Samsung Tab S4 bootloop (Android 10), cannot enter Safe Mode, cannot disable magisk modules (need to solve without wiping data)

[skag1nnya86]

Device: SM-T835 (LTE) Android version: 10 Magisk version name: 5f4cd50 Magisk version code: 23017

Basic Info:

• Device: SM-T835 (LTE) (Samsung Tab S4 LTE) [GSM Arena Info]
• Android version: 10 (Stock ROM Link — before patching via Magisk)
• Magisk version name: 5f4cd50c (Installed with Preserve force encryption option enabled by patching boot image file "AP_xxx.tar.md5 file" with Magisk Manager, as per this tutorial)
• Magisk version code: 23017

• • • Problem: My Samsung Tab S4 was working well, rooted, with Magisk installed. It entered bootloop after I installed ADB Root Magisk Module and tried to reboot my device.

I tried to boot in Safe Mode (to trigger modules disabling) with no success to solve bootloop (details in point [1] in What I tried section below).

These are collected logs when I tried patched boot image file (AP_xxx.tar.md5) using Magisk latest version (23000) and using canary version (23017):

• magisk.log and recovery logs (using v23.0 (23000))
• magisk.log and recovery logs (using canary version 5f4cd50c (23017))
• magisk.log and recovery logs (using canary version 92546e8a (23016))

Based on what I tried (detailed below), it seems there's no way to disable modules using the official way (triggering Safe Mode boot) or using a recovery script/procedure to disable modules as neither official recovery, nor TWRP can access /data (where magisk modules are installed).

What I think is a solution is to be able to patch the boot image file (AP_xxx.tar.md5) to produce a patched magisk_patched-_xxx.tar file with all modules forcibly disabled by default (without the need to enter Safe Mode), so I can boot to my system and uninstall the Magisk modules that're causing bootloop. Then, I can repatch the boot image file (AP_xxx.tar.md5) back to normal with all modules enabled by default.

I know this request was brought up before, and the final decision made was to make Magisk detect if booting in Safe Mode (for better user experience). But it seems the Safe Mode method isn't working well for some of devices (other issue for another one facing somehow similar glitch). So it will be a great fix to provide the other option of being able to have a patched force-all-modules-disabled boot image as well.

---

What I tried (with no success at all):

1. Tried to boot Safe Mode (in order to disable all modules, as per this), by holding volume down key when Samsung logo appears (as per this). However, bootloop persists. It seems that either my device cannot boot into Safe Mode, or Magisk doesn't respond to Safe Mode and doesn't disable any installed module. Also I tried too many other different key and holding time combinations on the hope that I'll be lucky and Magisk detect somehow Safe Mode, but with no success.

2. Tried adb command adb wait-for-device shell magisk --remove-modules, but device isn't detected at all. Device isn't shown at all using adb devices command. (as per this guide)

3. Tried to install Magisk Module Uninstaller/Disabler and Magisk Manager for Recovery Mode using Official Recovery & TWRP but neither was successful to install because /data is inaccessible from TWRP and official recovery doesn't allow unverified packages installations.

4. Tried reflashing non-rooted (totally clean) Stock ROM (original, not patched by magisk). I used HOME_CSC_xxx.tar.md5 instead of CSC_xxx.tar.md5 file in order not to wipe my data. I got the expected error: Verification failed. Unable to restart your device. The integrity verification has failed. You need to reset your device to factory default settings. This will erase all your data.

5. Tried reflashing magisk-rooted Stock ROM (original AP_xxx.tar.md5 patched by Magisk, as per this: guide on how to install OTA with keeping data). I used HOME_CSC_xxx.tar.md5 instead of CSC_xxx.tar.md5 file in order not to wipe my data. I had a try with Magisk latest version (23000) and another try with canary version (23017) but both returned to the state as it is, bootloop..

[hhihhio]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

[skag1nnya86]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

I already mentioned in point [3] that /data is inaccessible from TWRP (because Preserve force encryption was enabled when I patched my boot image with Magisk at first, and this makes dm-verity / AVB enabled), so any solution depending on accessing /data from TWRP (including the one you mentioned) will not work unfortunately.

[HuskyDG]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

I already mentioned in point [3] that /data is inaccessible from TWRP (because Preserve force encryption was enabled when I patched my boot image with Magisk at first, and this makes dm-verity / AVB enabled), so any solution depending on accessing /data from TWRP (including the one you mentioned) will not work unfortunately.

https://github.com/Magisk-Modules-Alt-Repo/HuskyDG_BootloopSaver

[HuskyDG]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

Next time you should read the issue carefully

[skag1nnya86]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

I already mentioned in point [3] that /data is inaccessible from TWRP (because Preserve force encryption was enabled when I patched my boot image with Magisk at first, and this makes dm-verity / AVB enabled), so any solution depending on accessing /data from TWRP (including the one you mentioned) will not work unfortunately.

https://github.com/Magisk-Modules-Alt-Repo/HuskyDG_BootloopSaver

This seems to be a good protection for not getting into this issue again in the future. But unfortunately, I didn't install it before this bootloop issue happened :( I hope there is a way to install this module, even if I don't have access to /data. Or a way to patch boot image file (AP_xxx.tar.md5) with Magisk with preinstalled module (e.g. HuskyDG_BootloopSaver).

I think the idea of detecting bootloop automatically (e.g. like after 3 unsuccessful boots) (similar to what HuskyDG_BootloopSaver module provides) is very needed to be implemented in Magisk itself along with the Safe Mode boot detection, because depending only on detecting Safe Mode to disable all modules seems not efficient for all devices and some devices may have anomalies not allowing Magisk to detect Safe Mode boot.

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

Next time you should read the issue carefully

It's okay. Any way thanks for your participation both.

[HuskyDG]

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

I already mentioned in point [3] that /data is inaccessible from TWRP (because Preserve force encryption was enabled when I patched my boot image with Magisk at first, and this makes dm-verity / AVB enabled), so any solution depending on accessing /data from TWRP (including the one you mentioned) will not work unfortunately.

https://github.com/Magisk-Modules-Alt-Repo/HuskyDG_BootloopSaver

This seems to be a good protection for not getting into this issue again in the future. But unfortunately, I didn't install it before this bootloop issue happened :( I hope there is a way to install this module, even if I don't have access to /data. Or a way to patch boot image file (AP_xxx.tar.md5) with Magisk with preinstalled module (e.g. HuskyDG_BootloopSaver).

I think the idea of detecting bootloop automatically (e.g. like after 3 unsuccessful boots) (similar to what HuskyDG_BootloopSaver module provides) is very needed to be implemented in Magisk itself along with the Safe Mode boot detection, because depending only on detecting Safe Mode to disable all modules seems not efficient for all devices and some devices may have anomalies not allowing Magisk to detect Safe Mode boot.

seeee https://www.droidviews.com/uninstall-magisk-modules-twrp/

Next time you should read the issue carefully

It's okay. Any way thanks for your participation both.

Do you have USB Debugging enabled

[skag1nnya86]

Do you have USB Debugging enabled

Yes

[HuskyDG]

Do you have USB Debugging enabled Yes

~On bootloop state, connect your phone to pc, after adb shell, type magisk --remove-modules and Enter, it will remove all modules and restart~

[skag1nnya86]

On bootloop state, connect your phone to pc, after adb shell, type magisk --remove-modules and Enter, it will remove all modules and restart

I already mentioned that I tried this in point [2]. Device isn't detected at all and command isn't applied.

[HuskyDG]

On bootloop state, connect your phone to pc, after adb shell, type magisk --remove-modules and Enter, it will remove all modules and restart

I already mentioned that I tried this in point [2]. Device isn't detected at all and command isn't applied.

Sorry my bad, i just read it again

[HuskyDG]

On bootloop state, connect your phone to pc, after adb shell, type magisk --remove-modules and Enter, it will remove all modules and restart

I already mentioned that I tried this in point [2]. Device isn't detected at all and command isn't applied.

Sadly there are no way else than that 😥

[yujincheng08]

Compile your own magisk to skip loading modules:

diff --git a/native/jni/core/bootstages.cpp b/native/jni/core/bootstages.cpp
index 93c6a103f..f4de2df12 100644
--- a/native/jni/core/bootstages.cpp
+++ b/native/jni/core/bootstages.cpp
@@ -296,7 +296,7 @@ void post_fs_data(int client) {
         goto early_abort;
     }

-    if (getprop("persist.sys.safemode", true) == "1" || check_key_combo()) {
+    if (getprop("persist.sys.safemode", true) == "1" || check_key_combo() || true) {
         safe_mode = true;
         // Disable all modules and denylist so next boot will be clean
         disable_modules();

But anyway we have to fix the bug that it cannot correctly detect the volume down button. Please try to grab bugreport of debug magisk with down button pressed during boot.

[HuskyDG]

Compile your own magisk to skip loading modules:

diff --git a/native/jni/core/bootstages.cpp b/native/jni/core/bootstages.cpp
index 93c6a103f..f4de2df12 100644
--- a/native/jni/core/bootstages.cpp
+++ b/native/jni/core/bootstages.cpp
@@ -296,7 +296,7 @@ void post_fs_data(int client) {
         goto early_abort;
     }

-    if (getprop("persist.sys.safemode", true) == "1" || check_key_combo()) {
+    if (getprop("persist.sys.safemode", true) == "1" || check_key_combo() || true) {
         safe_mode = true;
         // Disable all modules and denylist so next boot will be clean
         disable_modules();

But anyway we have to fix the bug that it cannot correctly detect the volume down button. Please try to grab bugreport of debug magisk with down button pressed during boot.

Thanks, so i found another way! @skag1nnya86 did you get it?