Indeed, there is an OEM unlock option inside developer options, but it makes no difference if it is enabled or disabled when you go to the bootloader and try either fastboot oem get_unlock_data or flashing unlock, it always returns "unknown command" , and even trying to get any oem command to work, it returns "unknown command". I'm sure that my device is installed correctly because any other command for fastboot works, like erasing data and cache partitions.
Moto E6 Twrp and Root
- Thread starter McTRASH692
- Start date
What to do now?
Would it help if I uploaded the Oficial ROM files? if someone could help us and take a look, it would be apreciated
it's an MTK phone (Again, Just to remind everyone, this bootloader doesn't allow in any way to unlock via fastboot commands, and enabling OEM unlock and ADB under developer options doesn't make a difference either)
Would it help if I uploaded the Oficial ROM files? if someone could help us and take a look, it would be apreciated
it's an MTK phone (Again, Just to remind everyone, this bootloader doesn't allow in any way to unlock via fastboot commands, and enabling OEM unlock and ADB under developer options doesn't make a difference either)
Yes! please upload the oficial ROM if you can. It will be always be very helpful have that files here in the forum.Would it help if I uploaded the Oficial ROM files? if someone could help us and take a look, it would be apreciated
I've been trying to make a full backup of this device, but I couldn't figure out how to do it properly. I've found a possible root solution here https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213/amp/ but I don't want to take any risks without backups.
This is for XT-2025-1: https://mega.nz/file/WYghESTL#sQiQzUmsVsTy3s9EPliH0SuoJhKUgF9J06BAcgh42JM
All the files can be downloaded officially and flashed with Lenovo MOTO Smart Assistant, there are some other models in there
Thanks!! hopefully we can at least root our device in the near future. I've been reading a lot the XDA forum of the Moto E4 (mtk variant) which I think it has a similar chipset.
How did you flash the boot.img? via sp flash tool or fastboot?Well, i managed to flash patched boot.img, but dm-verity is enabled and fstab is not on ramdisk because of project treble... now what
I had to flash it in a very specific way, because with sp flash tool you need to have the auth file and the specific Download agent to write to this phone and I looked everywhere how to flash this thing and I couldn't make it flash any file in any way.
But then I discovered that the official Lenovo tool uses SPFlashTool to flash mediatek devices, so I messed around with it for a while and found out how to flash files to this phone
What I did was download the Lenovo MOTO Smart Assistant for Windows, went into the flash tab, selected rescue; then selected MOTO device, i chose my specific device model (which is Moto E6 Plus XT2025-1 4G/64G) and clicked in the download button to download the latest firmware.
After it finishes downloading, you can go into the software's downloaded tab, and in the bottom there's an option to open the default download directory. In there are all the files for rescuing the smartphone (Full ROM, Lenovo's provided spflashtool (which i guess is the one Lenovo MOTO Smart Assistant uses to flash this phone), Some Download Agents for SPFlashtool, and among other things).
So, what i did at this point is I closed the tool, got into the Firmware's folder, grabbed the Boot.img and modified it with Magisk's android app (there is no root needed if you don't intend to flash the file to the actual device) and afterwards, replaced the old boot.img in the tool's download folder with the new one generated by Magisk (of course, after renaming it to boot.img) and opened the tool again and went into the same tab, selected again my device, clicked in the rescue button instead of the download one, and followed instructions on screen. It seemed like everything went fine, but when I started the phone, bootloader stated that the system integrity was changed (because I wrote to flash that new boot.img) that's when i realised that the dm-verity is not disabled in boot.img on Oreo -> + devices, but at least i knew that we could flash files to the device.
At that point I tried everything to disable DM verity and other verification: Using kitchens (In windows and in Linux) , using python scripts, Manually searching where to disable it, but i couldn't get any software to correctly disable it and /or to unpack any of the img files of the Firmware (system.img and some others unpacked but i didn't find anything there) so if anyone can help with this it would be very appreciated.
After doing some research, I found that this device has AVB 1.1.0 (Android Verified Boot) enabled. What this means is that the boot.img is linked to another partition called vbmeta.img, which verifies the signature of the boot.img at boot time. The kernel searchs this verifications keys in vbmeta.img, if the key is OK the phone will boot.
I think we need to find a way to disable AVB in boot.img, or patch vbmeta.img so the kernel thinks that it has the right signature hence the phone will boot.
I found some information in some forums of xiaomi, and oneplus devices and what they do is patch the vbmeta.img so they can boot a customized boot image (https://miui.blog/redmi-note-7/patched-vbmeta-redmi-note-7-lavender/).
For the root on this device, I've tried this exploit found in this thread https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 with no positive results. After running the exploit it shows me the message "This platform cannot be supported". Tomorrow I'll try downgrading to a older build to see if the exploit works there. (don't know if it can be achieved though I have the link of a older one https://drive.google.com/file/d/1v7yfNuxsMYHgJKlPVqsDAJtF9AycVxfS/view).
Would it work if we just flashed an empty vbmeta.img file? And thanks for the info
tried going back to an older build (december 2019) and the script to gain superuser access didn't work either. I don't know if this device has been patched since release, maybe if we rollback to the oldest build we can find, the script could work.
If gaining SU access through that script doesn't work in ANY way, our only chance to modify this device would be to mess with the boot verification (vbmeta). Sadly, I don't have the knowledge and the time to attempt this full time. I'll be updating this post with mi findings, so hopefully we can achieve something!
If gaining SU access through that script doesn't work in ANY way, our only chance to modify this device would be to mess with the boot verification (vbmeta). Sadly, I don't have the knowledge and the time to attempt this full time. I'll be updating this post with mi findings, so hopefully we can achieve something!
Last edited:
I've unlocked bootloader, flashed blank vbmeta.img and modified lk.img. Ported A TWRP recovery that's fully functional as well. Tried everything possible I know of and still can't achieve root access or install custom GSI. Magisk flashes successfully but root is undone when system reboots. Same with patched boot.img.
I wouldn't bother with unlocking your bootloader as it will void warranty and nothing can be done with it. Also on newest update it will state "Illegal Unlock"in upper left corner and "Safe Mode"in lower left. I downgraded back to original OS from device launch and don't know if it can be unlocked on newer updates. Once unlocked always unlocked, unless you relock it.
To unlock simply boot into fastboot and enter command:
fastboot flashing unlock_critical
Then hit volume up button to confirm. Volume down will cancel command and keep it locked.
Any questions about what I've done post here and I'll respond.
Update: Unpacked boot image and there's no ramdisk in it for this phone. Have to tick recovery mode in magisk manager and patch recovery image. Then flash via fastboot. Select reboot to recovery from bootloader mode. Device will boot into system rather than recovery but you will have to access.
I wouldn't bother with unlocking your bootloader as it will void warranty and nothing can be done with it. Also on newest update it will state "Illegal Unlock"in upper left corner and "Safe Mode"in lower left. I downgraded back to original OS from device launch and don't know if it can be unlocked on newer updates. Once unlocked always unlocked, unless you relock it.
To unlock simply boot into fastboot and enter command:
fastboot flashing unlock_critical
Then hit volume up button to confirm. Volume down will cancel command and keep it locked.
Any questions about what I've done post here and I'll respond.
Update: Unpacked boot image and there's no ramdisk in it for this phone. Have to tick recovery mode in magisk manager and patch recovery image. Then flash via fastboot. Select reboot to recovery from bootloader mode. Device will boot into system rather than recovery but you will have to access.
Last edited:
Could you make a guide about this? Does it work with the April security patch?
Do you have the img files? so we can try at our side.
Where have you found the Original Firmware?
Bootloader unlock is very important, with that we can achieve a lot of things.
Guide keeps getting flagged so I'm posting link for people to get guide from Google Documents
https://docs.google.com/document/d/1RbNPANoPnvq1kN992DOt3uTAS-FqWGnJ3pK-onPVG_E/edit?usp=drivesdk
If not accessible let me know and I'll copy text file to my Google Drive link containing my modified files. Should've started with that but new to posting. Sorry
https://docs.google.com/document/d/1RbNPANoPnvq1kN992DOt3uTAS-FqWGnJ3pK-onPVG_E/edit?usp=drivesdk
If not accessible let me know and I'll copy text file to my Google Drive link containing my modified files. Should've started with that but new to posting. Sorry
Last edited:
I tried this but the command "fastboot flashing unlock_critical" also doesn't work, I was only able to downgrade to the August patch ;-;
As I said in previous post when on newest update for phone it tells me illegal unlock and safe mode. Unlocking probably not possible as was probably an error that allowed unlocking of bootloader. Downgrade to original software as instructed in my guide and try again.
Also renamed recovery file for easier identification but forgot to change batch file. Uploaded new batch file to Google Drive. New file name is TWRP install batch. It will flash vbmeta, lk, and TWRP recovery files.
Download link:
https://drive.google.com/folderview?id=1WqvUtuuU-wTglTjtEkZdRZMP7heZjcK6
Also renamed recovery file for easier identification but forgot to change batch file. Uploaded new batch file to Google Drive. New file name is TWRP install batch. It will flash vbmeta, lk, and TWRP recovery files.
Download link:
https://drive.google.com/folderview?id=1WqvUtuuU-wTglTjtEkZdRZMP7heZjcK6
But I downgraded to the Patch of August 2019 and even then the command does not work ;_;
Is there another way to do that? Maybe a bootloader_unlock.bat?
I believe this is the exact firmware that I unlocked the bootloader with:
P160AN_PVT_9.0_LA_32B_LOG_76.01-01_FLASH_sign_SVC.zip
Downloaded from here:
https://mirrors.lolinet.com/firmware/moto/pokerp/official/RETLA/
After unlocking you can switch firmware but newer firmwares may boot to safe mode as I've stated.
P160AN_PVT_9.0_LA_32B_LOG_76.01-01_FLASH_sign_SVC.zip
Downloaded from here:
https://mirrors.lolinet.com/firmware/moto/pokerp/official/RETLA/
After unlocking you can switch firmware but newer firmwares may boot to safe mode as I've stated.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone