[GUIDE] How to unlock your bootloader, install TWRP and gain root access

TheSt33v

Senior Member
Jun 12, 2014
1,741
1,362
0
The Stupid Country
There doesn't seem to be a comprehensive guide on this, so I thought I would provide one.

READ THIS FIRST

DO NOT TAKE ANY OTA UPDATES!!!

Please consider the following:

  • Ask yourself these two questions: "Why do I want to unlock my bootloader? Why do I need root access?" If the answer to either one of those is "I don't know," don't do it. Both of these actions weaken the security of your phone, and there's no reason to do that if you're not sure why.
  • This guide is for the Droid Turbo, model XT1254. It is not for the Droid Turbo 2, and it is not for any phone that is not named Droid Turbo.
  • Standard XDA rules apply. I'm not responsible for anything you do, and neither is anyone else other than you.
  • I'm assuming that you are running a Windows PC. If you have a Mac, I can't help you. If you're running Linux, you shouldn't need help.
  • This method is not free. It costs $25 (USD). If that's not okay with you, don't do this.
  • Once your bootloader is unlocked, you CANNOT safely re-lock and unlock it again. See this thread for what happens when you try to do that: http://forum.xda-developers.com/droid-turbo/help/relocked-bootloader-bricked-t3306081#post65095391

Still here? Cool.

Section 0: Installing Firmware Version MCG24.251-5

1. Go to Settings -> About phone -> Build number. If it says SU4TL-44, SU4TL-49 or MCG24.251-5, skip to section 1 of this guide. If it says MCG24.251-5-5, you need to take an extra step to unlock your bootloader. I'll explain later. For now, just skip to section 1 of this guide. If it says anything else, keep reading.

Flashing MCG24.251-5 using this method will erase all of your data. Back up any important files/information before proceeding.

2. Download and install Minimal ADB and Fastboot from here: http://forum.xda-developers.com/showthread.php?t=2317790.
3. Download and install the Motorola Device Manager from here: https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481
4. Download the MCG24.251-5 firmware package from here: https://www.androidfilehost.com/?fid=889764386195901169
5. Extract the contents of the MCG24.251-5 firmware package to the installation directory of Minimal ADB and Fastboot (C:\Program Files (x86)\Minimal ADB and Fastboot on any 64-bit installation of Windows).
6. Power off your phone.
7. Hold down the volume down button and power on your phone. Release the volume down button when you see that the phone has booted into bootloader mode. You'll see a dead green android.
8. Plug the phone into your computer.
9. Open the Minimal ADB and Fastboot shortcut on your desktop. This will open a command prompt.
10. Type "fastboot devices" and press enter. If it displays your device's serial number, you're ready to go. If it displays nothing, your computer is not recognizing your device properly.
11. Navigate to the installation directory of Minimal ADB and Fastboot and double click on FlashAll.bat. This will flash MCG24.251-5 to your device and erase all of your data.
12. Use the power button to select Start in the bootloader menu to boot normally.
13. Set up your phone at least to the point where you can install apps if you want to.

For now, just try to ask someone nicely to help you out with this. I'll try to get this done before the end of the day.

Section 1: Unlocking the Bootloader

1. Download Sunshine from here: http://theroot.ninja/download.html
2. Move the apk file to a convenient location on your phone. If you downloaded it with your phone, it's in your downloads folder already, so leave it there.
3. Use any file browser on your phone to navigate to the folder that contains the Sunshine apk file. Tap on it to install it.
4. If a message comes up and says that you need to enable installation of apps from unknown sources, follow the instructions on that message to enable it.
5. Enable Wi-Fi on your phone if it is disabled. Even if you aren't connected to a Wi-Fi network, it still needs to be on.
6. !!!DO THIS STEP ONLY IF YOU'RE ON MCG24.251-5-5!!! Follow the instructions here to obtain temporary root: https://forum.xda-developers.com/g4-play/development/root-autoinitroot-motorola-bootloader-t3639316/. DO NOT perform the uninstall step.
7. Open your app drawer and start Sunshine.
8. Follow the instructions.
9. !!!FOR MCG24.251-5-5 ONLY!!! Sunshine will reboot your phone automatically, and it will go into a bootloop. This is normal. Don't panic. Hold down the volume down button until the phone goes into bootloader mode. Plug your phone into the computer, start Minimal ADB and Fastboot (see Section 0 for link if you didn't have to install it before this point), and enter the command fastboot oem config fsg-id "". This will disable the temporary root exploit. Reboot your phone normally, and everything should be happy again.
10. If, when your phone reboots, you see a "Warning: The bootloader is unlocked" message, you have successfully unlocked your bootloader. If you do not see this message, open Sunshine again and follow the directions again. If you're on MCG24.251-5-5, you'll have to gain and uninstall temproot again at the appropriate times.

Section 2: Installing TWRP

Team Win Recovery Project is arguably the most important tool to have on a bootloader-unlocked phone. This is how you install it:

1. Download and install Minimal ADB and Fastboot from here: http://forum.xda-developers.com/showthread.php?t=2317790. If you already did this in section 0, you don't have to do it again.
2. Download the latest TWRP .img file from here: https://www.androidfilehost.com/?w=files&flid=39562
NOTE: The TWRP file that you download should have a .img extension. Make sure you can see this. If you don't see .img at the end of the filename, Google how to make file extensions visible on your version of Windows and do it. If you do not do this, you may run into trouble later.
3. Download and install the Motorola Device Manager from here: https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481. If you already did this in section 0, you don't have to do it again.
3. Rename the file that you downloaded in step 2 to TWRP.img
4. Copy TWRP.img to the directory that you installed Minimal ADB and Fastboot to. The default location on an installation of 64-bit Windows is C:\Program Files (x86)\Minimal ADB and Fastboot.
5. Turn off your phone.
6. Hold the volume down button and press the power button to boot into bootloader mode. You should see a green android lying on his back with his chest open, and some information about your phone. Poor little guy...
7. Plug your phone into your PC.
8. Double click on the Minimal ADB and Fastboot shortcut that's on your desktop. It will open a command prompt.
9. Type "fastboot devices" without quotes and press enter. If it gives you your phone's serial number, you're good to go. If it gives you nothing, your device is not detected. This can happen for several reasons, and I won't discuss them here. However, if you followed these directions and all of your hardware is functioning properly, you should be good to go.
10. Type "fastboot flash recovery TWRP.img" without quotes and press enter. It should tell you that the flash was successful. You might see some "not found" errors. These are normal and can be ignored.
11. Highlight "Recovery mode" on your phone using the volume up and down buttons.
12. Press the power button to boot into TWRP.
13. TWRP will boot, and it will ask you if you want to allow write access to the system partition. IT IS VERY IMPORTANT THAT YOU ALLOW THIS. Check the box that says to never ask this question again.
14. Select Reboot, followed by System to boot the phone normally.

Section 3: Gaining Root Access

If you intend to install a custom rom, these steps are not necessary. Custom roms almost always come with root access built in. Refer to the thread of your custom rom of choice for installation instructions.

If you do not want a custom rom, and you simply want root access on the stock Droid Turbo rom, continue reading.

1. If you are on the stock marshmallow rom, build MCG24.251-5 or higher, download the latest version of both Magisk and Magisk Manager to your phone: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445.

NOTE: You need to be on marshmallow to use Magisk to root your phone. The Magisk thread says it supports lollipop and higher, but it only supports lollipop for some stock Samsung roms. This does not apply to you. If you want to root your phone on lollipop, you'll need to use SuperSU. I won't go into that here because I don't think there is a lot of demand for it, but if you need help with that, reach out to someone here. It's not difficult.

2. Install Magisk Manager the same way you installed Sunshine.
3. Turn off your phone.
4. Hold the volume down button and press the power button to boot into bootloader mode. You should see a green android lying on his back with his chest open, and some information about your phone. Andy, what have they done to you?
5. Use the volume up and down buttons to highlight "Recovery mode."
6. Press the power button to select Recovery mode.
7. Select Install from the TWRP main menu.
8. Select the most recent version of Magisk (the .zip file, NOT the Magisk Manager .apk file) that you downloaded.
9. Swipe the bar at the bottom of the screen to flash this zip file.
10. When it finishes, select Wipe Cache/Dalvik and swipe the bar at the bottom of the screen.
11. Select Reboot System

Section 4: Passing Safetynet using Stock, Unrooted Marshmallow
If you are running stock marshmallow with an unlocked bootloader, you will fail safetynet verification (and be unable to use Android Pay). Installing Magisk is the only recommended method, as of this writing, to bypass this limitation. If you completed Section 3, you shouldn't have any trouble. Understand, however, that there is a constant game of cat and mouse going on between Google and Magisk's developer, so sometimes Google will update safetynet to beat Magisk. If that happens, wait for Magisk Manager to tell you that a new version of Magisk is available, and it will install the new version for you. That's your best bet for passing safetynet again.

If you really want to pass safetynet, but you really don't want to be rooted, you can disable root (Superuser access) in the Magisk Manager settings.

Section 5: Miscellaneous

Here are some links to stuff you can flash now that your bootloader is unlocked:

Official LineageOS 12.1 (Android 5.1.1): http://forum.xda-developers.com/dro.../moto-maxx-xt1225-droid-turbo-xt1254-t3260253

Official LineageOS 13.0 (Android 6.0.1): http://forum.xda-developers.com/dro.../moto-maxx-xt1225-droid-turbo-xt1254-t3353298

AOSPExtended (Android 7.X): https://forum.xda-developers.com/moto-maxx/general/rom-aospextended-rom-v3-1-t3555361

Unofficial LineageOS 14.1 (Android 7.X): http://forum.xda-developers.com/moto-maxx/development/rom-t3494646

crDroid (Android 7.X): http://forum.xda-developers.com/moto-maxx/development/rom-crdroid-android-t3491257

Android Open Kang Project (Android 7.X): http://forum.xda-developers.com/droid-turbo/development/rom-aokp-7-x-quark-t3504629

Resurrection Remix (a great LineageOS-based rom, Android 5.1.1): http://forum.xda-developers.com/moto-maxx/development/rom-resurrection-remix-5-5-5-t3197643

Resurrection Remix (Android 6.0.1): http://forum.xda-developers.com/moto-maxx/development/rom-resurrection-remix-t3316232

Resurrection Remix (Android 7.X): https://forum.xda-developers.com/moto-maxx/development/rom-resurrection-remix-t3511109

Computerfreek274's optimized stock rom (Android 6.0.1): http://forum.xda-developers.com/droid-turbo/development/computerfreekunlocked1-0-t3255945

MoKee Open Source Project (Android 6.0.1): http://forum.xda-developers.com/moto-maxx/development/rom-mokee-opensource-project-t3188936

Bliss Rom (Android 6.0.1): http://forum.xda-developers.com/droid-turbo/development/rom-bliss-rom-6-4-team-bliss-t3422937

Android Open Kang Project (Android 6.0.1): http://forum.xda-developers.com/droid-turbo/development/rom-android-kang-project-t3422456

Android Open Kang Project (Android 7.X): https://forum.xda-developers.com/droid-turbo/development/rom-aokp-7-x-quark-t3504629

Change the splash screen (the bootloader unlocked warning message) that you see when you first start your phone: http://forum.xda-developers.com/dro...custom-boot-logos-accepting-requests-t3262873

Xposed framework and installer (make sure to use the sdk22-arm version if you're running a lollipop rom, sdk23-arm if you're running marshmallow. Not available for nougat yet.): http://forum.xda-developers.com/showthread.php?t=3034811

Alternative Material Design Xposed Installer that provides additional features: http://forum.xda-developers.com/xposed/material-design-xposed-installer-t3137758

Pon-3 Audio Mod (modified and improved Viper4Android. It makes your phone sound better.): http://forum.xda-developers.com/showthread.php?t=2530976

Other modded Viper4Android versions that are better than PON-3: http://forum.xda-developers.com/android/software/viperaudio-viperatmos-3-8-sq-driver-t3289075

Theme your TWRP with different colors: http://forum.xda-developers.com/android/themes/theme-twrp-3-0-0-0-dark-stock-colors-t3310235

More TWRP themes: http://forum.xda-developers.com/showpost.php?p=66276401&postcount=2889

Android N Emojis: http://android.wonderhowto.com/how-to/get-android-nougats-all-new-emojis-right-now-0170328/

Section 6: Troubleshooting

Issue: When you try to boot TWRP, you see a screen that says "no command." TWRP does not boot.

Solution: The screen you are seeing is the stock Droid Turbo recovery menu (the menu that you're trying to replace with TWRP). If you see this after flashing TWRP, one of two things happened:
-You did not boot into the recovery menu immediately after flashing TWRP, and it was therefore replaced by the stock recovery menu.
-When you flashed TWRP, the process did not complete successfully.
The solution to both of these problems is to repeat section 2 and follow the instructions more carefully.

Issue: When TWRP asked you if you wanted to allow write access to the system partition, you selected no. Now you cannot flash anything.

Solution: At the main TWRP menu, select Mount. Uncheck the box that says "Mount system partition as read-only."

Issue: Fastboot says "cannot load TWRP.img" when you try to flash it.

Solution: This error indicates that Fastboot cannot find TWRP.img. The most common source of this problem is that you did not make your file extensions visible, and so when you renamed the TWRP file to TWRP.img, you actually renamed it to TWRP.img.img (including the hidden .img file extension that you didn't realize was there). Google how to enable file extensions on your version of Windows, follow those instructions, and if this is the issue you will see it.
 
Last edited:

s4shield

Senior Member
Aug 23, 2015
223
42
0
Thanks just got this phone yesterday. I came from a Verizon s4 with a unlockable bootloader so now running cm on a phone is really awesome for me. Although I was concerned about the $25. I love paying people for there work but it seemed different and I was expecting the app to be a scam or something. However everything went okay. I wish there was a way to get viper4android working. Does anyone know about that? I thought installing cm would have fixed the issue. Anyways thanks a lot. I wonder if I can change my username. Lol.
 

22e

Member
Jan 14, 2016
9
1
0
I keep getting a "no command" screen after step 6 in section 3. Everything else worked perfect. Any ideas?
 
Last edited:

22e

Member
Jan 14, 2016
9
1
0
So you can't boot into twrp?

Sent from my XT1254 using Tapatalk
Nope, no matter what I do, it stays on that screen. I have to reboot and then it returns to normal. I've followed all of the steps twice now and got the same results each time. I do have the phone still plugged into the computer charging.
 

iceblitz4

Member
Feb 23, 2015
41
5
0
Thanks just got this phone yesterday. I came from a Verizon s4 with a unlockable bootloader so now running cm on a phone is really awesome for me. Although I was concerned about the $25. I love paying people for there work but it seemed different and I was expecting the app to be a scam or something. However everything went okay. I wish there was a way to get viper4android working. Does anyone know about that? I thought installing cm would have fixed the issue. Anyways thanks a lot. I wonder if I can change my username. Lol.
https://www.androidfilehost.com/?w=files&flid=44797 try this just flash it through TWRP its basically viper4android i've used it before
 
Last edited:

CatMan8

Member
Nov 7, 2012
18
1
0
5.1

HI, I am on SU3TL-39, android 5.1, system 23.11.39.quark_verizon.verizon.en.US vzw.
I have been holding off on an OTA that my phone keeps prompting me to do, should I now take that OTA?
 

TheSt33v

Senior Member
Jun 12, 2014
1,741
1,362
0
The Stupid Country
I keep getting a "no command" screen after step 6 in section 3. Everything else worked perfect. Any ideas?
The screen that you're seeing is the stock Droid Turbo recovery menu, which means that TWRP is not getting flashed. What result does it give you after section 2, step 10?
 
Last edited:

TheSt33v

Senior Member
Jun 12, 2014
1,741
1,362
0
The Stupid Country
Thanks just got this phone yesterday. I came from a Verizon s4 with a unlockable bootloader so now running cm on a phone is really awesome for me. Although I was concerned about the $25. I love paying people for there work but it seemed different and I was expecting the app to be a scam or something. However everything went okay. I wish there was a way to get viper4android working. Does anyone know about that? I thought installing cm would have fixed the issue. Anyways thanks a lot. I wonder if I can change my username. Lol.
Yeah, I did the exact same thing. The MDK bootloader is golden. I broke my phone once and almost cried. Luckily, I was able to get another MDK on Swappa. The seller wasn't even charging extra for it! He/she must not have known what they had.

As for Viper4Android, I've added a link to section 4 that you might want to look at.
 
Last edited:

s4shield

Senior Member
Aug 23, 2015
223
42
0
https://www.androidfilehost.com/?w=files&flid=44797 try this just flash it through TWRP its basically viper4android i've used it before
Thanks! If I can only remove all the brony stuff from the app. Lol. I guess I can change the icon. I have to pretend at least that I don't have a mangina when I'm with my friends. No seriously this post made my day. I thought I was stuck without viper on my phone. :D
 

TheSt33v

Senior Member
Jun 12, 2014
1,741
1,362
0
The Stupid Country
Thanks! If I can only remove all the brony stuff from the app. Lol. I guess I can change the icon. I have to pretend at least that I don't have a mangina when I'm with my friends. No seriously this post made my day. I thought I was stuck without viper on my phone. :D
Such is life. Sometimes if you want the wubz, you gotta take the brony.
 

jco23

Senior Member
Nov 17, 2011
2,480
638
0
successful for me, thanks!
to comment on @22e issue, I had the same problem. i was able to correct it by copying the TWRP.img file to the same directory as the minimal adb fastboot files were installed in.

also, a shortcut after flashing TWRP is to type "fastboot reboot-bootloader". this will return back to bootloader rather than having to reboot, power off, and then press the buttons to get to bootloader.

hope this helps.
 

Krugger

Member
Apr 1, 2010
6
0
0
Awesome post. It definitely will come in handy. One question, at what point should I create a backup image via twrp? Is it before section 3 step 7?
 

TechByTaz

Member
Sep 9, 2015
14
1
0
49
Canton
Www.youtube.com
Thanks just got this phone yesterday. I came from a Verizon s4 with a unlockable bootloader so now running cm on a phone is really awesome for me. Although I was concerned about the $25. I love paying people for there work but it seemed different and I was expecting the app to be a scam or something. However everything went okay. I wish there was a way to get viper4android working. Does anyone know about that? I thought installing cm would have fixed the issue. Anyways thanks a lot. I wonder if I can change my username. Lol.
Download the file www.viperforandroid.com install goto menu set as expert ui under ui setting open viper4android check on click box click appropriate sound changer so it sounds right to u I suggest doing on headphones than use thoose settings as base settings for phone bt ect.. The the real good sound comes in under conolover files you must download impulse response files or. Irs files dfx_pro_surround_2.irs, Dolby,, dfx ect. After u download you unzip and using a file manager find unzipped file and goto sd card u will see viper4android folder inside that folder you will see 2 other folders one being kernel place irs files in kernel folder. Now when you click impulse response you will have the audio producing files. Like Dolby digital cinema, stereo, HD. Ect there are hundreds I'll post my walk though install video
 

gzaqgila

Member
Mar 19, 2014
31
2
0
LOR E SARKEM
can you help me sir
my friend have verizon moto droid ultra xt1254 and he already give it to me
and i got this phone with google account privacy and he forgot last email in this device, so i cant finished setup wizard and go to home screen
this device locked bootloader so i cant do something to
what should i can do?
 

22e

Member
Jan 14, 2016
9
1
0
successful for me, thanks!
to comment on @22e issue, I had the same problem. i was able to correct it by copying the TWRP.img file to the same directory as the minimal adb fastboot files were installed in.

also, a shortcut after flashing TWRP is to type "fastboot reboot-bootloader". this will return back to bootloader rather than having to reboot, power off, and then press the buttons to get to bootloader.

hope this helps.
Thanks for the help.

After I got stuck, I downloaded and installed KingRoot. It successfully rooted my phone. I downloaded two different root checkers and they confirmed. Everything works correctly within Rom Toolbox Pro now, I can remove apps (stupid NFL mobile, Amazon, etc). My software status says "Modified". I did not need to format or anything like that. Is that normal? My only issues are with XBlast Tools and SuperSU, when I change a setting in XBlast, it does NOT get updated. Even after a reboot. In SuperSU cannot update binaries for some reason.

I cannot post outside links for screen shots yet. :(