TWRP for Fairphone 4

Participate Development
, ,
121

Hello friends!

I’m currently doing some tests with linux-based alternatives OS on my FP4, Ubuntu Touch and Sailfish OS.
I wanted to try TWRP backup and restore, and share here my experience :slight_smile:
NOTE: those two OS are not encrypted so it’s ok for me.

On my FP2 I have a long and successful story of using TWRP to switch between alternative OSes.
It consists of backup and restore of 3 partitions : Boot/System/Data

Here on FP4 partitions are slightly different (A/B device), I found here that one can do:

  • Data Backup: select only the Data partition.
  • System Backup: select partitions
    • Boot
    • DTBO
    • Super which contains the logical system, system_ext, odm, product, and vendor partitions

I tried with Ubuntu Touch, however I have those red error message:

failed to mount '/system_ext' (Block device required)
failed to mount '/product' (Block device required)

and I’m only able to backup Data

NOTE that this could be already useful, in this case the restore process is:

  • Erase the previous OS
  • Fresh install of UT
  • TWRP restore of /Data partition, and reboot :slight_smile:

I then tried with SailfishOS and, even if there is no red messages, backing up of Super partition failed at 67% (4215Mo of 6264Mo).
Looking at the recovery.log, there is this error message:

Backing up Super (system system_ext product vendor)...
I:Reading '/dev/block/by-name/super', writing '/external_sd/TWRP/BACKUPS/xxx super.emmc.win'
I:Error writing destination fd (Operation not permitted)
Backup Failed. Cleaning Backup Folder.

Searching for a solution, I found here that this could be due to a FAT32 SD Card (and indeed my SD card is formatted in FAT32 filesystem)
I tried again on Internal Storage… and it worked :smiley:

[BACKUP COMPLETED IN 80 SECONDS]

I have now a full backup of SailfishOS 4.5.0.24.
In the backup folder (total size 7.73 Go), the file super.emmc.win is 6.00 Go big!

Could you try again? it could be the same issue :wink:

2 Likes
122

You are right, that might very well be the case, but I don’t think I have time to test that any time soon.

super isn’t really all that interesting to me since we have factory images now and I can just get it from there, data still can’t be decrypted so at least for Android backups TWRP isn’t all that useful at the moment.

But there will come a time when I switch my FP4 to proper Linux, so I’m closely following your discoveries :nerd_face:

1 Like
123

Hey you! That sounds awesome. Is there any update if accessing userdata with TWRP will be possible in the nearer future?

124
1 Like
125

Hello.
I am trying to boot twrp with the

fastboot boot twrp-3.7.0_11-0-FP4.img

command. I did the

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

thing before sucessfully.
However, when trying to boot, I get stuck on the black Fairphone-Screen (with the green Android in the lower left) and nothing more happens.
And no, I do not want to install it, I only want to boot it.

Anything I can do to get it working??

126

I had the same issue, as mentioned here…
Didn’t understood the cause and didn’t find any solution yet :frowning:
Olivier

127

Must be some issue with the image. I have a lineage recovery which I use ADB as root with. I can boot into it just fine.
As a Linux user I tried Windows, too: no difference. This sometimes helps, especially with Motorola Phones.

I have now contacted the programmers. Let’s wait what they might come up with…

128

Hi!

I also had a problem booting TWRP, but its a little different.
My phone is running latest CalyxOS, and is patched to run Magisk, so bootloader is of course unlocked. I have just installed it less than a week ago, as I have received that device secondhand (actually third, as I know).

I have downloaded TWRP 3.7.0 from this page: Download TWRP for FP4
Checksum checks out.

After rebooting my phone to bootloader, I used the fastboot boot twrp-3.7.0_11-0-FP4.img command as others above, and I get this error:

Sending 'boot.img' (98304 KB)                      FAILED (Write to device failed (Unknown error))
fastboot: error: Command failed

Then I have searched around and found that I might have been in fastbootd instead of real fastboot, so I have rebooted with adb reboot bootloader after starting up Android normally, and then I retried the fastboot command as above. From that on, I’m bootlooping too.
Removing the battery for a minute did not help.

I’ll soon try to switch the active partitions. I was assuming though that the fastboot boot command is not supposed write anything to flash, but now it seems as if it corrupted something.

Do you have an issue tracker for the TWRP variant of this phone? I could help with testing if thats helpful.

Also, does the phone have any kind of recovery system installed by default?
My first and so far only experience with it is that when I wanted to start it from the fastboot menu, it erased my data and I had lost everything. Fortunately I did not yet start moving over at that point. Is this expected?

1 Like
129

With fastboot set_active a I was able to boot Android normally, as Volker suggested in #73.
Magisk still has root capabilities, so for any Magisk users reading this in the future, you probably dont need to reflash the patched boot.img either.

Still, if I can help with testing TWRP, I’m interested. For the time being I’ll look around what other kinds of recoveries are there for the FP4.

1 Like
130

I have stumbled upon the Orange Fox Recovery (a TWRP fork) docs about this, and they this write about botting the recovery: Installing OrangeFox Recovery | OrangeFox Recovery wiki

If your ROM uses vendor_boot-as-recovery, or you have an A/B or Virtuaal A/B device with a dedicated recovery partition, you will not be able to do this. If you try to do it, you will brick your device.

If I’m not misunderstanding it, it seems its kind of expected that using fastboot boot anyrecovery.img on such a phone as the FP4 causes problems.

According to the output of ls -hal /dev/block/by-name/ being executed in an adb shell, this is an A/B partitioned device with dedicated recovery partitions (with an A/B pair as well), so this seems to apply to us too.

Why? No idea. Does fastboot boot write something, actually? Or does TWRP itself write something compulsively to somewhere? If the latter is the case, it seems to be broken, like if a bootable gparted ISO would write to an arbitrarty block device (a hard disk, ssh, pendrive, anything) when booting up.

But I know very little about modern android, so take this with a large grain of salt.

1 Like
131

Did you read that?

132

I did, yes. Why do you ask?

I dont tend to ignore such things, I understand that it is harder to recover a phone than any PC.

1 Like
133

Hi,
Im trying to install the TWRP from the SD card in recovery mode but the image file cant be seen.
I already tried to name it as recovery.img and i placed the file in the root folder.
Do you guys know why that?

Cheers

134

Which tutorial are you following?

I always installed TWRP with ‘fastboot’ command, from the computer.

135

Hi all,

Few quick questions:

  • Does the FP4 version of TWRP have the password protection feature?
  • Can AVB be re-enabled? Or is this just not possible because TWRP isn’t part of the verified filesystem from FP?
  • Can TWRP be updated if bootloader is relocked? (And AVB re-enabled, if possible)?
  • What are the remaining security risks if TWRP is installed and password protection is enabled? (And AVB re-enabled, if possible)

Cheers :slight_smile:

Ps - how to get vbmeta.img?

136

No idea, but couldn’t someone just flash a version that doesn’t have password protection to get around it?

No, you would need to build your own factory images with TWRP included so everything is signed with the proper key.

If you lock the bootloader AVB is enabled, if TWRP isn’t signed with the right key that’s a brick.
Updating TWRP as part of the images you built yourself, sure (same as any partition you’d change in an otaupdate).

Userdata is still encrypted if you access it through TWRP, unless the attacker has a way to decrypt it (if that’s the case they probably also have an EDL-loader) there’s not a lot they can do with it either way.

2 Likes
137

Hi @hirnsushi,
Thanks for your replies, I’m definitely rusty on all this hence some of my naive questions.

I thought locking the bootloader would stop someone doing this, but then later you say

Which I had not realised, that’s the first time I’ve read anywhere (though I’m sure it’s written somewhere) DON’T relock the bootloader if you’ve installed TWRP and you’ve not built the whole image and signed it yourself.

Thanks for the help!
Cheers :slight_smile:

138

Yes, locking the bootloader would disable flashing. In that case a password might be helpful, if available.

Or to put it differently, only lock the bootloader if the ROM you’ve installed supports it (Lineage OS doesn’t for example) and you haven’t modified the system.

If you modify the system partitions you’ll need to build it yourself, but I definitely wouldn’t for the little benefit TWRP provides in 2025…

2 Likes
139

but I definitely wouldn’t for the little benefit TWRP provides in 2025…

being able to make a full filesystem or partition image backup is very useful, not a little benefit. you cant reliably do that from a running system, and other than that only the recovery can give you access to the partitions (with ADB)

2 Likes
140

Thanks for the help @hirnsushi and @mpeter. For now, I already relocked the bootloader after downgrading from A14b to A13, so if a relocked bootloader with TWRP installed would be easy to do I would probably go through the pain of resetting and reinstalling again, however if the only way to get this is by either building TWRP myself (plus the rest of the ROM) then it’s not something I have time for now… or probably not until I retire! Anyway, it was good to learn, thanks :slight_smile:

1 Like