Root and Recovery (CAN-L11)

Search This thread

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,449
2,213
-∇ϕ
It seem impossible to find any useful root tools for the Huawei Nova (EU edition).

This thread is in hope to collect some more info on this device, in order to give people better instruction on how to Root it.

Getting the boot-loader unlocked is easy as its unlock code is given by Huawei, and described
elsewhere. (1st 6 steps.) The problem appears to be to find an easy and persistent method for
root. It is very possible that I have missed something as I have not had much time to look
around very hard. So any input and links would be greatly appreciated.

If you do find the FULL firmware, please upload it and post a new link. It seem that most links I've found are
either fake, behind a long chain of ad-walls or on Chinese hard to navigate websites.

First of all the phone (I am interested in) has the following Firmware properties:


Code:
[ro.build.cust.id]:           [CAN-L11C432B100CUSTC432D004]
[ro.product.fingerprintName]: [HUAWEI-MILAN]
[ro.product.CustCVersion]:    [C432]
[ro.product.CustDVersion]:    [D004]
[ro.product.board]:           [CAN-L11]
[ro.product.hardwareversion]: [HL1CANL01M]
The update available so far is incomplete since it's an OTA to patch and resolve some
minor issues. So don't take it. Other OTAs can be found with this tool.

The processor (MSM8953) is exactly the same as for the following devices:

Code:
Asus Zenfone 3 (ZE520KL)
Asus Zenfone 3 (ZE552KL)
Asus Zenfone 3 Deluxe 5.5"
Huawei G9 Plus
Huawei Nova
Huawei Nova plus
Lenovo Vibe P2
Motorola Moto Z Play
Oppo R9s
Qiku 360 N4S
Samsung Galaxy C7
Samsung Galaxy On7 (2016)
Vivo X9
Xiaomi Redmi 4 Prime(32GB)
ZTE Axon Max 2
ZTE Axon 7 MAX
This means, that anything root that works on these, may also have a better success on this device.
But be careful, since these are just common names of devices and not exact model numbers!

For the bootloader unlock you need to provide this info:
Code:
Product Model:          [ro.product.model]:
Product Serial number*  [ro.boot.serialno]:
Product IMEI || MEID:   (*#06#):           
Product ID:             (*#*#1357946#*#*):
 
Last edited:
  • Like
Reactions: Vinnom

wangdaning

Senior Member
Sep 17, 2012
1,377
571
Wuxi
All it takes is for someone to compile twrp. Knowing the differences in the models is important. I am in China so looking at the 64g internal 4gb memory. It is listed as CAZ-AL10. The partitions seem different, as the twrp developed does not support other models. Build it with you partition breakdown and it will work.
 

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,449
2,213
-∇ϕ
All it takes is for someone to compile twrp. Knowing the differences in the models is important. I am in China so looking at the 64g internal 4gb memory. It is listed as CAZ-AL10. The partitions seem different, as the twrp developed does not support other models. Build it with you partition breakdown and it will work.

Yeah, I was thinking to do that since nobody else seem interested, but since I'm not rooted yet, I can't even get a proper partition layout as standard partition layout "by-name" is unreadable for non-root, at least not from simple shell. Is your device using the same processor (see my post above)? (I doubt it.) However, it was compiled with kernel debug fs, so perhaps something can be used there. I was also asking elsewhere if we can use the recent full AOS 7.0 (EMUI 5.0) update posted by @lgstoian and use it to build TWRP also for the original 6.0 (EMUI 4.1)?

By the way, where does Huawei post their sources? And who to contact to make them post it? Do they normally comply with open-source requirements?

The partition table seem to look as follows:
Code:
$ cat /proc/partitions

major minor  #blocks  name

 254        0     524288 zram0
 179        0   30535680 mmcblk0
 179        1        512 mmcblk0p1
 179        2        512 mmcblk0p2
 179        3       2048 mmcblk0p3
 179        4        256 mmcblk0p4
 179        5       8192 mmcblk0p5
 179        6        256 mmcblk0p6
 179        7        256 mmcblk0p7
 179        8        256 mmcblk0p8
 179        9        512 mmcblk0p9
 179       10        512 mmcblk0p10
 179       11       2048 mmcblk0p11
 179       12        256 mmcblk0p12
 179       13       8192 mmcblk0p13
 179       14        256 mmcblk0p14
 179       15        256 mmcblk0p15
 179       16        256 mmcblk0p16
 179       17      65536 mmcblk0p17
 179       18       4096 mmcblk0p18
 179       19       4096 mmcblk0p19
 179       20       4096 mmcblk0p20
 179       21     163840 mmcblk0p21
 179       22          1 mmcblk0p22
 179       23          8 mmcblk0p23
 179       24      16384 mmcblk0p24
 179       25         32 mmcblk0p25
 179       26         16 mmcblk0p26
 179       27       8192 mmcblk0p27
 179       28      11264 mmcblk0p28
 179       29       4096 mmcblk0p29
 179       30      81920 mmcblk0p30
 179       31      81920 mmcblk0p31
 259        0      81920 mmcblk0p32
 259        1       1024 mmcblk0p33
 259        2     262144 mmcblk0p34
 259        3       7168 mmcblk0p35
 259        4      65536 mmcblk0p36
 259        5      65536 mmcblk0p37
 259        6        512 mmcblk0p38
 259        7        512 mmcblk0p39
 259        8         32 mmcblk0p40
 259        9        512 mmcblk0p41
 259       10       1024 mmcblk0p42
 259       11      32768 mmcblk0p43
 259       12        512 mmcblk0p44
 259       13       4096 mmcblk0p45
 259       14        128 mmcblk0p46
 259       15        128 mmcblk0p47
 259       16        256 mmcblk0p48
 259       17        256 mmcblk0p49
 259       18          8 mmcblk0p50
 259       19      16384 mmcblk0p51
 259       20     524288 mmcblk0p52
 259       21    3788800 mmcblk0p53
 259       22   25178095 mmcblk0p54
 179       32       4096 mmcblk0rpmb
 253        0    3758932 dm-0
 253        1     520124 dm-1
 253        2   25178079 dm-2
But we need the correct mapping to the files as given in the full update.
 

merlin21

Senior Member
Jul 19, 2010
1,176
701
Looking forward for the root of the Huawei nova urgently. I think it needs more time for this newly device to get one great dev to compile twrp and get a root method to work.

I just switched from HTC 10 to nova and I'm very impressed. Huawei emui did so much better than HTC.
Everything is working out of the box and looks great. The only thing I really miss is root for using adblock and a network speed indicator.
 

Vinnom

Senior Member
Jun 21, 2012
1,705
1,143
Campinas
Xiaomi Poco F1
It seem impossible to find any useful root tools for the Huawei Nova (EU edition).

This thread is in hope to collect some more info on this device, in order to give people better instruction on how to Root it.

Getting the boot-loader unlocked is easy as its unlock code is given by Huawei, and described
elsewhere. (1st 6 steps.) The problem appears to be to find an easy and persistent method for
root. It is very possible that I have missed something as I have not had much time to look
around very hard. So any input and links would be greatly appreciated.

If you do find the FULL firmware, please upload it and post a new link. It seem that most links I've found are
either fake, behind a long chain of ad-walls or on Chinese hard to navigate websites.

First of all the phone (I am interested in) has the following Firmware properties:


Code:
[ro.build.cust.id]:           [CAN-L11C432B100CUSTC432D004]
[ro.product.fingerprintName]: [HUAWEI-MILAN]
[ro.product.CustCVersion]:    [C432]
[ro.product.CustDVersion]:    [D004]
[ro.product.board]:           [CAN-L11]
[ro.product.hardwareversion]: [HL1CANL01M]
The update available so far is incomplete since it's an OTA to patch and resolve some
minor issues. So don't take it. Other OTAs can be found with this tool.

The processor (MSM8953) is exactly the same as for the following devices:

Code:
Asus Zenfone 3 (ZE520KL)
Asus Zenfone 3 (ZE552KL)
Asus Zenfone 3 Deluxe 5.5"
Huawei G9 Plus
Huawei Nova
Huawei Nova plus
Lenovo Vibe P2
Motorola Moto Z Play
Oppo R9s
Qiku 360 N4S
Samsung Galaxy C7
Samsung Galaxy On7 (2016)
Vivo X9
Xiaomi Redmi 4 Prime(32GB)
ZTE Axon Max 2
ZTE Axon 7 MAX
This means, that anything root that works on these, may also have a better success on this device.
But be careful, since these are just common names of devices and not exact model numbers!

For the bootloader unlock you need to provide this info:
Code:
Product Model:          [ro.product.model]:
Product Serial number*  [ro.boot.serialno]:
Product IMEI || MEID:   (*#06#):           
Product ID:             (*#*#1357946#*#*):

Hi man! I bought my Nova but it didn't arrive yet. But I'm following this thread and searched a bit. It seems that there is a source for Zenfone 3 ZE520KL here. Don't know if something can be done from here.

Sadly, Huawei G9 Plus isn't even listed at the site that @lgstoian sent. For more accurated source, we will have to wait for Huawei to put the source code on the site =/

EDIT: in fact, I noticed that g9 plus isn't to be found anywhere in Huawei website. And it seems that G9 Plus has the same specs of Nova Plus, So they might be the same device.
 
Last edited:

-=MoRpH=-

Senior Member
May 6, 2007
180
137
Kleve
If you read with compile, send me a copy :p I will try it on my L-11. (I bricked it with manual flash a system img from the 7.0 Update xD )

And with a working TWRP i can flash a backup from another phone, to get it work again. :)
 
  • Like
Reactions: merlin21

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,449
2,213
-∇ϕ
...And it seems that G9 Plus has the same specs of Nova Plus, So they might be the same device.

It probably is the same device. I would guess it is a test release device, possibly even a developer device from a very limited release.

The difference between the L-01 and the L-11 should only the modem because the dual sim.

Yep, I think so too, because both firmware and and ro.product.hardwareversion are often referring to L01.

What we need is a working partition table, to know what can be flashed where. ATM I can't even read the partitions, since I have no working root. I'm closely following the developments on the dirtycow thread. However, the full AOS 7 update contain all partitions, but I need to get the mappings.

Running 7zip on the UPDATE.APP give you these 61 image files:
Code:
$ ls -1
aboot.img*
abootbak.img*
apdp.img*
boot.img*
bootfail_info.img*
cache.img*
cmnlib.img*
cmnlib64.img*
cmnlib64bak.img*
cmnlibbak.img*
config.img*
cust.img*
DDR.img*
devcfg.img*
devcfgbak.img*
devinfo.img*
dip.img*
dpo.img*
dsp.img*
erecovery.img*
fsc.img*
fsg.img*
keymaster.img*
keymasterbak.img*
keystore.img*
limits.img*
lksecapp.img*
lksecappbak.img*
log.img*
mcfg.img*
mdtp.img*
misc.img*
modem.img*
modemst1.img*
modemst2.img*
mota.img*
msadp.img*
nff.img*
oeminfo.img*
pad0.img*
pad1.img*
pad2.img*
patch.img*
persist.img*
product.img*
recovery.img*
rpm.img*
rpmbak.img*
rrecord.img*
sbl1.img*
sbl1bak.img*
sec.img*
splash.img*
ssd.img*
syscfg.img*
system.img*
tz.img*
tzbak.img*
userdata.img*
vendor.img*
version.img*

However, using 7z to unpack give you an error for each, even though the names (and number of partitions) now seem correct. This is because the image packaging contain additional non-standard data. Although there are some differences, it's something like this:

Code:
1. First 92 bytes are 0x00
2. Each file are started with 55AA 5AA5
3. Then 4 bytes for Header Length
4. Then 4 bytes for Unknown1
5. Then 8 bytes for Hardware ID
6. Then 4 bytes for File Sequence
7. Then 4 bytes for File Size
8. Then 16 byts for File Date
9. Then 16 byts for File Time
10.Then 16 byts for File Type
11.Then 16 byts for Blank1
12.Then 2 bytes for Header Checksum
13.Then 2 bytes for BlockSize
14.Then 2 bytes for Blank2
15.Then ($headerLength-98) bytes for file checksum
16.Then data file length bytes for files.
17.Then padding if have
18.Then repeat 2 to 17

So you need to use a Huawei specific unpacker. Trying to use any previous and outdated split_updata.pl (or splitupdate) scripts, does not give all the partitions without modifications. There are some hope for the better maintained Huawei Updater Extractor tool by @worstenbrood.

Mapping this back to /proc/partitions, should be fairly straight forward...

What is note worthy is that the mmcblk0p54 partition is 16 bytes larger than dm-2 (verity?), and /system is mounted on dm-2.
 

-=MoRpH=-

Senior Member
May 6, 2007
180
137
Kleve
The question here is, how got the Chinese guy the mounting point or the partition table for the 64gb version? ;) My Chinese is to bad, so I can't ask him. :p


Gesendet von iPhone mit Tapatalk
 

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,449
2,213
-∇ϕ
Google's translation of the link: :D

Code:
NovaTWRP for XiaoWang_v1.1

UPDATE:
1. Added the king su_v3.64, integrated with the recovery file
2. Perfect support sub-f2fs
3. Solved the previous version of the bug

Boot file also improved, to solve the last version of the small probability
 of the collapse of the phenomenon, be sure to use the new version

Because the system can not support supersu, will not start, so the use
 of the kingroot team file (kingroot program is really high, I looked 
directly on the ignorant of), and by the kingroot implementation of 
the root. This program needs to format the data, please make a backup

As the screenshot upload it is too slow, so do not upload, and then 
pass on the following text with a very detailed description of it

Before operation, please charge the battery to 60 or more, just in 
case
1. First of all, please back up good data, first of all, please back 
up good data, first back up good data, I have said important three times
2. Your phone needs to unlock the OEM before follow-up operation
3. Press the power button to restart, hold down the black screen of the moment the volume down, it will enter fastboot
4. Then extract the downloaded file, click the brush into the boot, 
brush into the recovery, will be prompted to brush into the general impossible to error
5. Unplug the USB, press the power button to shut down, 
press and hold the volume after the black screen, until you see a 
large English, and so on 3 seconds to release, entered the Nova 
special TWRP latest version
6. Go to Main> Clear> Format data partition> enter yes>
7. Main interface> Restart> Recovery
8. The main interface> mount> the system hook
9. Main interface> Advanced> File management> Select su folder> Select su> Copy> system> xbin> Point to the lower right corner of the hook> Slide button to confirm >>>> Back to system / xbin / Select su file>
10. Main interface> Restart> System>
11. Restart to the system, do not set the fingerprint and account
12. Install KingRoot.apk just downloaded, be sure to this version, do not download other versions, and do not download other software will be error, will become a serious brick
13.root after he turned around and then complete the point that the blue immediately deal with
14. Do not ask me why always the middle of the night post
15. Cherish the fruits of labor, reproduced, please indicate the source

If the operation failed, please do not lose heart, I also prepared the 
original document, under any circumstances, as long as BootLoader 
is not formatted, you can save the brick paste is a virtue, to 
download the file, please reply " My brother "file 118.92M, it is 
recommended to use WiFi download
Pan.baidu.com/s/1eRTkmsi
This link was updated on November 26, 2016 at 22:37:36
 

-=MoRpH=-

Senior Member
May 6, 2007
180
137
Kleve
Let me guess you tried the C900 one? Have you tried to flash also recovery and boot from this package?

First i tried the L11 EMUI 5 Beta (Yes boot, recovery and system.img). After that i got a boot loop and tried to wipe user data... that fails at 30%.

Than i tried the full firmware for the C900 (dload and fastboot) doesn't work too. Right now i can only boot the recovery and erecovery. :(
 

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    So there is an unofficial release..look here..
    4
    I'm honest: it's a little bit annoying that nearly nobody has the right patience for that..

    As I stated before: I already have collected the files needed to compile TWRP for the Nova..it's just a matter of time..patience!
    4
    That's right..but let me start with L01-Version..at the moment I've some problems to solve for compiling, but the files should be complete.. ;)
    3
    All it takes is for someone to compile twrp. Knowing the differences in the models is important. I am in China so looking at the 64g internal 4gb memory. It is listed as CAZ-AL10. The partitions seem different, as the twrp developed does not support other models. Build it with you partition breakdown and it will work.
    3
    As I stated in the bootloader thread, I'm really interested in compiling TWRP for the device, but I'm on L01. I put together some files and if everything goes well, I'll give it a try at the end of the week. This isn't a promise, but I try to..
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone