Rooting E6 (Surfna)

[mer2017]

I had success rooting this device (Moto E6 Surfna) by following the "Boot Image Patching" method here: https://topjohnwu.github.io/Magisk/install.html
mingkee had success with the same method on the G7 https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/moto-g7/how-to/guide-unlock-g7-bootloader-t3906858
2. Download the firmware for your variant: https://mirrors.lolinet.com/firmware/moto/surfna/official/
3. From the firmware zip, extract the recovery.img
4. Install the Magisk Manager https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 on the phone
5. Push the recovery.img to the phone
6. From the Magisk Manager, tap "Install" then "Select and Patch a File", find the recovery.img and patch it.
7. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)

I used the recovery.img instead of the boot.img because the boot.img didn't work for me. Check out the "Magisk in Recovery" section https://topjohnwu.github.io/Magisk/install.html
Start the phone in recovery mode and Magisk will start the phone normally. In the future, the phone will need to boot in recovery mode to start Magisk. A normal boot will cause Magisk to deactivate.

Proceed at your own risk. I give no guarantees, implied or otherwise.
Also, I might've missed a step here or there.

Good luck, happy rooting.

 

[fddm]

Makes me wonder if you can flash the magisk-patched recovery to the bootloader partition. On other devices I've flashed boot to recovery so it would always boot normally, kids would sometimes trigger it otherwise.

 

[Viva La Android]

Nice work @mer2017. These recent Moto devices -- some of them at least -- have proven difficult to root. The Moto G7 Play is among those devices that, despite adamant efforts, does not presently have a viable rooting method. Methods which have been confirmed successful for other Moto G7 variants are not effective on the G7 Play, despite the fact that an unofficial and seemingly stable TWRP build has been compiled as well.
I have been reading the Magisk support topics you referenced for recovery image patching versus boot image patching. The answer is most likely some utilization of a patched recovery image, perhaps somehow flashed to the /boot partition?? This is where things get muddled for me, as the G7 Play -- being an A/B partition index device -- is devoid of an actual /recovery partition. Anyway, OP, I apologize in advance for my somewhat off-topic post. I realize this thread is intended for Moto E6 subject matter regarding root. When I read your thread, a light bulb sort of illuminated for me with respect to a working root method for my device. I will provide links to a couple of the tentative root threads for the Moto G7 Play. If you could perhaps give some input based on your experience, it would be a huge help to us. Again, I humbly beg your pardon for posting about a different device, and nice work on the Moto E6. :good:
https://forum.xda-developers.com/g7...ery-dirty-ported-twrp-g7-play-t3947205/page19

https://forum.xda-developers.com/g7-play/help/successfully-rooted-moto-g7-play-t3930747/page4

 

[tony198841]

my verizon moto e6 (Your device does not qualify for bootloader unlocking) tells me when I want to release the bootloader

 

[tigapawz_nyc]

Just rooted my tmo e6 using above. :good::silly:

 

[brncgreen]

Almost?

I was able to get the root to stick by after a few hours I plugged my phone in and it randomly turned off. I tried to boot it back up and it booted into bootloader. I tried to restart it and it still kept going to bootloader. I then used the fastboot reboot command and it rebooted and OS popped up. However of course. Magisk was deactivated. Went back and tried to boot to recovery and the flash had been erased and it booted me into the regular recovery mode. Also with no magisk. What could I have done wrong.

[email protected]:~/Downloads/adb - platform tools v28.0.0# fastboot flash recovery recovery.img
target reported max download size of 535822336 bytes
sending 'recovery' (16331 KB)...
OKAY [  0.530s]
writing 'recovery'...
(bootloader) Image not signed or corrupt
OKAY [  0.279s]
finished. total time: 0.809s

Now this is the message I get when I flash it still will boot into OS with root enabled.
after about 5 hours it did the continous fastboot boot up and the log said something like
"fastboot reason: reboot mode set to fastboot"
I did oem fb_mode_clear to no avail and not sure why it changed regardless.

 

[sasuke33]

Dead to the touch

I followed the guide linked and attempted to root by patching the boot.img with magisk. My device boots, but touch screen appears to be shot. I've reflashed the boot.img file without the patch, and factory reset several times, unfortunately my device's touch functionality seems to be gone... Any suggestions on how I can fix this?

 

[FEGuy]

I followed the guide linked and attempted to root by patching the boot.img with magisk. My device boots, but touch screen appears to be shot. I've reflashed the boot.img file without the patch, and factory reset several times, unfortunately my device's touch functionality seems to be gone... Any suggestions on how I can fix this?

If you're using a boot image you downloaded from somewhere else rather than the one from your own device, you might be out of luck. You can probably grab the proper stock firmware through Moto Smart Assistant on PC and reflash, but that might wipe your data.

The original post is a bit misleading, as Magisk can't be installed into the boot partition of the e6 due to the system-as-root setup. You'll need to install it in the recovery partition - re-read the guide and make sure you're aware of the caveats before proceeding.

 

[sasuke33]

If you're using a boot image you downloaded from somewhere else rather than the one from your own device, you might be out of luck. You can probably grab the proper stock firmware through Moto Smart Assistant on PC and reflash, but that might wipe your data.

The original post is a bit misleading, as Magisk can't be installed into the boot partition of the e6 due to the system-as-root setup. You'll need to install it in the recovery partition - re-read the guide and make sure you're aware of the caveats before proceeding.

Thanks for responding. I actually figured out the issue this afternoon, but didn't get a chance to edit my post yet. I needed to flash the vendor.img file that came with the boot.img file. Once I did that, it restored touch capabilities. And yes, I ended up patching and flashing the recovery.img file to flash. While I was able to patch and flash the boot.img file it didn't do anything as you said.

I have root as long as I boot to recovery, so all is round in my world. It'll be even more awesome if it ever gets a twrp release, but for now this root method serves my needs ?

Again thanks for responding to my post, and I hope my little anecdote can help someone from making my mistakes or help fix the issue.

 

[endleesss]

i got to step 8
but when i reboot normally, on root.
When i reboot to reocovery , the E6 displays android pic with No command

 

[motoembers]

I thought no command was an error at first, it's just how the android system is. It is saying 'no command' because you have not inserted a command. If you hold down power button and volume up it should go into recovery options.

I was able to root my phone, using a similar method as the OP. Magisk offers a good guide actually. The reason it may not be working for other people is when you make the image make sure you include recovery option in magisk options. Otherwise it's not going to work.

Downside of this is you have to boot into recovery mode all the time. But at least its rooted.

 

[alexsherman4]

getprop ro.build.ab_update returns nothing!

I unlocked the bootloader, and am now trying to install magisk manager.

Attached is the return of the commands it wants me to check. Since its not returning true do I just assume that its false?

 

[endleesss]

awesome, i have root. Here's my steps
download LMSA Tool https://www.motorola.com/us/lenovo-motorola-smart-assistant
Install, Go to rescue, download firmware, flash the phone.

LMSA downloads the firmware to C:\ProgramData\LMSA\Download\RomFiles
SURFNA_PPBS29.73_81_5_3_cid50_subsidy_DEFAULT_regulatory_DEFAULT_CFC.xml
In that folder, save a copy of recovery.img

Then do these steps, credit to OP.

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/mot...oader-t3906858
2 Install the Magisk Manager https://forum.xda-developers.com/app...mless-t3473445 on the phone
3. Push the recovery.img to the phone
4. Open Magisk Manager, tap Advance Settings. Tap Recovery mode
5. Magisk Manager, tap the first "Install" then "Select and Patch a File", find the recovery.img and patch it.
6. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
7. Put phone in fastboot
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)
9. use phone buttons to Boot to recovery mode, it will say "Signature missing or corrupted"
10. Wait, Let phone boot to OS
11. OS loaded with Root

Exceptions:
•If I let the phone boot up just once normally, i loose root. I have to do setp 7,8,9,10 again.
---
Recovery mode instructions from motorola site
1. With the phone powered off, press and hold the Volume Down button and the Power button at the same time until the device turns on. [Bootloader mode]
2. Press the Volume Down button until the flag says RECOVERY MODE.
3. Press the Power button to restart into Recovery mode.
4. You'll see an image of an Android robot with a red triangle. [and No command]
5. While holding down the Power button, press the Volume Up button. [you'll see the recovery menu]

 

[pvsgh]

If you need to reboot the phone for any reason, use Reboot to recovery option in Magisk. Or any other third party root app which provides option to reboot to recovery.

 

[Charuto]

Hey, Guys. Just unlocked the bootloader. Need help choosing which firmware. I got the phone from this company, Visible, which Google tells me is by Verizon. However, the VZW directory files don't match my model or build number.

From the phone settings:

Model number: XT2005-5
Build number: PPBS29.73-81-5-3

USC, RETUS, and CC directories have files that match these numbers. They all have the same file size too. Which one should I use if I'm on T-mobile?

EDIT: Thanks, fcohen! RETUS worked fine for me as well.

 

[fcohen]

Hey, Guys. Just unlocked the bootloader. Need help choosing which firmware. I got the phone from this company, Visible, which Google tells me is by Verizon. However, the VZW directory files don't match my model or build number.

From the phone settings:

Model number: XT2005-5
Build number: PPBS29.73-81-5-3

USC, RETUS, and CC directories have files that match these numbers. They all have the same file size too. Which one should I use if I'm on T-mobile?

RETUS worked fine on mine.

 

[EnokiPPT]

I had success rooting this device (Moto E6 Surfna) by following the "Boot Image Patching" method here: https://topjohnwu.github.io/Magisk/install.html
mingkee had success with the same method on the G7 https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/moto-g7/how-to/guide-unlock-g7-bootloader-t3906858
2. Download the firmware for your variant: https://mirrors.lolinet.com/firmware/moto/surfna/official/
3. From the firmware zip, extract the recovery.img
4. Install the Magisk Manager https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 on the phone
5. Push the recovery.img to the phone
6. From the Magisk Manager, tap "Install" then "Select and Patch a File", find the recovery.img and patch it.
7. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)

I used the recovery.img instead of the boot.img because the boot.img didn't work for me. Check out the "Magisk in Recovery" section https://topjohnwu.github.io/Magisk/install.html
Start the phone in recovery mode and Magisk will start the phone normally. In the future, the phone will need to boot in recovery mode to start Magisk. A normal boot will cause Magisk to deactivate.

Proceed at your own risk. I give no guarantees, implied or otherwise.
Also, I might've missed a step here or there.

Good luck, happy rooting.

When I try to flash I get "Bad Key". I can't flash no-verity-opt-encrypt without TWRP though, so I don't know what to do.

 

[Charuto]

I messed up. Rebooted regularly and lost root. Can't seem to get root back. Followed the directions again starting with unlocking the bootloader. Read later that wasn't necessary. Is it possible I corrupted something by trying to unlock the bootloader more than once?

In any case, I'm flashing the magisk_patched.img and rebooting to recovery. From there it says "Signature missing or corrupted" and just bootloops this error message. I let this go on for over half an hour and nothing changed. Taking out the battery and booting normally gives the same error message and bootloop.

I can start normally again if I start in bootloader mode and select the start option--this gives me the normal phone without root. Below I've included more notes which may have some clues to what I did wrong.

Here is the result when I flash recovery:

Sending 'recovery' (16335 KB) OKAY [ 0.577s]
Writing 'recovery' (bootloader) Image not signed or corrupt
OKAY [ 0.316s]
Finished. Total time: 0.904s

Here's the text when I start bootloader mode:

AP Fastboot Flash Mode (Secure)
BL:MBM-2.1-surfna_retail-eed5d2a-200205
Baseband: M8940_32.127.01.130.01R SURF_NA_CA_CUST
Product/Variant: surfna XT2005-5 16B PVT
Serial Number: ZF6522C3LK
CPU: MSM8940
eMMC 16GB SKHYNIX HAG4a2 RV=08 PV=A5 FV=00000000000000A5
DRAM: 2GB SKYNIX LP3 DIE=8Gb M5=06 M6=03 M7=01 M8=1F
Console [NULL]: null
Tools Mode Config: DISABLED
Battery OK (Charging)
flashing_unlocked
Transfer Mode: USB Connected

 

[EnokiPPT]

I messed up. Rebooted regularly and lost root. Can't seem to get root back. Followed the directions again starting with unlocking the bootloader. Read later that wasn't necessary. Is it possible I corrupted something by trying to unlock the bootloader more than once?

In any case, I'm flashing the magisk_patched.img and rebooting to recovery. From there it says "Signature missing or corrupted" and just bootloops this error message. I let this go on for over half an hour and nothing changed. Taking out the battery and booting normally gives the same error message and bootloop.

I can start normally again if I start in bootloader mode and select the start option--this gives me the normal phone without root. Below I've included more notes which may have some clues to what I did wrong.

Here is the result when I flash recovery:

Sending 'recovery' (16335 KB) OKAY [ 0.577s]
Writing 'recovery' (bootloader) Image not signed or corrupt
OKAY [ 0.316s]
Finished. Total time: 0.904s

Here's the text when I start bootloader mode:

AP Fastboot Flash Mode (Secure)
BL:MBM-2.1-surfna_retail-eed5d2a-200205
Baseband: M8940_32.127.01.130.01R SURF_NA_CA_CUST
Product/Variant: surfna XT2005-5 16B PVT
Serial Number: ZF6522C3LK
CPU: MSM8940
eMMC 16GB SKHYNIX HAG4a2 RV=08 PV=A5 FV=00000000000000A5
DRAM: 2GB SKYNIX LP3 DIE=8Gb M5=06 M6=03 M7=01 M8=1F
Console [NULL]: null
Tools Mode Config: DISABLED
Battery OK (Charging)
flashing_unlocked
Transfer Mode: USB Connected

Download the stock firmware for your e6 model and flash it via ADB.

 

[Charuto]

Download the stock firmware for your e6 model and flash it via ADB.

I was hoping I wouldn't have to go all the way back to stock I'll report back when I get it done. Thanks.