SM-T295 - Finally rooted tablet!! (updated 19-May-2020)

gcrutchr

Senior Member
Jun 11, 2009
1,094
520
113
Bangkok
I have root on my SM-T295 A8 tablet!!

Updated (23 March 2020) my Tab A with XXS3ATB2 and got it rooted!!

Attached AP.tar file is for XXU2ASL3 only.

T295-Magisk-AP.tar

Okay, after multiple failed attempts, I read about a method to root my T295. It did not work!! But, I decided to just use Magisk Manager on the boot.img file only. The resultant file would not flash - it will fail. The original boot.img & recovery.img files are 65,536K bytes each. I had to take the Magisk modified boot.img and overlay it onto the original boot.ing file. I did the same for the recovery.img. Then the files would flash successfully. The first thing after booting was to check Magisk Manager. It showed I have Magisk 20.3 installed. So, I tested this with Root Explorer. I did have root!!

If you are going to try this, you need to unlock your boot loader, I think. I have not tried this with a locked bootloader.


Basic instructions


PLEASE READ ALL OF THIS BEFORE STARTING!! VERY IMPORTANT!!

Here are the steps to root your tablet:
Make a backup of you apps & data before doing this. This procedure will
wipe all you data.

Go to settings.
Select software info
Tap build number 7 times to get into developer mode
Go back to main settings page.
Scroll to bottom and select developer mode
In middle of page find OEM unlocking
Make sure slider is all the way to the right (should say allow bootloader to be unlocked)

Unlock bootloader:
1. turn off tablet
2. press and hold down vol up & vol down keys together
3. insert usb cable (should already be connected to computer)
4. when bootloader screen appears, release all keys
5. press and hold vol up key for 5 seconds, then release
6. read instructions on screen to unlock bootloader (this will wipe all your data)

After reboot, go through normal setup.

Now for the hard part.

You need to download the complete ROM you have installed on your Tablet.
It will be better if you have the same ROM version as I do in post in this post (#1).
You need to unzip the ROM so you can flash it in ODIN.

If you are on the same ROM version as in my post #1, then you can just download my rooted files.

Unzip my downloaded root files zip file.
Unzip the downloaded ROM files.

In the AP* file, you need to replace my files in the zip: boot.img, recovery.img & vbmeta.img

Start ODIN. Select files for BL*, AP*, CSC* & CP*
For CSC file, select HOME_CSC*
*** Uncheck auto reboot ***

Flash ROM.
After flashing ROM. press vol dn + pwr key
As soon as screen goes blank press vol up key and hold
When get into recovery, select data wipe, then reboot
Set up phone as you normally would.
After setup, go to Play store and install Magisk Manager. Run Magisk Manager to see if you have root.


Do It Yourself Instructions
You need to do some research before doing this. This is NOT a walk you by the hand tutorial. You need to learn some things before following these instructions. Learn how to use lz4.exe. Learn how to use simg2img. Learn how to make a .tar file.


Make a backup of you apps & data before doing this. This procedure will
wipe all you data.

Go to settings.
Select software info
Tap build number 7 times to get into developer mode
Go back to main settings page.
Scroll to bottom and select developer mode
In middle of page find OEM unlocking
Make sure slider is all the way to the right (should say allow bootloader to be unlocked)

Unlock bootloader:
1. turn off tablet
2. press and hold down vol up & vol down keys together
3. insert usb cable (should already be connected to computer)
4. when bootloader screen appears, release all keys
5. press and hold vol up key for 5 seconds, then release
6. read instructions on screen to unlock bootloader (this will wipe all your data)

After reboot, go through normal setup.

Now for the hard part.

You need to download the complete ROM you have installed on your Tablet.
Extract ROM files
Extract system.*.lz4, recovery*.lz4 and vbmeta*.lz4
Use tar to make an AP.tar file with the 3 above files. **Search the Internet if you do not know how to use tar.
Copy the AP.tar file to your phone. It is better to use adb push to prevent file correuption.
Install Magisk Manager from Play store.
Run Magisk Manager. Select install Magisk. Choose Select and Patch a file. Follow directions on screen to patch the AP.tar file.
Once the AP.tar file has been patched, use adb to pul the file to yur computer.
Extract the file from the AP.tar file.

Now come the hard part:

You cannot edit .lz4 directly. You have to decompress them. After decompressing system*, use simg2img to decompress the sparse file. Search the Internet if you do not know how to do this.

Now we make our modified files so they will flash in ODIN.

Instructions:
I used hex editor neo - a windows 10 app
I opened the stock kernel & recovery files in hex editor neo
I opened the Magisk modified kernel & recovery files in hex editor neo
I copied the modified kernel & recovery code onto their respective stock files in hex editor neo
I saved the stock files & closed hex editor neo.
I used cygwin to create a tar file: boot.img, recovery.img, vbmeta.img plus other files in original AP*.MD5 file.
You should also flash all ROM *.MD5 files (BL, CP, CSC) per Magisk instructions.
New AP.tar contents:
boot.img
dtbo.img.lz4
meta-data
recovery.img
system.img.ext4.lz4
userdata.img.ext4.lz4
vbmeta.img
vendor.img.ext4.lz4

I used Odin to flash the tar file

Flash ROM.
After flashing ROM. press vol dn + pwr key
As soon as screen goes blank press vol up key and hold
When get into recovery, select data wipe, then reboot
Set up phone as you normally would.
After setup, go to Play store and install Magisk Manager. Run Magisk Manager to see if you have root.

After installing Magisk:

(Powering up normally) → (System with NO Magisk)
(OEM Recovery Key Combo) → (Splash screen) → (Release all buttons) → (System with Magisk)
(OEM Recovery Key Combo) → (Splash screen) → (Keep pressing volume up) → (Actual recovery)

Please follow my instructions and the install instructions from Magisk web page.

Magisk Installation
 
Last edited:

J.Michael

Senior Member
Jan 20, 2018
306
113
43
What system do you use to manipulate the files? (Windows? Linux? Android?)

What is "overlay"? Do you extract the boot.img from the original AP.tar.md5, and from the magisk-patched.tar, copy the magisk-patched-boot.img to the beginning of the original-boot.img, and then replace the boot.img in magisk-patched.tar?

Do you give Odin four files, or just AP? Do you use CSC or HOME_CSC?
 

gcrutchr

Senior Member
Jun 11, 2009
1,094
520
113
Bangkok
What system do you use to manipulate the files? (Windows? Linux? Android?)

What is "overlay"? Do you extract the boot.img from the original AP.tar.md5, and from the magisk-patched.tar, copy the magisk-patched-boot.img to the beginning of the original-boot.img, and then replace the boot.img in magisk-patched.tar?

Do you give Odin four files, or just AP? Do you use CSC or HOME_CSC?
In answer to your question, basically, yes.
I only flash the 3 files in the .tar file

I am on a Windows 10 laptop. Only 3 files need to be modified by Magisk: boot.img, recovery.img, vbmeta.img
I use Hex Editor Neo for overlaying the modified kernel and recovery files..
At the end of these 2 stock files is code that needs to be there, thus the 65 MB file size.
So I open the stock .img files (boot, recovery) in Hex Editor Neo, and copy the modded boot, recovery code into each stock .img file..
I use cygwin to create the .tar file, then flash with ODIN 3.1.14
 
Last edited:

J.Michael

Senior Member
Jan 20, 2018
306
113
43
Where does this leave you with respect to booting? Do you have to hold down buttons like you're trying to boot to recovery, then let go at the right time, to boot with Magisk active? Have you booted "normally" since you installed Magisk? Is Magisk still active? Have you shut down completely and then rebooted?

Wu's writeup says, when he's patching an AP file, to install to recovery, the boot.img is patched to "remove the signature of the image to prevent soft bricks". He doesn't explain why the signature would cause a soft brick with an unlocked bootloader and a nulled-out vbmeta. If you're restoring the original signature, it seems like you're flirting with the situation he was trying to avoid.

Will you be posting in the main Magisk thread. Aside from the news of another success, the details of your solution might help Wu improve the automatic patching enough to make manual adjustments unnecessary.
 

gcrutchr

Senior Member
Jun 11, 2009
1,094
520
113
Bangkok
Where does this leave you with respect to booting? Do you have to hold down buttons like you're trying to boot to recovery, then let go at the right time, to boot with Magisk active? Have you booted "normally" since you installed Magisk? Is Magisk still active? Have you shut down completely and then rebooted?

Wu's writeup says, when he's patching an AP file, to install to recovery, the boot.img is patched to "remove the signature of the image to prevent soft bricks". He doesn't explain why the signature would cause a soft brick with an unlocked bootloader and a nulled-out vbmeta. If you're restoring the original signature, it seems like you're flirting with the situation he was trying to avoid.

Will you be posting in the main Magisk thread. Aside from the news of another success, the details of your solution might help Wu improve the automatic patching enough to make manual adjustments unnecessary.
No keypress is required for booting to maintain root.
I have tried this multiple ways: shutdown/boot & reboot - still have root.
I have not posted in main Magisk thread yet. Can you give me a link to the main thread where I can post this information?
 

Gartrax

Member
Dec 29, 2010
6
2
0
Cochabamba
Well, besides the possible outcomes, I tried the method and it worked for me. I'm not loosing magisk between boots too, not touching system apps but I can install modules and get root.
So, thank you very much for the finding!
 
  • Like
Reactions: blueberry.sky

gcrutchr

Senior Member
Jun 11, 2009
1,094
520
113
Bangkok
Well, besides the possible outcomes, I tried the method and it worked for me. I'm not loosing magisk between boots too, not touching system apps but I can install modules and get root.
So, thank you very much for the finding!
You're welcome. Enjoy your Tab A now that you have root.
 

secretwolf98

Senior Member
Jan 30, 2017
1,446
608
113
Iowa
ryzen5-3600.github.io
I have root on my SM-T295 A8 tablet!!

Attached boot.tar file is for XXU2ASL3 only.

T295-Magisk-AP.tar

Okay, after multiple failed attempts, I read about a method to root my T295. It did not work!! But, I decided to just use Magisk Manager on the boot.img file only. The resultant file would not flash - it will fail. The original boot.img & recovery.img files are 65,536K bytes each. I had to take the Magisk modified boot.img and overlay it onto the original boot.ing file. I did the same for the recovery.img. Then the files would flash successfully. The first thing after booting was to check Magisk Manager. It showed I have Magisk 20.3 installed. So, I tested this with Root Explorer. I did have root!!

If you are going to try this, you need to unlock your boot loader, I think. I have not tried this with a locked bootloader.
You must have a unlocked bootloader to proceed. How did you overlay the files?
 
  • Like
Reactions: blonderulez

amnher

Senior Member
Sep 23, 2011
3,073
585
253
33
Taguig
In unlocking the bootloader, does it have any negative side? I remember on my sasung s5 before that i would loose what they call knox and not be able to restore permanently. How abiut in the 2019 tab?
 

gcrutchr

Senior Member
Jun 11, 2009
1,094
520
113
Bangkok
In unlocking the bootloader, does it have any negative side? I remember on my sasung s5 before that i would loose what they call knox and not be able to restore permanently. How abiut in the 2019 tab?
Probably the same situation. I do not care about knox. I do not care about Samsun Pay.
I have not tested anything to restore knox.