# Requirements
1. The Signed File from your device specific AUTOLOADER, MAKE SURE TO USE ONE THAT IS FROM A VERSION THAT IS THE SAME OR HIGHER THAN YOUR CURRENT OS VERSION. AND IS AN ORIGINAL ONE NOT A MODDED ONE.
2. Make sure to have the correct drivers to flash your device installed on your computer, such as the BlackBerry Link drivers or the BlackBerry Desktop Software.

NOTE: READ NOTES ON THE ROOTING SECTION AT THE BOTTOM, IF YOU WANT TO HAVE YOUR SSH PUBLIC KEY INCLUDED ON THE PATCH.
NOTE 2: IF YOU SEND THIS TO A LANGUAGE MODEL FOR IT TO READ IT FOR YOU'LL PROBABLY BREAK YOUR DEVICE, THIS NEEDS TO BE A WARNING IT NEEDS TO BE READ CAREFULLY IS NOT THAT LONG ANYWAY.
NOTE 3: If you distribute roms created with this or modify this, please credit where credit is due. This things take time so please mention Oleksandr (https://bb10.root.sx/) 
and Waitberry (https://www.patreon.com/c/waitberry) and ask to support this initiatives.

# References
- Root and more [https://bb10.root.sx/] 
- Blackberry System Packer [https://github.com/FerreiraPablo/]
- Waitberry [https://store.waitberry.com/] [https://www.patreon.com/c/waitberry]

# How to get your .Signed files?
Easy, download Darcy BB Tools and a compatible (preferably 10.3.3.3216) autoloader, open the Autoloader with Darcy BB Tools and click on "Split Autoloader" and that will export 2 Signed files OS and RADIO to the directory where your autoloader was. Is Magical.

# How to use
1. Extract your IFS Signed File and RADIO Signed File from your device specific AUTOLOADER.
2. Place the extracted files to the "signed" folder. With the names OS.Signed and Radio.Signed respectively.
The directory structure should look like something this:
```
.
├── signed
│   ├── OS.Signed
│   └── Radio.Signed
└── README.md
```
3. Run the "blackberrysystempacker.exe" executable.
4. Wait for the program to finish. And you'll see a file called "Autoloader.exe" in the "output" folder. This is you patched Autoloader.
5. Flash the "Autoloader.exe" file using the same method you would use to flash a normal autoloader.
6. Enjoy your patched autoloader with the new radio and OS files.


# Notes
- This tool includes the "mod-nvram" binary created by @Oleksandr, and is located in "/accounts/1000/shared/documents/mod-nvram" after flashing.
- This tool also installs the EXFAT Driver, which is required for the device to read and write to exFAT formatted SD cards.
- This tool preinstalls term49, which is a terminal emulator for BlackBerry 10 devices.
- IMPORTANT: The impersonation patch is only applied on the first boot after flashing the autoloader. If you want to keep the impersonation patch, follow the instructions below to keep it on the next boot.
- On Linux is currently not possible to generate an autoloader, but you can still use bb10_mt to flash the generated signed files, using your original Radio.Signed and the generated OS.Signed on the output folder.

# Downgrading
After patching and flashing the autoloader, you can downgrade your device to a previous OS version if you wish. 
NOTE: YOU CAN ONLY DO THIS ON THE FIRST BOOT AFTER FLASHING THE AUTOLOADER.

1. Go to Term49 the terminal emulator installed by the patched autoloader.
2. Go to the documents directory by typing `cd /accounts/1000/shared/documents`.
3. Use the NTO Group, impersonation by running `/q/g_nto`.
3. Type `./mod-nvram -d` to run the mod-nvram binary.

This will clear the blocked os versions, allowing you to run an Older Autoloader.

If you want to revert back to the original autoloader, just flash the original autoloader again.

# Rooting: Keeping the Impersonation Patch on the Next Boot & Gaining Root. (READ HERE IF YOU WANT YOUR SSH KEYS ON THE SYSTEM)
What this will do:
- Persist impersonation till next boot.
- Start QCONN and SSHD as root.
- Patch your Launcher so it supports unsigned apps.
- (OPTIONALLY) Setup Term48 to execute to restore all the previously mentioned things, by just running it.

Notes: Once you do this, you'll have a qconn server running as root on the port 9090. Which wil allow you to run commands with something like "qcl.pl" the Perl QCONN Client.
Note 2: Also an SSH Daemon will start, but to log in you need to first enable development mode and connect with qconndoor at least once, so your SSH Keys are added an authorized.
Note 3: If you want you can also just PRE-PATCH add your public key to the /include/accounts/devuser/.ssh/authorized_keys2 file. BEFORE PATCHING YOUR ROM. So your keys are included, then you don't need to connect via development mode or anything like that.
Note 4: If you don't wait till the Android App runs to the fullest, then probably the root will not work. But you can just try agin.

If you want to keep the impersonation patch, you can do so by following these steps:
1. After flashing the patched autoloader, open an Android App (The Amazon App Store is there at startup, so do that one) wait until you see the UI of the app fully rendered.
2. Go to Term49 the terminal emulator installed by the patched autoloader.
3. Go to the installer directory by typing `cd /accounts/1000/shared/.installer`.
4. And execute the installer by typing `./run.sh` and pressing ENTER.
5. Let it run, in the end the program will ask you if you want to run it every time you open "Term49" this is super recommended, so you can keep your root.

This will set the impersonation patch to be reinstalled on the next boot, and will also install any .bar files located on the downloads/documents directory.
Running this program on every boot will ensure that the impersonation patch is always available, and also runs the "exploit" that enables 

If you did the steps to have your SSH Keys added, then connecting is pretty easy you can use it via Wi-Fi by running "ssh root@<device_ip_in_your_network>" or if you have it connected via USB to your PC with BB Link you can use 169.

NOTE 5: If by mistake you clicked "No" on the automatic setup dialog, because you're desperate and didin't read anything you can get the dialog back one more time by deleting one file
```bash
rm -rf /accounts/1000/shared/.installer/.term_prompt_asked
```

If you're already on the `/accounts/1000/shared/.installer` directory, you can also just try
```bash
./run.sh -f
```

# How this works?
There are a couple of files with different responsabilities in the patch:
1. The "blackberrysystempacker.exe" is the main program that packs the signed files into an autoloader, and applies the changes.
2. The "patch.txt" defines a series of instructions that the "blackberrysystempacker.exe" will follow to apply the changes.
3. The config.json defines the configuration for the "blackberrysystempacker.exe" program, such as the paths to the signed files and the output directory.

# Special Thanks
To Oleksandr, he did everything, i just scripted and made a packer in .NET