Rooting E6 (Surfna)

Search This thread

mer2017

New member
Jul 3, 2017
3
20
I had success rooting this device (Moto E6 Surfna) by following the "Boot Image Patching" method here: https://topjohnwu.github.io/Magisk/install.html
mingkee had success with the same method on the G7 https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/moto-g7/how-to/guide-unlock-g7-bootloader-t3906858
2. Download the firmware for your variant: https://mirrors.lolinet.com/firmware/moto/surfna/official/
3. From the firmware zip, extract the recovery.img
4. Install the Magisk Manager https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 on the phone
5. Push the recovery.img to the phone
6. From the Magisk Manager, tap "Install" then "Select and Patch a File", find the recovery.img and patch it.
7. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)

I used the recovery.img instead of the boot.img because the boot.img didn't work for me. Check out the "Magisk in Recovery" section https://topjohnwu.github.io/Magisk/install.html
Start the phone in recovery mode and Magisk will start the phone normally. In the future, the phone will need to boot in recovery mode to start Magisk. A normal boot will cause Magisk to deactivate.

Proceed at your own risk. I give no guarantees, implied or otherwise.
Also, I might've missed a step here or there.

Good luck, happy rooting.
 

fddm

Senior Member
Feb 24, 2011
237
161
Makes me wonder if you can flash the magisk-patched recovery to the bootloader partition. On other devices I've flashed boot to recovery so it would always boot normally, kids would sometimes trigger it otherwise.
 
  • Like
Reactions: al.islam.333
Nice work @mer2017. These recent Moto devices -- some of them at least -- have proven difficult to root. The Moto G7 Play is among those devices that, despite adamant efforts, does not presently have a viable rooting method. Methods which have been confirmed successful for other Moto G7 variants are not effective on the G7 Play, despite the fact that an unofficial and seemingly stable TWRP build has been compiled as well.
I have been reading the Magisk support topics you referenced for recovery image patching versus boot image patching. The answer is most likely some utilization of a patched recovery image, perhaps somehow flashed to the /boot partition?? This is where things get muddled for me, as the G7 Play -- being an A/B partition index device -- is devoid of an actual /recovery partition. Anyway, OP, I apologize in advance for my somewhat off-topic post. I realize this thread is intended for Moto E6 subject matter regarding root. When I read your thread, a light bulb sort of illuminated for me with respect to a working root method for my device. I will provide links to a couple of the tentative root threads for the Moto G7 Play. If you could perhaps give some input based on your experience, it would be a huge help to us. Again, I humbly beg your pardon for posting about a different device, and nice work on the Moto E6. :good:
https://forum.xda-developers.com/g7...ery-dirty-ported-twrp-g7-play-t3947205/page19

https://forum.xda-developers.com/g7-play/help/successfully-rooted-moto-g7-play-t3930747/page4
 
Last edited:

tony198841

New member
Oct 2, 2019
1
0
my verizon moto e6 (Your device does not qualify for bootloader unlocking) tells me when I want to release the bootloader
 

brncgreen

Member
Dec 10, 2018
35
5
Almost?

I was able to get the root to stick by after a few hours I plugged my phone in and it randomly turned off. I tried to boot it back up and it booted into bootloader. I tried to restart it and it still kept going to bootloader. I then used the fastboot reboot command and it rebooted and OS popped up. However of course. Magisk was deactivated. Went back and tried to boot to recovery and the flash had been erased and it booted me into the regular recovery mode. Also with no magisk. What could I have done wrong.

Code:
[email protected]:~/Downloads/adb - platform tools v28.0.0# fastboot flash recovery recovery.img
target reported max download size of 535822336 bytes
sending 'recovery' (16331 KB)...
OKAY [  0.530s]
writing 'recovery'...
(bootloader) Image not signed or corrupt
OKAY [  0.279s]
finished. total time: 0.809s

Now this is the message I get when I flash it still will boot into OS with root enabled.
after about 5 hours it did the continous fastboot boot up and the log said something like
"fastboot reason: reboot mode set to fastboot"
I did oem fb_mode_clear to no avail and not sure why it changed regardless.
 

sasuke33

Member
Dec 27, 2017
9
3
Elk Grove
Dead to the touch

I followed the guide linked and attempted to root by patching the boot.img with magisk. My device boots, but touch screen appears to be shot. I've reflashed the boot.img file without the patch, and factory reset several times, unfortunately my device's touch functionality seems to be gone... Any suggestions on how I can fix this?
 

FEGuy

Senior Member
Jan 22, 2011
89
51
Marquette, MI
I followed the guide linked and attempted to root by patching the boot.img with magisk. My device boots, but touch screen appears to be shot. I've reflashed the boot.img file without the patch, and factory reset several times, unfortunately my device's touch functionality seems to be gone... Any suggestions on how I can fix this?

If you're using a boot image you downloaded from somewhere else rather than the one from your own device, you might be out of luck. You can probably grab the proper stock firmware through Moto Smart Assistant on PC and reflash, but that might wipe your data.

The original post is a bit misleading, as Magisk can't be installed into the boot partition of the e6 due to the system-as-root setup. You'll need to install it in the recovery partition - re-read the guide and make sure you're aware of the caveats before proceeding.
 

sasuke33

Member
Dec 27, 2017
9
3
Elk Grove
If you're using a boot image you downloaded from somewhere else rather than the one from your own device, you might be out of luck. You can probably grab the proper stock firmware through Moto Smart Assistant on PC and reflash, but that might wipe your data.

The original post is a bit misleading, as Magisk can't be installed into the boot partition of the e6 due to the system-as-root setup. You'll need to install it in the recovery partition - re-read the guide and make sure you're aware of the caveats before proceeding.

Thanks for responding. I actually figured out the issue this afternoon, but didn't get a chance to edit my post yet. I needed to flash the vendor.img file that came with the boot.img file. Once I did that, it restored touch capabilities. And yes, I ended up patching and flashing the recovery.img file to flash. While I was able to patch and flash the boot.img file it didn't do anything as you said.

I have root as long as I boot to recovery, so all is round in my world. It'll be even more awesome if it ever gets a twrp release, but for now this root method serves my needs ?

Again thanks for responding to my post, and I hope my little anecdote can help someone from making my mistakes or help fix the issue.
 
  • Like
Reactions: al.islam.333

endleesss

Senior Member
Feb 19, 2011
117
16
i got to step 8
but when i reboot normally, on root.
When i reboot to reocovery , the E6 displays android pic with No command
 

motoembers

New member
Feb 15, 2020
2
0
I thought no command was an error at first, it's just how the android system is. It is saying 'no command' because you have not inserted a command. If you hold down power button and volume up it should go into recovery options.

I was able to root my phone, using a similar method as the OP. Magisk offers a good guide actually. The reason it may not be working for other people is when you make the image make sure you include recovery option in magisk options. Otherwise it's not going to work.

Downside of this is you have to boot into recovery mode all the time. But at least its rooted.
 
Last edited:

alexsherman4

New member
Feb 16, 2020
3
0
getprop ro.build.ab_update returns nothing!

I unlocked the bootloader, and am now trying to install magisk manager.

Attached is the return of the commands it wants me to check. Since its not returning true do I just assume that its false?
6PJWvvx.png
 

endleesss

Senior Member
Feb 19, 2011
117
16
awesome, i have root. Here's my steps
download LMSA Tool https://www.motorola.com/us/lenovo-motorola-smart-assistant
Install, Go to rescue, download firmware, flash the phone.

LMSA downloads the firmware to C:\ProgramData\LMSA\Download\RomFiles
SURFNA_PPBS29.73_81_5_3_cid50_subsidy_DEFAULT_regulatory_DEFAULT_CFC.xml
In that folder, save a copy of recovery.img

Then do these steps, credit to OP.

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/mot...oader-t3906858
2 Install the Magisk Manager https://forum.xda-developers.com/app...mless-t3473445 on the phone
3. Push the recovery.img to the phone
4. Open Magisk Manager, tap Advance Settings. Tap Recovery mode
5. Magisk Manager, tap the first "Install" then "Select and Patch a File", find the recovery.img and patch it.
6. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
7. Put phone in fastboot
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)
9. use phone buttons to Boot to recovery mode, it will say "Signature missing or corrupted"
10. Wait, Let phone boot to OS
11. OS loaded with Root

Exceptions:
•If I let the phone boot up just once normally, i loose root. I have to do setp 7,8,9,10 again.
---
Recovery mode instructions from motorola site
1. With the phone powered off, press and hold the Volume Down button and the Power button at the same time until the device turns on. [Bootloader mode]
2. Press the Volume Down button until the flag says RECOVERY MODE.
3. Press the Power button to restart into Recovery mode.
4. You'll see an image of an Android robot with a red triangle. [and No command]
5. While holding down the Power button, press the Volume Up button. [you'll see the recovery menu]
 
Last edited:
  • Like
Reactions: al.islam.333

pvsgh

Senior Member
Nov 16, 2011
714
1,136
If you need to reboot the phone for any reason, use Reboot to recovery option in Magisk. Or any other third party root app which provides option to reboot to recovery.
 
  • Like
Reactions: Ruuel and EnokiPPT

Charuto

Member
Dec 16, 2010
30
3
Hey, Guys. Just unlocked the bootloader. Need help choosing which firmware. I got the phone from this company, Visible, which Google tells me is by Verizon. However, the VZW directory files don't match my model or build number.

From the phone settings:

Model number: XT2005-5
Build number: PPBS29.73-81-5-3

USC, RETUS, and CC directories have files that match these numbers. They all have the same file size too. Which one should I use if I'm on T-mobile?

EDIT: Thanks, fcohen! RETUS worked fine for me as well.
 
Last edited:
  • Like
Reactions: al.islam.333

fcohen

Member
Dec 4, 2013
12
5
Hey, Guys. Just unlocked the bootloader. Need help choosing which firmware. I got the phone from this company, Visible, which Google tells me is by Verizon. However, the VZW directory files don't match my model or build number.

From the phone settings:

Model number: XT2005-5
Build number: PPBS29.73-81-5-3

USC, RETUS, and CC directories have files that match these numbers. They all have the same file size too. Which one should I use if I'm on T-mobile?

RETUS worked fine on mine.
 
  • Like
Reactions: Charuto

EnokiPPT

Senior Member
Feb 9, 2020
123
28
Denver, CO
I had success rooting this device (Moto E6 Surfna) by following the "Boot Image Patching" method here: https://topjohnwu.github.io/Magisk/install.html
mingkee had success with the same method on the G7 https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084

Summary:
1. Unlock bootloader, this can help https://forum.xda-developers.com/moto-g7/how-to/guide-unlock-g7-bootloader-t3906858
2. Download the firmware for your variant: https://mirrors.lolinet.com/firmware/moto/surfna/official/
3. From the firmware zip, extract the recovery.img
4. Install the Magisk Manager https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 on the phone
5. Push the recovery.img to the phone
6. From the Magisk Manager, tap "Install" then "Select and Patch a File", find the recovery.img and patch it.
7. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)

I used the recovery.img instead of the boot.img because the boot.img didn't work for me. Check out the "Magisk in Recovery" section https://topjohnwu.github.io/Magisk/install.html
Start the phone in recovery mode and Magisk will start the phone normally. In the future, the phone will need to boot in recovery mode to start Magisk. A normal boot will cause Magisk to deactivate.

Proceed at your own risk. I give no guarantees, implied or otherwise.
Also, I might've missed a step here or there.

Good luck, happy rooting.

When I try to flash I get "Bad Key". I can't flash no-verity-opt-encrypt without TWRP though, so I don't know what to do.
 

Charuto

Member
Dec 16, 2010
30
3
I messed up. Rebooted regularly and lost root. Can't seem to get root back. Followed the directions again starting with unlocking the bootloader. Read later that wasn't necessary. Is it possible I corrupted something by trying to unlock the bootloader more than once?

In any case, I'm flashing the magisk_patched.img and rebooting to recovery. From there it says "Signature missing or corrupted" and just bootloops this error message. I let this go on for over half an hour and nothing changed. Taking out the battery and booting normally gives the same error message and bootloop.

I can start normally again if I start in bootloader mode and select the start option--this gives me the normal phone without root. Below I've included more notes which may have some clues to what I did wrong.

Here is the result when I flash recovery:

Sending 'recovery' (16335 KB) OKAY [ 0.577s]
Writing 'recovery' (bootloader) Image not signed or corrupt
OKAY [ 0.316s]
Finished. Total time: 0.904s

Here's the text when I start bootloader mode:

AP Fastboot Flash Mode (Secure)
BL:MBM-2.1-surfna_retail-eed5d2a-200205
Baseband: M8940_32.127.01.130.01R SURF_NA_CA_CUST
Product/Variant: surfna XT2005-5 16B PVT
Serial Number: ZF6522C3LK
CPU: MSM8940
eMMC 16GB SKHYNIX HAG4a2 RV=08 PV=A5 FV=00000000000000A5
DRAM: 2GB SKYNIX LP3 DIE=8Gb M5=06 M6=03 M7=01 M8=1F
Console [NULL]: null
Tools Mode Config: DISABLED
Battery OK (Charging)
flashing_unlocked
Transfer Mode: USB Connected
 

EnokiPPT

Senior Member
Feb 9, 2020
123
28
Denver, CO
I messed up. Rebooted regularly and lost root. Can't seem to get root back. Followed the directions again starting with unlocking the bootloader. Read later that wasn't necessary. Is it possible I corrupted something by trying to unlock the bootloader more than once?

In any case, I'm flashing the magisk_patched.img and rebooting to recovery. From there it says "Signature missing or corrupted" and just bootloops this error message. I let this go on for over half an hour and nothing changed. Taking out the battery and booting normally gives the same error message and bootloop.

I can start normally again if I start in bootloader mode and select the start option--this gives me the normal phone without root. Below I've included more notes which may have some clues to what I did wrong.

Here is the result when I flash recovery:

Sending 'recovery' (16335 KB) OKAY [ 0.577s]
Writing 'recovery' (bootloader) Image not signed or corrupt
OKAY [ 0.316s]
Finished. Total time: 0.904s

Here's the text when I start bootloader mode:

AP Fastboot Flash Mode (Secure)
BL:MBM-2.1-surfna_retail-eed5d2a-200205
Baseband: M8940_32.127.01.130.01R SURF_NA_CA_CUST
Product/Variant: surfna XT2005-5 16B PVT
Serial Number: ZF6522C3LK
CPU: MSM8940
eMMC 16GB SKHYNIX HAG4a2 RV=08 PV=A5 FV=00000000000000A5
DRAM: 2GB SKYNIX LP3 DIE=8Gb M5=06 M6=03 M7=01 M8=1F
Console [NULL]: null
Tools Mode Config: DISABLED
Battery OK (Charging)
flashing_unlocked
Transfer Mode: USB Connected
Download the stock firmware for your e6 model and flash it via ADB.
 
  • Like
Reactions: Charuto

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    I had success rooting this device (Moto E6 Surfna) by following the "Boot Image Patching" method here: https://topjohnwu.github.io/Magisk/install.html
    mingkee had success with the same method on the G7 https://forum.xda-developers.com/moto-g7/how-to/root-g7-magisk-t3907084

    Summary:
    1. Unlock bootloader, this can help https://forum.xda-developers.com/moto-g7/how-to/guide-unlock-g7-bootloader-t3906858
    2. Download the firmware for your variant: https://mirrors.lolinet.com/firmware/moto/surfna/official/
    3. From the firmware zip, extract the recovery.img
    4. Install the Magisk Manager https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 on the phone
    5. Push the recovery.img to the phone
    6. From the Magisk Manager, tap "Install" then "Select and Patch a File", find the recovery.img and patch it.
    7. Pull the patched img to the PC, Magisk Manager will put in /sdcard/Download/magisk_patched.img
    8. Flash the patched img as recovery (fastboot flash recovery magisk_patched.img)

    I used the recovery.img instead of the boot.img because the boot.img didn't work for me. Check out the "Magisk in Recovery" section https://topjohnwu.github.io/Magisk/install.html
    Start the phone in recovery mode and Magisk will start the phone normally. In the future, the phone will need to boot in recovery mode to start Magisk. A normal boot will cause Magisk to deactivate.

    Proceed at your own risk. I give no guarantees, implied or otherwise.
    Also, I might've missed a step here or there.

    Good luck, happy rooting.
    5
    Easy Root and Keep Root on Motorola E6

    Hi everyone. I have a new Moto E6 XT2005-3 and wanted a stable root with no error messages. I finally found a simple way to have a stable root that would not disappear. After reading everything in this thread, here are the steps I used, and you can too. It should work for any E6 with an unlocked bootloader.

    Be careful and take your time doing this.

    In any event, here goes...
    1. Install Magisk Manager 7.5.1 app and download and unzip your latest rom (https://mirrors.lolinet.com/firmware/moto/surfna/official/) on your phone
    2.. From the app, choose install Magisk, choose install again, and then choose install and patch file.
    3. Choose the boot.img from your unzipped latest rom and let the app do its thing
    4. Using your file manager app, go to the downloads folder and change the name of magisk_patched.img to magisk_boot.img
    5. Go back to the Magisk app, and this time open Advanced Settings and click the recovery option. Leave the other options as they are.
    6. Again, choose install Magisk, choose install again, and then choose install and patch file.
    7. Choose the recovery.img from your same rom as the boot.img and let the app do its thing
    8. Using your file manager app, go to the downloads folder and change the name of magisk_patched.img to magisk_recovery.img
    9. using the usb cable, copy magisk_boot.img and magisk_recovery.img to your PC's adb folder
    10. leave the usb cable connected and reboot your phone to bootloader
    11. using your PC, open a terminal in the adb folder.
    12. type the following 2 commands
    12a. fastboot flash boot magisk_boot.img
    12b. fastboot flash recovery magisk_recovery.img

    You are done. Now if you want a non-rooted phone, power off, and start it up.
    You will see a black screen with some words or numbers in the top left. It will stay that way for up to 30 seconds before your will see the normal motorola screen. THIS IS NORMAL.
    If you black screen bothers you... it did me, you can look into the app section of this forum for the logo.bin file and install procedure.
    If you want a rooted phone, (a) power off, boot into the bootloader, and choose RECOVERY, or, (b) install a "quickboot" app and choose the "reboot to recovery" option each time. you want to reboot.
    You will never lose root and, if you boot normally by mistake, no problem.

    Have fun.
    3
    Nice work @mer2017. These recent Moto devices -- some of them at least -- have proven difficult to root. The Moto G7 Play is among those devices that, despite adamant efforts, does not presently have a viable rooting method. Methods which have been confirmed successful for other Moto G7 variants are not effective on the G7 Play, despite the fact that an unofficial and seemingly stable TWRP build has been compiled as well.
    I have been reading the Magisk support topics you referenced for recovery image patching versus boot image patching. The answer is most likely some utilization of a patched recovery image, perhaps somehow flashed to the /boot partition?? This is where things get muddled for me, as the G7 Play -- being an A/B partition index device -- is devoid of an actual /recovery partition. Anyway, OP, I apologize in advance for my somewhat off-topic post. I realize this thread is intended for Moto E6 subject matter regarding root. When I read your thread, a light bulb sort of illuminated for me with respect to a working root method for my device. I will provide links to a couple of the tentative root threads for the Moto G7 Play. If you could perhaps give some input based on your experience, it would be a huge help to us. Again, I humbly beg your pardon for posting about a different device, and nice work on the Moto E6. :good:
    https://forum.xda-developers.com/g7...ery-dirty-ported-twrp-g7-play-t3947205/page19

    https://forum.xda-developers.com/g7-play/help/successfully-rooted-moto-g7-play-t3930747/page4
    3
    I don't know about all of that.
    But I can make a package that would use fastboot to unlock the device and then flash twrp and then restore a twrp backup that would set u up with magisk, in boot partition... And working twrp with touch on recovery. Also disables encryption and verity ....

    An all in one tool.

    Can be made for a PC,
    Linux or windows..

    I just need to feel motivated
    2
    Some sort of progress

    So, I got rooted with magisk using stock recovery.
    To get around the sometimes accident regular boot.
    I flashed the broken twrp that's floating around to my boot partition.
    Now it always reboots to recovery.

    Going to work out the encryption from fstabs and from the dtb and dtb0.

    Also my friends and I are trying to get the twrp working with the touch screen

    I'm going to pull the firmware off my e6 for a way back to rooted stock,
    Then start working towards getting custom rom

    I think twrp that semi works needs the ramdisk fixed up and a point to dtbo.

    I might try appending the dtb to the zimage in the recovery kernel....

    Anyway just some small progress, I'll update as I have time and make advancement