• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Moto E6 Twrp and Root

Search This thread

DemolidorAK

New member
Jun 20, 2020
1
0
Sorry, I know this is a thread for moto e6 plus, but do you guys know what is the command to unlock Moto e6 play XT2029-3 bootloader, I tried fastboot flashing unlock_critical but it returns that its a unknown command, my phone got bricked after this last OTA update and its giving me red state warning and its stuck in bootloop, its a second hand phone so no warranty, if you guys could help me I would really appreciate it...
 

Facundo160

New member
Feb 4, 2019
3
0
Hi guys, I wanted to comment that the ramdisk of the 32-bit boot is in a different format than the 64-bit, so when you flash magisk through TWRP having the 32-boot, it cannot partition the ramdisk, and therefore, not you can have normal root access. I wanted to comment it in case some dev does xd, if they don't understand me I'm sorry, I'm using google transalate xD
 
Root is possible. The way I achieved it is first to follow the official bootloader unlock method given by Motorola. Then install Magisk Manager V 7.5.1 (latest as of today). After that have magisk patch the boot image and recovery image, and flash them both through fastboot. It will say the boot partition is signed but when you Flash it to the recovery partition it will tell you the image is either not signed or corrupt. Don't worry about this, it does not affect loading back into system or back into the bootloader or recovery. Remember, after this you will have to boot through recovery every time you reboot or you will not have root until you do. Unfortunately I am still trying to work on TWRP, and it is going rather slow as this is my first attempt at compiling a custom recovery and I am no developer, and am learning as I go... Hope I helped!!!
Can Magisk Manager actually create a patched boot image without root? Didn't know that. Btw, thanks for doing all this work!
 

eluallen

Member
Mar 20, 2017
19
11
Moto E6
Sorry, I know this is a thread for moto e6 plus, but do you guys know what is the command to unlock Moto e6 play XT2029-3 bootloader, I tried fastboot flashing unlock_critical but it returns that its a unknown command, my phone got bricked after this last OTA update and its giving me red state warning and its stuck in bootloop, its a second hand phone so no warranty, if you guys could help me I would really appreciate it...

Have you tried LMSA Repair Assistant to rescue you device.
 

yourfreunde

New member
Aug 25, 2020
1
1
Is there any way to root / unlock bootloader / install TWRP in the European 64GB Dual-SIM version, XT2025-2?
I have the stock rom with August 2019 patches and tried using multiple ways described here to unlock it, but didn't get anywhere.

First I tried fastboot flashing unlock_critical, didn't work. Tried installing latin american version via the Recovery Tool, didn't work. Tried to install TWRP with same tool, nope either. Then I tried the mtk-su tool, got error 4 even thought it should in theory be compatible. Kinda losing hope. Anyone got any tips or ideas what I could try?
 
  • Like
Reactions: DAFIEL

Fastoh

Member
Sep 1, 2020
33
9
Is there any way to root / unlock bootloader / install TWRP in the European 64GB Dual-SIM version, XT2025-2?
I have the stock rom with August 2019 patches and tried using multiple ways described here to unlock it, but didn't get anywhere.

First I tried fastboot flashing unlock_critical, didn't work. Tried installing latin american version via the Recovery Tool, didn't work. Tried to install TWRP with same tool, nope either. Then I tried the mtk-su tool, got error 4 even thought it should in theory be compatible. Kinda losing hope. Anyone got any tips or ideas what I could try?

You have to do it with the firmware that they passed previously, if not, it will not leave you.

It's this: mirrors.lolinet.com/firmware/moto/pokerp/official/RETLA/

Version 76.01
 

karstenDr

New member
Sep 3, 2020
1
0
You have to do it with the firmware that they passed previously, if not, it will not leave you.

It's this: mirrors.lolinet.com/firmware/moto/pokerp/official/RETLA/

Version 76.01

May be this works

://old.reddit.com/r/MotoE/comments/ilvni7/moto_e6_plus_root/

/add http before :

hey! saw your replie on my comment about Moto E6 plus root, sorry for being late, i'm not an active reddit user.

If you still interested in it there is a written guide on how to do it, I'll try to transtale it using google translator and fix the translation errors
the reason why I'm sendind those messages is because the thread got archived
here is the link:

://pt.scribd.com/document/473156290/Moto-E6-Plus-Root-Guide-ENG


/add http before :

since my english still sucks a bit I used Google Translator and and double-checked for possible errors, I've read everything and it is understandable.
 
Last edited:
Jul 29, 2020
12
0
In my Country we only have the 64/4g model and plus its been rebranded as the Lenovo K10 [Not Note or Plus] It has the Same fastboot Screen and the same recovery and the same Motorola update services the only that has change is that it has a MTK-8000 series chip and the Splash screen is different is this a different model? And can i flash Root or TWRP on it?
 

LichtEstarossx

Senior Member
Nov 23, 2017
64
19
In my Country we only have the 64/4g model and plus its been rebranded as the Lenovo K10 [Not Note or Plus] It has the Same fastboot Screen and the same recovery and the same Motorola update services the only that has change is that it has a MTK-8000 series chip and the Splash screen is different is this a different model? And can i flash Root or TWRP on it?


if it has another name, processor and splash, then it is another mobile:good::good:
 

camibalmiron

New member
Oct 20, 2020
1
0
Hi everyone!
I have been using AOSP 10 arm64 AB for months now, the phhusson one, it works amazing in my 4/64.
Today i tried to install AOSP 11, same arm, same developer. But it ended in bootloop.
I've tried everything, permissive, reinstall it after formatting data, anything worked.
Has anyone tried android 11 with this device? can anyone give me a stable GSI?
 

Fastoh

Member
Sep 1, 2020
33
9
Hi everyone!
I have been using AOSP 10 arm64 AB for months now, the phhusson one, it works amazing in my 4/64.
Today i tried to install AOSP 11, same arm, same developer. But it ended in bootloop.
I've tried everything, permissive, reinstall it after formatting data, anything worked.
Has anyone tried android 11 with this device? can anyone give me a stable GSI?

That AOSP 11 GSI still is beta, you will have to wait for phhusson to release a stable AOSP 11 GSI, or you may try with other GSIs how Lineage OS 18, Bliss 14, Pixel GSI, etc.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 6
    Root is possible. The way I achieved it is first to follow the official bootloader unlock method given by Motorola. Then install Magisk Manager V 7.5.1 (latest as of today). After that have magisk patch the boot image and recovery image, and flash them both through fastboot. It will say the boot partition is signed but when you Flash it to the recovery partition it will tell you the image is either not signed or corrupt. Don't worry about this, it does not affect loading back into system or back into the bootloader or recovery. Remember, after this you will have to boot through recovery every time you reboot or you will not have root until you do. Unfortunately I am still trying to work on TWRP, and it is going rather slow as this is my first attempt at compiling a custom recovery and I am no developer, and am learning as I go... Hope I helped!!!
    4
    I had to flash it in a very specific way, because with sp flash tool you need to have the auth file and the specific Download agent to write to this phone and I looked everywhere how to flash this thing and I couldn't make it flash any file in any way.

    But then I discovered that the official Lenovo tool uses SPFlashTool to flash mediatek devices, so I messed around with it for a while and found out how to flash files to this phone

    What I did was download the Lenovo MOTO Smart Assistant for Windows, went into the flash tab, selected rescue; then selected MOTO device, i chose my specific device model (which is Moto E6 Plus XT2025-1 4G/64G) and clicked in the download button to download the latest firmware.

    After it finishes downloading, you can go into the software's downloaded tab, and in the bottom there's an option to open the default download directory. In there are all the files for rescuing the smartphone (Full ROM, Lenovo's provided spflashtool (which i guess is the one Lenovo MOTO Smart Assistant uses to flash this phone), Some Download Agents for SPFlashtool, and among other things).

    So, what i did at this point is I closed the tool, got into the Firmware's folder, grabbed the Boot.img and modified it with Magisk's android app (there is no root needed if you don't intend to flash the file to the actual device) and afterwards, replaced the old boot.img in the tool's download folder with the new one generated by Magisk (of course, after renaming it to boot.img) and opened the tool again and went into the same tab, selected again my device, clicked in the rescue button instead of the download one, and followed instructions on screen. It seemed like everything went fine, but when I started the phone, bootloader stated that the system integrity was changed (because I wrote to flash that new boot.img) that's when i realised that the dm-verity is not disabled in boot.img on Oreo -> + devices, but at least i knew that we could flash files to the device.

    At that point I tried everything to disable DM verity and other verification: Using kitchens (In windows and in Linux) , using python scripts, Manually searching where to disable it, but i couldn't get any software to correctly disable it and /or to unpack any of the img files of the Firmware (system.img and some others unpacked but i didn't find anything there) so if anyone can help with this it would be very appreciated.

    After doing some research, I found that this device has AVB 1.1.0 (Android Verified Boot) enabled. What this means is that the boot.img is linked to another partition called vbmeta.img, which verifies the signature of the boot.img at boot time. The kernel searchs this verifications keys in vbmeta.img, if the key is OK the phone will boot.
    I think we need to find a way to disable AVB in boot.img, or patch vbmeta.img so the kernel thinks that it has the right signature hence the phone will boot.
    I found some information in some forums of xiaomi, and oneplus devices and what they do is patch the vbmeta.img so they can boot a customized boot image (https://miui.blog/redmi-note-7/patched-vbmeta-redmi-note-7-lavender/).

    For the root on this device, I've tried this exploit found in this thread https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 with no positive results. After running the exploit it shows me the message "This platform cannot be supported". Tomorrow I'll try downgrading to a older build to see if the exploit works there. (don't know if it can be achieved though I have the link of a older one https://drive.google.com/file/d/1v7yfNuxsMYHgJKlPVqsDAJtF9AycVxfS/view).
    4
    How did you flash the boot.img? via sp flash tool or fastboot?

    I had to flash it in a very specific way, because with sp flash tool you need to have the auth file and the specific Download agent to write to this phone and I looked everywhere how to flash this thing and I couldn't make it flash any file in any way.

    But then I discovered that the official Lenovo tool uses SPFlashTool to flash mediatek devices, so I messed around with it for a while and found out how to flash files to this phone

    What I did was download the Lenovo MOTO Smart Assistant for Windows, went into the flash tab, selected rescue; then selected MOTO device, i chose my specific device model (which is Moto E6 Plus XT2025-1 4G/64G) and clicked in the download button to download the latest firmware.

    After it finishes downloading, you can go into the software's downloaded tab, and in the bottom there's an option to open the default download directory. In there are all the files for rescuing the smartphone (Full ROM, Lenovo's provided spflashtool (which i guess is the one Lenovo MOTO Smart Assistant uses to flash this phone), Some Download Agents for SPFlashtool, and among other things).

    So, what i did at this point is I closed the tool, got into the Firmware's folder, grabbed the Boot.img and modified it with Magisk's android app (there is no root needed if you don't intend to flash the file to the actual device) and afterwards, replaced the old boot.img in the tool's download folder with the new one generated by Magisk (of course, after renaming it to boot.img) and opened the tool again and went into the same tab, selected again my device, clicked in the rescue button instead of the download one, and followed instructions on screen. It seemed like everything went fine, but when I started the phone, bootloader stated that the system integrity was changed (because I wrote to flash that new boot.img) that's when i realised that the dm-verity is not disabled in boot.img on Oreo -> + devices, but at least i knew that we could flash files to the device.

    At that point I tried everything to disable DM verity and other verification: Using kitchens (In windows and in Linux) , using python scripts, Manually searching where to disable it, but i couldn't get any software to correctly disable it and /or to unpack any of the img files of the Firmware (system.img and some others unpacked but i didn't find anything there) so if anyone can help with this it would be very appreciated.
    2
    It was added, it's hidden away in developer options,
    May require an unlock code from Motorola though,

    Indeed, there is an OEM unlock option inside developer options, but it makes no difference if it is enabled or disabled when you go to the bootloader and try either fastboot oem get_unlock_data or flashing unlock, it always returns "unknown command" , and even trying to get any oem command to work, it returns "unknown command". I'm sure that my device is installed correctly because any other command for fastboot works, like erasing data and cache partitions.
    2
    Yes! please upload the oficial ROM if you can. It will be always be very helpful have that files here in the forum.

    I've been trying to make a full backup of this device, but I couldn't figure out how to do it properly. I've found a possible root solution here https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213/amp/ but I don't want to take any risks without backups.

    This is for XT-2025-1: https://mega.nz/file/WYghESTL#sQiQzUmsVsTy3s9EPliH0SuoJhKUgF9J06BAcgh42JM

    All the files can be downloaded officially and flashed with Lenovo MOTO Smart Assistant, there are some other models in there