Rooting the Cosmo Communicator

[v3ritas]

I forget how I was getting root on my Gemini while using stock firmware, but may be similar to this.

For the Gemini, Planet provided a pre-rooted boot.img for us to flash with the SP Flash Tool. Unless you're saying you might have done something else.

Do we have recovery images yet for the Cosmo? May need those (either for root or when I inevitably break something while trying to root).

Not that I know of. I did come across this last night though: 'Mediatek (MTK) Auto TWRP recovery porter by Team Hovatek' - https://forum.hovatek.com/thread-21839.html. It looks recently developed enough that it might just work once we extract the stock recovery image  These Hovatek people are champs.

Good luck! And let us know what you learn

It's using the "new" unlocking commands (`fastboot flashing unlock`), but currently hung at the prompt because I can't find out what's bound as the volume keys on the device. Going to try to play around with it while I'm at work today.

Here's some info from `fastboot getvar all` though:
?  ~ fastboot getvar all
(bootloader) max-download-size: 0x8000000
(bootloader) variant:
(bootloader) logical-block-size: 0x200
(bootloader) erase-block-size: 0x80000
(bootloader) hw-revision: ca00
(bootloader) battery-soc-ok: yes
(bootloader) battery-voltage: 3734mV
(bootloader) partition-size:flashinfo: 1000000
(bootloader) partition-type:flashinfo: raw data
(bootloader) partition-size:otp: 2b00000
(bootloader) partition-type:otp: raw data
(bootloader) partition-size:userdata: 1be53f8000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:cache: 1b000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: c0000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:vendor: 35800000
(bootloader) partition-type:vendor: ext4
(bootloader) partition-size:tee2: c00000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:dtbo: 800000
(bootloader) partition-type:dtbo: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-size:boot: 2000000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:lk2: 100000
(bootloader) partition-type:lk2: raw data
(bootloader) partition-size:lk: 100000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:nvram: 4000000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-size:gz2: 1000000
(bootloader) partition-type:gz2: raw data
(bootloader) partition-size:gz1: 1000000
(bootloader) partition-type:gz1: raw data
(bootloader) partition-size:cam_vpu3: f00000
(bootloader) partition-type:cam_vpu3: raw data
(bootloader) partition-size:cam_vpu2: f00000
(bootloader) partition-type:cam_vpu2: raw data
(bootloader) partition-size:cam_vpu1: f00000
(bootloader) partition-type:cam_vpu1: raw data
(bootloader) partition-size:sspm_2: 100000
(bootloader) partition-type:sspm_2: raw data
(bootloader) partition-size:sspm_1: 100000
(bootloader) partition-type:sspm_1: raw data
(bootloader) partition-size:scp2: 600000
(bootloader) partition-type:scp2: raw data
(bootloader) partition-size:scp1: 600000
(bootloader) partition-type:scp1: raw data
(bootloader) partition-size:spmfw: 100000
(bootloader) partition-type:spmfw: raw data
(bootloader) partition-size:md1dsp: 1000000
(bootloader) partition-type:md1dsp: raw data
(bootloader) partition-size:md1img: 6400000
(bootloader) partition-type:md1img: raw data
(bootloader) partition-size:proinfo: 300000
(bootloader) partition-type:proinfo: raw data
(bootloader) partition-size:sec1: 200000
(bootloader) partition-type:sec1: raw data
(bootloader) partition-size:persist: 3000000
(bootloader) partition-type:persist: ext4
(bootloader) partition-size:seccfg: 800000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-size:protect2: 978000
(bootloader) partition-type:protect2: ext4
(bootloader) partition-size:protect1: 800000
(bootloader) partition-type:protect1: ext4
(bootloader) partition-size:metadata: 2000000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:nvdata: 4000000
(bootloader) partition-type:nvdata: ext4
(bootloader) partition-size:nvcfg: 2000000
(bootloader) partition-type:nvcfg: ext4
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:expdb: 1400000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:para: 80000
(bootloader) partition-type:para: raw data
(bootloader) partition-size:recovery: 2000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot_para: 100000
(bootloader) partition-type:boot_para: raw data
(bootloader) partition-size:preloader: 80000
(bootloader) partition-type:preloader: raw data
(bootloader) serialno: << Redacted >>
(bootloader) off-mode-charge: 1
(bootloader) warranty: yes
(bootloader) unlocked: no
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: k71v1_64_bsp
(bootloader) slot-count: 0
(bootloader) version-baseband: MOLY.LR12A.R3.MP.V66.11
(bootloader) version-bootloader: k71v1_64_bsp-7c4ca86-20191029135153-201
(bootloader) version-preloader:
(bootloader) version: 0.5
all: Done!!
Finished. Total time: 0.015s
?  ~

EDIT: Added the unlocking command above: `fastboot flashing unlock`

EDIT2: Okay, got the bootoader unlocked -- it looks like the button(s) in the fingerprint sensor are bound to volume. After hitting that I was able to actually get it through the unlock process. Now to see about getting a boot image to modify with Magisk for root.
? ~ fastboot getvar all
...
(bootloader) unlocked: yes
(bootloader) secure: no
...
? ~

[v3ritas]

I'm pretty much stuck. Tried a few different things I found online related to getting a dump of the current firmware, but wasn't successful. Trying to avoid using any app I come across (also running Linux), but through one of the tutorials I have a template for the scatter file. I'm attaching it here in case it helps anyone else out.

Going to keep trying, but don't think I'll be able to accomplish anything before Planet releases the firmware or a way for us to root themselves.

EDIT: Might have the wrong chip there -- the MT6771 appears to be for MediaTek P60, not the Cosmo's P70.

[ZimbiX]

Good news, everyone!

I've managed to make decent progress with WwR. The UI in the latest version is a bit different from the tutorial I linked, but I've managed to generate a full scatterfile, and have commenced a full readback of the device! It looks like that's going to take a very long time to finish, so I thought I'd update here in the meantime.

Next up would be to use WwR to split the backup into individual image files.

Given it seems so easy to do that, I think I'll do a factory reset of my Cosmo and upload a full stock backup so no one else has to go through the same process. That way it'll be easy for anyone to use the SP Flash Tool to do a factory reset

The blocking two-minute donation prompt on launching WwR is pretty annoying, haha. I would donate to get rid of it - plus they really deserve the money - but the PayPal form's loaded in the app, which is pretty dodgy. I think I'd prefer the delays than risk having my payment details stolen via man-in-the-middle

Actually, I've just realised I could have simply readback only the boot image partition now that I know the partition layout from the scatterfile  I think I'll do that next before working out the splitting.

Going at 29.53MB/s, it's 32% done as I post this! I'm excited, haha.

I've attached the scatterfile for anyone else interested in playing around

[ZimbiX]

Ok, I've extracted the boot image from the partition called 'boot' (using WwR on my full device backup), and patched it in Magisk Manager on the Cosmo. Here are the original and Magisk'd images:

boot.img: https://mega.nz/#!x8lXTKjT!kXjEjYGD...36v2Tbht3a4n1yQ
boot-magisk.img: https://mega.nz/#!U8sFVACI!J-TS3q11...V1YIVDipez05BvE

Flashing the Magisk'd image (with Sp Flash Tool v5.1916 using the scatterfile I uploaded), I'm unfortunately seeing this message on top of the splash screen:

Bad State

Your device has failed verification and may not
work properly.
Please download boot image with correct signature
or disable verified boot.
Your device will reboot in 5 seconds.

Flashing the original boot image back at least gets the Cosmo working again.

I'm terribly late for bed, so sadly I'll have to wait until the weekend to continue. We're so close now!

I'm guessing this error is where the bootloader unlocking comes in - @v3ritas: your turn!

[peter]

Ok, I've extracted the boot image from the partition called 'boot' (using WwR on my full device backup), and patched it in Magisk Manager on the Cosmo. Here are the original and Magisk'd images:

boot.img: https://mega.nz/#!x8lXTKjT!kXjEjYGD...36v2Tbht3a4n1yQ
boot-magisk.img: https://mega.nz/#!U8sFVACI!J-TS3q11...V1YIVDipez05BvE

Flashing the Magisk'd image (with Sp Flash Tool v5.1916 using the scatterfile I uploaded), I'm unfortunately seeing this message on top of the splash screen:

Bad State

Your device has failed verification and may not
work properly.
Please download boot image with correct signature
or disable verified boot.
Your device will reboot in 5 seconds.

Flashing the original boot image back at least gets the Cosmo working again.

I'm terribly late for bed, so sadly I'll have to wait until the weekend to continue. We're so close now!

I'm guessing this error is where the bootloader unlocking comes in - @v3ritas: your turn!

Last night I had success unlocking the bootloader using adb and fastboot per the instructions here: https://www.thecustomdroid.com/unlock-bootl...fastboot-guide/

This morning I installed the boot-magisk.img file using fastboot starting at step 12 of Method 2 here: https://www.thecustomdroid.com/install-magi...ndroid-devices/

Successfully booted, and Magisk is now installed, so I've got root?  Maybe?  I've always used SuperSU, so I need to learn how Magisk works.

[v3ritas]

Ah, this is great~ Thanks ZimbiX!

Didn't get a chance to check on this while I was at work today so this is a nice surprise. Getting mine rooted now.

Glad you were able to get the app working to dump the scatter file. I don't have a Windows laptop anymore & it was not going well for me when I tried do it through VMware Fusion on my Mac.

peter: Yes, if you have Magisk then you're rooted. If you have any apps that use root you can go ahead & give them a try, or if you already have you can check what has rights in Magisk Manager > Superuser.

I'm getting it flashed now, as soon as my Cosmo finishes charging.

EDIT: I forgot, since we're just flashing the modified boot image, Magisk Manager needs to be installed separately. You can download it from the XDA thread here.

[peter]

peter: Yes, if you have Magisk then you're rooted. If you have any apps that use root you can go ahead & give them a try, or if you already have you can check what has rights in Magisk Manager > Superuser.

I'm getting it flashed now, as soon as my Cosmo finishes charging.

EDIT: I forgot, since we're just flashing the modified boot image, Magisk Manager needs to be installed separately. You can download it from the XDA thread here.

Thanks for your reply, v3ritas.  Unfortunately, what I'm seeing on my Cosmo doesn't match the descriptions I'm reading about.  Magisk Manager was pre-installed.  Even after unlocking the bootloader, flashing the modified .img, and updating Magisk and MM,  I'm left with the following:

 [ Invalid Attachment ]

When I hit Ok, I get a small pop-up saying "Setup failed."  I couldn't find anywhere to toggle superuser permissions.  The info I've read at xda so far seems to assume that the additional setup has been completed successfully.

I'd be grateful for any tips!  Tomorrow when my brains are fresh, I'll try un- and then re-installing, but I'd really rather not.

[ZimbiX]

When I hit Ok, I get a small pop-up saying "Setup failed."  I couldn't find anywhere to toggle superuser permissions.  The info I've read at xda so far seems to assume that the additional setup has been completed successfully.

I'd be grateful for any tips!  Tomorrow when my brains are fresh, I'll try un- and then re-installing, but I'd really rather not.

Damn, that's annoying!

I've just had a go, and got it working on mine  After tapping 'ok' on the 'Requires additional setup' popup, it runs a spinner for a few seconds, then reboots. Root confirmed working via Termux

I flashed boot using the SP Flash Tool rather than using fastboot if that makes any difference. I can't work out what the key combination is to boot straight to fastboot - maybe there isn't one..?

Edit: Did you retry it? Maybe the download failed somehow. And maybe there's logs somewhere - adb logcat while you do it?

Edit 2: It's amusing that the only way to tell a Cosmo and Gemini apart in these kinds of photos is by the subtle presence of the third hinge in the centre =P

[v3ritas]

When I hit Ok, I get a small pop-up saying "Setup failed."  I couldn't find anywhere to toggle superuser permissions.  The info I've read at xda so far seems to assume that the additional setup has been completed successfully.

I'd be grateful for any tips!  Tomorrow when my brains are fresh, I'll try un- and then re-installing, but I'd really rather not.

Damn, that's annoying!

I've just had a go, and got it working on mine  After tapping 'ok' on the 'Requires additional setup' popup, it runs a spinner for a few seconds, then reboots. Root confirmed working via Termux

I flashed boot using the SP Flash Tool rather than using fastboot if that makes any difference. I can't work out what the key combination is to boot straight to fastboot - maybe there isn't one..?

Edit: Did you retry it? Maybe the download failed somehow. And maybe there's logs somewhere - adb logcat while you do it?

Edit 2: It's amusing that the only way to tell a Cosmo and Gemini apart in these kinds of photos is by the subtle presence of the third hinge in the centre =P

I did get the same prompt about needing additional setup, hit okay & think mine clocked a little too. After that I was set though. Tested through ADB shell & worked as expected. I also flashed the Magisk boot.img through fastboot, so I don't think that would be causing the issue.

I wasn't sure about the key combo for direct fastboot either. I think using the Assistant button just works on the different OS boot methods, but I usually just go through `adb reboot bootloader` instead of fumbling around with the required keys per device.

[peter]

I've attached the scatterfile for anyone else interested in playing around

So, here's a question.  Would it be possible to manually tweak the Cosmo scatter file by comparing it to a Gem file and use the Debian .img provided by Planet for the Gem to set up a dual boot Cosmo? Or is that Debian .img too heavily customized for the Gem to work on our new devices?

I'd just go ahead and try it myself, but I still haven't wrangled Magisk Manager successfully.  I'm aiming to do that so I can use Titanium Backup before moving on to further experiments...

[AP756]

Thank you all contributing to this thread. With the scatter.txt and boot-magisk.img provided by ZimbiX I was able to root my Cosmo about 4h after receiving it :-).

Now I'm going to "improve" it the way I used to optimize my Gemini.

Update 1: Started Magisk manager, within Magisk installed Riru-Core and then Riru-EdXposed (SandHook), installed edXposed manager.apk, rebooted and started edxposed. It works!

Update 2: Within edXposed I installed GravityBox [P] v 9.1.3, updated modules list  and rebooted. It works :-)

Regarding "Your device has failed verification and may not work properly..." I think this message is most probably located in lk (21500000). In another forum someone tweakd this area, the text is gone, but the 5 sec waiting time still exists. We'll know when the Planet Computers solution of rooting is published. For the time being I just ignore that message ;-)

Bye for now

[xopher]

These steps do work, I had to update my ADB Fastboot Driver to get the bootloader to unlock (curse words happened during that process). I don't want to provide the source of the updated driver in case the source I used is not altruistic.

Now, I wait for someone knowledgeable and/or brave enough to make a new scatter file with an empty partition to add some Linux spice to my device. I wonder if PC will host a partition tool before the community provides and figures out the key combos.

I imagine PC doesn't want to open the floodgates so they can focus on general support first. Their undertaking is not a small feat even at 4000. Imagine the possibility of having 4000 hungry infants to feed at once with only a few baby feeding bottles, YIKES!

I'm pretty sure since bootloader is unlocked NFC payments are out of the question since the device is "untrusted", it is possible your banking apps may no run on it post bootloader unlock since you broke the trust (if the app checks for that sort of thing). This is something to consider before unlocking ("tampering") with bootloader, you know your use case.

I might be wrong but thought I'd throw that last bit out there since no one else mentioned it. An LG Watch I had became ineligible for NFC payment until I reverted it back to "natural" state and Samsung has Knox, all the same principal, and I could be wrong.

Time to tame battery drain. My Gemini has a lot more stamina than Cosmo ATM (what are others using for power mgmt and background process control these days?? That is another question for another subforum).

BTW, hi; I'm new here, thanks for allowing me to fly the OESF skies!

[gidds]

We'll know when the Planet Computers solution of rooting is published.

Is that definitely ‘when’, rather than ‘if’?  Have they said anything on the issue?

(My Cosmo is scheduled to be delivered tomorrow, but I won't be able to set it up and transfer everything from my Gemini without having rooted Android…  At first glance, the above posts looks pretty daunting; I'd be much happier if Planet provided downloadable firmware for the Cosmo, the way they did for the Gemini — after a lot of pain, I know how to use that!)

[MadAdy]

Hi owners, FYI Bootloader Unlock is in Developer Options.

Tap on Build Number in About Phone.

[v3ritas]

We'll know when the Planet Computers solution of rooting is published.

Is that definitely ‘when’, rather than ‘if’?  Have they said anything on the issue?

(My Cosmo is scheduled to be delivered tomorrow, but I won't be able to set it up and transfer everything from my Gemini without having rooted Android…  At first glance, the above posts looks pretty daunting; I'd be much happier if Planet provided downloadable firmware for the Cosmo, the way they did for the Gemini — after a lot of pain, I know how to use that!)

It's not as bad as it looks above. That was mostly just work when we were figuring out how to get root working. Right now the process is just to unlock the bootloader (which will wipe the device) & either backup & modify your own boot.img from the device, or use the already Magisk'ed one that ZimbiX has posted.

I'm waiting for those recovery images too. Hopefully will have some time this weekend to make a proper backup, so I have something to restore if I ended up doing harm to my device with root. That's part of the reason I haven't done anything crazy with root right now.

Hi owners, FYI Bootloader Unlock is in Developer Options.

Tap on Build Number in About Phone.

Also need to then boot to the bootloader & run `fastboot flashing unlock`. The button(s) in the fingerprint scanner worked as volume keys to confirm I wanted to unlock (& wipe the device in the process).