[GUIDE]HOW TO ROOT YOUR MATE 9 with Decrypt Data in TWRP without needing a patched

Status
Not open for further replies.
Search This thread

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
HOW TO ROOT YOUR MATE 9 with Decrypted Data in TWRP without needing a patched Boot.img

I created this thread because there are some users is still confuse on how to root their Mate 9 with decrypted data.
**Disclaimer-I won't be responsible if you BRICK your MATE 9.Proceed with own RISK,make sure you know what you are doing**

STEPS
**SuperRoot**
01-UNLOCK YOUR BOOTLOADER
02-FLASH TWRP 3.0.2-2 (thanks to @Tkkg1994) using ADB
03-Boot into TWRP (HOLD VOL up + POWER)
03(a)-Backup your Boot thru TWRP into your ext SD or OTG(optional)
04-Format Data in TWRP
05-Flash superRoot.zip (thanks to @ante0 for this)
06-Flash Public_data.zip if you are on build L29C636 u can use THIS
07-Flash Full_HW_data.zip(you will get error 7 but it still went thru)if you are on build L29C636 u can use THIS
***how to obtain files for step 6&7 Read THIS thanks to @gm007
08-Boot into system (setup ur phone)
09-Install PHH superuser from playstore.

**SuperSU** (do not set security such as pin/fingerprint etc b4 fully setup)
01-UNLOCK YOUR BOOTLOADER
02-FLASH TWRP 3.0.2-2 (thanks to @Tkkg1994) using ADB
03-Boot into TWRP (HOLD VOL up + POWER)
03(a)-Backup your Boot thru TWRP into your ext SD or OTG(optional)
04-Format Data in TWRP
05-Flash SuperSU|Mirror 2| Mirror 3Thanks to @ante0
06-Flash Public_data.zip if you are on build L29C636 u can use THIS
07-Flash Full_HW_data.zip(you will get error 7 but it still went thru)if you are on build L29C636 u can use THIS
***how to obtain files for step 6&7 Read THIS thanks to @gm007
08-Boot into system (setup ur phone)

HOPE THE ABOVE IS CLEAR.

GOOD LUCK

VIDEO GUIDE
 

Attachments

  • Screenshot_2017-03-09-16-50-34.png
    Screenshot_2017-03-09-16-50-34.png
    93.8 KB · Views: 17,231
  • Screenshot_2017-03-09-16-50-38.png
    Screenshot_2017-03-09-16-50-38.png
    95.5 KB · Views: 16,935
  • Screenshot_2017-03-11-11-46-24.jpg
    Screenshot_2017-03-11-11-46-24.jpg
    213.8 KB · Views: 15,748
  • Screenshot_2017-03-11-11-46-04.jpg
    Screenshot_2017-03-11-11-46-04.jpg
    117 KB · Views: 14,008
  • Screenshot_20170311-114528.png
    Screenshot_20170311-114528.png
    80.1 KB · Views: 13,808
  • Screenshot_20170311-114536.png
    Screenshot_20170311-114536.png
    114.6 KB · Views: 13,426
  • Screenshot_20170312-230515.png
    Screenshot_20170312-230515.png
    192.1 KB · Views: 13,851
Last edited:

audioralf

Senior Member
Mar 12, 2011
1,325
378
Than you for summarizing. This means that data stays encrypted. Can we make TWRP backup for the data partition? Does TWRP have access to the files on the internal sd?

My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
 
  • Like
Reactions: eddmecha

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
Than you for summarizing. This means that data stays encrypted. Can we make TWRP backup for the data partition? Does TWRP have access to the files on the internal sd?

My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
yes i can backup data and internal also can be read in twrp.
 

Attachments

  • Screenshot_2017-03-09-16-50-38.png
    Screenshot_2017-03-09-16-50-38.png
    95.5 KB · Views: 3,086
  • Screenshot_2017-03-09-16-52-27.png
    Screenshot_2017-03-09-16-52-27.png
    194.7 KB · Views: 3,083
  • Screenshot_2017-03-09-16-50-34.png
    Screenshot_2017-03-09-16-50-34.png
    93.8 KB · Views: 3,081

audioralf

Senior Member
Mar 12, 2011
1,325
378
Thank you. One word to security. The encrypting users the password I set on EMUI and have to enter on each boot. How does TWRP gets knowledge about it to be able to show the files as if they were not encrypted?


My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
 

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
Thank you. One word to security. The encrypting users the password I set on EMUI and have to enter on each boot. How does TWRP gets knowledge about it to be able to show the files as if they were not encrypted?


My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
sorry i wish i can answer u but i never tested it

can i use this method to root mate 9 pro?
i m sorry didn't test on other device besides m9 bcoz i dont have a m9p,but u can test for us if u dont mind:D
 

virtyx

Senior Member
Jan 3, 2011
2,505
650
@eddmecha Can we skip step 5 if we decide to root later?

also what benefits are there to flashing without decrypt boot img vs having a decrypt boot img? (any difference)

also, can we use chainfire's supersu apk? (not binary)
 
Last edited:

audioralf

Senior Member
Mar 12, 2011
1,325
378
sorry i wish i can answer u but i never tested it

Once we had a TWRP version on NEXUS 6p where we had to enter the password once. Then the version came where it was not necessary any more. I think twrp can read the key from somewhere. Or is there a dialog box to enter that key?

The advantage on non readable data is that you are able to store data partition in TWRP backup, to be able to restore apps and personal settings. The disadvantage is that your data from sd card is also readable from twrp without entering a password. For this security reason the bootloader is closed normally and deletes all data on opening.

If you flash new stock firmware bootloader closes. If you open for rooting again you loose all data. But then you can restore data from Nandroid if you had followed the instructions of post 1. I think files from internal sd must be saved before on external sd, too.

My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
 

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
@eddmecha Can we skip step 5 if we decide to root later?

also what benefits are there to flashing without decrypt boot img vs having a decrypt boot img? (any difference)

also, can we use chainfire's supersu apk? (not binary)
im sorry but superSU is not supported yet hope it will in near future.
 

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
Once we had a TWRP version on NEXUS 6p where we had to enter the password once. Then the version came where it was not necessary any more. I think twrp can read the key from somewhere. Or is there a dialog box to enter that key?

The advantage on non readable data is that you are able to store data partition in TWRP backup, to be able to restore apps and personal settings. The disadvantage is that your data from sd card is also readable from twrp without entering a password. For this security reason the bootloader is closed normally and deletes all data on opening.

If you flash new stock firmware bootloader closes. If you open for rooting again you loose all data. But then you can restore data from Nandroid if you had followed the instructions of post 1. I think files from internal sd must be saved before on external sd, too.

My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
ohh i get what u mean now,but since i root this phone i never enter any password nor got any dialog box pop up.and yes when back up u need to select where u wanna save b4 proceed to back up.
 

virtyx

Senior Member
Jan 3, 2011
2,505
650
is it possible to over-write a file in /system/fonts (to get ios emojis system wide) without rooting on this phone?
 

audioralf

Senior Member
Mar 12, 2011
1,325
378
I need the public_data.zip and full_hw_data.zip for us c567b167. Id appreciate it if someone could help me out. I tried the firmware site it won't let me dl ?
didn't 'firmware finder' app automatically installed these files?
What did you do before? Did you use firmware finder app, or did you manually install downloaded zip?


My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)
 

eddmecha

Senior Member
Jan 26, 2011
553
204
Penampang
didn't 'firmware finder' app automatically installed these files?
What did you do before? Did you use firmware finder app, or did you manually install downloaded zip?


My device: Mediapad X2 GEM 701->703 B212 KangVIP (AJ mod)

yes it did but once u format data in twrp u will need to reflash both zips to get the updater,keyboard,themes etc to work again.
 

audioralf

Senior Member
Mar 12, 2011
1,325
378
ah yes I understand now. It is installed, but will be removed when we do the root process.
To reply the question above where to find the public like it es described here:
it should be
http://update.hicloud.com:8180/TDS/...77/v76459/f2/full/hw/eu/update_full_hw_eu.zip

but the patched link doesn't work for the requested version MHA-L29C567B167
I think this is reason why @biggzo is asking.
I remember to read that the files are almost the same. So maybe downloadable files for other other branding could work.
copy link from word update until "/full/" and add /hw/eu/update_full_hw_eu.zip or update_data_full_public.zip
Seems this "tick" does not work on all links, but it works definitely for B156
http://update.hicloud.com:8180/TDS/...04/v75974/f2/full/hw/ew/update_full_hw_eu.zip
C432B156 update_data_full_public.zip
http://update.hicloud.com:8180/TDS/...04/v75974/f2/full/update_data_full_public.zip
 
  • Like
Reactions: eddmecha
Status
Not open for further replies.

Top Liked Posts

  • There are no posts matching your filters.
  • 33
    HOW TO ROOT YOUR MATE 9 with Decrypted Data in TWRP without needing a patched Boot.img

    I created this thread because there are some users is still confuse on how to root their Mate 9 with decrypted data.
    **Disclaimer-I won't be responsible if you BRICK your MATE 9.Proceed with own RISK,make sure you know what you are doing**

    STEPS
    **SuperRoot**
    01-UNLOCK YOUR BOOTLOADER
    02-FLASH TWRP 3.0.2-2 (thanks to @Tkkg1994) using ADB
    03-Boot into TWRP (HOLD VOL up + POWER)
    03(a)-Backup your Boot thru TWRP into your ext SD or OTG(optional)
    04-Format Data in TWRP
    05-Flash superRoot.zip (thanks to @ante0 for this)
    06-Flash Public_data.zip if you are on build L29C636 u can use THIS
    07-Flash Full_HW_data.zip(you will get error 7 but it still went thru)if you are on build L29C636 u can use THIS
    ***how to obtain files for step 6&7 Read THIS thanks to @gm007
    08-Boot into system (setup ur phone)
    09-Install PHH superuser from playstore.

    **SuperSU** (do not set security such as pin/fingerprint etc b4 fully setup)
    01-UNLOCK YOUR BOOTLOADER
    02-FLASH TWRP 3.0.2-2 (thanks to @Tkkg1994) using ADB
    03-Boot into TWRP (HOLD VOL up + POWER)
    03(a)-Backup your Boot thru TWRP into your ext SD or OTG(optional)
    04-Format Data in TWRP
    05-Flash SuperSU|Mirror 2| Mirror 3Thanks to @ante0
    06-Flash Public_data.zip if you are on build L29C636 u can use THIS
    07-Flash Full_HW_data.zip(you will get error 7 but it still went thru)if you are on build L29C636 u can use THIS
    ***how to obtain files for step 6&7 Read THIS thanks to @gm007
    08-Boot into system (setup ur phone)

    HOPE THE ABOVE IS CLEAR.

    GOOD LUCK

    VIDEO GUIDE
    7
    @eddmecha

    Use this instead for HW/Public, it's easier.
    https://forum.xda-developers.com/showpost.php?p=71302827&postcount=627

    And this to find firmware/hw/public as the search function is down atm
    http://hwmt.ru/oth/HWFF/info/view.php?find_model=

    Oh, gm007 included the above link already :)
    6
    Everything worked for me on my C567. I am now unlocked, rooted, and soon to be ROM'd. Thanks OP!

    **NOTE**
    You might want to add to the OP that the files need to be on an sdcard because MTP file transfer doesn't work in TWRP. Here are the steps I took, broken down a little more:

    1. Unlock bootloader (erases all data)
    2. Place root zip, hw zip, and data zip on an external sdcard in the phone.
    3. Flash TWRP (fastboot flash recovery twrp.img)
    4. Boot into TWRP using VOL UP+POWER
    5. In TWRP go to "Backup" and only select "Boot."
    6. In TWRP go to Wipe, then Advanced Wipe, then "Format Data," but DO NOT REBOOT OR EXIT TWRP. Go back to the main TWRP menu.
    7. Go to "Reboot," then select "Recovery."
    8. Once back in TWRP flash the root zip that you chose. I chose SuperSU.
    9. Flash your devices update_data_full_public.zip
    10. Flash your devices update_full_hw_usa.zip
    11. Reboot to system.
    4
    Can anyone do a video on how to root the Mate 9?

    VIDEO is up!! hope its clear!!
    p/s - sorry for the vid quality:p
    3
    what is public_data and full_hw_Data?
    whats in these two zips?

    Public data and full hw data...

    .
    .
    .
    :D
    They contain bloat apps (Huawei stock apps), lots of settings, themes.
    When you do a full install using Firmware Finder or Funky Huawei they're downloaded and flashed automatically, and installed to /data/hw_init/, when you Format Data that folder is removed. Some people can't use camera either if they don't flash it.

    Make sure you use the guide linked by gm007 so you get the correct versions of those 2 files.

    ---------- Post added at 06:33 PM ---------- Previous post was at 06:22 PM ----------

    ah yes I understand now. It is installed, but will be removed when we do the root process.
    To reply the question above where to find the public like it es described here:
    it should be
    http://update.hicloud.com:8180/TDS/...77/v76459/f2/full/hw/eu/update_full_hw_eu.zip

    but the patched link doesn't work for the requested version MHA-L29C567B167
    I think this is reason why @biggzo is asking.
    I remember to read that the files are almost the same. So maybe downloadable files for other other branding could work.
    copy link from word update until "/full/" and add /hw/eu/update_full_hw_eu.zip or update_data_full_public.zip
    Seems this "tick" does not work on all links, but it works definitely for B156
    http://update.hicloud.com:8180/TDS/...04/v75974/f2/full/hw/ew/update_full_hw_eu.zip
    C432B156 update_data_full_public.zip
    http://update.hicloud.com:8180/TDS/...04/v75974/f2/full/update_data_full_public.zip

    @biggzo
    It's in one of the OTA for b167.
    http://update.hicloud.com:8180/TDS/...59/f2/full/public/update_data_full_public.zip

    http://update.hicloud.com:8180/TDS/.../v76459/f2/full/hw/usa/update_full_hw_usa.zip

    The path is not /eu/, it's /usa/. And there are other paths too so check filelist.xml to get the path.

    ---------- Post added at 06:46 PM ---------- Previous post was at 06:33 PM ----------

    Im familiar with adb
    How would it be done?

    You will need to extract and modify your boot image ramdisk and ramdisk cpio's default.prop from ro.secure=1 to ro.secure=0. That will allow you to run adb shell as root without having su. However, if your boot image still has verity enabled it might not be a good idea to write stuff to system. (I'm not sure how Huawei has done it as I've yet to see a dm-verity screen at boot, only thing I've seen are files reverted to their original after reboot)
    But for this you still need to unlock bootloader. And a modified /system = OTA will fail to install.

    That's how you're supposed to do it, but apparently adbd does not have this enabled.
    ro.adb.secure=0 does nothing either.