[JamesAt15]

I have a new Alldocube iplay 20 tablet and I have successfully unlocked the bootloader by following the tutorials elsewhere on this forum.

Next, I would like to root the device by patching the boot image with Magisk. I believe I'll need to:

1. Use Magisk Manager to patch the boot.img file
   
   
2. Generate a new vmbeta.img file to support the new boot.img
   

For #1, I have used the Spreadtrum ResearchDownload tool with a firmware PAC file to extract the boot.img file, copy it to my device, and use Magisk Manager to patch the image file (following https://www.hovatek.com/forum/thread-21427.html).  I believe I need to sign the new image, which I plan to do with the rsa4096_vbmeta.pem key I downloaded.

I am comparing with the How to root the Doogee S88 Pro using OEM keys Tutorial and it looks like I would need to run something similar to the below (after changing to RSA4096):

Code:

python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 33554432 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

What should I use for the partition_size value? Does it need to match the size of the original boot.img file? Below is the "avbtool info_image" output from the original boot.img file.

Code:

Footer version:          1.0
Image size:              36700160 bytes
Original image size:      17532928 bytes
VBMeta offset:            17534976
VBMeta size:              2176 bytes
--
Minimum libavb version:  1.0
Header Block:            256 bytes
Authentication Block:    576 bytes
Auxiliary Block:          1344 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:          0
Flags:                    0
Release String:          'avbtool 1.1.0'
Descriptors:
    Hash descriptor:
      Image Size:            17532928 bytes
      Hash Algorithm:        sha256
      Partition Name:        boot
      Salt:                  8feba2520e631978e35fcb28882d2021efd5e9015a477221a610c7d17209bb24
      Digest:                af48266b29dfa98b13aa1a78907e43b382f51e04d5fc2638300d46cc585ab13d
      Flags:                0
    Prop: com.android.build.boot.os_version -> '10'

Should I use image size "36700160" for the partition_size value?

Once this is done, I'll move on to #2, creating a new vbmeta.img file. I have followed https://www.hovatek.com/forum/thread-32667.html to extract to public keys from vbmeta-sign.img. Below is the "avbtool info_image" output from the original vbmeta.img:

Code:

Minimum libavb version:  1.0
Header Block:            256 bytes
Authentication Block:    576 bytes
Auxiliary Block:          13568 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:          0
Flags:                    0
Release String:          'avbtool 1.1.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          boot
      Rollback Index Location: 1
      Public key (sha1):      ea410c1b46cdb2e40e526880ff383f083bd615d5
ea410c1b46cdb2e40e526880ff383f083bd615d5
    Chain Partition descriptor:
      Partition Name:          dtbo
      Rollback Index Location: 10
      Public key (sha1):      ea410c1b46cdb2e40e526880ff383f083bd615d5
    Chain Partition descriptor:
      Partition Name:          recovery
      Rollback Index Location: 2
      Public key (sha1):      d9093b9a181bdb5731b44d60a9f850dc724e2874
    Chain Partition descriptor:
      Partition Name:          socko
      Rollback Index Location: 11
      Public key (sha1):      bc688cacacd959cfaafbf0549d080d6fc2d50a08
    Chain Partition descriptor:
      Partition Name:          odmko
      Rollback Index Location: 12
      Public key (sha1):      425215859f49f31809f16491c2a67e04df79baaf
    Chain Partition descriptor:
      Partition Name:          vbmeta_system
      Rollback Index Location: 3
      Public key (sha1):      e2c66ff8a1d787d7bf898711187bff150f691d27
    Chain Partition descriptor:
      Partition Name:          vbmeta_vendor
      Rollback Index Location: 4
      Public key (sha1):      9885bf5bf909e5208dfd42abaf51ad9b104ee117
    Chain Partition descriptor:
      Partition Name:          l_modem
      Rollback Index Location: 6
      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          l_ldsp
      Rollback Index Location: 7
      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          l_gdsp
      Rollback Index Location: 8
      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          pm_sys
      Rollback Index Location: 9
      Public key (sha1):      e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

So I am checking https://www.hovatek.com/forum/thread-32664.html for how to create the new vbmeta-sign-custom.img. It shows that I need to run a command like the following:

Code:

python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/key_boot.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/hovatek.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom.img

What is the --flag setting for and what will I need to set it to?

I know I need to list my own partition names and arrange them in the same order. I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?

The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?

Code:

python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/rsa4096_vbmeta.bin --chain_partition dtbo:10:keys/key_dtbo.bin --chain_partition recovery:2:keys/key_recovery.bin --chain_partition socko:11:keys/key_socko.bin --chain_partition odmko:12:keys/key_odmko.bin --chain_partition vbmeta_system:3:keys/key_vbmetasystem.bin --chain_partition vbmeta_vendor:4:keys/key_vbmetavendor.bin --chain_partition l_modem:6:keys/key_l_modem.bin --chain_partition l_ldsp:7:keys/key_l_ldsp.bin --chain_partition l_gdsp:8:keys/key_l_gdsp.bin --chain_partition pm_sys:9:keys/key_pm_sys.bin --include_descriptors_from_image phone/dtbo.img --padding_size 16384 --output vbmeta-sign-custom.img

There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?

Thanks very much for any help. This has been a very interesting learning experience.

[X3non]

...Should I use image size "36700160" for the partition_size value?

Yes, the full image size is the partition size

...What is the --flag setting for and what will I need to set it to?

same as in the original vbmeta, in your case 0

...I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?

exactly

...The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?

ignore what you read from the other thread, your vbmeta is different from what the other person has

...There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?

what you see in your original vbmeta is exactly what you should use. just ensure that the PAC firmware you are using is meant for the exact build number of your phone as seen in settings > about phone > build number

[hovatek]

I have a new Alldocube iplay 20 tablet

I see you're making some assumptions here that might only end up confusing you
The Doogee S88 Pro is Mediatek while yours is Unisoc. This doesn't mean the same technique won't work but in this case, you might only confuse yourself.

The --flag is avb image verification where 0 is Enabled and 2 is Disabled

A little History

The reason we went for that technique in the S88 Pro was that building a vbmeta from scratch flashed fine and worked but merely changing only flag from 0 to 2 (everything else left like in stock vbmeta) failed to flash.
Luckily, the oem had signed the partitions using that 2048 key so we just used that to sign modified images

Your model might not mind changing the --flag value and might not have used the 4096 key to sign the partitions so don't try to base your approach on that till you've tried the technique @ https://www.hovatek.com/forum/thread-32678.html

[JamesAt15]

X3non and Hovatek, thanks so much for your suggestions. I'll go through them to make sure I understand the process and will give it a try soon.

Hovatek, the link you posted seems to be suggesting that I try Magisk patching the recovery.img first and check if booting to recovery will boot up with root. I'll give that a try, since it seems like it will let me leave the current system in place and be easier to recover from if something goes wrong. It will also be practice for signing the new recovery image and compiling the vbmeta.img values. Do I need to use Magisk Manager Canary version to do this, or will the standard version work? I'm not sure if I'm looking at github right, but I see an app-debug.apk and stub-release.apk for the canary version but not an app-release.apk.

[hovatek]

X3non and Hovatek, thanks so much for your suggestions. I'll go through them to make sure I understand the process and will give it a try soon.

Hovatek, the link you posted seems to be suggesting that I try Magisk patching the recovery.img first and check if booting to recovery will boot up with root. I'll give that a try, since it seems like it will let me leave the current system in place and be easier to recover from if something goes wrong. It will also be practice for signing the new recovery image and compiling the vbmeta.img values. Do I need to use Magisk Manager Canary version to do this, or will the standard version work? I'm not sure if I'm looking at github right, but I see an app-debug.apk and stub-release.apk for the canary version but not an app-release.apk.

You can try regular magisk since you're working on recovery. Using the regular magisk on boot.img caused a brick but worked fine with recovery (on the Teclast P80x we used). Only canary build worked on boot.img.
This might have changed in the latest version of magisk..can't say, haven't tested