How to install root?

[doveman]

I've created a patched boot.img with Magisk and flashed that with Fastboot but after rebooting Magisk still shows that it's not rooted. So I tried flashing the boot.img in Recovery but again after rebooting it's not rooted.

What am I doing wrong?

 

[NOSS8]

I've created a patched boot.img with Magisk and flashed that with Fastboot but after rebooting Magisk still shows that it's not rooted. So I tried flashing the boot.img in Recovery but again after rebooting it's not rooted.

What am I doing wrong?

The boot.img to patch must be the same as the rom you are using.
Try renaming magisk.apk and magisk.zip and flashing it with Twrp. (You may need to flash vbmeta and use "fastboot flash --disable-verity --disable-verification vbmeta images\vbmeta.img").

 

[doveman]

The boot.img to patch must be the same as the rom you are using.
Try renaming magisk.apk and magisk.zip and flashing it with Twrp. (You may need to flash vbmeta and use "fastboot flash --disable-verity --disable-verification vbmeta images\vbmeta.img").

Yeah, I downloaded the correct ROM (miui_SURYAEEAGlobal_V12.5.4.0.RJGEUXM_0deb1eaf6f_11.0.zip) and extracted the boot.img from that.

Renaming magisk.apk to magisk.zip and flashing it just installs the app doesn't it, it doesn't root the phone as far as I'm aware.

I followed the instructions here, which say that you should only tick the "Patch vbmeta in boot image” option when patching the boot.img in Magisk if the device does NOT have a separate vbmeta partition. The Poco X3 does have a separate vbmeta partition,, so I didn't tick that option.

Installation

The Magic Mask for Android

topjohnwu.github.io

I've tried the "fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img" command with four different versions of fastboot that I've got, dating from 2016 to 2020, and they all reject the "--disable" switches as an "unknown option".

I tried it without those options, so I flashed the patched boot.img and then did "fastboot flash vbmeta vbmeta.img" but after rebooting Magisk still shows that root is not installed.

 

[NOSS8]

https://xiaomifirmwareupdater.com/miui/surya/stable/V12.5.4.0.RJGEUXM/

• Type: Fastboot​

• Size: 5.3 GB​

• Release Date: 2021-11-09​

• Package Name: surya_eea_global_images_V12.5.4.0.RJGEUXM_20211109.0000.00_11.0_eea_e9805977c3.tgz​

 

[doveman]

https://xiaomifirmwareupdater.com/miui/surya/stable/V12.5.4.0.RJGEUXM/

• Type: Fastboot​

• Size: 5.3 GB​

• Release Date: 2021-11-09​

• Package Name: surya_eea_global_images_V12.5.4.0.RJGEUXM_20211109.0000.00_11.0_eea_e9805977c3.tgz​

OK, I see that the one I downloaded was the 2.7GB recovery version rather than the 5.3GB fastboot version, but isn't the boot.img the same in both?

 

[NOSS8]

OK, I see that the one I downloaded was the 2.7GB recovery version rather than the 5.3GB fastboot version, but isn't the boot.img the same in both?

Yep, normally, in the current recovery there is only a "payload.bin" file but maybe on old phones the boot.img is present (I don't remember).
Maybe download it and check the imgs in the img folder.
Have you tried with an older or beta version of Magisk?

In case the cmd posted above is generic, the real cmd is:
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
fastboot flash vbmeta vbmeta.img

Check:
https://forum.xda-developers.com/t/...n-vendor-dynamic-partition-enable-rw.4238807/
https://forum.xda-developers.com/t/q-h-safety-way-to-unlock-bootloader-flash-recovery-root.4198719/

 

[doveman]

Yep, normally, in the current recovery there is only a "payload.bin" file but maybe on old phones the boot.img is present (I don't remember).
Maybe download it and check the imgs in the img folder.
Have you tried with an older or beta version of Magisk?

In case the cmd posted above is generic, the real cmd is:
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
fastboot flash vbmeta vbmeta.img

Yeah, in the "miui_SURYAEEAGlobal_V12.5.4.0.RJGEUXM_0deb1eaf6f_11.0.zip" recovery version, there's a boot.img in the root folder and vbmeta.img (and vbmeta_system.img) in the firmware-update folder.

In the fastboot version, the boot.img is in the images folder but it's the same size (134,217,728) as is vbmeta.img (4,096).

I realised I made a stupid mistake as I was trying to do it in Powershell and it was saying "unknown option -- disable-verity" so it was adding a phantom space between -- and disable-verity. I reflashed the patched boot.img and vbmeta.img using those switches from a command prompt and it flashed them OK, but after rebooting Magisk still says it's not rooted!

 

[NOSS8]

Yeah, in the "miui_SURYAEEAGlobal_V12.5.4.0.RJGEUXM_0deb1eaf6f_11.0.zip" recovery version, there's a boot.img in the root folder and vbmeta.img (and vbmeta_system.img) in the firmware-update folder.

In the fastboot version, the boot.img is in the images folder but it's the same size (134,217,728) as is vbmeta.img (4,096).

I realised I made a stupid mistake as I was trying to do it in Powershell and it was saying "unknown option -- disable-verity" so it was adding a phantom space between -- and disable-verity. I reflashed the patched boot.img and vbmeta.img using those switches from a command prompt and it flashed them OK, but after rebooting Magisk still says it's not rooted!

What happens if you try to root from the Magisk app?

 

[doveman]

What happens if you try to root from the Magisk app?

The only option in the Magisk app is to root by patching the boot.img, which you then have to flash in fastboot.

I know it used to have an option to root in situ but I think that was removed some time ago.

 

[NOSS8]

The only option in the Magisk app is to root by patching the boot.img, which you then have to flash in fastboot.

I know it used to have an option to root in situ but I think that was removed some time ago.

No functional TWRP for this device.?

 

[doveman]

No functional TWRP for this device.?

Yeah, I've got TWRP installed. I tried booting into that after flashing in fastboot, as I recall there was an issue once (probably on a different device) where the root wouldn't "stick" if you didn't do that, but it didn't help.

 

[NOSS8]

Yeah, I've got TWRP installed. I tried booting into that after flashing in fastboot, as I recall there was an issue once (probably on a different device) where the root wouldn't "stick" if you didn't do that, but it didn't help.

Strange case as strange as the number of threads has this subject for this device.

 

[doveman]

Strange case as strange as the number of threads has this subject for this device.

I tried flashing the patched boot.img in TWRP, followed by the vbmeta.img, then I went to Advanced and did the "Fix AVB (vbmeta)". Now the System can't boot at all and it just boots into TWRP every time, so I guess that "Fix AVB (vbmeta)" has screwed something up.

 

[NOSS8]

I tried flashing the patched boot.img in TWRP, followed by the vbmeta.img, then I went to Advanced and did the "Fix AVB (vbmeta)". Now the System can't boot at all and it just boots into TWRP every time, so I guess that "Fix AVB (vbmeta)" has screwed something up.

This phone is rootable, surely an oversight or an error somewhere.

 

[doveman]

This phone is rootable, surely an oversight or an error somewhere.

I've tried reflashing the patched and the original boot.img and vbmeta.img but it still says "System is destroyed" if I try to boot to System. I don't know what the "Fix AVB" did but it's not good!

 

[NOSS8]

I've tried reflashing the patched and the original boot.img and vbmeta.img but it still says "System is destroyed" if I try to boot to System. I don't know what the "Fix AVB" did but it's not good!

In case you can always flash a recovery or use Miflash to recover the phone.

To see:
https://www.gizmochina.com/2020/10/13/how-to-unlock-bootloader-and-root-poco-x3-nfc/

 

[doveman]

In case you can always flash a recovery or use Miflash to recover the phone.

To see:
https://www.gizmochina.com/2020/10/13/how-to-unlock-bootloader-and-root-poco-x3-nfc/

I've already got TWRP recovery flashed. I guess I'll have to flash the ROM again and start from scratch.

 

[doveman]

I tried flashing super.img but that didn't fix it. In the end, going into ADB Sideload mode in TWRP and flashing the 2.7GB recovery version of the ROM with
"adb sideload miui_SURYAEEAGlobal_V12.5.4.0.RJGEUXM_0deb1eaf6f_11.0.zip" fixed it without losing any data.

I still can't root it though. I've tried the "install Magisk (root)" option in TWRP and renaming magisk.apk to magisk.zip and installing that in TWRP, but it still shows "Installed N/A" in Magisk and Root Verifier says "Root permission not granted or Superuser App Missing" but then it says "Superuser App: 25.25:MAGISKSU", so it's the root permission that isn't granted.

 

[NOSS8]

Surely that is the problem.
https://techshift.net/what-is-disable-verity/

 

[doveman]

Surely that is the problem.
https://techshift.net/what-is-disable-verity/

I thought so but I've reflashed the patched boot.img and done

"fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img"

and

"fastboot --disable-verity --disable-verification flash vbmeta_system vbmeta_system.img"

in case it needed that too, but Magisk still shiows "Installed N/A"

I tried installed SR5-SuperSU-2.82 zip from TWRP to see if that would get it rooted,, but it couldn't even install that, it just gave some error.