[Tutorial]Root Oppo F1s with FlashTool for 6.0 (SafetyNet Passed/no red status bar)

[evilhawk00]

First of all, big thanks to @ngoralph sent me a link at May. It's a post looks like a working guide rooting A1601 with flash tool, however it's written in Vietnamese,none of us understand Vietnamese. I finally have some time to take a deeper look at that guide and figure it out how it works.

2017.11.04 Update
Added a stock recovery image generated with install-recovery.sh and boot.img(Generated from A1601EX_11_OTA_002_all_201704120142_wipe.zip) for those who don't have stock recovery image
Download Stock recovery of 20170412 : https://drive.google.com/open?id=0B1X00ZJdxkKyR3g5V3BuTlNYdlU


In short, It seems like the process was done by a tool from phone repair services. The tool itself did try to connect to an oppo server when it's opened. Anyway, lets start

Benefits in comparison with other known old root method:
1.No modification to system.img, no red status bar "root detected", no need to replace SystemUI.
2.Pass SafetyNet.



SOMETHING YOU HAVE TO KNOW BEFORE DOING
*NOTE:This method uses meta mode*
1.You need a clean install 6.0 stock rom(factory reset)(6.0 Stock firmware installed by stock recovery not twrp, all the twrp for F1s are buggy).
*why buggy? take a look at /cache/recovery/xxx.log, you'll find out the ported recovery was compiled with different PixelFormat and also many different specifications, that's why the twrp recovery often give you a black screen.
2.Some twrp automatically did some modifications with your system.img to prevent stock recovery being recovered at boot, that might be the reason everyone see the read status bar "root detected"(modification detected). (Edit: Now there're more version of ported TWRP available, so this issue depends on the version of your twrp)
3.The flash tool will only work when you have mtk driver installed properly on your PC.
4.The new added dm-varity in oppo 6.0 rom will cause /data become unreadable with recovery, thus a format of /data is required (systemless root needs /data readable with recovery because they put su.img in /data).
5.Until now, I think this CTR recovery is the most stable recovery for oppo F1s


Preparations : Installation & Downloads before rooting process
1.Install mtk driver:
If you haven't have mtk drivers installed, you can follow this tutorial to install it on your PC
https://tehnotone.com/windows-10-mtk-vcom-usb-drivers-for-32-64-bit-drivers-installation-tutorial/(this driver also works on win7)

To install the driver under Windows 10, the only method is entering trouble shoot menu to temporary disable Driver Signature Enforcement and install it.(after next reboot, the driver will not work again. You will need to do the same trouble shoot menu procedure again if you want to use it again)
If you want the driver works permantly , enabling test mode will does the trick. To enable test mode, open cmd.exe with administrator privilege,type following command

bcdedit /set testsigning on

Other problems cause the flash tool not working!! If you're sure you installed mtk driver correctly.....
If you have Core Quarantine enabled in Windows Defender,the flash tool will not be able to download firmware to your phone.(Tried to fix driver problem but all no luck until i found this.......I spent almost a day to figure out this)
To disable Core Quarantine, go to ( Windows Defender Security Center> Device Security> Core Quarantine)

2.Download DownloadTool_1612.8.exe here
3.Download a Flashtool flashable stock rom here(Any build number version is okay, but need to match your phone's hardware specifications. 3GB ram = mt6750, 4GB ram= mt6755. Even you just want to flash a single partition, the FlashTool still need you to load a full firmware,so you have to download it.)
4.Download newest 6.0 stock firmware zip( You can use your own or here is a 20170412 6.0 build)
5.Download newest Magisk flashable zip here
6.Download a little modified CTR here with "ro.product.device=A1601" which can open all the stock firmware package. (modified from this CTR recovery (original CTR credits @BouyaPK) )


LASTEST EDIT : The modified CTR recovery seems has no problem to handle official OTA package correctly after being tested(unlike some old twrp builds have issues), if you found any problem with this CTR recovery for installing any official OTA Package, please report...
Good! Now you are ready to root your device !
Here's the steps:
old steps was abandoned due to lastest edit: no need to revert to stock recovery
1. Copy magisk, 6.0 stock firmware zip to your external sd card( internal storage may had been encrypted sometimes)
2.Flash CTR Recovery to your phone with DownloadTool...Video Demonstration for this step:
https://youtu.be/DPRzWiAaaCY
Open DownloadTool_1612.8.exe, choose "Developement Mode", enter password "oppodeve", then uncheck all partitions, leave only recovery checked, then select CTR recovery image as target. ==>Press start ==>Hold phone's volume up(when your phone is off) and connect it to PC with usb cable ==> the PC detected it ==> release volume up button.
3.After flashing CTR recovery, boot into recovery , hold Volume down key+ power key boot into CTR recovery
4.Do a full wipe with CTR recovery(factory reset in wipe menu)
5.[optional step] If you have android 6.0 on your phone installed before, your /data partition was encrypted when you boot 6.0 rom , you need to wipe /data(you will loose your internal SD data). To wipe /data , in CTR Recovery Click "Mounts/Storage" ==> Click "Format /data" . If you have 5.1 firmware on your phone before you do these steps, just skip this step.
6.Install stock firmware zip ( in CTR recovery main menu ==> Click "Install zip" ==> select the firmware zip and install) (IMPORTANT: you must not reboot phone before you've done step 7(install magisk)!!!!! If you reboot system before installing magisk, your /data will end up being encrypted, You will have to do step 5 wipe data then you can install magisk)
7.Install magisk zip ( in CTR recovery main menu ==> Click "Install zip" ==> select magisk and install)
8.reboot ==> select no when ask fix stock recovery
9. you have root with SafetyNet passed.


ScreenShots:
Proof Of SafetyNet On A1601 Marshmallow Rooted Rom

 

[ngoralph]

EDIT: followed the instruction and sucessfully done it
maybe you should include that the zip file to be downloaded in preparation 3 is only used to flash the recovery and that they can flash any firmware via stock recovery

 

[sagargjasani264]

Red root detection warning is only in MM..
It doesn't matter how you root, u will get that red statud bar in MM if u root it as it is implemented in systemUI..

 

[ngoralph]

Red root detection warning is only in MM..
It doesn't matter how you root, u will get that red statud bar in MM if u root it as it is implemented in systemUI..

nope, following this method i got root without the annoying status bar i think the red status bar triggers when something is edited in system ie like installing xposed since installing xposed triggers the red status bar even after doing this

 

[evilhawk00]

Red root detection warning is only in MM..
It doesn't matter how you root, u will get that red statud bar in MM if u root it as it is implemented in systemUI..

The old root method might have tampered something in system and it's possible related to TWRP because SafetyNet always show CTS profile mismatch.
With this method you can get SafetyNet pass, take a look at my screenshot, Safetynet passed ,no red status bar and also it's android marshmallow 6.0 Android Pay is only compatible with this root method.

I'm a player of pokemon go that's why I care SafetyNet

 

[sagargjasani264]

The old root method might have tampered something in system and it's possible related to TWRP because SafetyNet always show CTS profile mismatch.
With this method you can get SafetyNet pass, take a look at my screenshot, Safetynet passed ,no red status bar and also it's android marshmallow 6.0 Android Pay is only compatible with this root method.

I'm a player of pokemon go that's why I care SafetyNet

Thats good.. If u have flashed like this and have root access then can u try to flash twrp and check whats the results?
Bcos to flash custom rom of MM this CTR recovery wont work.. As it contains L data with L recovery..

 

[evilhawk00]

Thats good.. If u have flashed like this and have root access then can u try to flash twrp and check whats the results?
Bcos to flash custom rom of MM this CTR recovery wont work.. As it contains L data with L recovery..

I already tried, and failed with TWRP.

After the upgrade of Android 6.0, all the twrp stopped working on my device, all gave me a black screen, your MM twrp doesn't work on my device either. Even I reflashed twrp, still not working , the only solution for me is CTR.

I tried to figure out the reason twrp stopped working from /cache/recovery/xxx.log and found out all twrp was compiled with the different pixel format,such as RGB, which gave this black screen error. You can take a look at your recovery log.

I flashed twrp with flash tool, it gave me black screen so I couldn't do any operation to my system, but when I reboot, I got root detected status bar. I think the root detected might related to twrp itself.

That's why I chose CTR, correct pixel format and it did ask fixing stuff to prevent stock recovery being recovered(so I can choose no to keep system unmodified)

 

[betongsky]

Finally, thanks so much for dedication. So after flashing and rooting, is it ok to restore all the apps and data that has been backed up before flashing?

 

[sagargjasani264]

I already tried, and failed with TWRP.

After the upgrade of Android 6.0, all the twrp stopped working on my device, all gave me a black screen, your MM twrp doesn't work on my device either. Even I reflashed twrp, still not working , the only solution for me is CTR.

I tried to figure out the reason twrp stopped working from /cache/recovery/xxx.log and found out all twrp was compiled with the different pixel format,such as RGB, which gave this black screen error. You can take a look at your recovery log.

I flashed twrp with flash tool, it gave me black screen so I couldn't do any operation to my system, but when I reboot, I got root detected status bar. I think the root detected might related to twrp itself.

That's why I chose CTR, correct pixel format and it did ask fixing stuff to prevent stock recovery being recovered(so I can choose no to keep system unmodified)

Have you tried my new twrp or old one?
Bcos blank screen is different in both..
Previously it tooks 1-2min
But now after some modifications in some xml it boots after 10-15 sec..

I will try to make CTR recovery for M

 

[evilhawk00]

Have you tried my new twrp or old one?
Bcos blank screen is different in both..
Previously it tooks 1-2min
But now after some modifications in some xml it boots after 10-15 sec..

I will try to make CTR recovery for M

I tried both new and old. Both black screen, and~ it's not just few minutes only........ it showed black screen forever~~

The most weird part was that if I press power+ volume down , I can take a screenshot of twrp,the file was stored in dcim/screenshot , and the screenshot taken was white background and purple title bar(the title bar should be blue though)

 

[sagargjasani264]

I tried both new and old. Both black screen, and~ it's not just few minutes only........ it showed black screen forever~~

The most weird part was that if I press power+ volume down , I can take a screenshot of twrp,the file was stored in dcim/screenshot , and the screenshot taken was white background and purple title bar(the title bar should be blue though)

Strange.. Bcos i have tested it personally on my 3/32 version.. Still i will try to improve twrp... But right now I am behind bug in my custom rom...

 

[evilhawk00]

Finally, thanks so much for dedication. So after flashing and rooting, is it ok to restore all the apps and data that has been backed up before flashing?

of course yes! why not?

 

[betongsky]

Thank you so much bro evilhawk. Followed your tutorial, works flawlessly. Im on marsmallow now, with no annoying rooting detected on top. Thanks again and more power.

 

[betongsky]

Oops, after installing xposed framework via ctr, after boot there goes again the rooting has been detected on top. What have i done wrong? Anybody here pls enlighten me how to flash the signature file along with xposed framework via ctr? All I know is that the verification signature is enabled when i flashed the framework. Unlike twrp that i could flash signature, i cant see the signature file for my framework. Thnks in advance

 

[evilhawk00]

Oops, after installing xposed framework via ctr, after boot there goes again the rooting has been detected on top. What have i done wrong? Anybody here pls enlighten me how to flash the signature file along with xposed framework via ctr? All I know is that the verification signature is enabled when i flashed the framework. Unlike twrp that i could flash signature, i cant see the signature file for my framework. Thnks in advance

You can't install normal xposed because it it might modify your /system which will trigger "ROOT DETECTED". You have to use systemless xposed. Just a reminding that sometimes the newest systemless xposed has bootloop bug, the newest version of systemless xposed often have compatibility issue with updated magisk, always check the replies of the systemless xposed thread before installing any systemless xposed. If the newest version seems to cause bootloop, install an older version of systemless xposed. A buggy systemless xposed will definitely softbrick your phone,so a backup is necessary.

btw, what is "signature file" you mentioned????? what did you mean by " i cant see the signature file for my framework" , why kind of error did you encountered?
How did you flash signature with twrp, what's that????

 

[betongxda]

When installing xposed framework, the zip file i mean, is it a must that we flash along with it the .asc file? If so, how?
I mentioned twrp bec couple of years ago i remember flashing xposed framework, along with the .asc file, flashed together at once. And that .asc file i cant seem to find via bouyaks ctr.
However, no error occured after flashing xposed framework. Just like you said, the change in the system triggerd that annoying notice on top. I'll head to the systemless xposed thanks bro.
And one last, when restoring from backup(in ctr), system wont restore. Forgot the error msg, but it cause me to bootloop in recovery. Is it compatibility issue, or bug in ctr, or might be something ive done wrong? Anyway thanks replying to my inquiries bro

 

[evilhawk00]

When installing xposed framework, the zip file i mean, is it a must that we flash along with it the .asc file? If so, how?
I mentioned twrp bec couple of years ago i remember flashing xposed framework, along with the .asc file, flashed together at once. And that .asc file i cant seem to find via bouyaks ctr.
However, no error occured after flashing xposed framework. Just like you said, the change in the system triggerd that annoying notice on top. I'll head to the systemless xposed thanks bro.
And one last, when restoring from backup(in ctr), system wont restore. Forgot the error msg, but it cause me to bootloop in recovery. Is it compatibility issue, or bug in ctr, or might be something ive done wrong? Anyway thanks replying to my inquiries bro

ah....okay, after reading xposed thread, yeah there did exist an .asc thing which I never noticed before(I've seen that but didn't take that seriously), okay so the .asc thing is just a verification thing that verify the zip you downloaded was not corrupted, that's it! you can verify the signed zip with any GPG tools or something on PC.......I actually don't care about .asc because it seems useless to verify a zip before flashing unless your network is "extremely" unstable. I've never verify any zip with recovery and also never flashed a corrupted zip file(well, my network is very stable). Just flash the zip, the .asc is nothing related to xposed itself.

You know that when you install magisk, it patched your boot.img and also disable dm-varity? anyway there're so many possiblity to cause bootloop. I have no idea what did the zip file of xposed modify, but if dm-varity is enabled again that will cause recovery can not mount /data correctly and make the installation or restoration failed. Better check if there's an mount error of your /data. Anyway, that's just my prediction , only the error msg can give the correct information. The error log can be read from /cache/recovery/last_xxx.log, you can use "carliv menu" ==> aroma file manager ==> select aromafm.zip from external sdcard ==> use aroma file manager to copy that log to your external sd card so we can read the log and figure out what happened.

 

[betongxda]

ah....okay, after reading xposed thread, yeah there did exist an .asc thing which I never noticed before(I've seen that but didn't take that seriously), okay so the .asc thing is just a verification thing that verify the zip you downloaded was not corrupted, that's it! you can verify the signed zip with any GPG tools or something on PC.......I actually don't care about .asc because it seems useless to verify a zip before flashing unless your network is "extremely" unstable. I've never verify any zip with recovery and also never flashed a corrupted zip file(well, my network is very stable). Just flash the zip, the .asc is nothing related to xposed itself.

You know that when you install magisk, it patched your boot.img and also disable dm-varity? anyway there're so many possiblity to cause bootloop. I have no idea what did the zip file of xposed modify, but if dm-varity is enabled again that will cause recovery can not mount /data correctly and make the installation or restoration failed. Better check if there's an mount error of your /data. Anyway, that's just my prediction , only the error msg can give the correct information. The error log can be read from /cache/recovery/last_xxx.log, you can use "carliv menu" ==> aroma file manager ==> select aromafm.zip from external sdcard ==> use aroma file manager to copy that log to your external sd card so we can read the log and figure out what happened.

I see, might be the trials ive done after the detection appears, i mean not going tru the whole process. but its negative, we have to start from the very beginning(your tutorial). i could get used to the flashing process but its backing up and restoring that consumes time.
attached here are the last_logxx files, i zip them using xplore as i cannot see them tru carlivs...
oh oh... how to send files here? lol

 

[betongsky]

Attached are the lastlogxxs bro, zipped tru xplore.

 

[evilhawk00]

Attached are the lastlogxxs bro, zipped tru xplore.

I took a look at your log files, however I don't think there's any error when you tried to restore /system.


It's at log 5.
According to the log, all files in /system were restored successfully.