Rabbit R1 Rollback Guide

Introduction

This guide provides a solution for users who have attempted to flash their Rabbit R1 using the Rabbit R1 Escape repo and have either bricked their device or wish to roll back from a custom Android installation.

A system backup is required. You can either use your own backup or download one from the link provided in the references below.

This guide is based on the solution discussed in this GitHub issue.

Important: This guide assumes you have the frp.bin file from a previous installation. If you do not have this file, do not comment out line 46 in the r1.ps1 script.

Steps

1. Prepare the r1.ps1 Script

1. Open PowerShell in the r1_escape folder (where r1.ps1 is located).

2. Modify r1.ps1 by commenting out line 46 and ensuring line 47 is active:

   # Lines 46-47
   # python mtk r frp frp.bin --serialport
   python mtk wl "r1 backup" --serialport

2. Fix for Slow Rollback Speeds

If you experience extremely slow speeds (around 0.09 MB/s), follow these steps:

1. Open the following file for editing: mtkclient\mtkclient\Library\DA\xflash\xflash_lib.py.

2. On line 162, change the dsize value from 0x200 to 0x80100:

   # Before (Capped)
   dsize = min(length, 0x200)
   
   # After (Fixed)
   dsize = min(length, 0x80100)

3. Modify frp.bin Handling

In r1.ps1, adjust the logic for frp.bin as follows:

# Lines 52-55
if ($frpBinBytes[-1] -eq 0x01) { # Changed from 0x00
   $frpBinBytes[-1] = 0x00      # Changed from 0x01
   [System.IO.File]::WriteAllBytes($frpBinPath, $frpBinBytes)
}

4. Comment Out fastboot Commands

Comment out the fastboot commands at the end of r1.ps1 to run them manually later:

# Lines 74-79
# fastboot flashing unlock
# fastboot -w
# fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
# fastboot reboot-fastboot
# fastboot flash system system.img
# fastboot reboot

5. Run the Rollback Script

Execute the modified r1.ps1 script. The script will install the R1 backup images onto your device.

Note: You will need to disconnect and reconnect the Rabbit R1 from USB multiple times during the process, just as with the standard r1.ps1 script.

5. Run the Rollback Script

Once the r1.ps1 exits succesfully since it finished, run the following commands on the same powershell window the r1.ps1 script was running.

fastboot flashing lock
fastboot -w
fastboot reboot

Once done, you should be back into Stock OS!

References

• GitHub Issue: Rollback Discussion
• R1 Backup: Download Link
• GitHub Issue: Slow speeds on mtkclient Discussion