Guides

Install guide

What the install does to the phone, and where the steps are.

The per-phone steps are on the Install page. This is the shape of them, and what each part does to the phone.

Two parts

1. The root, with fastboot. fastboot flash userdata root.img puts the iOS root image into the phone’s userdata partition. From here Android’s data is gone.
2. The boot loader, from the recovery. A small zip, installed in TWRP or OrangeFox, checks the phone, the root and every block it is about to rely on before it writes anything. It copies the touch and Wi-Fi firmware off your own phone, keeps a copy of your boot partition, puts the boot loader in front of Android’s in boot, and reads every write back.

You make both on your Mac from a release and your own copy of iOS: the release script downloads iOS 16.7.16 from Apple and checks it against a pinned size and SHA-256. Running it is your consent to that download. Open Mapple never ships iOS, and what you make contains it: keep it to yourself and your phone.

What is written

The zip writes boot (the loader in front of your Android kernel) and fastboot flash userdata root.img writes userdata. The install page’s fourth step takes your own backup first, from Android itself, while it runs: boot, lk, lk2, nvram, nvdata, nvcfg, persist, protect1, protect2, and the partition table.

When it does not boot

• Safe boot: hold Volume Down from the “Booting Darwin / XNU” text and keep holding until the loader prints safe boot (a 3 s window). The phone starts on the built-in settings instead of the saved ones, with Wi-Fi and Bluetooth off.
• Back to Android: adb reboot bootloader, fastboot flash boot with your backup, then format data in the recovery.
• If the phone reaches neither Android, the recovery nor fastboot: MediaTek’s boot ROM mode with mtkclient writes your backup back. Never flash an LK you have not verified.

The install page has the exact commands for each.

Source: the install page, mtk/loader/mtkloader.c (mapple_loader at 2aa5786) for the safe boot.