https://drive.google.com/file/d/12dJJBRcJzO1kKWNeqMjqFotr5IdnyO8p/view?usp=sharing (Google Drive link no longer available)
- Flip Phones
Alcatel TCL Flip 2 (T408DL)
EnriqueMcquade So does the modified boot image run?
Yes, it worked on my flip phone without any problems but problem is, when I attempted to use su on the adb shell, it gave me a "Permission denied" error. I suspect that it's because of the operating system's file system restrictions.
it's suspected that the su binary is denied because the magisk app isn't installed.
usually in a case of running su from adb shell, the magisk app will launch a prompt asking you to confirm su access for the shell application. Essentially, the device is rooted, but until we have some kind of write permission to the system, or can in some other way disable the app install block.
I've been experimenting with magisk's Root Directory Overlay System to achieve this but haven't found much success.
I've also played around with what neutronscott was talking about, but the image fails to boot on my device when the cmdline is set to eng.
yeti So to have the su binary running, the Magisk app must be installed?
lgexalter1 Where is the source code for magisk?
Um, yes. But I don't have any problems flashing a patched image with an unlocked bootloader on my T408DL.
Yes
yeti Sorry I looked back at the code and it checks for "userdebug" not "eng"
Also Magisk comes with resetprop. @EnriqueMcquade can you use resetprop to set ro.vendor.tct.endurance to true or ro.build.type to userdebug
Probably I've tried to use this feature and it does nothing to me.
I'm kind of confused right now.
lgexalter1 I don't have additional steps. So anyway how the error looked like. It might be an incompatibility with the boot image I've provided to you because this boot.img is presumably tied to the T408DL.
EnriqueMcquade you mean it has an error or does it not set the property? After you set these you can try an apk install?
lgexalter1 I've heard that there are slight differences between the walmart family mobile t408dl and the tracfone t408dl. Which one do you guys have?
In fact, I have a Walmart Family Mobile version of the T408DL. Which I got from a local Walmart Supercenter in Georgia.
If the image is compatible with the T408DL, maybe I slightly made an error making the image or what could be possibility go wrong with such image?
I have a Walmart Family Mobile version. Mine boots fine with patched.zip that @Biden2020prez patched.
neutronscott I have also tried this and it doesn't work, Im assuming it needs to be allowed just like su.
My phone arrives tomorrow night hopefully. I made an attempt at writing a quick custom script that runs on boot using the patched.img that darth posted. It polls /data/local/tmp for *.sh files every 5 sec. It writes a .out file and skips .sh which already have a .out. Hopefully all running as root. If it works you should be able to do something like:
cd /data/local/tmp
cat >1.sh <<EOF
resetprop ro.vendor.tct.endurance true
resetprop ro.build.type userdebug
EOFWait 5 sec and check the properties...
lgexalter1 here EnriqueMcquade or stockboot.zip
Maybe I uploaded the wrong one. My phone just arrived and I've lots of ideas so hopefully tonight after work one of them works for us.
I've uploaded the new image in the same place if anyone wants to play with it. It just runs a script that looks for scripts in /data/local/tmp/*.sh that it will run as root.
eb50480572980ab6894b08789bbc47f0 neutron.img
https://scottn.us/downloads/neutron.img
neutronscott Your img booted fine but when trying to run su it still says Permission denied. And in /data/local/tmp there are no .sh files all thats showing is: mtk-su myscript.out. Am I supposed to be doing something to make your script run?
lgexalter1 I tried pushing a basic script and got the following errors: resetprop: __system_properties_init error which is the same error it throws when I try using resetprop in adb. (Thanx for asking around for a magisk exploit 😉 )
resetprop: __system_properties_init error
lgexalter1 Interesting... adb shell getprop ro.build.type returns userdebug andadb shell getprop ro.vendor.tct.endurance returns a blank line, in fact it seems there is no prop ro.vendor.tct.endurance.
Apps4Flip-Admin Apps4Flip-Admin Apps4Flip-Admin Can you explain these posts and update based on our current situation? What exactly needs to be modified?
I made it as a way to test things as root until more is discovered. For example:
Gflip6_TF:/data/local/tmp $ echo 'cat /vendor/build.prop' > 3.sh; sleep 5; cat 3.out | head
ro.boot.dynamic_partitions=true
ro.product.first_api_level=30
ro.vendor.build.security_patch=2021-09-05
ro.vendor.product.cpu.abilist=armeabi-v7a,armeabi
ro.vendor.product.cpu.abilist32=armeabi-v7a,armeabi
ro.vendor.product.cpu.abilist64=
ro.product.board=gflip6
ro.board.platform=mt6739
ro.hwui.use_vulkan=
Gflip6_TF:/data/local/tmp $THANK YOU @neutronscott FOR FIGURING OUT APP INSTALLATION/ROOT!!!
More details will follow!
lgexalter1 Definitely!
darth
I'm excited (and waiting) to hear the details of the breakthrough
Right now it can be done with using the boot.img neutronscott provided and than running the following commands from adb shell:
/data/local/tmp $ echo 'resetprop ro.build.product gflip6gc' > /data/local/tmp/1.sh
/data/local/tmp $ echo 'pkill system_server' > /data/local/tmp/2.sh
@neutronscott is working on simplifying his boot.img to not need these commands.
Thank You! This is amazing work @neutronscott . Can't wait to try it out later tonight!
Now that we are able to modify the properties to allow installs, next step is to get a MDM based filter working on it!
Apps4Flip-Admin What is a "MDM filter"? I am trying different things to make the new boot.img allow install without user intervention but I already tried to install a launcher from here and it was still not allowed. That is my next task, but @darth reminded me of the key shortcuts can be set to any installed app so at least that gets things running.
I decided to go with setting the ro.vendor.tct.endurance variable in a custom.rc.
on init
setprop neutron.build 2022-09-01T00:10
on post-fs-data
exec u:r:magisk:s0 root root -- ${MAGISKTMP}/magisk resetprop -n ro.vendor.tct.endurance trueSame URL but I kept the old img that ran the shell script every 5 sec as neutron-debug
This is built with Magisk-v25.2.apk
9612c358d5130c399787d1840b3fd5f0 https://scottn.us/downloads/neutron.img [neutron.build=2022-09-01T03:50]
eb50480572980ab6894b08789bbc47f0 https://scottn.us/downloads/neutron-debug.img
Instructions are something like --
- Open MTK Meta and select "Reboot Fastboot Mode"
- Plug in powered off flip phone
- fastboot flashing unlock
- fastboot flash boot neutron.img
- fastboot reboot
- Dial
*#*#DEBUG#*#*to enable adb (optional) - adb install magisk.apk (optional - can do online download later)
- Menu > Settings > Phone Settings > Key shortcuts
- Change left or right key to Magisk and select Save (If not an option, reboot once more)
- Launch Magisk
- Run adb shell and su!
EDIT: You need to reboot once for the magisk.db to be created and to keep your Grant saved
To remove write protection on emmc partitions in normal boot run /vendor/bin/write_protect 0
neutronscott Great work! An MDM filter is something that allows a user to block access to specific apps. A lot of users in this community use it to prevent there flip phone from having internet access, hence the reference here.
We would love to post these instructions on our main site with a link to your image. Are you ok with us doing that? What name would you want us to list as credit for this?
Apps4Flip-Admin Yes I think this thread is too long. Please put it on a device page or something 🙂
Just the handle neutronscott is fine.
neutronscott Will do! Thank You
@neutronscott Do you have a good site you would recommend to download mtk-meta from? All the links from a google search look spammy
Apps4Flip-Admin This is the direct link I used https://www.mediafire.com/file/7i5kcbdpnj17vky/MTKMETAUtilityV52.rar/file
So now the TCL flip 2 can install apps?
I realized the Magisk popup was because the patched.img was built with 25201 so I recreated it with the release version v25.2 (25200). Now I'll leave it alone for awhile.
ChaseChiller Sure can
neutronscott Do you need to install magisk with adb? Once your boot.img changed the props to allow for installation Im pretty sure the stub is installed already automatically and can be accessed using the settings>phonesettings>keyshortcuts
Also do you need to enable OEM unlocking before unlocking bootloader?
Im working on a zip with very basic instructions and all that is needed for app installation on this phone (ADB, MTKmeta, @neutronscott boot.img).
KCO mouse has the selecting glitch. Button mapper is not able to use the star and message and sos buttons.
darth Do you need to install magisk with adb?
Oh I didn't know. I just quickly tested after a factory reset and it did show up after a reboot, then after I setup wifi it installed after enabling magisk to install apps. So that way works fine too I just didn't have WiFi setup yet and didn't try rebooting. Perhaps the rc could be modified so that reboot isn't necessary.. I'll check it out tomorrow.
darth Also do you need to enable OEM unlocking before unlocking bootloader?
No. I never entered that menu on this phone.
neutronscott very impressive work you did, You've managed to circumvent the restrictions of this device, meaning you can install apks on this device.
lgexalter1 I just want to confirm you are using the tracfone version from amazon?