Alldocube iplay 20 (Unisoc) - Creating Magisk patched boot.img and then vmbeta.img

26-09-2020, 08:48 AM

I have a new Alldocube iplay 20 tablet and I have successfully unlocked the bootloader by following the tutorials elsewhere on this forum.

Next, I would like to root the device by patching the boot image with Magisk. I believe I'll need to:

Use Magisk Manager to patch the boot.img file
Generate a new vmbeta.img file to support the new boot.img

For #1, I have used the Spreadtrum ResearchDownload tool with a firmware PAC file to extract the boot.img file, copy it to my device, and use Magisk Manager to patch the image file (following https://www.hovatek.com/forum/thread-21427.html). I believe I need to sign the new image, which I plan to do with the rsa4096_vbmeta.pem key I downloaded.

I am comparing with the How to root the Doogee S88 Pro using OEM keys Tutorial and it looks like I would need to run something similar to the below (after changing to RSA4096):

Code:

python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 33554432 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

What should I use for the partition_size value? Does it need to match the size of the original boot.img file? Below is the "avbtool info_image" output from the original boot.img file.

Code:

Footer version:          1.0

Image size:              36700160 bytes

Original image size:      17532928 bytes

VBMeta offset:            17534976

VBMeta size:              2176 bytes

--

Minimum libavb version:  1.0

Header Block:            256 bytes

Authentication Block:    576 bytes

Auxiliary Block:          1344 bytes

Algorithm:                SHA256_RSA4096

Rollback Index:          0

Flags:                    0

Release String:          'avbtool 1.1.0'

Descriptors:

    Hash descriptor:

      Image Size:            17532928 bytes

      Hash Algorithm:        sha256

      Partition Name:        boot

      Salt:                  8feba2520e631978e35fcb28882d2021efd5e9015a477221a610c7d17209bb24

      Digest:                af48266b29dfa98b13aa1a78907e43b382f51e04d5fc2638300d46cc585ab13d

      Flags:                0

    Prop: com.android.build.boot.os_version -> '10'

Should I use image size "36700160" for the partition_size value?

Once this is done, I'll move on to #2, creating a new vbmeta.img file. I have followed https://www.hovatek.com/forum/thread-32667.html to extract to public keys from vbmeta-sign.img. Below is the "avbtool info_image" output from the original vbmeta.img:

Code:

Minimum libavb version:  1.0

Header Block:            256 bytes

Authentication Block:    576 bytes

Auxiliary Block:          13568 bytes

Algorithm:                SHA256_RSA4096

Rollback Index:          0

Flags:                    0

Release String:          'avbtool 1.1.0'

Descriptors:

    Chain Partition descriptor:

      Partition Name:          boot

      Rollback Index Location: 1

      Public key (sha1):      ea410c1b46cdb2e40e526880ff383f083bd615d5

ea410c1b46cdb2e40e526880ff383f083bd615d5

    Chain Partition descriptor:

      Partition Name:          dtbo

      Rollback Index Location: 10

      Public key (sha1):      ea410c1b46cdb2e40e526880ff383f083bd615d5

    Chain Partition descriptor:

      Partition Name:          recovery

      Rollback Index Location: 2

      Public key (sha1):      d9093b9a181bdb5731b44d60a9f850dc724e2874

    Chain Partition descriptor:

      Partition Name:          socko

      Rollback Index Location: 11

      Public key (sha1):      bc688cacacd959cfaafbf0549d080d6fc2d50a08

    Chain Partition descriptor:

      Partition Name:          odmko

      Rollback Index Location: 12

      Public key (sha1):      425215859f49f31809f16491c2a67e04df79baaf

    Chain Partition descriptor:

      Partition Name:          vbmeta_system

      Rollback Index Location: 3

      Public key (sha1):      e2c66ff8a1d787d7bf898711187bff150f691d27

    Chain Partition descriptor:

      Partition Name:          vbmeta_vendor

      Rollback Index Location: 4

      Public key (sha1):      9885bf5bf909e5208dfd42abaf51ad9b104ee117

    Chain Partition descriptor:

      Partition Name:          l_modem

      Rollback Index Location: 6

      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

    Chain Partition descriptor:

      Partition Name:          l_ldsp

      Rollback Index Location: 7

      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

    Chain Partition descriptor:

      Partition Name:          l_gdsp

      Rollback Index Location: 8

      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

    Chain Partition descriptor:

      Partition Name:          pm_sys

      Rollback Index Location: 9

      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

So I am checking https://www.hovatek.com/forum/thread-32664.html for how to create the new vbmeta-sign-custom.img. It shows that I need to run a command like the following:

Code:

python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/key_boot.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/hovatek.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom.img

What is the --flag setting for and what will I need to set it to?

I know I need to list my own partition names and arrange them in the same order. I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?

The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?

Code:

python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/rsa4096_vbmeta.bin --chain_partition dtbo:10:keys/key_dtbo.bin --chain_partition recovery:2:keys/key_recovery.bin --chain_partition socko:11:keys/key_socko.bin --chain_partition odmko:12:keys/key_odmko.bin --chain_partition vbmeta_system:3:keys/key_vbmetasystem.bin --chain_partition vbmeta_vendor:4:keys/key_vbmetavendor.bin --chain_partition l_modem:6:keys/key_l_modem.bin --chain_partition l_ldsp:7:keys/key_l_ldsp.bin --chain_partition l_gdsp:8:keys/key_l_gdsp.bin --chain_partition pm_sys:9:keys/key_pm_sys.bin --include_descriptors_from_image phone/dtbo.img --padding_size 16384 --output vbmeta-sign-custom.img

There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?

Thanks very much for any help. This has been a very interesting learning experience.

X3non
Recognized Contributor

22,062

28-09-2020, 09:18 AM

(26-09-2020, 08:48 AM)JamesAt15 ...Should I use image size "36700160" for the partition_size value?

Yes, the full image size is the partition size

(26-09-2020, 08:48 AM)JamesAt15 ...What is the --flag setting for and what will I need to set it to?

same as in the original vbmeta, in your case 0

(26-09-2020, 08:48 AM)JamesAt15 ...I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?

exactly

(26-09-2020, 08:48 AM)JamesAt15 ...The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?

ignore what you read from the other thread, your vbmeta is different from what the other person has

(26-09-2020, 08:48 AM)JamesAt15 ...There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?

what you see in your original vbmeta is exactly what you should use. just ensure that the PAC firmware you are using is meant for the exact build number of your phone as seen in settings > about phone > build number

hovatek
Administrator

49,585

28-09-2020, 08:01 PM

(26-09-2020, 08:48 AM)JamesAt15 I have a new Alldocube iplay 20 tablet

I see you're making some assumptions here that might only end up confusing you
The Doogee S88 Pro is Mediatek while yours is Unisoc. This doesn't mean the same technique won't work but in this case, you might only confuse yourself.

The --flag is avb image verification where 0 is Enabled and 2 is Disabled

A little History

The reason we went for that technique in the S88 Pro was that building a vbmeta from scratch flashed fine and worked but merely changing only flag from 0 to 2 (everything else left like in stock vbmeta) failed to flash.
Luckily, the oem had signed the partitions using that 2048 key so we just used that to sign modified images

Your model might not mind changing the --flag value and might not have used the 4096 key to sign the partitions so don't try to base your approach on that till you've tried the technique @ https://www.hovatek.com/forum/thread-32678.html

This post was last modified: 28-09-2020, 08:04 PM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

JamesAt15
Newbie

29-09-2020, 01:52 AM

X3non and Hovatek, thanks so much for your suggestions. I'll go through them to make sure I understand the process and will give it a try soon.

Hovatek, the link you posted seems to be suggesting that I try Magisk patching the recovery.img first and check if booting to recovery will boot up with root. I'll give that a try, since it seems like it will let me leave the current system in place and be easier to recover from if something goes wrong. It will also be practice for signing the new recovery image and compiling the vbmeta.img values. Do I need to use Magisk Manager Canary version to do this, or will the standard version work? I'm not sure if I'm looking at github right, but I see an app-debug.apk and stub-release.apk for the canary version but not an app-release.apk.

hovatek
Administrator

49,585

29-09-2020, 01:59 PM

(29-09-2020, 01:52 AM)JamesAt15 X3non and Hovatek, thanks so much for your suggestions. I'll go through them to make sure I understand the process and will give it a try soon.

Hovatek, the link you posted seems to be suggesting that I try Magisk patching the recovery.img first and check if booting to recovery will boot up with root. I'll give that a try, since it seems like it will let me leave the current system in place and be easier to recover from if something goes wrong. It will also be practice for signing the new recovery image and compiling the vbmeta.img values. Do I need to use Magisk Manager Canary version to do this, or will the standard version work? I'm not sure if I'm looking at github right, but I see an app-debug.apk and stub-release.apk for the canary version but not an app-release.apk.

You can try regular magisk since you're working on recovery. Using the regular magisk on boot.img caused a brick but worked fine with recovery (on the Teclast P80x we used). Only canary build worked on boot.img.
This might have changed in the latest version of magisk..can't say, haven't tested

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions