SM-T295 - Finally rooted tablet!! (updated 19-March-2021)

[Talich52]

here are the screenshots from your programme.

I see on the screenshot the loader T290XXS3ATF1 from android 9, with which charging does not work when turned off. I need an android loader 11, the file of which I posted above is aboot_T290XXU3CVG3.tar. Try to flash it and if the device continues to work, the charging of the switched-off device will also work. If there is a problem, just flash back the loader T290XXS3ATF1, this is the aboot_vk_T290XXS3ATF1.tar file laid out above. For firmware, select files in the BL or AP ODIN window. The problem, I believe, is precisely the inability to fully charge Android 11 with a 9 loader

 

[vidtek]

I see on the screenshot the loader T290XXS3ATF1 from android 9, with which charging does not work when turned off. I need an android loader 11, the file of which I posted above is aboot_T290XXU3CVG3.tar. Try to flash it and if the device continues to work, the charging of the switched-off device will also work. If there is a problem, just flash back the loader T290XXS3ATF1, this is the aboot_vk_T290XXS3ATF1.tar file laid out above. For firmware, select files in the BL or AP ODIN window. The problem, I believe, is precisely the inability to fully charge Android 11 with a 9 loader

I have tried multilple times to flash the aboot_T290XXU3CVG3.tar file, it always results in the blue screen with the red warning at the top as in post #456 in this thread. Maybe when I have tried to flash it I haven't been fast enough mashing the buttons to try and get to recovery after the flash-what do you think-should I try again?

 

[Talich52]

Read the topic from here:

[rom] [twrp] sm-t290 & sm-t295 [discussions & help thread]

Downloads: ROM: Working link is in the comments. TWRP: Working link is in the comments. Notes: *This ROM is based on the stock Samsung OneUI firmware. *This ROM is currently in testing. So please proceed with caution. *This ROM must be...

forum.xda-developers.com

If youIt is claimed that it is possible to install TWRP and root the device with the original android 11 bootloader, but the firmware is specified at most VE1, I can't check, since I have a T295 model... manage to root the device with the android bootloader 11, then I'm sure the necessary option will work
P.S. And another crazy option is to roll back the firmware to 9 android T290XXS3ATF1, root and use in full ...

 

[J.Michael]

I haven't tried making a Magisk module, no. Wu's warning? Can you tell me where to find it please?

There isn't much to making a module that just masks some files. I think in your case you would create a file /data/adb/modules/lpm-module/system/bin/lpm
Probably make sure file has owner and permissions of original (file being "replaced").

After rebooting, it should be clear whether the file got replaced. Then you can try the charger scenario of interest to see if it has any effect.

I thought the warning was in the Magisk install instructions. Maybe it's in some other document in his github.

If you have remounted /system and you can still boot, then clearly it is not as dangerous as I thought.

 

[vidtek]

Still struggling, I had a go at modifying my /system/bin folder replacing the lpm file with my own following these ideas: Lolvatveo's tutorial.

Everything went surprisingly smoothly until I came to the block count. I ended up with a system.img file of just 63Mb, instead of about 3gb. I have been unable to work out why the

tune2fs -l system.img | grep "Block size\|Block count"

gave me such a small block count.

I flashed it anyway and the tablet gave an error with "no operating system installed" (Paraphrasing).

Back to square one.

 

[J.Michael]

Still struggling, I had a go at modifying my /system/bin folder replacing the lpm file with my own following these ideas: Lolvatveo's tutorial.

Everything went surprisingly smoothly until I came to the block count. I ended up with a system.img file of just 63Mb, instead of about 3gb. I have been unable to work out why the

tune2fs -l system.img | grep "Block size\|Block count"

gave me such a small block count.

I flashed it anyway and the tablet gave an error with "no operating system installed" (Paraphrasing).

Back to square one.

What did "tune2fs" say about the original "system.img" you extracted from the AP.tar file?
Did you make any sense of the post following the post you cite, in which @xs23933 claimed he got something he didn't like, and then cited one "tune2fs" output, apparently believing that made it obvious about what he was talking.

 

[vidtek]

What did "tune2fs" say about the original "system.img" you extracted from the AP.tar file?
Did you make any sense of the post following the post you cite, in which @xs23933 claimed he got something he didn't like, and then cited one "tune2fs" output, apparently believing that made it obvious about what he was talking.

Michael - yes I did look at that post carefully, but I couldn't see quite what he was getting at, except his failed in the same manner as mine. No obvious solution there. I will see what tunefs has to say about the original though-that's a good place to start. I'll report back.

 

[vidtek]

OK reporting back. I selected 2 different iterations of the available systems from Samsung for my Tab A, the original T290XXS3ATF1 and also the T290XXU3CVG3 versions.
I went through the procedure of untar and unlz4 to isolate the system.img and mounted the system.img in a loop file as in these instructions:
https://stackoverflow.com/questions...ack-and-flash-system-img-ext4-file-using-odin

I removed the /system/bin/lpm file and replaced it with my own, adhering to the correct permissions as per the original lpm file.

I then found some strange anomalies with the procedures. Because the system.img was mounted as a loop device, there was not enough room for the packing command to work.
I cheated by copying the whole mounted system.img to a different folder on my drive and was able to produce a 3.8gb file (for both the ATF1 and the CVG3 versions).
I also had to ensure the make_ext4fs binary was in the /(myfolder)/system
folder for it to work.

Then came the flashing to the tablet.

Results for ATF1: Boot loop
Results for CVG3: Boot loop.

At this point I am giving up, Samsung have just stuffed it all up too much, I have spent way too much time on getting nowhere and there are more productive things for me to do.

I will use the tablet as per factory, just having to switch it on, another routine when starting the car I will have to get used to it and it will become automatic.
I will use Tasker to run a routine to switch it off when turning off the ignition, that is easy.

The best of luck to all that follows me down this rabbit hole, I hope you have better fortune than I.

Cheers Tony.

 

[Talich52]

Then came the flashing to the tablet.

Results for ATF1: Boot loop
Results for CVG3: Boot loop.

You didn't write anything about the core, I guess it's stock? But the protection of the stock kernel will not allow loading the custom system. To disable protection, you need to patch the Magisk kernel. More precisely, the boot.img file and the vbmeta.img file. You can flash it along with the system by selecting ODIN UserData in the window.
In general, I previously recommended simply installing 9 android T290XXS3ATF1, rutting and making the necessary changes - I think this is a working option Unfortunately, I can’t check it myself ...
Good luck!

 

[vidtek]

Talich - thanks for your input again. It was a stock core downloaded from Samsung, I thought I'd made that clear, sorry.
It wasn't a custom system, it was identical except for that single LPM file.

My file is 38bytes, the original was 345 or thereabouts (from memory), maybe the file size was detected?

I didn't want to keep the Android 9 with the associated issues with charging-that's exactly what I am trying to alter.
Tony

 

[J.Michael]

Talich - thanks for your input again. It was a stock core downloaded from Samsung, I thought I'd made that clear, sorry.
It wasn't a custom system, it was identical except for that single LPM file.

My file is 38bytes, the original was 345 or thereabouts (from memory), maybe the file size was detected?

I didn't want to keep the Android 9 with the associated issues with charging-that's exactly what I am trying to alter.
Tony

Have you ever succeeded in installing Magisk?
Have you tried "overlaying" the lpm file using a Magisk module?

I am ready for the answer to be that it doesn't help because Magisk is not running when this file is executed, but this is such a simple experiment, I think you should at least try.

What is the original "lpm" doing? Is it a shell script?

My "lpm" is 335KB. Did you forget to say "K", or is yours really so much smaller?

Shouldn't your "patch" be trying to run the original lpm, and *then* reboot?

 

[J.Michael]

@vidtek Have you seen this thread about doing what you describe, but on an S7?

 

[vidtek]

Have you ever succeeded in installing Magisk?
Have you tried "overlaying" the lpm file using a Magisk module?

I am ready for the answer to be that it doesn't help because Magisk is not running when this file is executed, but this is such a simple experiment, I think you should at least try.

What is the original "lpm" doing? Is it a shell script?

My "lpm" is 335KB. Did you forget to say "K", or is yours really so much smaller?

Shouldn't your "patch" be trying to run the original lpm, and *then* reboot?

Michael- Thank you too for your help. I have managed to install Magisk - about 5 times!
No I'm not sure what you mean by "overlaying" a Magisk module.
Yes the original LPM file is a shell script. It controls the charging port and it's various states.
Yes of course it should have been KB ... don't get old......
My "patch" just replaced the LPM completely, maybe that's where I went wrong.
In your other post you gave a link where someone just added the lines in my file to the end of the LPM file on an S7 and it worked. Maybe that's all I had to do!!

Cheers Tony.

 

[Talich52]

My "patch" just replaced the LPM completely, maybe that's where I went wrong.
In your other post you gave a link where someone just added the lines in my file to the end of the LPM file on an S7 and it worked. Maybe that's all I had to do!!

Very likely. However, you can't hear me, and I will say again that everything would have worked out if both the system and the loader were the same version, 9 or 11. If the system is android 11, and the bootloader is android 9, then charging the switched-off device does not work properly. Hence I think the problem... Unfortunately, although they claim that they rooted the T290 on Android 11 with a regular loader, but you failed, and I did not check on the T295 model... Therefore, there was a recommendation to do everything on Android 9, on the T290XXS3ATF1 firmware

 

[vidtek]

Very likely. However, you can't hear me, and I will say again that everything would have worked out if both the system and the loader were the same version, 9 or 11. If the system is android 11, and the bootloader is android 9, then charging the switched-off device does not work properly. Hence I think the problem... Unfortunately, although they claim that they rooted the T290 on Android 11 with a regular loader, but you failed, and I did not check on the T295 model... Therefore, there was a recommendation to do everything on Android 9, on the T290 firmware

Talich - From memory I think the original system when I purchased it was Android 10, not 9. This is my present system:

 

[Talich52]

Talich - From memory I think the original system when I purchased it was Android 10, not 9.

You can roll back to android 9, but with version 3 of the loader, say T290XXS3ATF1 . Alternatively, on the current full firmware of android 11, just look at how charging works when the device is turned off.Then flash the bootloader from android 9 aboot_vbmeta_T290XXS3ATF1.tar and compare the picture when charging. You don't need to root, just see the root of the problem...
I never turn off the device, so I don't see a problem when charging...

 

[vidtek]

That's where I started ha!
The boot behaviour with Android 11 and the Android 9 bootloader displays the same as you describe, it will only charge when up and running.

 

[J.Michael]

Michael- Thank you too for your help. I have managed to install Magisk - about 5 times!
No I'm not sure what you mean by "overlaying" a Magisk module.
Yes the original LPM file is a shell script. It controls the charging port and it's various states.
Yes of course it should have been KB ... don't get old......
My "patch" just replaced the LPM completely, maybe that's where I went wrong.
In your other post you gave a link where someone just added the lines in my file to the end of the LPM file on an S7 and it worked. Maybe that's all I had to do!!

Cheers Tony.

"overlaying": A Magisk module is a directory tree in /data/adb/modules. One of the effects of a Magisk module is that a file under /data/adb/modules/${module-name}/system will be "mounted" by Magisk in such a way that everyone other than Magisk will see the file provided by the module, instead of seeing the file at the corresponding position under /system. So, I was suggesting that you put your version of lpm at /data/adb/modules/fixlpm/system/bin/lpm to see if that changed your charging behavior.

WARNING: a bad module can make it impossible to boot. There are things you can do to deactivate a module. You should read about them.

I doubt that the original lpm is a shell script. On my system it is identified as an ELF file, a kind of binary executable.

The thread I referenced did *not* talk about appending to lpm, it talked about overwriting lpm. Those people apparently can get away with remounting /system read/write. Someone suggested that it was important for the lpm file to be at a particular inode. Overwriting the original lpm was a way to achieve that. I don't remember whether he claimed that was verified. It may just be that that avoided perturbing the layout of the disk image -- we have reason to believe that Samsung detects "changes" to /system, but we don't know that they scan the whole thing every time you boot. They may have taken a shortcut, and overwriting lpm might evade detection.

 

[vidtek]

"overlaying": A Magisk module is a directory tree in /data/adb/modules. One of the effects of a Magisk module is that a file under /data/adb/modules/${module-name}/system will be "mounted" by Magisk in such a way that everyone other than Magisk will see the file provided by the module, instead of seeing the file at the corresponding position under /system. So, I was suggesting that you put your version of lpm at /data/adb/modules/fixlpm/system/bin/lpm to see if that changed your charging behavior.

WARNING: a bad module can make it impossible to boot. There are things you can do to deactivate a module. You should read about them.

I doubt that the original lpm is a shell script. On my system it is identified as an ELF file, a kind of binary executable.

The thread I referenced did *not* talk about appending to lpm, it talked about overwriting lpm. Those people apparently can get away with remounting /system read/write. Someone suggested that it was important for the lpm file to be at a particular inode. Overwriting the original lpm was a way to achieve that. I don't remember whether he claimed that was verified. It may just be that that avoided perturbing the layout of the disk image -- we have reason to believe that Samsung detects "changes" to /system, but we don't know that they scan the whole thing every time you boot. They may have taken a shortcut, and overwriting lpm might evade detection.

Michael - Thank you for explaining the Magisk overlay. Interesting, I'll read up on modules as you suggest. It's good to keep the old brain cells ticking over and active when you are over 70... It's a very long time since I wrote my first database using database3 in 1986 for my fledgling business-I couldn't justify an off the shelf solution when starting out and it taught me a lot.

 

[Minionguyjpro]

I have root on my SM-T295 A8 tablet!!

See my new post: How to Install TWRP and Root T295


Update 19 March 2021
Tested on T295XXU3BUC3 ROM

Prerequisites:
Bootloader unlocked - search forums.xda-developers for instructions how to do this.
OEM unlock on. In Settings/developer options, OEM Unlock slider should be to the right.

I see people still trying to patch files to get root.
If you flash the TWRP posted by @Talich52, with reboot unchecked you can install Magisk from TWRP.

1. If prerequisites met: install Android 9 bootloader through ODIN
2. Reboot to system
3. Go into download mode.
4. Open ODIN and in the AP slot put TWRP (see attachment below)
5. Uncheck auto reboot
6. Flash TWRP
7. Press vol dn + pwr keys.
8: When screen goes blank, press vol up + pwr keys.
9. Keep holding down both keys after reboot.
10. Tablet will reboot again.
11. When Samsung logo appears stop pressing pwr key.
12. When bootloader msg appears, release vol up key, quickly press & release pwr key, and quickly press vol up key until in TWRP.
13. You will then format (NOT WIPE) data. Answer yes to the format prompt
14. Clear dalvik/cache if prompted
15. Install Fix_vendor_9.0.zip or Fix_vendor_10.0.zip. See attached files.
16. Clear dalvik and cache.
17. Reboot back into recovery.
18. Install magisk - see attached
19. Reboot into system. May reboot again - that's okay
20. Enjoy!!


Updated (23 March 2020) my Tab A with XXS3ATB2 and got it rooted!!

Attached AP.tar file is for XXU2ASL3 only.

T295-Magisk-AP.tar

Okay, after multiple failed attempts, I read about a method to root my T295. It did not work!! But, I decided to just use Magisk Manager on the boot.img file only. The resultant file would not flash - it will fail. The original boot.img & recovery.img files are 65,536K bytes each. I had to take the Magisk modified boot.img and overlay it onto the original boot.ing file. I did the same for the recovery.img. Then the files would flash successfully. The first thing after booting was to check Magisk Manager. It showed I have Magisk 20.3 installed. So, I tested this with Root Explorer. I did have root!!

If you are going to try this, you need to unlock your boot loader, I think. I have not tried this with a locked bootloader.


Basic instructions


PLEASE READ ALL OF THIS BEFORE STARTING!! VERY IMPORTANT!!

Here are the steps to root your tablet:
Make a backup of you apps & data before doing this. This procedure will
wipe all you data.

Go to settings.
Select software info
Tap build number 7 times to get into developer mode
Go back to main settings page.
Scroll to bottom and select developer mode
In middle of page find OEM unlocking
Make sure slider is all the way to the right (should say allow bootloader to be unlocked)

Unlock bootloader:
1. turn off tablet
2. press and hold down vol up & vol down keys together
3. insert usb cable (should already be connected to computer)
4. when bootloader screen appears, release all keys
5. press and hold vol up key for 5 seconds, then release
6. read instructions on screen to unlock bootloader (this will wipe all your data)

After reboot, go through normal setup.

Now for the hard part.

You need to download the complete ROM you have installed on your Tablet.
It will be better if you have the same ROM version as I do in post in this post (#1).
You need to unzip the ROM so you can flash it in ODIN.

If you are on the same ROM version as in my post #1, then you can just download my rooted files.

Unzip my downloaded root files zip file.
Unzip the downloaded ROM files.

In the AP* file, you need to replace my files in the zip: boot.img, recovery.img & vbmeta.img

Start ODIN. Select files for BL*, AP*, CSC* & CP*
For CSC file, select HOME_CSC*
*** Uncheck auto reboot ***

Flash ROM.
After flashing ROM. press vol dn + pwr key
As soon as screen goes blank press vol up key and hold
When get into recovery, select data wipe, then reboot
Set up phone as you normally would.
After setup, go to Play store and install Magisk Manager. Run Magisk Manager to see if you have root.


Do It Yourself Instructions
You need to do some research before doing this. This is NOT a walk you by the hand tutorial. You need to learn some things before following these instructions. Learn how to use lz4.exe. Learn how to use simg2img. Learn how to make a .tar file.


Make a backup of you apps & data before doing this. This procedure will
wipe all you data.

Go to settings.
Select software info
Tap build number 7 times to get into developer mode
Go back to main settings page.
Scroll to bottom and select developer mode
In middle of page find OEM unlocking
Make sure slider is all the way to the right (should say allow bootloader to be unlocked)

Unlock bootloader:
1. turn off tablet
2. press and hold down vol up & vol down keys together
3. insert usb cable (should already be connected to computer)
4. when bootloader screen appears, release all keys
5. press and hold vol up key for 5 seconds, then release
6. read instructions on screen to unlock bootloader (this will wipe all your data)

After reboot, go through normal setup.

Now for the hard part.

You need to download the complete ROM you have installed on your Tablet.
Extract ROM files
Extract system.*.lz4, recovery*.lz4 and vbmeta*.lz4
Use tar to make an AP.tar file with the 3 above files. **Search the Internet if you do not know how to use tar.
Copy the AP.tar file to your phone. It is better to use adb push to prevent file correuption.
Install Magisk Manager from Play store.
Run Magisk Manager. Select install Magisk. Choose Select and Patch a file. Follow directions on screen to patch the AP.tar file.
Once the AP.tar file has been patched, use adb to pul the file to yur computer.
Extract the file from the AP.tar file.

Now come the hard part:

You cannot edit .lz4 directly. You have to decompress them. After decompressing system*, use simg2img to decompress the sparse file. Search the Internet if you do not know how to do this.

Now we make our modified files so they will flash in ODIN.

Instructions:
I used hex editor neo - a windows 10 app
I opened the stock kernel & recovery files in hex editor neo
I opened the Magisk modified kernel & recovery files in hex editor neo
I copied the modified kernel & recovery code onto their respective stock files in hex editor neo
I saved the stock files & closed hex editor neo.
I used cygwin to create a tar file: boot.img, recovery.img, vbmeta.img plus other files in original AP*.MD5 file.
You should also flash all ROM *.MD5 files (BL, CP, CSC) per Magisk instructions.
New AP.tar contents:
boot.img
dtbo.img.lz4
meta-data
recovery.img
system.img.ext4.lz4
userdata.img.ext4.lz4
vbmeta.img
vendor.img.ext4.lz4

I used Odin to flash the tar file

Flash ROM.
After flashing ROM. press vol dn + pwr key
As soon as screen goes blank press vol up key and hold
When get into recovery, select data wipe, then reboot
Set up phone as you normally would.
After setup, go to Play store and install Magisk Manager. Run Magisk Manager to see if you have root.

After installing Magisk:

(Powering up normally) → (System with NO Magisk)
(OEM Recovery Key Combo) → (Splash screen) → (Release all buttons) → (System with Magisk)
(OEM Recovery Key Combo) → (Splash screen) → (Keep pressing volume up) → (Actual recovery)

Please follow my instructions and the install instructions from Magisk web page.

Magisk Installation

Nice, i also made a guide for the SM-T290 model which i have myself and also rooted. When you figure out how it works, you can do it more flawless.