How to root Unisoc | Spreadtrum Android 9+; Case study: Teclast P80X
How to root Unisoc | Spreadtrum Android 9+; Case study: Teclast P80X
15-12-2022, 07:16 PM
(15-12-2022, 07:20 AM)hovatek(13-12-2022, 11:19 AM)AnxiousHumanoid ...
Now main question(asking again) would there be any problem(like stuck in bootloop) if I rename it without signing the system partition?
-Or- It's just simple, I can rename it without any problem and I'm twisting the thread for no reason
..
You can rename it without any problem
Ohh, I knew i was twisting the wire for no reason
Anyway, thanks for your time
15-01-2023, 01:00 PM
I spent a good 20hrs trying lots of things and learning from my mistakes - in the end I achieved it.
Just sharing my journey so others who are trying to root might save time.
I messed up plenty of times and bricked it numerous times but luckily I used the teclast upgrade tool to bring it back to life each time.
So this is the final steps that achieved permanent root via boot.img
1. Followed guide much more closely (forum/thread-32678.html)
2. Bootloader unlocking was straightforward and achieved success first time (3 days ago)
3. Creating the signed vbmeta-sign-custom.img was fine the first time as I was trying the recovery method
4. Flashing vbmeta-sign-custom.img and a signed magisk_patched-recovery.img was fine - but no matter what I did (over 10 times), I couldn't turn off the tablet via fastboot to avoid the patched recovery img being overwritten. I lost abilit to enter recovery and bootloader/fastboot via button press and had to use windows adb reboot bootloader.
5. So I tried the boot.img method. Bricked it 5 times.
5.1 I couldn't get a successful flash of the boot.img - tried about 20 times different ways to patch and sign.
5.2 Kept re-reading the posts in the thread until finally realised that i had to modify the avbtool command to to apply the hovatek.bin to the right partition. To save anyone else who might be trying this (I couldn't find the command anywhere on this site using search).
To create a vbmeta image for BOOT ONLY -
"boot:1:keys/hovatek.bin" and "recovery:2:keys/key_recovery.bin"
python2 avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/hovatek.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/key_recovery.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom-boot.img
The original command for RECOVERY was
"boot:1:keys/key_boot.bin" and "recovery:2:keys/hovatek.bin"
python2 avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/key_boot.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/hovatek.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom.img
5.3 Now I have a vbmeta-sign-custom-boot.img
6. Patching the stock boot.img - I messed this up a few times using various magisk versions and options - so each time I flashed it bricked the tablet.
The options THAT WORKED.
Use the latest Canary build from the magisk website. its called app_debug.apk 831a398b (25206) (34) (D)
MUST select Recovery (as per the youtube video on how to patch boot.img). DO NOT SELECT vbmeta boot image
In this version of magisk canary there is no option to preserve like the youtube video.
Once patched - rename it to magisk_patched-boot.img
7. Sign the patched boot image with the command
python2 avbtool add_hash_footer --image magisk_patched-boot.img --partition_name boot--partition_size 36700160 --key hovatek.pem --algorithm SHA256_RSA4096
7.1 Now you have a matching vbmeta custom boot image and the magisk patched signed boot image.
8. Boot to fastboot
8.1 On my p80x g5k5 - i flashed both stock g5k4 and g5k6 firmware.pac after bricking and both worked fine - I decided to use the newer one g5k6. There is no stock g5k5 from the teclast website (when you download g5k5 firmware.pac, researcher and upgrade tool reads it as g5k6).
Method to boot to fastboot. Shutdown tablet first. Press hold volume down and press hold power button same time and hold for around 10sec until the tablet comes alive and shows the Teclast boot logo, release power button and continue to hold volume down. After a few more seconds the screen will go blank and you will be presented with the stock recovery. Select boot to bootloader - this is fastboot.
8.2 You can also boot the tablet to Android 9 - connect usb to Windows PC and type adb reboot bootloader. This will also boot the tablet to fastboot. But this stopped working after I installed all the drivers to get upgrade tool to work.
9. Flash vbmeta custom boot image and the magisk patched signed boot image - I flashed one after the other without rebooting.
10. Type fastboot reboot, or just turn off and turn on the tablet - you could probably put a pin in reset - though i didnt try that.
11. It will boot into Android 9 and now you have permanent root - confirmed by root checker
Hope this helps anyone trying to root their Teclast p80x. My reason for rooting - not to install custom rom, none exists anyways?
I want to change the device ID/type so some apps (Yi Home) will think it's a phone instead of a tablet and runs normally instead of crashing.
30-01-2023, 01:59 AM
Note - running the Eufy security app would only display 1 x pan and tilt camera and 1 x 2C Pro - it would not display my other pan and tilt (same camera) and 3 other 2C Pro and definitely not the eufycam 3 4k.
Was impossible to edit build.prop after root - it would wipe the entire file to 0kb and not save. Android 9 restriction.
Only way to fix was to restore stock firmware.pac - tried to edit build.prop 5 times, each time had to restore firmware.pac
Found the magisk hideprop module and gave that a go. Successfully changed the device ID to a samsung A30 phone.
Yi Home still wouldn't run and Eufy Security still would only display the 2 cameras mentioned above.
The tablet became a backseat videoplayer on a roadtrip and while charging from a powerbank - somehow the tablet thought i was in permanent charge mode (showing battery charging icon). Diff USB cables and diff chargers, wouldn't recognise connected to laptop. Essentially ran itself out of battery and has become a paperweight. Not worth trying to solder a new charge port.
Found local supermarket selling an Orbic Tab8 4G for $99AUD (i paid $130AUD for the Teclast).
The Orbic has a Snapdragon 660 - runs Yi Home fine, runs Eufy Security app fine and displays all cameras including the 4k. The 8"S creen on the Orbic is 10x better than the P80X (grey washed out).
The Snapdragon 660 is also about 5x faster in terms of performance, browsing, installing apps, watching youtube etc.
The Unisoc processor in the P80X was the cause of the apps not running properly. It was ok while it lasted for the last few years. But happy it died so I could move on to the Orbic and stop wasting time on the P80X.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
