[jwehle]

I originally opened this over at XDA as:

 xda thread

however it doesn't seem to be yielding a solution so I was wondering if you guys have some suggestions.

Recently purchased an iplay 7t after reading the xda review. This is replacing an LG v400 tablet that I had rooted. I updated the iplay to build T701_V1.20_20191112, enabled developer options, enabled unlock bootloader in developer options, found the corresponding firmware pac, installed magisk and used it to patch boot.img. So far so good.

I entered fastboot, then I attempted to flash the modified boot.img and was told:

Code:

target didn't report max-download-size
sending 'boot' (18584 KB)...
OKAY [  0.593s]
writing 'boot'...
FAILED (remote: Flashing Lock Flag is locked. Please unlock it first!)
finished. total time: 0.608s

I tried various options to unlock the bootloader:

Code:

> fastboot getvar unlocked
unlocked:
finished. total time: -0.000s

> fastboot oem unlock
...
FAILED (remote: unknown cmd.)
finished. total time: -0.000s

> fastboot oem unlock-go
...
FAILED (remote: unknown cmd.)
finished. total time: 0.002s

> fastboot flashing get_unlock_ability
...
FAILED (remote: Not implement.)
finished. total time: -0.000s

> fastboot flashing unlock
...
FAILED (remote: Not implemet.)
finished. total time: -0.000s

> fastboot flashing unlock_critical
...
FAILED (remote: Not implement.)
finished. total time: 0.016s

> fastboot flashing unlock_bootloader
fastboot: usage: unknown 'flashing' command unlock_bootloader

> fastboot flashing unlock_bootloader_nonce
fastboot: usage: unknown 'flashing' command unlock_bootloader_nonce

Okay ... fine. I fired up SPD Research tool and attempted to use it to flash the modified boot.img. It transfers the image and then times out.

As a sanity check I used SPD Research tool to flash the original boot.img and that worked fine.

I'll note the modified image is smaller than the original, however padding the modified image with zeros to the same size didn't seem to help. Using SPD Research tool to flash the padded image still timed out.

I am looking to open a request up on the Alldocube support site (currently their registration form is giving me an error), in the meantime ... suggestions? Has anyone successfully flashed a modified boot.img on this device / rooted this device?

I've attached the original boot.img which I can flash and the patched boot.img which doesn't flash.

[jwehle]

Correction I tried to attached the original boot.img which I can flash and the patched boot.img which doesn't flash, however apparently they are too big to attach.

[freshtyt]

I originally opened this over at XDA as:
 xda thread

however it doesn't seem to be yielding a solution so I was wondering if you guys have some suggestions.
Recently purchased an iplay 7t after reading the xda review. This is replacing an LG v400 tablet that I had rooted. I updated the iplay to build T701_V1.20_20191112, enabled developer options, enabled unlock bootloader in developer options, found the corresponding firmware pac, installed magisk and used it to patch boot.img. So far so good.

I entered fastboot, then I attempted to flash the modified boot.img and was told:
...

try using adb and fastboot from latest google platform tools. see if it helps in unlocking the bootloader
download latest platform tools @ https://www.hovatek.com/forum/thread-17104.html

if you want to upload a file, upload to any cloud storage e.g google drive, mediafire, mega.nz e.t.c then post the download link here

[jwehle]

try using adb and fastboot from latest google platform tools. see if it helps in unlocking the bootloader download latest platform tools @ https://www.hovatek.com/forum/thread-17104.html

Okay installed the latest platform tools from google (r29.0.5), unfortunately retrying the various fastboot commands produce the same results as before.

[jwehle]

I've dump the strings from fdl2-sign.bin ... the interesting bits are:

Code:

Flashing Lock Flag is locked. Please unlock it first!
ret is %04x
lcs is %d
data too large
DATA%08x
SOCID
socid is:
subcmd is null.
get_identifier_token
Identifier token:
unknown cmd.
get backup partition name fail
Write nv img fail
write %s size 0x%llx fail
image write with backup error!
image write error!
bad boot image header
kernel image should not be zero
ramdisk size error
unlock
Not implemet.
Not implement.
unlock_critical
get_unlock_ability
get_unlock_bootloader_nonce
Bootloader can not been locked repeatly.
Lock bootloader fail.
  Info:Lock bootloader success!
Lock bootloader successfully!
unlock_bootloader
Bootloader can not been unlocked repeatly.
Please firstly execute <fastboot oem get_identifier_token>
Unlock bootloader fail.
  Warning: Unlock device may erase user data.
  Press volume down button to confirm that.
  Press volume up button to cancel.
  Info:user cancelled!
Info:user cancel unlock bootloader!
Erase userdata fail.
  Info:Unlock bootloader success!
Info:Unlock bootloader success!
  Begin to erase user data...
------------------------------------------------------------------------
  Warning:RMA will change hardware status and unrecoverable, also will make some secure data unaccessible!
  Do you confirm that you are developer and need this operation really?
  Press button 'Volumn-Down' for 'No'.
  Press button 'Volumn-Up' for 'Yes'.
  The operation will be cancelled automatically after 20 seconds.
------------------------------------------------------------------------
user cancelled
time out
  fastboot mode
getvar:
download:
flash:
erase:
powerdown
continue
reboot-bootloader
flashing
getlcs
setrma
getsocid

They seem to be similar to those mentioned in:

Code:

How To Unlock Bootloader SC9850KL Oreo 8.1.0 Go Edition

which unfortunately looks like it wasn't able to be solved.

[X3non]

Okay installed the latest platform tools from google (r29.0.5), unfortunately retrying the various fastboot commands produce the same results as before.

at this point, only the OEM can help you unlock the bootloader of the device

[jwehle]

at this point, only the OEM can help you unlock the bootloader of the device

Understood.

Though I'm curious ... how specific is the SoC boot signing?

I.e. Could a signed fdl1 / fdl2 from a different SC9832E device
work on this device or does the signing on a device only allow
booting signed firmware from the same OEM.

I noticed that CM2SP2 recently added a generic boot for SC9832E
and it wasn't clear to me how that works with devices that require
signed firmware.

[X3non]

Understood.
Though I'm curious ... how specific is the SoC boot signing?

I.e. Could a signed fdl1 / fdl2 from a different SC9832E device
work on this device or does the signing on a device only allow
booting signed firmware from the same OEM.
...

signed fdl files from a different device won't work on yours, these are usually oem specific

...
I noticed that CM2SP2 recently added a generic boot for SC9832E
and it wasn't clear to me how that works with devices that require
signed firmware.

generic boot would only work non-secure devices, for secure devices if the generic doesn't work for you then you will have to manually select your fdl or pac as the case maybe before proceeding with the procedure you intend to carry out

[X3non]

...

do you still have this device?
if yes, try using latest fastboot binaries i.e the one within google platform tools
run the command below and let me know if there's an output

Code:

fastboot oem get_identifier_token

[hovatek]

....
I've attached the original boot.img which I can flash and the patched boot.img which doesn't flash.

Try unlock bootloader using https://www.hovatek.com/forum/thread-32287.html