June 09, 2026Author • Eno

Rooting Notes — Magisk, Odin4, AVB Fail, and VBMETA Bullshit

A515F
Samsung
odin4
Bootloader
VBMETA

Device:

Samsung Galaxy A51
Model: SM-A515F/DSN
Firmware: A515FXXU8HWI1
Android: 13
Binary: U8
Tool: odin4 on Linux
Magisk: v30.7

Working dir:

~/Documents/A515F/firmware

Main files:

AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5
BL_A515FXXU8HWI1_QB71281625_REV00_user_low_ship.tar.md5
CP_A515FXXU8HWI1_CP25025400_QB71281625_REV00_user_low_ship.tar.md5
CSC_OLM_A515FOLM8HWI1_QB71298985_REV00_user_low_ship.tar.md5
odin4
Magisk-v30.7.apk

Bootloader was already unlocked:

OEM LOCK: OFF(U)
FRP LOCK: OFF
KG STATE: Checking

So technically, the phone was ready. Samsung’s AVB system, however, decided to be a dramatic little bastard.

1. Patch AP with Magisk

Push the stock AP to the phone using ADB.

Do not use MTP unless you enjoy corrupting multi-gigabyte files like a clown.

cd ~/Documents/A515F/firmware

adb push AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5 /sdcard/Download/

In Magisk:

Magisk
→ Install
→ Select and Patch a File
→ choose AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5
→ Let's Go

Magisk showed:

Ramdisk: Yes

So patch normally. No Recovery Mode nonsense. No weird checkbox. No “pray to the Samsung gods” ritual.

Magisk generated:

/sdcard/Download/magisk_patched-30700_19Uwq.tar

Pull it back with ADB:

cd ~/Documents/A515F/firmware

adb pull /sdcard/Download/magisk_patched-30700_19Uwq.tar .
mv magisk_patched-30700_19Uwq.tar magisk_patched_A515FXXU8HWI1_fresh.tar

Check size:

ls -lh magisk_patched_A515FXXU8HWI1_fresh.tar

Expected:

4.4G - 4.5G

If the file is tiny, stop. You did not make a patched AP. You made digital trash.

2. Flash the Fresh Magisk Patched AP

Flash with Odin4:

cd ~/Documents/A515F/firmware

sudo ./odin4 \
  -b BL_A515FXXU8HWI1_QB71281625_REV00_user_low_ship.tar.md5 \
  -a magisk_patched_A515FXXU8HWI1_fresh.tar \
  -c CP_A515FXXU8HWI1_CP25025400_QB71281625_REV00_user_low_ship.tar.md5 \
  -s CSC_OLM_A515FOLM8HWI1_QB71298985_REV00_user_low_ship.tar.md5

Odin4 successfully uploaded the binaries:

Setup Connection
initializeConnection
Set Partition
Receive PIT Info
success getpit
Upload Binaries
...
boot.img
vbmeta.img
vbmeta.img.lz4
vbmeta_samsung.img.lz4
...
Close Connection

Looks good, right?

Wrong.

The phone rebooted into:

ODIN MODE (AVB Fail)
vbmeta: Error verifying vbmeta
vbmeta: VERIFICATION_DISABLED bit is set.
CUSTOM VBMETA

Translation:

Samsung saw your Magisk patch and immediately lost its damn mind.

3. The Disabled VBMETA Experiment

The obvious nerd-brain idea:

Maybe disabled vbmeta fixes it.

Spoiler: it did not. But here’s the process anyway, because pain should be documented.

Create work folders:

cd ~/Documents/A515F

mkdir -p advanced_root/{stock_vbmeta,patched_ap}

Extract VBMETA from the same stock AP:

cd ~/Documents/A515F/advanced_root/stock_vbmeta

tar -xf ../../firmware/AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5 \
  vbmeta.img.lz4 \
  vbmeta_samsung.img.lz4

Decompress:

lz4 -d -f vbmeta.img.lz4 vbmeta.img
lz4 -d -f vbmeta_samsung.img.lz4 vbmeta_samsung.img

Patch AVB flags:

python3 - <<'PY'
from pathlib import Path
import struct

for name in ["vbmeta.img", "vbmeta_samsung.img"]:
    p = Path(name)
    data = bytearray(p.read_bytes())

    if data[:4] != b"AVB0":
        raise SystemExit(f"[!] {name}: not AVB0 vbmeta image")

    old_flags = struct.unpack(">I", data[120:124])[0]
    new_flags = old_flags | 3

    data[120:124] = struct.pack(">I", new_flags)
    p.write_bytes(data)

    print(f"[+] {name}: flags {old_flags} -> {new_flags}")
PY

Output:

[+] vbmeta.img: flags 0 -> 3
[+] vbmeta_samsung.img: flags 0 -> 3

Very hacker. Very fancy. Still didn’t mean shit.

Recompress properly for Odin4:

lz4 -B6 --content-size -f vbmeta.img vbmeta.img.lz4
lz4 -B6 --content-size -f vbmeta_samsung.img vbmeta_samsung.img.lz4

Why?

Because if you use plain lz4 -f, Odin4 might cry like this:

Contens size is not defined
Fail parse

Yes, “Contens.” Even the error message is broken. Beautiful.

4. Repack Magisk AP with Disabled VBMETA

Extract the fresh Magisk patched AP:

cd ~/Documents/A515F/advanced_root/patched_ap

tar -xf ../../firmware/magisk_patched_A515FXXU8HWI1_fresh.tar

Remove old VBMETA:

rm -f vbmeta.img vbmeta.img.lz4 vbmeta_samsung.img vbmeta_samsung.img.lz4

Copy the disabled VBMETA:

cp ../stock_vbmeta/vbmeta.img.lz4 .
cp ../stock_vbmeta/vbmeta_samsung.img.lz4 .

Repack:

tar -H ustar -cvf ../../firmware/magisk_patched_A515FXXU8HWI1_disabled_vbmeta.tar *

Verify contents:

cd ~/Documents/A515F/firmware

tar -tf magisk_patched_A515FXXU8HWI1_disabled_vbmeta.tar | grep -E 'boot|vbmeta|super|recovery|dtbo|metadata'

Expected:

boot.img
dtbo.img.lz4
metadata.img.lz4
recovery.img.lz4
super.img.lz4
vbmeta.img.lz4
vbmeta_samsung.img.lz4

Flash it:

sudo ./odin4 \
  -b BL_A515FXXU8HWI1_QB71281625_REV00_user_low_ship.tar.md5 \
  -a magisk_patched_A515FXXU8HWI1_disabled_vbmeta.tar \
  -c CP_A515FXXU8HWI1_CP25025400_QB71281625_REV00_user_low_ship.tar.md5 \
  -s CSC_OLM_A515FOLM8HWI1_QB71298985_REV00_user_low_ship.tar.md5

Odin4 uploaded everything successfully.

The phone replied with:

ODIN MODE (AVB Fail)
CUSTOM VBMETA

Translation:

Nice try, dumbass.

Disabled VBMETA was not the sauce.

5. The Actual Fix: Stock VBMETA from the Same Firmware

The fix that actually worked was hilariously simple:

Flash the original stock vbmeta.img.lz4 and vbmeta_samsung.img.lz4
from the exact same AP firmware.

Not disabled.

Not patched.

Not some random Telegram file.

Not an ancient “disable dm-verity” ZIP from 2020.

Just the original VBMETA from:

AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5

Because apparently Samsung hates custom VBMETA, but is willing to chill if you give it its own damn VBMETA back.

6. Build the Stock VBMETA Tar

Create folder:

cd ~/Documents/A515F/firmware

mkdir -p stock_vbmeta_only
cd stock_vbmeta_only

Extract original VBMETA:

tar -xf ../AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5 \
  vbmeta.img.lz4 \
  vbmeta_samsung.img.lz4

Check:

ls -lh

Expected:

vbmeta.img.lz4
vbmeta_samsung.img.lz4

Pack them:

tar -H ustar -cvf ../stock_vbmeta_A515FXXU8HWI1.tar \
  vbmeta.img.lz4 \
  vbmeta_samsung.img.lz4

Verify:

cd ~/Documents/A515F/firmware

tar -tf stock_vbmeta_A515FXXU8HWI1.tar
ls -lh stock_vbmeta_A515FXXU8HWI1.tar

Expected:

vbmeta.img.lz4
vbmeta_samsung.img.lz4

stock_vbmeta_A515FXXU8HWI1.tar ≈ 10K

Tiny file. Massive attitude.

7. Flash Stock VBMETA While Stuck in AVB Fail

When the phone is stuck at:

ODIN MODE (AVB Fail)
CUSTOM VBMETA

check if Odin4 sees it:

cd ~/Documents/A515F/firmware

sudo ./odin4 -l

If detected, flash stock VBMETA:

sudo ./odin4 -a stock_vbmeta_A515FXXU8HWI1.tar

Successful output:

Check file : stock_vbmeta_A515FXXU8HWI1.tar
Setup Connection
initializeConnection
Receive PIT Info
success getpit
Upload Binaries
vbmeta.img.lz4
vbmeta_samsung.img.lz4
Close Connection

After this, the phone stopped rage-quitting into AVB Fail and booted into Recovery.

Finally. Some fucking progress.

8. Recovery Step

In Recovery:

Wipe data / factory reset
→ Factory data reset / Yes
→ Reboot system now

After reboot, red text may appear above the Samsung logo.

That is normal.

It basically means:

Your bootloader is unlocked and Samsung is judging you.

Boot time:

5-15 minutes is normal

Do not panic reboot every 10 seconds. Let the damn thing cook.

9. If Android Boots

Once Android setup appears:

Do minimal setup
Connect Wi-Fi
Reach home screen
Install / open Magisk

If Magisk asks for:

Additional Setup

tap:

OK / Install

Let it reboot.

Then check root:

adb shell su -c id

Root success:

uid=0(root) gid=0(root)

That’s the win screen.

Technical Takeaways

1. Magisk patched AP can trigger CUSTOM VBMETA

On this firmware:

A515FXXU8HWI1

flashing Magisk patched AP can cause:

ODIN MODE (AVB Fail)
CUSTOM VBMETA

Even when Odin4 says the flash completed fine.

Because apparently flashing fine and booting fine are two completely different fucking religions.

2. Disabled VBMETA did not work here

Setting:

HASHTREE_DISABLED
VERIFICATION_DISABLED

on both:

vbmeta.img
vbmeta_samsung.img

still resulted in:

ODIN MODE (AVB Fail)
CUSTOM VBMETA

So no, “just disable vbmeta bro” was not the magic spell.

3. Odin4 is picky with LZ4

If you repack .lz4 files for Odin4, use:

lz4 -B6 --content-size -f input.img output.img.lz4

Otherwise Odin4 may throw:

Contens size is not defined
Fail parse

The typo makes it even worse. Peak Linux flashing experience.

4. The working fix was stock VBMETA from the same firmware

The file that worked:

stock_vbmeta_A515FXXU8HWI1.tar

Contents:

vbmeta.img.lz4
vbmeta_samsung.img.lz4

Source:

AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5

Do not use VBMETA from another firmware.

Do not use VBMETA from another Samsung.

Do not use random shit from Telegram.

Do not use some fossil ZIP from 2020 and call it “advanced.”

Use the same firmware. The exact same one. Samsung is picky as hell.

Working Sequence

The sequence that actually worked:

1. Flash Magisk patched AP fresh
2. Phone hits ODIN MODE (AVB Fail) / CUSTOM VBMETA
3. Build stock_vbmeta_A515FXXU8HWI1.tar from the same AP firmware
4. Flash stock VBMETA via Odin4 AP slot
5. Phone boots into Recovery
6. Wipe data / factory reset
7. Reboot system
8. Finish Magisk setup if Android boots

Minimal Command Recap

Flash Magisk patched AP fresh

sudo ./odin4 \
  -b BL_A515FXXU8HWI1_QB71281625_REV00_user_low_ship.tar.md5 \
  -a magisk_patched_A515FXXU8HWI1_fresh.tar \
  -c CP_A515FXXU8HWI1_CP25025400_QB71281625_REV00_user_low_ship.tar.md5 \
  -s CSC_OLM_A515FOLM8HWI1_QB71298985_REV00_user_low_ship.tar.md5

Build stock VBMETA fix

cd ~/Documents/A515F/firmware

mkdir -p stock_vbmeta_only
cd stock_vbmeta_only

tar -xf ../AP_A515FXXU8HWI1_QB71281625_REV00_user_low_ship_meta_OS13.tar.md5 \
  vbmeta.img.lz4 \
  vbmeta_samsung.img.lz4

tar -H ustar -cvf ../stock_vbmeta_A515FXXU8HWI1.tar \
  vbmeta.img.lz4 \
  vbmeta_samsung.img.lz4

Flash stock VBMETA fix

cd ~/Documents/A515F/firmware

sudo ./odin4 -a stock_vbmeta_A515FXXU8HWI1.tar

Recovery

Wipe data / factory reset
→ Reboot system now

Final Sauce

For this Samsung Galaxy A51 SM-A515F/DSN on firmware:

A515FXXU8HWI1

the fix was not:

disabled vbmeta

The fix was:

flash stock vbmeta from the exact same firmware after Magisk patched AP triggers AVB Fail