#!/usr/bin/env sh ## OnePlus Two (64 GB) [2015] - aarch64 (ARM64 / ARM 64-bit) ## Flash/Patch path: OOS 3.6.1 (Android 6) -> LOS 16.1 (Android 10) + TWRP v3.2.1 + Magisk v27 ## ## When flashing OOS, it will put on latest (official) firmware as well as system and recovery ## This is why OOS ZIP is so large over LOS (as it only has system) ## Firmware = partitions? = bootloader/fastboot, bootanimation, radio, etc ## ## Device needs to have USB debugging mode enabled via developer options already ## Settings -> System -> About phone -> Build number: 7x taps ## Settings -> Search: "USB Debugging" -> Enable -> Always allow: RSA key fingerprint ## _Menu structure changes between Android 10 + 11_ ## ## If device bootloader is locked, when unlocking will reboot the device, breaking this script ## Re-run script (may need to re-enabled USB Debugging) ## ## Unlike OnePlus One: ## - Able to install LOS & TWRP in the same session (without rebooting in-between) ## ## Kali NetHunter: ## - NetHunter isn't (yet?) supported on LOS 17.1 (only LOS 16.1) ## ## Alt Flash/Patch path: ## OOS 2.0 (Android 5) -> OOS 3.6.1 (Android 6) -> LOS 16.1 (Android 10) + TWRP v3.2.1 + Magisk v27 ## OOS 3.6.1 (Android 6) -> LOS 17.1 (Android 11) + TWRP v3.2.1 + Magisk v27 ## - If starting with OOS 2.x, its bootloader/firmware doesn't support: $ fastboot boot [...] ## OOS 2.2.1-2 and under doesn't support it ## OOS 3.0.2 and above DOES support it ## - OOS recovery doesn't support ADB. At all. Out Of The Box (OOTB)/default/at boot/at start, or even an option to enable it in a menu. ## However, able to use OOS recovery to use a signed OOS ZIP to upgrade via SD/USB (can upload when in system mode) ## Thus, flash/patch path: OOS 2.0 -> OOS 3.6.1 -> LOS 14.1 ## - Would recommend starting with OOS 3.6.1 over OOS 2.0 - mostly due to automation! ## Doing OOS 2.0 gives a complete wipe (back to stock/vendor/manufacturer settings) - also the only time recovery was replaced ## Everything else "upgrades" - as settings are carried over (like developer options was still enabled) ## ## Can manually extract the OOS ZIP and run `fastboot flash {modem,sbl1,rpm,tz,dbi,aboot} [...]`, to skip out doing system and recovery_ ## Diff between OOS 2.x and 3.x: Some `./RADIO/static_nvbk.bin` (3.x), `./firmware-update/{logo,sdi}.bin` (2.x) ## $ rm -rf oos/; mkdir -pv oos && cd oos/ && cp -vf ../OnePlus2Oxygen_14_OTA_002_all_1507251956_wipe.zip . ## unzip OnePlus2Oxygen_14_OTA_*.zip ## fastboot flash modem firmware-update/NON-HLOS.bin ## fastboot flash sbl1 firmware-update/sbl1.mbn ## fastboot flash sdi firmware-update/sdi.mbn ## fastboot flash aboot firmware-update/emmc_appsboot.mbn ## fastboot flash rpm firmware-update/rpm.mbn ## fastboot flash tz firmware-update/tz.mbn ## fastboot flash LOGO firmware-update/logo.bin ## fastboot flash static_nvbk RADIO/static_nvbk.bin ## fastboot flash system system.new.dat ## fastboot flash boot boot.img ## fastboot flash hyp firmware-update/hyp.mbn ## fastboot flash pmic firmware-update/pmic.mbn ## fastboot flash bluetooth firmware-update/BTFM.bin ## fastboot flash recovery ../oos-op2-recovery.img ## cd ../ && rm -rf oos/ ## fastboot reboot ## ## Recover from soft/hard brick ## REF: https://xdaforums.com/t/guide-unbrick-or-restore-to-oos-using-only-fastboot.4289013/ ## https://droidwin.com/download-msm-download-tool-unbrick-any-oneplus-device/#OnePlus_X_MSM_Download_Tool ## ## Misc terms: ## - OOS recovery refers to bootloader as fastboot ## - OOS system refers to bootloader as bootloader ## ## ./$0 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ## wait_device wait_device() { #set +x; while ! adb devices | grep -q recovery; do echo "[i] Waiting on the device to be in recovery mode"; sleep 2; done; sleep 2; set -x #set +x; while ! adb devices | grep -qw 'device$'; do echo "[i] Waiting for the first time install/setup wizard to be completed, and for USB debugging to be re-enable via developer options"; sleep 5; done; sleep 2; set -x #set +x; while ! adb devices | grep -qw 'device$'; do echo "[i] Waiting on device to be in system mode, with USB debugging enabled"; sleep 2; done; sleep 2; set -x ## Gets to be too verbose set +x; mode="${1:-recovery}" case "${mode}" in recovery) device="recovery" msg="[i] Waiting on the device to be in recovery mode"; i=2;; setup) device=device msg="[i] Waiting for the first time install/setup wizard to be completed, and for USB debugging to be re-enable via developer options"; i=5;; system) device=device msg="[i] Waiting on device to be in system mode"; i=2;; *) echo "[-] Unknown mode: ${mode}" >&2 && exit 1;; esac while ! adb devices | grep -q "${device}$"; do echo "${msg}" sleep "${i}"s done; ## Be verbose again set -x } # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ## Be verbose - show commands set -x ## Path may need altering ## REF: https://download.g0tmi1k.com/android/oneplustwo-oneplus2/ cd ~/oneplustwo-oneplus2/ ## Bootloader adb reboot bootloader fastboot oem device-info fastboot oem unlock # If device was previously locked, will see a prompt. Select Yes and it wipe all data before rebooting. Plus will break this script! # > FAILED (remote: 'oem unlock is disabled') -> Need to have "Enable: OEEM unlocking" via developer options being enabled # Unlock will erase user data, continue? Yes/No #adb reboot bootloader # Solution to the above issue (or just re-run!) ## Team Win Recovery Project (TWRP) ## Can't automate OOS's recovery due to lack of CLI options (so will need todo this a few times) ## Will be overwritten when flashing OOS fastboot flash recovery twrp-3.2.1-0-oneplus2.img # Need to have "disabled: updated recovery" via developer options when enabled fastboot boot twrp-3.2.1-0-oneplus2.img # Will fail if current ROM is OOS 2.x # Doesn't always work (may need to completely power off and boot into recovery - hold power & volume down, until on/vibrate) ## Stock/Vendor ROM (OxygenOS - OOS) wait_device recovery #adb push OnePlus2Oxygen_14_OTA_002_all_1507251956_wipe.zip /sdcard/oos-2.0.zip; adb shell 'twrp install /sdcard/oos-2.0.zip' # Will replace TWRP/recovery adb push OnePlus2Oxygen_14_OTA_032_all_1710240102.zip /sdcard/oos-3.6.1.zip; adb shell 'twrp install /sdcard/oos-3.6.1.zip' # Will NOT replace TWRP/recovery ## Team Win Recovery Project (TWRP) ...again adb reboot bootloader # TWRP can't install IMG files from CLI (yet), otherwise could install itself from itself! fastboot flash recovery twrp-3.2.1-0-oneplus2.img # Re-flash TWRP, as OOS replaced theirs fastboot boot twrp-3.2.1-0-oneplus2.img # Workaround, as can't do: $ fastboot reboot recovery ## LineageOS (LOS) + Magisk wait_device recovery adb push lineage-16.0-20200426-nightly-oneplus2-signed.zip /sdcard/los-16.1.zip; adb shell 'twrp install /sdcard/los-16.1.zip' #adb push lineage-17.1-20210605-nightly-oneplus2-signed.zip /sdcard/los-17.1.zip; adb shell 'twrp install /sdcard/los-17.1.zip' adb push Magisk-v27.0.apk /sdcard/Magisk-27.apk; adb shell 'twrp install /sdcard/Magisk-27.apk' # v28.0 doesn't work with TWRP, but does work with: $ adb install Magisk-v28.0.apk adb reboot ## (Re-)Enable developer mode wait_device setup ## Kali NetHunter ## REF: https://gitlab.com/kalilinux/nethunter/build-scripts/kali-nethunter-kernels/-/raw/main/devices.yml #wait_device system #adb push *nethunter*oneplus2*.zip /sdcard/nh-10.zip #adb shell 'twrp install /sdcard/nh-10.zip' # Opt'ing to to install via Magisk instead #adb shell 'su -c magisk --install-module /sdcard/nh-10.zip' # Needs Internet access to complete first time app launch of Magisk (aka update) then patch boot and finally reboot tp apply before this command fully work exit 0 - - - ## OOS 2.x fastboot boot failing ```console $ fastboot boot twrp-3.2.1-0-oneplus2.img Sending 'boot.img' (22180 KB) OKAY [ 1.838s] Booting FAILED (remote: 'dtb not found') fastboot: error: Command failed $ ```