[GUIDE][Nougat & Oreo] How to flash TWRP and Magisk with locked bootloader

Search This thread

SkaboXD

Senior Member
Jan 18, 2017
1,132
445
Ganja
Xiaomi Poco X3 NFC
Before following guide check this:

If you never unlocked bootloader or you flashed Android 7.1.1 nb0 with locked bootloader, then you need to go back to Android 7.0, after that unlock then lock bootloader. If you want to update, use OTA, don't flash nb0 because it have stock LK inside.
Here is the explanation why:
In theory and put simply as possible it should not work on a never unlocked before device if the LK does it's job properly. :confused:
The LK does all the checking down the secure boot chain prior to allowing the recovery or boot.img to boot.
If a device has been officially Unlocked then the LK should write (normally hidden) 1 bite identifiers to partitions like secro, misc, oem, etc etc (Depends on the OEM where and how) so when you flash a new ROM the new LK should still look for these bite's and if it see's them then it will allow the none stock .img's like twrp to boot normally.
So to sum up
1. Nokia made a huge screw up and the Nokia 3 is a totally insecure device like most of cheap MediaTek Chinese phone's out there.
2. The LK knows the bootloader was officially Unlocked before and therefore ignores the secure boot chain.
Downloads:
SP Flash Tool:
https://spflashtool.com/download/
VCOM Drivers:
https://spflashtool.com/download/MediaTek_USB_VCOM_drivers.zip
Scatter file (extracted from nb0, use this scatter to avoid renaming issue):
https://mega.nz/#!qJh1TSLL!5afi-7NYqKT3H62tqBISYSAdBDgN6eIM20WRSbtq3qE
Compatible DA (Download Agent):
https://mega.nz/#!xd8B3AJQ!PW82IpLzMzyNQk55BdwMnRMPlKQA0Yzj_8k_xN5r9XM
Stock boot.img and Stock recovery.img:
https://forum.xda-developers.com/nokia-3/development/link-stock-boot-img-stock-recovery-img-t3785576
TWRP 3.1.0-0 by mediafire007:
https://onedrive.live.com/?authkey=...126&parId=768DA1AA966F93C9!3122&action=locate
TWRP 3.2.1-0 by SkaboXD:
https://mega.nz/#!qIhFkKia!AkUMvQJ0PGVnSePabTvOgO-oUAMZahlCNaZfy2gE4vE
Magisk ZIP:
https://github.com/topjohnwu/Magisk/releases/download/v16.0/Magisk-v16.0.zip
Magisk Manager APK:
https://github.com/topjohnwu/MagiskManager/releases/download/v5.7.0/MagiskManager-v5.7.0.apk
unSU script:
https://forum.xda-developers.com/attachment.php?attachmentid=4410561&d=1517853382

First Step: Installing and setting SP Flash Tools
Install VCOM Drivers (video tutorial): https://youtube.com/watch?v=w3whZ2QMGvo
Then extract SP Flash Tool to Desktop. Open extracted folder and open flash_tool.exe. Create new folder on Desktop and call it ''magisk twrp sp flash tool'' or something like that and move scatter to that folder. Then go back to SP Flash Tool and load scatter file. Close SP Flash Tool. Now copy/move DA_SWSEC_CRYPTO20.bin (Compatible DA that you downloaded) and replace it to sp flash tool folder. Then open sp flash tool and load DA that you replaced.

Second Step: Flashing TWRP and Magisk
Extract twrp to ''magisk twrp sp flash tool'' folder. Rename it to NE1-0-215H-00WW-recovery so SP Flash Tool can recognize it. Turn off your phone. Now open SP Flash Tool, tick recovery, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. Now you have TWRP. Rename NE1-0-215H-00WW-recovery to twrp-recovery.img so you can remember file name.

If you don't have root, just flash Magisk ZIP with TWRP.
If you have SuperSU and you want to switch to Magisk, flash unSU script with TWRP which uninstalls SuperSU, then you need to flash stock boot.img. Switch from install zip to install image and click on stock boot.img. Tick boot partition and flash. When it's done with flashing, you can flash Magisk.

OPTIONAL
If you are for some reason scared to flash TWRP or don't want to mess with recovery partition, this is step for you.

Second Step: Flashing Magisk without touching recovery partition
If you want to switch from SuperSU to Magisk, unroot SuperSU in SuperSU options. Transfer stock boot.img to your device from PC. Go to your phone and install Magisk Manager APK and open it. Click install then click "Patch boot image file" then select stock boot.img then it starts downloading Magisk ZIP and patching boot.img. You will get patched_boot.img in /sdcard/MagiskManager. Now transfer stock boot.img and patched boot.img back to PC and move it to "magisk twrp sp flash tool" folder. Rename stock boot.img to NE1-0-215H-00WW-boot. Turn off your phone. Now open SP Flash Tool, tick boot, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. Close SP Flash Tool. Rename NE1-0-215H-00WW-boot to stock-boot.img and rename patched-boot.img to NE1-0-215H-00WW-boot. Turn off your phone. Now open SP Flash Tool, tick boot, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. TA-DA you have Magisk root. Rename NE1-0-215H-00WW-boot to patched-boot.img so you can remember file name.

What about OTA?:
If you want to have OTA updates, remember to flash stock recovery back if you flashed TWRP. With installed update you will not lose:
- Data (apps, internal storage data)
- Xposed framework (if flashed directly to system)
- Xposed modules

you will lose:
- Magisk
- Magisk modules
- Xposed framework (if you flashed it systemlessly)

To gain root, just flash Magisk again.

Comment if links need to be updated.

Credits:
@sp flash Tool developers for providing SP Flash Tool
@blackpanther0582 for nb0 and scatter file
@Max brackenz for Download Agent
@mediafire007 for TWRP
@topjohnwu for Magisk
@osm0sis for unSU script
@bigrammy for useful tips
 
Last edited:

Elvaa

Senior Member
Feb 16, 2018
105
14
Việt Nam
I very happy to hearing a New Guide to root Nokia 3 ^^

---------- Post added at 05:47 PM ---------- Previous post was at 05:44 PM ----------

I will try it when I get up
 
  • Like
Reactions: SkaboXD

Elvaa

Senior Member
Feb 16, 2018
105
14
Việt Nam
Try to flash official firmware 7.0 via SPFlashTool with uncheck in preloader and use Download Only, then my Phone just virable

---------- Post added at 08:41 AM ---------- Previous post was at 08:03 AM ----------

ERROR: S_BROM_CMD_STARTCMD_FAIL (0x7D5)
[BROM] Can not pass bootrom start command! Possibly target power up too early
[HINT]:
 

SkaboXD

Senior Member
Jan 18, 2017
1,132
445
Ganja
Xiaomi Poco X3 NFC
Try to flash official firmware 7.0 via SPFlashTool with uncheck in preloader and use Download Only, then my Phone just virable

---------- Post added at 08:41 AM ---------- Previous post was at 08:03 AM ----------

ERROR: S_BROM_CMD_STARTCMD_FAIL (0x7D5)
[BROM] Can not pass bootrom start command! Possibly target power up too early
[HINT]:

You inserted USB late, try again
 

Elvaa

Senior Member
Feb 16, 2018
105
14
Việt Nam
You inserted USB late, try again

Not good. I was know that before you comment. But I use format tab, with default choose, I click start. It successfully. Now I can't see the Phone virable

---------- Post added at 10:11 AM ---------- Previous post was at 09:29 AM ----------

Except the Bootloader Format selected

---------- Post added at 10:15 AM ---------- Previous post was at 10:11 AM ----------

My Windows found Ports COM (when Plugin phone with PC). I try Remove cable, click Download, press UP volume + Power button, Insert cable. But It show AUTH_HANDLE_IS_NOT_READY. Then I click Download again, it show me the ERROR similar after I using format tab
 

redweaver

Senior Member
Nov 25, 2017
427
89
Lagos
Not good. I was know that before you comment. But I use format tab, with default choose, I click start. It successfully. Now I can't see the Phone virable

---------- Post added at 10:11 AM ---------- Previous post was at 09:29 AM ----------

Except the Bootloader Format selected

---------- Post added at 10:15 AM ---------- Previous post was at 10:11 AM ----------

My Windows found Ports COM (when Plugin phone with PC). I try Remove cable, click Download, press UP volume + Power button, Insert cable. But It show AUTH_HANDLE_IS_NOT_READY. Then I click Download again, it show me the ERROR similar after I using format tab

Not good,never use format unless you know what you're doing . You can try and see if you can flash OST , if that doesn't work, there's a post by SkaboXD on recovering his phone using spflashtool. Hopefully one of those methods will work
 

Elvaa

Senior Member
Feb 16, 2018
105
14
Việt Nam
I may found my problem. I can't authentic by hand for my phone. Because If I press UP + Power button, It said ERROR s_auth_handle_is_not_ready (5000). If then I click download again, it said ERROR ERROR: S_BROM_CMD_STARTCMD_FAIL (0x7D5) if I still press two button too up to 7sec. It said similar ERROR when I click download and remove cable

---------- Post added at 10:40 AM ---------- Previous post was at 10:38 AM ----------

Not good,never use format unless you know what you're doing . You can try and see if you can flash OST , if that doesn't work, there's a post by SkaboXD on recovering his phone using spflashtool. Hopefully one of those methods will work

Except Bootloader
 

Ihatenokia3

New member
May 7, 2018
1
2
I waited a week for this guide when I saw you talking to each other in the Nokia 3 TWRP thread..
And when I lost hope that you're going to make the thread I had to break down what you were saying amd make my own way..
It took me 6 hours to get all the tools and files and figure it out.. :)
Thank you anyways <3
 

SkaboXD

Senior Member
Jan 18, 2017
1,132
445
Ganja
Xiaomi Poco X3 NFC
Is there any slowdowns with the magisk ? Can it run viper4android as module afterwards?
Thank you skabo as always!

Thank you

Thanks bro,

No slowdowns, it even works better than SuperSU. For example i couldn't install Nethunter because SuperSU misses some lib for sh execution. With Magisk it works perfectly.

Also you have magisk modules unlike SuperSU (i didn't tested it though).
 

bigrammy

Senior Member
Apr 8, 2011
2,945
2,570
huddersfield
Nice Tread.

It will be interesting to see if this works for someone who as never unlocked the bootloader previously which is why I held off since there were no volunteers to test it.
 

bubba1601

Senior Member
Aug 23, 2016
1,886
1,191
50
Nokia G10/G20
well it should work for them too, but where to find someone who never unlocked bootloader.


I've never unlocked a Nokia (HMD) device bootloader and to be honest, after reading all the issues and problems some have been having trying to unlock their Nokia 3's, I don't think I want to try.

I am getting very frustrated about the fact my TA 1020 (UK) is still stuck on Android 7.1.1 and the march security update.

I've tried all the hacks suggested like taking the Sim out and resetting, connecting to Indian vpns and pressing check for updates every hour over a 14 hour period.
My Nokia 3 is an unlocked (Sim free) version as well.
 

SkaboXD

Senior Member
Jan 18, 2017
1,132
445
Ganja
Xiaomi Poco X3 NFC
I've never unlocked a Nokia (HMD) device bootloader and to be honest, after reading all the issues and problems some have been having trying to unlock their Nokia 3's, I don't think I want to try.

I am getting very frustrated about the fact my TA 1020 (UK) is still stuck on Android 7.1.1 and the march security update.

I've tried all the hacks suggested like taking the Sim out and resetting, connecting to Indian vpns and pressing check for updates every hour over a 14 hour period.
My Nokia 3 is an unlocked (Sim free) version as well.

did you cleaned Google services data after that?
 
  • Like
Reactions: bubba1601

Top Liked Posts

  • There are no posts matching your filters.
  • 10
    Before following guide check this:

    If you never unlocked bootloader or you flashed Android 7.1.1 nb0 with locked bootloader, then you need to go back to Android 7.0, after that unlock then lock bootloader. If you want to update, use OTA, don't flash nb0 because it have stock LK inside.
    Here is the explanation why:
    In theory and put simply as possible it should not work on a never unlocked before device if the LK does it's job properly. :confused:
    The LK does all the checking down the secure boot chain prior to allowing the recovery or boot.img to boot.
    If a device has been officially Unlocked then the LK should write (normally hidden) 1 bite identifiers to partitions like secro, misc, oem, etc etc (Depends on the OEM where and how) so when you flash a new ROM the new LK should still look for these bite's and if it see's them then it will allow the none stock .img's like twrp to boot normally.
    So to sum up
    1. Nokia made a huge screw up and the Nokia 3 is a totally insecure device like most of cheap MediaTek Chinese phone's out there.
    2. The LK knows the bootloader was officially Unlocked before and therefore ignores the secure boot chain.
    Downloads:
    SP Flash Tool:
    https://spflashtool.com/download/
    VCOM Drivers:
    https://spflashtool.com/download/MediaTek_USB_VCOM_drivers.zip
    Scatter file (extracted from nb0, use this scatter to avoid renaming issue):
    https://mega.nz/#!qJh1TSLL!5afi-7NYqKT3H62tqBISYSAdBDgN6eIM20WRSbtq3qE
    Compatible DA (Download Agent):
    https://mega.nz/#!xd8B3AJQ!PW82IpLzMzyNQk55BdwMnRMPlKQA0Yzj_8k_xN5r9XM
    Stock boot.img and Stock recovery.img:
    https://forum.xda-developers.com/nokia-3/development/link-stock-boot-img-stock-recovery-img-t3785576
    TWRP 3.1.0-0 by mediafire007:
    https://onedrive.live.com/?authkey=...126&parId=768DA1AA966F93C9!3122&action=locate
    TWRP 3.2.1-0 by SkaboXD:
    https://mega.nz/#!qIhFkKia!AkUMvQJ0PGVnSePabTvOgO-oUAMZahlCNaZfy2gE4vE
    Magisk ZIP:
    https://github.com/topjohnwu/Magisk/releases/download/v16.0/Magisk-v16.0.zip
    Magisk Manager APK:
    https://github.com/topjohnwu/MagiskManager/releases/download/v5.7.0/MagiskManager-v5.7.0.apk
    unSU script:
    https://forum.xda-developers.com/attachment.php?attachmentid=4410561&d=1517853382

    First Step: Installing and setting SP Flash Tools
    Install VCOM Drivers (video tutorial): https://youtube.com/watch?v=w3whZ2QMGvo
    Then extract SP Flash Tool to Desktop. Open extracted folder and open flash_tool.exe. Create new folder on Desktop and call it ''magisk twrp sp flash tool'' or something like that and move scatter to that folder. Then go back to SP Flash Tool and load scatter file. Close SP Flash Tool. Now copy/move DA_SWSEC_CRYPTO20.bin (Compatible DA that you downloaded) and replace it to sp flash tool folder. Then open sp flash tool and load DA that you replaced.

    Second Step: Flashing TWRP and Magisk
    Extract twrp to ''magisk twrp sp flash tool'' folder. Rename it to NE1-0-215H-00WW-recovery so SP Flash Tool can recognize it. Turn off your phone. Now open SP Flash Tool, tick recovery, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. Now you have TWRP. Rename NE1-0-215H-00WW-recovery to twrp-recovery.img so you can remember file name.

    If you don't have root, just flash Magisk ZIP with TWRP.
    If you have SuperSU and you want to switch to Magisk, flash unSU script with TWRP which uninstalls SuperSU, then you need to flash stock boot.img. Switch from install zip to install image and click on stock boot.img. Tick boot partition and flash. When it's done with flashing, you can flash Magisk.

    OPTIONAL
    If you are for some reason scared to flash TWRP or don't want to mess with recovery partition, this is step for you.

    Second Step: Flashing Magisk without touching recovery partition
    If you want to switch from SuperSU to Magisk, unroot SuperSU in SuperSU options. Transfer stock boot.img to your device from PC. Go to your phone and install Magisk Manager APK and open it. Click install then click "Patch boot image file" then select stock boot.img then it starts downloading Magisk ZIP and patching boot.img. You will get patched_boot.img in /sdcard/MagiskManager. Now transfer stock boot.img and patched boot.img back to PC and move it to "magisk twrp sp flash tool" folder. Rename stock boot.img to NE1-0-215H-00WW-boot. Turn off your phone. Now open SP Flash Tool, tick boot, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. Close SP Flash Tool. Rename NE1-0-215H-00WW-boot to stock-boot.img and rename patched-boot.img to NE1-0-215H-00WW-boot. Turn off your phone. Now open SP Flash Tool, tick boot, select Download only mode and click Download. Hold power + vol up button at the same time and quickly connect phone to USB. Then it will go to META mode and downloading will begin first with red bar and second with yellow bar. When download completes, green tick/circle mark will appear. TA-DA you have Magisk root. Rename NE1-0-215H-00WW-boot to patched-boot.img so you can remember file name.

    What about OTA?:
    If you want to have OTA updates, remember to flash stock recovery back if you flashed TWRP. With installed update you will not lose:
    - Data (apps, internal storage data)
    - Xposed framework (if flashed directly to system)
    - Xposed modules

    you will lose:
    - Magisk
    - Magisk modules
    - Xposed framework (if you flashed it systemlessly)

    To gain root, just flash Magisk again.

    Comment if links need to be updated.

    Credits:
    @sp flash Tool developers for providing SP Flash Tool
    @blackpanther0582 for nb0 and scatter file
    @Max brackenz for Download Agent
    @mediafire007 for TWRP
    @topjohnwu for Magisk
    @osm0sis for unSU script
    @bigrammy for useful tips
    2
    well it should work for them too, but where to find someone who never unlocked bootloader.
    In theory and put simply as possible it should not work on a never unlocked before device if the LK does it's job properly. :confused:
    The LK does all the checking down the secure boot chain prior to allowing the recovery or boot.img to boot.
    If a device has been officially Unlocked then the LK should write (normally hidden) 1 bite identifiers to partitions like secro, misc, oem, etc etc (Depends on the OEM where and how) so when you flash a new ROM the new LK should still look for these bite's and if it see's them then it will allow the none stock .img's like twrp to boot normally.
    So to sum up
    1. Nokia made a huge screw up and the Nokia 3 is a totally insecure device like most of cheap MediaTek Chinese phone's out there.
    2. The LK knows the bootloader was officially Unlocked before and therefore ignores the secure boot chain.

    I've never unlocked a Nokia (HMD) device bootloader and to be honest, after reading all the issues and problems some have been having trying to unlock their Nokia 3's, I don't think I want to try.

    I am getting very frustrated about the fact my TA 1020 (UK) is still stuck on Android 7.1.1 and the march security update.

    I've tried all the hacks suggested like taking the Sim out and resetting, connecting to Indian vpns and pressing check for updates every hour over a 14 hour period.
    My Nokia 3 is an unlocked (Sim free) version as well.

    Your not the Only one bubba1601 both mine and a friends TA 1020 still have not received the official Oreo update yet. :(
    My Friends phone is 100% pure stock and never been rooted or bootloader unlocked both of us have sim free devices too so not sure why UK users are not getting the update yet. :silly:
    2
    Works in variant TA-1028 on official Oreo. Great guide tnx
    2
    I waited a week for this guide when I saw you talking to each other in the Nokia 3 TWRP thread..
    And when I lost hope that you're going to make the thread I had to break down what you were saying amd make my own way..
    It took me 6 hours to get all the tools and files and figure it out.. :)
    Thank you anyways <3
    2
    did you cleaned Google services data after that?

    Flashing ost will work on TA-1020 right? Now I wonder if that's the reason why the vpn thing has been working for most people. Perhaps since it's the nb0 files are Asian (India and UAE)
    @bubba1601 maybe flashing OST is the only way to go.