OnePlus 7 Pro: Update System Firmware on Custom ROM

Follow up to the OnePlus 7 Pro: LineageOS+MicroG post, where I mentioned I would have to update the Bluetooth & Modem firmware on my device. This fortunately went as smoothly as the LineageOS+MicroG install, so I’m very happy about that.

The first step was downloading the latest OxygenOS ZIP through this post: XDA Developers: [ROM][STOCK][FASTBOOT][OP7P] Stock Fastboot ROMs for OnePlus 7 Pro/ 7 Pro 5G by mauronofrio. The specific ZIP i pulled down from Android File Host was “10.0-GM21AA-OnePlus7ProOxygen_21.O.20_OTA_020_all_1909172051_db7a3f61-FASTBOOT.zip”. From there, it was just a simple matter of extracting that, images.zip, & flashing the bluetooth.img & modem.img files:

➜  Downloads cd 10.0-GM21AA-OnePlus7ProOxygen_21.O.20_OTA_020_all_1909172051_db7a3f61-FASTBOOT/images
➜  images file bluetooth.img
bluetooth.img: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 3, sectors/track 63, heads 255, sectors 16384 (volumes > 32 MB), serial number 0xbc614e, unlabeled, FAT (16 bit)
➜  images file modem.img
modem.img: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 10, sectors/track 63, heads 255, sectors 76800 (volumes > 32 MB), serial number 0xbc614e, unlabeled, FAT (16 bit)

➜  images adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
➜  images adb devices
List of devices attached
1234abcd        device
➜  images adb reboot bootloader
➜  images fastboot devices
1234abcd        fastboot
➜  images fastboot flash bluetooth_a bluetooth.img
Sending 'bluetooth_a' (828 KB)                     OKAY [  0.030s]
Writing 'bluetooth_a'                              OKAY [  0.005s]
Finished. Total time: 0.049s
➜  images fastboot flash bluetooth_b bluetooth.img
Sending 'bluetooth_b' (828 KB)                     OKAY [  0.032s]
Writing 'bluetooth_b'                              OKAY [  0.005s]
Finished. Total time: 0.050s
➜  images fastboot flash modem_a modem.img
Sending 'modem_a' (161700 KB)                      OKAY [  4.308s]
Writing 'modem_a'                                  OKAY [  0.633s]
Finished. Total time: 4.954s
➜  images fastboot flash modem_b modem.img
Sending 'modem_b' (161700 KB)                      OKAY [  3.769s]
Writing 'modem_b'                                  OKAY [  0.696s]
Finished. Total time: 4.480s
➜  images fastboot reboot
Rebooting                                          OKAY [  0.002s]
Finished. Total time: 0.002s
➜  images

Remapping Hardware Buttons: Mi MIX 3

Now that I was able to get my Mi MIX 3 setup with TWRP & a custom ROM (unofficial LineageOS 16 build), I started looking into remapping the AI button to something actually useful. I found a few posts to point me in the right direction, as well as a Magisk module that is supposed to handle this:

I tried out a bunch of the codes to see what would work, & for now just remapped the key to SEARCH, until I can find something better \ more useful.

There is a Magisk module for this, but I had issues making the selection during the install process: Magisk-Modules-Repo/XiaomiAI-remap. When I tried using the volume keys to change the intended function, it was actually changing my volume, not anything on the screen. Pressing the AI button during that process seemed to make changes to the choices, but still couldn’t get it working as intended. Instead, I just used the install.sh script for that module to make the change myself.

File: /system/usr/keylayout/gpio-keys.kl

cat gpio-keys.kl
# Copyright (c) 2013, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above
#       copyright notice, this list of conditions and the following
#       disclaimer in the documentation and/or other materials provided
#       with the distribution.
#     * Neither the name of The Linux Foundation nor the names of its
#       contributors may be used to endorse or promote products derived
#       from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

key 115   VOLUME_UP
key 114   VOLUME_DOWN
key 102   HOME
key 528   FOCUS
key 766   CAMERA
key 689   CAMERA

I changed key 689 to SEARCH on my device. If I can get the key to open a specific app, then I will likely end up changing the key to perform that function. Sending the keyevent for CAMERA doesn’t appear to do anything on my phone, but that may just be due to running the custom ROM. To test, the command to input key events is: adb shell input keyevent << number or function >>

Custom ROM on Mi MIX 3

I recently picked up a Xiaomi Mi MIX 3 & was able to unlock the bootloader after the 72 hour waiting period. That wasn’t a problem, however getting TWRP up & running was where I had a problem.

For some reason, whenever I would flash TWRP, but device was stuck in a fastboot loop — could not reboot out of it, boot the TWRP image, or any other method of exiting fastboot. I finally got TWRP working properly after flashing perseus_global_images_9.5.17_20190517.0000.00_9.0 _global_134d3070e5.tgz. I tried flashing one of the China ROM’s, & that was of no help.

Since this was turning out to be nothing close to simple like other devices, I was then running into an issue flashing NanoDroid after my ROM. That one seemed to be related to the /system partition not being found. It looks like my partition was instead mounted as /system_root, but the NanoDroid install script was looking for /system. Managed to fix that as well:

Results of mount:


/dev/block/sde48 on /system_root type ext4 (rw,seclabel,relatime,block_validity,delalloc,barrier,user_xattr)

Remount /system_root as /system:

perseus:/ # mount -o bind /system_root/system /system

Taking a look at NanoDroid-20.8.91.20190525.zip\CommonInstaller: Lines 248-252:

if [ -f /system/init.rc ]; then
mkdir /system_root 2>/dev/null
mount –move /system /system_root
mount -o bind /system_root/system /system
fi

Once NanoDroid was working, I then needed to double check how to restore my backed up Signal messages: Signal: Backup & Restore Messages.