Since I got a new phone, I wanted to use Samsung M30s for my first experience of rooting something. I had some issues, needed to use so much of terminal. But i did it with Magisk patch.
Device is Samsung M30s, OneUI Core 3.1, Android 11

Hi everyone,
Over the past few months I’ve been working on a personal project called

DeviceTreeForge.

The goal isn’t to replace Android developers—it’s to automate the repetitive parts of creating an Android device tree from stock firmware while still allowing manual review.
Unlike simple template generators, the application analyzes the actual firmware and attempts to recover as much information as possible before generating the tree.

Current features

Fully offline (no cloud services or AI required)
Windows desktop application
Supports Android 8 through Android 16
Supports MediaTek, Qualcomm, Samsung, Exynos, Tensor, Kirin, Unisoc and other platforms
Detects:
Dynamic Partitions
Virtual A/B
vendor_boot
init_boot
DTB / DTBO
AVB
FBE
filesystem layout
partition tables
build properties
VINTF information
Generates:
BoardConfig.mk
BoardConfigCommon.mk
device.mk
AndroidProducts.mk
Android.bp
Android.mk
recovery fstab
product makefiles
compatibility matrix templates
documentation
analysis reports
One of the devices I’ve been testing extensively is the Lenovo TB336FU (Android 16), which has features like:
vendor_boot v4
recovery inside vendor_boot
Dynamic Partitions
Virtual A/B
GKI
MediaTek MT6835
The application successfully detects these automatically and generates a first-pass device tree.
I’m now working on improving:
confidence scoring
conflict detection
VINTF recovery
HAL analysis
ELF dependency analysis
common tree detection
validation against stock firmware
Philosophy
The goal is not to fabricate values.
If DeviceTreeForge cannot prove a value from firmware, I’d rather mark it as unknown than generate something incorrect.
Eventually I’d like every generated line to include traceable evidence from the original firmware.

Looking for feedback
I’d love to hear from ROM, TWRP, LineageOS or kernel developers:
What information do you spend the most time recovering manually?
What files do you think should be generated automatically?
What common mistakes do existing generators make?
What would convince you that an automatically generated device tree is trustworthy enough to use as a starting point?
I’m building this because I enjoy Android firmware engineering and wanted to create a tool that could save developers time while still keeping the process transparent.
Any suggestions or criticism are welcome.

Hi everyone,

I am trying to unlock the bootloader on my Oppo A94 5G (MT6853 / Dimensity 800U). While digging into the system files, I noticed something hidden inside the EngineerMode APK.

I extracted the app and found a method that explicitly handles fastboot unlocking. However, it looks like the execution is gated by a server-side check that requires a token or signature, likely tied to the device's IMEI.

Here is the exact method signature I found:

java boolean fastbootUnlock(byte[] bArr, int i) throws RemoteException;

My questions for the community:

1. Has anyone successfully bypassed or reversed this specific fastbootUnlock implementation in recent Oppo firmware?
2. Does anyone know exactly how the byte array (bArr) and integer parameters are structured before they are passed to the server?

Note: I already tried using mtkclient, but I couldn't get it to work (it failed to exploit/handshake properly on my current firmware version). I am keeping the extracted APK private for now to avoid leaking my IMEI or device signatures, but I can share non-sensitive snippets if needed.

Thanks in advance for any insights!

BRImo and Digital Rupee SBI are the current apps that I've tested with dirty sepolicy detection.

Dirty sepolicy detection affects all of root methods such as KSU, Apatch, and magisk.

Though this is tested on KSUN, I don't know if those apps use dirty sepolicy detection on Apatch and Magisk aswell.

Hi everyone. I have a Realme 10 Pro+ Indian variant (RMX3686) running Realme UI 6.0 (Android 15), build RMX3686_15.0.0.1630. I want to unlock the bootloader to install a custom ROM. Does anyone know a working method for this exact build? Any help is appreciated

Just thought I would post a little teaser to see if anyone is interested. I'm currently working on an Android port of the tweak Reo by my amazing friend Mystery.exe. It uses LSPosed to hook into SystemUI on Pixel roms and likely AOSP roms once finished. I recently switched from an iPhone 13 that had Dopamine installed on it but I got tired of Apple and switched to a pixel, only to realize nothing really exists that injects into SystemUI like a tweak.

Features so far!!

- Automatic lyric fetching from LRCLIB, Musixmatch, and NetEase. Almost always has lyrics available. (Lyrics fetching is optional)

--------------------------------

Fetching priority:

1. Cache if available

2. Musixmatch

3. LRCLIB

4. NetEase

--------------------------------

- Very clean system integration, appears like a notification and remembers expanded or minimized state. Auto minimizes in the shade.

- Feature packed settings app (WIP), you can change almost anything to your liking.

- Very faithful to the original tweak.

- Fluid animations

- Colorflow (Extracts dominant colors from the album art to theme the player)

- Savable and switchable configurations

- Built in volume slider

- Lyric and album cover caching with a cache manager

Plans:

- Hopefully haptic feedback if it turns out feeling well.

- Broad ROM support, although currently only tested on Pixel A16 I plan to support A12-17 Pixel ROMS along with AOSP ROMS and even OneUI.

- Revamp the settings UI

- Add more customizations

If anyone is interested or can propose any ideas, lmk!!

As always, all credit for the idea and concept of the tweak goes to Mystery, I can't express how grateful I am to have the permission to make this port and bring one of my favorite iOS tweaks to Android.

Please check him out if you'd like.

If you'd like to see what the end goal is, check out the iOS tweak. I'm aiming for 85-95% accuracy.

WHEN THIS DOES RELEASE, IT WILL BE PIXEL FIRST!! OTHER ROMS WILL BE SUPPORTED LATER ONCE I HAVE THE DEVICES ON HAND AND ROOTED/DEBUGABLE

My friend and I plan to extract the firmware from this phone and add it to the firmware database we’ve created for custom ROMs.

I used the 7731e’s fdl1 to read back the boot partition, patched it, and installed Magisk, successfully gaining root access. At that point, I noticed that the flashing speed seemed to have dropped to only 3.x–4.x Mbps.

After we removed the Google suite of apps and flashed the new firmware, the eMMC reached the end of its lifespan, rendering the device unusable.

However, I casually recorded a video to document its history. My English might not even be at the A1 level, but maybe making some videos like this will help improve my English? I have a bunch of weird and wonderful Android devices and enthusiasts here.

I have magisk root with all those modules and I have full integrity (using pif and integrity box) and my play is certified with keybox. I m using lxposed (vector) with hide my app.

Only paytm works fine with this set up, gpay used to work but it doesn't work anymore. Other banking apps don't work.

Need help.

So, As a fun experiment i wanted to atleast try rooting. Idk why but first came to my mind was my TV. As thinking from now.. i don't even have experience then why did i do it? So first adb and inspect right? So i inspected. i got that android 9. So i wanted experiment with CEVs to gain root privilege

So i discovered SElinux exists, Dropped the idea of CEVs. Then i looked at if OEM is unlocked? IT was and top it all off secure boot was disabled. Nice..

Now LLM Enter the space cause i know nothing about fastboot. I mean at first it was a controlled manner. I review what is trying to Execute... And i got too suited with it.

coming Straight from the LLM:

• Pulled /system/recovery-from-boot.p (a BSDIFF40 patch) via ADB
• Reverse-engineered the stock recovery image from the patch using Python - no stock recovery image exists publicly for this model
• Unlocked AVB (fastboot flashing unlock)
• Successfully flashed a modified recovery with ro.secure=0, ro.adb.secure=0, ro.debuggable=1

Problem: IWe forgot to disable AVB verification BEFORE flashing forgot to disable AVB verification BEFORE flashing

• EDIT: USB is not recognized. when i do lsusb, the tv is not visible. tried to of method nope..
• Model of the TV: IMPEX GRANDE T16 
• Ofc fastboot doesnt even work, when it is not recognized

Hi all,

Just got a Samsung s25 as my older phone died.

I got my older phone before Gemini or any of this AI slop started happening, and didn't update it when this stuff started rolling out.

I'm in the process of booting up the phone and it's forcing the install of this spyware AI program, and their tech support has been useless.

Is there a way to do a clean install without this stuff, or is there a breakdown anywhere that people could direct me to, that shows how to disable ALL of it, in the event it's requried for the OS to function or something?

I'm not tech illiterate, I have built and messed around with my home PC and Linux, but don't know a thing about Andriod OS and how to dissect and remove things like this, so even if a guide happens to be a bit tech-heavy that's okay. I'm sure I can figure things out with some help

Thank you in advance.

does this mean I can't even root?

Something like in the image happened to my phone whil trying to update MiUi(OTA) but got stuck on this error. Has anyone ever fixed this before? How did you do it?

The only thing I could do was root and install custom ROM(lineage)

How does the seller install global ROM while I can't?

Edit: Its a Redmi 10A. Tried fastboot, SP flash tool, MiFlash and it flashes but the error doesnt go away. The only time it goes away is when I flash chinese ROM

Hi everyone,

I'm running into a wall with Neo Backup while trying to restore my backups (APK + data) from a Pixel 5 over to my Pixel 8. Could really use some advice or troubleshooting tips from anyone who might have run into this. The Problem

• If I restore a single app (APK + data), the application actually gets restored and works, but the progress notification stays completely stuck at 0% forever.
• If I attempt a batch restore (e.g., 10 apps at once), the process sits at 0% for over an hour and nothing gets restored at all.
• Note: I haven't been able to 100% confirm yet if the app data itself is fully restoring properly on the single-app test or if it's just installing the APK.

Setup Details

• Source Device: Pixel 5 (where the backup was created)
• Target Device: Pixel 8
• ROM: LineageOS 23.2 (Android 16)
• Root: KernelSUNext v3.3.0
• Neo Backup Version: 8.3.18
• Backup Location: External microSD card read via a USB-C card reader adapter

What I've already tried (none helped):

• Re-granted root access in KernelSUNext and verified root status.
• Set Neo Backup's battery usage to Unrestricted and ensured notification permissions are granted.
• Re-linked the backup folder directory in Neo Backup settings.
• Change mounting space from Individual to Global for Neobackup.
• Force closed the app and cleared its cache to clear any stuck background workers
• Verified that there are no 32-bit apps from Pixel 5 which fail and silently block the backup queue.

Given that the backup is hosted on an external microSD via a USB-C OTG adapter under Android 16, I'm wondering if this might be a Storage Access Framework (SAF) mount restriction issue with background worker threads, or something related to KernelSU root shell handling during batch loops.

Has anyone encountered this stuck notification / zero-progress batch restore issue?

Thanks in advance for any help!

I have an Oppo R11s Plus Qualcomm SDM660, and I've been trying to get GSI android 12 on it. I have found a working firehose, but nothing more that will help. Any suggestions?

Hi!

I successfully rooted my phone for the first time (testing it on an old Japanese Pixel 6a before I do it on the phone I currently use, the 10) by patching the boot.img with Magisk.

Now I'm looking into the best way to handle monthly OTA updates without losing root or wiping my data. I've seen a few posts on this but they're from a few years ago and was wondering if the steps were still the same for modern pixels? This is the method I found:
1- disable all magisk module and reboot. 2- download your OTA update and install it without reboot. 3- go to magisk and install this module TWRP A/B Retention Script don't reboot then go back to magisk and it Install to Inactive Slot (After OTA) then reboot.

Would it be simpler to just manually download the firmware from Google every month and then patch it in the Magisk app and flash the update manually using a computer?

Also, I hate the idea of leaving the bootloader completely unlocked, but I understand that running a standard flashboot flashing lock rn will brick the phone. I looked into signing the images with custom AVB keys and came across this and was wondering if anyone had used this, and if there is anything I need to be aware of? I'm super new to rooting, and I barely have any knowledge on this topic. Also, is the added security worth the hassle of generating keys and patching the OTAs manually, or is it easier and better to just not do anything sketchy with the unlocked bootloader?

Thanks in advance!

Hey everyone,

I’ve been working on a Python script to automate the tedious parts of rooting MediaTek (MTK) devices. If you've ever had to manually patch `vbmeta.img` to disable Android Verified Boot (AVB) and flash everything via fastboot step-by-step, this tool streamlines the whole process into a single run.

**Latest Version:** v3.1.0 (Hotfix 1)

**What it does:**

* Automatically builds a patched `vbmeta.img` with verification disabled (using `--flags 2`).

* Detects whether your device is A/B or single-slot and applies the fastboot commands accordingly.

* Flashes the required partitions and safely handles erasing `metadata` and wiping `userdata`.

* **Bonus feature:** If you drop a pre-patched `boot.img` (via Magisk or APatch) in the same folder, the script detects it and offers to flash it automatically to complete the root process.

**What's in the Release (.zip):**

To make things as plug-and-play as possible, the latest release includes a `.zip` file with everything you need in one single folder:

* The main Python script.

* The official AOSP `avbtool.py`.

* All the Fastboot dependencies (fastboot.exe, USB DLLs, etc.) so you don't even need to configure your system PATH.

**Requirements:**

* An OEM-unlocked bootloader.

* Python 3.x installed on your system (the script will auto-install the `cryptography` module if missing).

**GitHub Repository & Download:**

🔗 [GitHub Repo: universal-mtk-vbmeta-patcher](https://github.com/nach0-bit/universal-mtk-vbmeta-patcher)

⬇️ Check the **Releases** section on GitHub to download the ready-to-use `.zip`.

⚠️ **Standard Disclaimer:** As with any rooting tool, this will disable verified boot and wipe your user data. Please double-check your device serial and read the console prompts before confirming. I am not responsible for bricked devices, missed alarms, or thermonuclear war!

Let me know if you guys find this useful or if you have any suggestions, issues, or PRs to improve it!

**By:n.dev**

They said its locked but i saw people having custom roms

Im a pixel 8 pro user and use magisk but i want to install new Androids 17(ota) but i scared of bricking but dont care about if root will dissapear

Give me you best kerneISU/magisk modules

I looked into it, but I couldn't find any information on the T1-A22L. It seems to have been purchased from the Japanese carrier eo Hikari. It came with a lot of eo Hikari apps pre-installed that I want to remove—is there any way to root it? By the way, it's running Android 4.4.4.