the magisk_patched (this is how I 'got in' to the fn, adb pulling this to create MyBoot1.img) - and it showed in the magisk logs, even if it fails, with the canary, this no longer shows... no reason given for failure

My guess is read only fs.

Ps, arm64-v8a

Edit:

Then it dawned on me, guess what? Is your os a user, eng, or dev build? check what we can and cant do... user builds cannot adb root, using vbmeta actually prevents system changes, depending on build. ad remount for instance, wont work on a user version of...

Lopstom. Could you look at the note 9 image, at the beginning of that file, in hex, it shows eng build, can this be hex edited into MyBoot1.img, as easy as copy n paste?

I Believe the armor 8 twrp has eng build in it, this would enable systemrw, we cant do this in user builds! Away to test that now.... betting the prob is what version gives what commands...

disable verity wiped or not, will not change user to eng(iineer) modes...?

Double edit... guess what? I'm correct.

Magisk can patch a boot but cant flash it if your not already root in USER builds.

Isn't this why succesful roots come from those with ENG builds?

And why all stock builds recently are only 'USER' build's?

They can defeat root using this fact alone.
 
Last edited:
  • Like
Reactions: lopestom

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
In the end, I settled for flashing boot-debug.img into boot to get the following:

adb root
adbd is already running as root

cant do this in magisk

adb shell

#

note: magisk kills this. so dont magisk your boot-debug.img

stock recovery wont show, so flash a twrp, for this fone, should you wish to, use twrp by lopstom.

flashing magisk at this point kills adb and removes #

leaving me reflashing to test systemrw_1.32 without root lol...

Edit, my bad, looks like we always had root, but dev's at magisk never did mention variant=user (will NEVER mount) the reason no-one can flash from the actual fone unless online... they dont have root to the fone...

Stock gives root loading the boot-debug.img into boot.img

So yeah, this fone rooted. They all are if the stock contains boot-debug.img.

Hows that john wu? Shoulda chipped in with the variant build not mounting...

Now I know...

Stop killing root we actually have, oh that's right, your no longer android... your an apple employee... tagging our magisk'd with id features... hence trapped to logging in online to get su that comes s=with simply flashing boot-debug.img with ZERO magisk.

adb root

adb shell

#

:)
 
Last edited:

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
Thanks. Not need more than respect. :cool:

I just chose you for the attitude of sharing information and the fact that you needed help to progress. Courage is for the few.
I prefer that you share the TWRP file and instructions yourself. So fastboot/fastbootD; encryption and decryption; installation of zips; backup and restore; internal and external storage; anything else is working??

Yes: Enjoy! No: let me know.
Would you do one more thing?

I have uploaded my boot-debug.img - could you possibly add twrp to this without using the note9 twrp, so I get all the proper settings made for my fone rather than a note9?

The note9 is pie,I need this for android 10 q, different super.img mount points in systemrw kinda thing..

it's taken from the stock I posted here, so you should have pretty much what you need, but one more thing, is it possible to add su to this too?
 

Attachments

  • boot-debug.img
    32 MB · Views: 8

lopestom

Senior Member
Nov 7, 2012
745
499
Archland - Narnia
mewe.com
Would you do one more thing?

I have uploaded my boot-debug.img - could you possibly add twrp to this without using the note9 twrp, so I get all the proper settings made for my fone rather than a note9?

The note9 is pie,I need this for android 10 q, different super.img mount points in systemrw kinda thing..

it's taken from the stock I posted here, so you should have pretty much what you need, but one more thing, is it possible to add su to this too?
Not understand what you need.
boot.img has has few files inside it. There are no files in the Ramdisk folder like in recovery.img.
More in-depth detail than you want.
If you want the kernel of this boot_debug.img in the TWRP then it can be done.
 

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
I'm hoping you can put twrp into this debug as it allows root and it's stock, all it needs is it's OWN up to date twrp, the note 9 is for pie, but I'm hoping porting twrp to this works yet retains my phone model's details etc... I think the twrp you've already made for me contains mt6733 or something, not my cpu.?

Lol whatever it takes, put twrp in it so I can flash it to recovery? Yeah, I reckon my kernel is in it, so if you could make a working twrp with kernel for my fone rather than the kernel from the note9, am I on right path? I am past programming lol, but still find things ;)
 

lopestom

Senior Member
Nov 7, 2012
745
499
Archland - Narnia
mewe.com
I'm hoping you can put twrp into this debug as it allows root and it's stock, all it needs is it's OWN up to date twrp, the note 9 is for pie, but I'm hoping porting twrp to this works yet retains my phone model's details etc... I think the twrp you've already made for me contains mt6733 or something, not my cpu.?

Lol whatever it takes, put twrp in it so I can flash it to recovery? Yeah, I reckon my kernel is in it, so if you could make a working twrp with kernel for my fone rather than the kernel from the note9, am I on right path? I am past programming lol, but still find things ;)
The TWRP 3.5 is from your stock recovery and made/compiled my self to MT6762_65.
But I'll look about boot_debug the kernel to change. Not promises about Su...... Not good free time now. So wait.
______-----------------______
You need stop comparing your device with Note9 device.
I don't know how you made Note9's TWRP start on your device. Although you may or may not confirm some part of a similar device or clone, even so what I've noticed is that they are different in some parts and it's intriguing how it could have been done. Comparing Comparing II
But now you have a working TWRP3.5. Some time ago busybox and other file features were removed in the TWRP build. The Su_ part is something that must be in the system or vendor, I don't remember now, for it to act relatively like what you want with it. This from Su_ in TWRP will have no effect. Also, is Su_ coming from magisk or Su_phh? You can place the Su_ file in the ROM and give it proper permissions for use. Try it.
______-----------------______

Update2: Compare yourself the files from boot_debug and TWRP file. I unpacked boot_debug to you look anything you want. But What folder/files you want put in the TWRP?
Make a decision for what you want.......
 

Attachments

  • WWW.png
    WWW.png
    144.2 KB · Views: 11
  • boot.7z.zip
    10.1 MB · Views: 4
Last edited:
  • Like
Reactions: Pachacouti

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
Again, I cant thank you enough. If you've kept up with me, I've actually found the reason most failures occur in twrp just now is poeple not yet understanding the a/b partitioning, and I think, that the note 9 gave access because the mt6762/6765 are the same instruction set, which allows root from recovery in my fone, it was the only one that worked until I found the boot debug part... cant believe I'v had this for a year and never noticed b4, could'nt have done it without the variant hurdle...

If you use magisk from 10 q onward, you can only use variant=user for magisk root, the true root of your fone from android 10 onward is your boot-debug, giving adb root magisk cant.

And magisk kills this boot-debug.. try it on a fone that tales a 32mb boot, should work..

I dont know the first thing about taking a twrp from one bootloader and putting it in another, but I reckon i would like to keep the boot-debug as close to origional as possible, so would ask for the bare minimum for twrp to work using this boot-debug files rather than the note9 files, in this I trust your good judgment, since you clearly better in this department.. ?

It's only because I dont know what files are needed, what I can change or not I ask, I'd get lost...looking for the fix lol..

ps, I think the note 9 uses the pie version of android 10, so dont quite work with my a only, because pie seems to be a/b partition, I'm prob wrong here tho...
 

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
The TWRP 3.5 is from your stock recovery and made/compiled my self to MT6762_65.
But I'll look about boot_debug the kernel to change. Not promises about Su...... Not good free time now. So wait.
______-----------------______
You need stop comparing your device with Note9 device.
I don't know how you made Note9's TWRP start on your device. Although you may or may not confirm some part of a similar device or clone, even so what I've noticed is that they are different in some parts and it's intriguing how it could have been done.


I was correct all the way.. android 9 WAS on the note 9, (I never had a note9, found this online) 10 was the change from pie to super partition, hence the mt6765/6762 of the note9, also known as 6763 in the land of android 9 and ulefone make it clear that attempting android 9 on my fone will brick it, yet it was suplied with 10 as stock for my fone, so changes took place between the android 9 and 10 for this fone alone, one that allows rooting like in pie, but without su or magisk, becuase root always was what I knew I was looking for, in variant=eng, which I discovered in the note9, the only fone who's booloader closely matched mine, enough to get in...
 

lopestom

Senior Member
Nov 7, 2012
745
499
Archland - Narnia
mewe.com

I was correct all the way.. android 9 WAS on the note 9, (I never had a note9, found this online) 10 was the change from pie to super partition, hence the mt6765/6762 of the note9, also known as 6763 in the land of android 9 and ulefone make it clear that attempting android 9 on my fone will brick it, yet it was suplied with 10 as stock for my fone, so changes took place between the android 9 and 10 for this fone alone, one that allows rooting like in pie, but without su or magisk, becuase root always was what I knew I was looking for, in variant=eng, which I discovered in the note9, the only fone who's booloader closely matched mine, enough to get in...
I made some modifications and additions to the attached boot_debug.img and recovery.img(TWRP) files.
But I can't guarantee some functioning or something you want at the moment.

It only remains for you to test and if it doesn't work I can't really help you with a solution to your idea.

Cheers
 

Attachments

  • recovery_boot-debug-MOD.zip
    34.7 MB · Views: 3
  • Like
Reactions: Pachacouti

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
Agaiin I cant thank you enough, but I can write of things that you will learn from, and I'll start with this...

Notice in the note9recovery, when opened in a hex editor, it states at the end of the first 'paragragh' on left, end's in build variant=eng?

Well here's the kind of thing I notice:

I load up boot.img in ultracompare, left panel, load up boot-debug.img in right panel, hit play to find all the differences, while ultracompare returns identical file.(s)

Opening hex edit, and dragging and dropping each file onto the editor shows in the very first line, a change in hex code. If they were identical, this change would not show.

(I guess here the encryption is read instead of file contents)

Two identical files, and BOTH show variant=user <- WARNING DO NOT BELIEVE, TEST!

So I load boot-debug.img into boot.img and voila, an eng version of boot that gives adb root when booted into phone!

Meanwhile, the note9recovery origional shows variant=eng when opened in hex!

In the above is why the note9 recovery worked for me.

I discovered why google say they are not releasing variant=eng anymore...

BUT... we all need adb root.

Haha, go on Elgoog...
 

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
I made some modifications and additions to the attached boot_debug.img and recovery.img(TWRP) files.
But I can't guarantee some functioning or something you want at the moment.

It only remains for you to test and if it doesn't work I can't really help you with a solution to your idea.

Cheers
Yeah, needs a bit more work so gona attempt the file changes myself, it's been a while, so gettin to it :)

Notice the last file has changed the beginning to variant=eng?

I'm going down the path of keeping the boot-debug root which dissapears when attempting magisk or su, my brain has yet to accept how this new style of root works and what can/cant be done, but on with the hex editing, again thank's, will post my final result when done :)
 
  • Haha
Reactions: lopestom

Myetta

New member
Sep 28, 2021
3
0
This 'tutorial' is a quicky for those yet to figure this fone out.

Well it took a bit time for sure, but this is how it went...

No matter what recovery or magisk I tried, nothing worked, all ulefone images with twrp were 64mb in size, where-as mine was 32mb. Betting the 64mb is a/b partioned like the old ambit 250 modems, where half the non-vol was the first boot, the second half a clone of the first half.

No file for the mt6765 worked. In other words, no twrp. instant bootloop every time.

But then I found the ulefone note9 mt6762 recovery, flashed it, booted into recovery, and had root!

Until I rebooted at least. There was no access to the actual fone system however, for in recovery, system, or / has not been mounted, and if it was, it cold not be written to..

Then I had an idea. I tested the root.img from android kitchen by flashing just that direct to the recovery of the fone, and it not only stuck, I could switch off fone, reboot, and what I call an overlaid file system with root presented itself, and before I knew it I had a fake root that worked.

The problem with this fone is that it actually uses mt6762 for booting, booting into mt6765 style, vice versa does not work. The note9 is a 6762 chipset. 32mb in size.

The root.img from android kitchen, flashed to recovery gives the head start, having magisk installed, but sadley, twrp did not show in recovery using the note9 recovery that has a working twrp, and the android kitchen root.img shows no twrp, being magisk'd!

Unlocked bootloader required.

Boot into fastboot.

fastboot flash vbmeta vblankmeta.img
fastboot flash recovery root.img

boot fone, install magisk manager, superuser and busybox apk's, then root checker pro, test and see, by rebooting, it should keep root if you set su to boot via busybox, AND superuser.

Now if someone wants to make this for this actual fone, with the correct file versions for this fone, I'll post my latest stock recovery, along with the files I used. All files as far as I know came from here, I have done nothing to them.

The actual Files are: Armor x5 Android 10_Q root.zip is actually a 7z file renamed to zip to upload here, i use 7z, and dont install winzip, and the password for both is Re-Kr8, used in order to prevent google tampering.

The zip contains vblankmeta.img and root.img taken from android kitchen, hope they dont mind auld folks like me helping this way...

The origional is recovery from unrooted fone taken from stock firmware, android 10 Q for ulefone armor x5.

Have a nice day.
Привет, подскажите где взять пароль? Папки не открывает без пароля
 

Myetta

New member
Sep 28, 2021
3
0
Am impressed... I see twrp in recovery at last.. you are a god send for all those armor x5 punters with the 'a' only partition, next time I see you in the street, i'll buy you a pint, but until then a lucky find will seek you out, respect!!

You should post this as a working twrp, since it's not my work, as twrp was what I actually needed to get stuff done, well appreciated, I'll away test it now ;)
 
Last edited:

Myetta

New member
Sep 28, 2021
3
0
This 'tutorial' is a quicky for those yet to figure this fone out.

Well it took a bit time for sure, but this is how it went...

No matter what recovery or magisk I tried, nothing worked, all ulefone images with twrp were 64mb in size, where-as mine was 32mb. Betting the 64mb is a/b partioned like the old ambit 250 modems, where half the non-vol was the first boot, the second half a clone of the first half.

No file for the mt6765 worked. In other words, no twrp. instant bootloop every time.

But then I found the ulefone note9 mt6762 recovery, flashed it, booted into recovery, and had root!

Until I rebooted at least. There was no access to the actual fone system however, for in recovery, system, or / has not been mounted, and if it was, it cold not be written to..

Then I had an idea. I tested the root.img from android kitchen by flashing just that direct to the recovery of the fone, and it not only stuck, I could switch off fone, reboot, and what I call an overlaid file system with root presented itself, and before I knew it I had a fake root that worked.

The problem with this fone is that it actually uses mt6762 for booting, booting into mt6765 style, vice versa does not work. The note9 is a 6762 chipset. 32mb in size.

The root.img from android kitchen, flashed to recovery gives the head start, having magisk installed, but sadley, twrp did not show in recovery using the note9 recovery that has a working twrp, and the android kitchen root.img shows no twrp, being magisk'd!

Unlocked bootloader required.

Boot into fastboot.

fastboot flash vbmeta vblankmeta.img
fastboot flash recovery root.img

boot fone, install magisk manager, superuser and busybox apk's, then root checker pro, test and see, by rebooting, it should keep root if you set su to boot via busybox, AND superuser.

Now if someone wants to make this for this actual fone, with the correct file versions for this fone, I'll post my latest stock recovery, along with the files I used. All files as far as I know came from here, I have done nothing to them.

The actual Files are: Armor x5 Android 10_Q root.zip is actually a 7z file renamed to zip to upload here, i use 7z, and dont install winzip, and the password for both is Re-Kr8, used in order to prevent google tampering.

The zip contains vblankmeta.img and root.img taken from android kitchen, hope they dont mind auld folks like me helping this way...

The origional is recovery from unrooted fone taken from stock firmware, android 10 Q for ulefone armor x5.

Have a nice day.
Привет, подскажите, пожалуйста, пароль для открытия папок
 

Pachacouti

Senior Member
Jul 8, 2020
232
44
52
The Capital above the Lower one...
For the record, and for the testers:

You must be stock.

Dont tamper with vbmeta.

Flash boot-debug.img to boot, NOT recovery.

Flash your twrp to do things.

Attempt putting su in xbin... (success)

Reboot with stock boot.img

adb root <- cannot use this in user build bootloaders, fact, unless rooted.

adb shell
$su
$su
$su --context u:r:system_app:s0 -c "pm uninstall --user 0 com.google.android.apps.wellbeing" < /dev/null
$success

All without #
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Thank you...

    I think uppin the super mite not go down too well with the ee unlimited broadband business class lol, isp, so if I disappear for a while lol...

    Ps, origional super.7z.001 was renamed to zip for my ease :)
    Downloaded recovery.img & super.zip files.
    Now I'm creating file test. Maybe 2h after this message.

    SYL

    Update: Try install recovery.img (TWRP) and if not good so install vbmeta modified.

    stock recovery - bootloader => fastboot (not fastbootd)
    cmd command:
    Code:
    fastboot --disable-verity --disable-verification flash vbmeta vbmetaAndroidSC_mod.img

    cmd command:
    Code:
    fastboot flash recovery recovery.img

    cmd command:
    Code:
    fastboot reboot-recovery

    Let me know about.
    1
    Am impressed... I see twrp in recovery at last.. you are a god send for all those armor x5 punters with the 'a' only partition, next time I see you in the street, i'll buy you a pint, but until then a lucky find will seek you out, respect!!

    You should post this as a working twrp, since it's not my work, as twrp was what I actually needed to get stuff done, well appreciated, I'll away test it now ;)
    Thanks. Not need more than respect. :cool:

    I just chose you for the attitude of sharing information and the fact that you needed help to progress. Courage is for the few.
    I prefer that you share the TWRP file and instructions yourself. So fastboot/fastbootD; encryption and decryption; installation of zips; backup and restore; internal and external storage; anything else is working??

    Yes: Enjoy! No: let me know.
    1
    Thanks. Not need more than respect. :cool:

    I just chose you for the attitude of sharing information and the fact that you needed help to progress. Courage is for the few.
    I prefer that you share the TWRP file and instructions yourself. So fastboot/fastbootD; encryption and decryption; installation of zips; backup and restore; internal and external storage; anything else is working??

    Yes: Enjoy! No: let me know.
    Hmm, I learn sumat new every day, thank god aquarius is here lol, anyway, so far, I'm still at some pernikity when it comes to writing system, dm-1 or dm-3 locked, but from what I see and have tested so far, all possibilities using fone before it boot's into gui, system and mnt points work, , my sdcard is very visible at last, and writable, using stock the crappy google file manager would not let me write to sdcard, so you've solved so many headache's in one swoop. I'll write a final tut to show my alternative route's lol, thanks again :)

    1
    Update...

    Can confirm only the note9 recovery allows me to load up gui, update magisk, flash magisk_patched, adb pull said image, (works for me) fastboot flash with vmeta, and it sticks.

    Magisk fails at flashing the image it creates... even online... I noticed in the non-canary version that it stored a copy of the magisk_patched (this is how I 'got in' to the fn, adb pulling this to create MyBoot1.img) - and it showed in the magisk logs, even if it fails, with the canary, this no longer shows... no reason given for failure

    My guess is read only fs.

    Ps, arm64-v8a

    Edit:

    Then it dawned on me, guess what? Is your os a user, eng, or dev build? check what we can and cant do... user builds cannot adb root, using vbmeta actually prevents system changes, depending on build. ad remount for instance, wont work on a user version of...

    Lopstom. Could you look at the note 9 image, at the beginning of that file, in hex, it shows eng build, can this be hex edited into MyBoot1.img, as easy as copy n paste?

    I Believe the armor 8 twrp has eng build in it, this would enable systemrw, we cant do this in user builds! Away to test that now.... betting the prob is what version gives what commands...

    disable verity wiped or not, will not change user to eng(iineer) modes...?

    Double edit... guess what? I'm correct.

    Magisk can patch a boot but cant flash it if your not already root in USER builds.

    Isn't this why succesful roots come from those with ENG builds?

    And why all stock builds recently are only 'USER' build's?

    They can defeat root using this fact alone.
    1
    I'm hoping you can put twrp into this debug as it allows root and it's stock, all it needs is it's OWN up to date twrp, the note 9 is for pie, but I'm hoping porting twrp to this works yet retains my phone model's details etc... I think the twrp you've already made for me contains mt6733 or something, not my cpu.?

    Lol whatever it takes, put twrp in it so I can flash it to recovery? Yeah, I reckon my kernel is in it, so if you could make a working twrp with kernel for my fone rather than the kernel from the note9, am I on right path? I am past programming lol, but still find things ;)
    The TWRP 3.5 is from your stock recovery and made/compiled my self to MT6762_65.
    But I'll look about boot_debug the kernel to change. Not promises about Su...... Not good free time now. So wait.
    ______-----------------______
    You need stop comparing your device with Note9 device.
    I don't know how you made Note9's TWRP start on your device. Although you may or may not confirm some part of a similar device or clone, even so what I've noticed is that they are different in some parts and it's intriguing how it could have been done. Comparing Comparing II
    But now you have a working TWRP3.5. Some time ago busybox and other file features were removed in the TWRP build. The Su_ part is something that must be in the system or vendor, I don't remember now, for it to act relatively like what you want with it. This from Su_ in TWRP will have no effect. Also, is Su_ coming from magisk or Su_phh? You can place the Su_ file in the ROM and give it proper permissions for use. Try it.
    ______-----------------______

    Update2: Compare yourself the files from boot_debug and TWRP file. I unpacked boot_debug to you look anything you want. But What folder/files you want put in the TWRP?
    Make a decision for what you want.......