Workaround found on leaked Android 8.1 Update, with Magisk Systemless Root Method.
ROOT YOUR PHONE MAY VOID YOUR WARRANTY, DO IT AT YOUR OWN RISK
You can download new recovery from this post: https://forum.xda-developers.com/nokia-6/how-to/nokia-6-ta-1000-homebrew-stock-android-t3752006
Changes in new TWRP Recovery 3.2.1-0:
1. Add English Interface.
2. Use Magisk ROOT instead of SuperSU ROOT.
3. You can backup EFS. However you can't backup modem or the procedure will break.
Thanks to @xinkid 's effort, we can finally root Nokia 6 on Android Oreo again.
Procedure for non TA-1000 users:
0. Backup your phone and remove your lock screen password before proceed! If your phone get stuck at "Powered by Android" splash after the procedure, you may need to format userdata.
1. Sideload the PLE-372B ota package in recovery, which you can download from here:
Refer this guide's part 2 to downgrade.
2. Flash the service bootloader and grant service permission
Reboot to bootloader, then flash the service bootloader with following commands. Service bootloader file (D1C-emmc_appsboot.mbn attached in this topic)
fastboot oem dm-verity [md5_of_your_device_serial_number] fastboot flash aboot D1C-emmc_appsboot.mbn fastboot reboot-bootloader fastboot oem dm-verity [md5_of_your_device_serial_number]
For example, if your serial number is PLEABCD123456789, and the md5 checksum of your serial number is 5f47b9a8dc1da1873c12945cf806691e, then type this command:
fastboot oem dm-verity 5f47b9a8dc1da1873c12945cf806691e fastboot flash aboot D1C-emmc_appsboot.mbn fastboot reboot-bootloader fastboot oem dm-verity 5f47b9a8dc1da1873c12945cf806691e
You can google a website to calculate md5 checksum of a string.
3. Reflash newer firmware basis to your phone except aboot
After you grant service permission, Extract the newer one OTA package on your PC, in this case, PLE-558B.
Everything you need are placed at firmware-update folder that you extracted.
Take PLE-558B for example, type these commands (commands need to be changed if newer firmware released):
fastboot flash sbl1 D1C-0-558B-sbl1.mbn fastboot flash keymaster D1C-0-558B-keymaster.mbn fastboot flash devcfg D1C-0-558B-devcfg.mbn fastboot flash cmnlib64 D1C-0-558B-cmnlib64.mbn fastboot flash rpm D1C-0-558B-rpm.mbn fastboot flash tz D1C-0-558B-tz.mbn fastboot flash cmnlib D1C-0-558B-cmnlib.mbn fastboot flash modem D1C-0-558B-NON-HLOS.bin fastboot flash dsp D1C-0-558B-adspso.bin fastboot flash default_nv D1C-0-558B-NV-default.mbn fastboot flash persist D1C-0-558B-00WW-persist.img fastboot flash hwcfg D1C-0-558B-hwcfg.img fastboot flash mdtp D1C-0-558B-00WW-mdtp.img fastboot flash systeminfo fver fastboot flash sec D1C-0-558B-sec.dat fastboot flash cda PLE-00WW-013-cda.img
You'll also need the boot img in the extracted ota package:
fastboot flash boot boot.img
Then flash the custom recovery:
fastboot flash recovery nokia-6-ta-1000-8_0-twrp3.2.1-7to-recovery-magisk-root-2018.3.15.img
Power off your phone (case sensitive). Disconnect your phone after execute this command:
fastboot oem HALT
4. Connect your phone to a charger. When charging animation appears, press and hold Volume Up and Power until you see "7to.com" logo. Tap the white cog to choose English language, tap Advanced - Magisk Root, and wait for the procedure complete.
This new guide is only based and tested on Nokia 6 TA-1000. Non TA-1000 (e.g. TA-1021) users need to find their own old OTA package to downgrade.
1. Downgrade the bootloader according to this guide: https://forum.xda-developers.com/nokia-6/how-to/guide-upgrade-downgrade-nougat-oreo-t3752393
If you've flashed my homebrew Android O firmware, skip this step.
2. Use old method below to flash the new recovery again. You must use this recovery, otherwise you can't mount and root.
If you've flashed my homebrew Android O firmware, type this command will allow you to flash recovery:
fastboot-android oem dm-verity (your_serial_number's_md5_checksum)
3. Use old method below to enter recovery. To load English interface, tap the white cog on the top-right corner, then tap "English" and OK button, just wait few seconds.
4. Tap "Advanced" - "Magisk ROOT" and swipe.
5. If you meet recovery loop after rooted, flash the package misc_initial.zip attached below to escape from recovery loop.
That's it. It's not recommended to receive any newer OTA update since it will overwrite bootloader to patched state.
If you're using TA-1000, you can also try to flash Android 8.1 Homebrew Firmware before rooting.
I'm sorry if you found the guide looks confusing.
Following method for Nougat is archived, only for reference.
Yesterday, I got my own Nokia 6 Retail Phone. Since I’ve already rooted Nokia 5, 6 and 8 Prototype, now it’s time to find out how to root retail Nokia 6 without involving risky Qualcomm EDL Mode.
It works on any variant of Nokia 6 in theory, but I only tested it on D1C/TA-1000.
If there’s a custom recovery for Nokia 2/3/5 released, the guide also works on them. But I’ve tested it on a Nokia 8 retail phone, it doesn’t work on it.
To Nokia 7 and 8 Users, You may want to read this topic: https://forum.xda-developers.com/showthread.php?t=3729396
First, you need to download OFW of Nokia 6, install OST LA and patch it.
You can download them from here: https://forum.xda-developers.com/no...ia-8-official-firmware-links-updated-t3678487
(Although the link is for Nokia 8, firmware for Nokia 6 is still available)
If you own an unlocked prototype device, just skip to step 6.
1. Open OST LA from INSTALLATION DIRECTORY DIRECTLY instead of Start Menu.
2. Load your OFW you downloaded with extension name nb0.
3. Power off your phone, then connect it to your PC. This will boot your phone to “Download mode” directly, in fact it’s fastboot mode.
4. Click “Edit Phone Info” on OST LA. This will load a service purposed bootloader. When your phone reboots and re-enters the Download mode, the service purposed bootloader is now loaded.
5. You can close OST LA when it prompts “Boot FTM mode fail”, or just kill it in task manager if it’s not responding.
6. Open a command prompt or PowerShell in OST LA Installation Directory, then execute this command to flash a custom recovery:
.\fastboot-android flash recovery E:\recovery.img
I assume that you put the custom recovery in drive E and named as recovery.img.
You can also use your own fastboot if you want, but I’ll prefer the one provided along with OST LA.
I used the recovery from here: https://forum.xda-developers.com/no...veryteamwim-recovery-project-nokia-6-t3650499
7. Type this command but do not execute right now:
8. Now this step is a little tricky. Press and hold [Volume Up] and [Power] on your phone, then execute the command above at the same time. DO NOT RELEASE both keys on your phone until your phone entered the custom recovery.
9. Now your phone has entered a custom recovery. In this example, we’re using TWRP from Chinese 7to forum, only Chinese is available. I believe most of members on XDA can’t read Chinese, so I’ll attach screenshots. Simply tap “Advanced” – “SuperSU ROOT” will root your phone. If you prefer your own root zip update package, tap “Install Zip” then flash your own zip package in your storage, or tap “Advanced” – “ADB Sideload” then use ADB to sideload a zip package.
You can install the Materialized Theme for TWRP to get English interface from https://forum.xda-developers.com/android/themes/theme-twrp-materialised-dark-light-play-t2915584 by @z31s1g
10. After your phone rooted, you can reboot your phone. DO NOT INSTALL ANY OTA UPDATES OR YOUR PHONE WILL GET STUCK AT STOCK RECOVERY, but I’ll recommend you to disable automatic update in settings.
Currently, DO NOT FLASH Magisk, or your phone will brick as Qualcomm 900E.
You can only use Magisk Root method in latest Android O Update, which I'll cover later.
That’s wraps up the whole guide. Please do feedback if there’s something wrong.
Here' the video of how to root a Nokia 6: https://youtu.be/24b-49qTheg
@blackpanther0582 for Nokia 3/5/6/8 Official Firmware.
@xinkid from Chinese 7to forum for his TWRP.
@hawwin88 for providing info about adding English Interface to recovery.
UPDATE: Uploaded the SuperSU ZIP (verify-xinkid.zip) used in this recovery.