when using windows you need to make sure you have the right drivers i dont know exactly where they are
i used zadig
So if I install the Qualcomm_HS-USB_QDLoader_9008_Driver and boot into EDL mode and my phone shows in device manager under ports with 9008 - Are you saying that this is not necessarily the right driver? and if I had the correct driver would that cause the QFIL to display my partitions as described in your guide? Thanks for the feedback.
It took a couple of days to figure out, lol.
I am on Win11 and rooted a Verizon XP3800.
At first I tried the QFIL program and it would not work. I had to do the manual install of bkerlerâs EDL (windows>method 2) to get python working (only with cmd - doesnât work with powershell). Then I used the Zadig program to swap the Qalcomm driver for the Winusb driver. I followed the instructions on bkerlerâs github to convert the edl loader (firehose). The EDL program kept throwing errors but I finally got the command right for creating a backup of my boot partition:
edl.py r boot boot_backup.img --memory=eMMC --loader=C:\Users\<my username>\edl\Loaders\<my custom firehose.bin>
Then I flashed your modified boot_magisk.img using edl but it didnât work - got bootloop. Finally I followed @anonymousfliphones guide for rooting (just the bit about sideloading magisk and file explorer) and used magisk to modify my original boot_backup.img.
SUCCESS!
I flashed it with edl using:
edl.py w boot boot_backup.img --memory=eMMC --loader=C:\Users\<my username>\edl\Loaders\<my custom firehose>
Now to install your ultimate app installerâŚ
Thanks to everyone who helped!
1 Like
Congratulations!! Thanks for documenting your workflow.
Can you explain what the bootloop issue was and how you fixed it? And what did you have to convert the firehose to and why?
Also, before you rooted you wouldnât be able to make my ultimate installer as device owner since Verizon had their own device owner. Now that youâre rooted, you can sudo disable it and then mine working.
BUT once youâre rooted, you donât have to use mine which requires device owner privileges, you can just use any root installer out there. Iâm not familiar with root installer options but I heard that there are some. If there arenât any good ones, I can make one (will work the same as the device owner installer and just use different install method. Or I can add it as an option in the app.) but I believe there are probably good ones out there already
1 Like
Iâm not sure why your image was causing the bootloop. The phone would hang on the Verizon splash and after a while would bring up a recovery screen to reset to factory (which didnât help). I tried a couple of times then flashed back to stock using my backup img. I did notice that when writing your image it was like a 0x0950 sector and then when I flashed my modified original backup it was a sector of 0x1000.
The instructions for converting the firehose are on the edl github page and I just went with it to avoid further errors. It might work fine with the the original firehose but I figured the converted version might be read differently by the edl script for some unknown reason.
I found your app and guide before my phone even arrived in the mail and was bummed when I couldnât get it working. The whole reason for attempting this root was to be able to disable the Verizon MDM device ownership. Iâm hoping to get the TextFree app working on this phone because I use it for work.
Thanks again.
1 Like
Interesting. Maybe I was wrong and for some weird reason the boot img is different in Verizon which is very weird.
I never saw their guide. Maybe itâs for more recent versions of edl. I used it without modding the firehose but with an older clone of edl I had.
Regarding your app situation, I hope you know that adb does work even before any root to install apps so if you just need one app you couldâve gotten around it but whatever.
1 Like
I did know about using adb but was interested in the freedom of not needing it.
1 Like
Btw any xp3800 users here would be interested in a xp3 root app similar to the one I made for the xp5s? It enables root access and everything but not modifying protected partitions. Also has itâs own app installer bundled in to install apps with root. Just install - no rooting or device owner stuffâŚ
Not really needed once itâs possible to root for real but I started working on it earlier this week and then got busy with other stuff (like zemer)
Iâll just have to finish porting the underlying cve to aarch32 (xp3 is 32 bit unlike xp5) which is proving to be quite a job but fun when Iâm bored 
2 Likes
It might be difficult to get back to the stock launcher if youâre using Molla. Itâs probably best not to choose it as âalwaysâ default home until youâre comfortable with it or find another way to reset the default home app. You can do this (change defaults) with another launcher - Before launcher v7.6.0-54 - but you might need to connect a bluetooth mouse to set it up. If you want to dive deep into customizing this phone with various root apps, a bluetooth mouse is a great tool to have.
C9 is a great mouse
1 Like
Still testing - set at own risk:
to get notifications working with other home launchers
edit /system/system/system.prop
find and set:
ro.config.low_ram=false
save file.
1 Like
another work around for notifications is to map a keypress to the actual notification activity.
I logged the action with adb then sifted through the output to find the activity. Then I used Key Mapper to put it to work. This method could potentially work for mapping the quick setting toggles too.
Hereâs a command that invokes the notification screen with su privileges:
su -c 'am start -n com.android.systemui/.NotificationManagerActivity'
1 Like
Sonim XP3800 Hotspot Entitlement Bypass (Visible / Verizon)
Somewhere along the line I botched my hotspot capabilities. Iâm on Visible and all plans include free hotspot but the phone would fail Verizonâs server check for hotspot service. With some help from a friend we managed to trace the issue to an android related blockage and a simple shell command fixes it and survives reboots:
adb shell
su
pm disable-user --user 0 com.borqs.carrier
reboot
this can be reversed with:
pm enable com.borqs.carrier
reboot
4 Likes
Does it need su
Iâm not sure. Depending on which shell is being used (linux, windows | cmd, powershell etc.) the adb shell su -c 'pm disable....method of passing su can fail. That doesnât answer your question but I thought I would add. I havenât tried (that i can remember) without su but one could try something like: adb shell -c 'pm disable-user --user 0 com.borqs.carrier'- I doubt it.
In otherwords :
adb shell su -c âcommandâ
is not as reliable as entering shell first with just:
adb shell
and then entering commands from there.
1 Like
@ars18 this is your style stuff
Iâm trying to get an Android 8.1 device to turn off SeLinux on boot using an init.rc script (which runs as root). The issue is that SeLinux wonât let me disable it even when called as root from an init script. I tried all sorts of context and stuff. Did anyone have any tricks up there sleeves to get this done?
(I have root and can write to /system and itâs init scripts..)
1 Like
K I think Iâm just giving up. Itâs probably impossible. I tried so much stuff and SeLinux gets in the way EVERY SINGLE TIME!!
We all hate SeLinux. no?
I like that SeLinux is very good for security. BUT
If I already have root and init and what not - BUG OFF!!
At that point Iâm not a hacker anymore. Iâm just trying to utilize my device (or Iâm a very skillful hacker that is already deep enough anyway).
What phone
And whatâs the end goal