26-09-2020, 08:48 AM
I have a new Alldocube iplay 20 tablet and I have successfully unlocked the bootloader by following the tutorials elsewhere on this forum.
Next, I would like to root the device by patching the boot image with Magisk. I believe I'll need to:
I am comparing with the How to root the Doogee S88 Pro using OEM keys Tutorial and it looks like I would need to run something similar to the below (after changing to RSA4096):
What should I use for the partition_size value? Does it need to match the size of the original boot.img file? Below is the "avbtool info_image" output from the original boot.img file.
Should I use image size "36700160" for the partition_size value?
Once this is done, I'll move on to #2, creating a new vbmeta.img file. I have followed https://www.hovatek.com/forum/thread-32667.html to extract to public keys from vbmeta-sign.img. Below is the "avbtool info_image" output from the original vbmeta.img:
So I am checking https://www.hovatek.com/forum/thread-32664.html for how to create the new vbmeta-sign-custom.img. It shows that I need to run a command like the following:
What is the --flag setting for and what will I need to set it to?
I know I need to list my own partition names and arrange them in the same order. I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?
The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?
There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?
Thanks very much for any help. This has been a very interesting learning experience.
Next, I would like to root the device by patching the boot image with Magisk. I believe I'll need to:
- Use Magisk Manager to patch the boot.img file
- Generate a new vmbeta.img file to support the new boot.img
I am comparing with the How to root the Doogee S88 Pro using OEM keys Tutorial and it looks like I would need to run something similar to the below (after changing to RSA4096):
Code:
python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 33554432 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
What should I use for the partition_size value? Does it need to match the size of the original boot.img file? Below is the "avbtool info_image" output from the original boot.img file.
Code:
Footer version: 1.0
Image size: 36700160 bytes
Original image size: 17532928 bytes
VBMeta offset: 17534976
VBMeta size: 2176 bytes
--
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 1344 bytes
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Hash descriptor:
Image Size: 17532928 bytes
Hash Algorithm: sha256
Partition Name: boot
Salt: 8feba2520e631978e35fcb28882d2021efd5e9015a477221a610c7d17209bb24
Digest: af48266b29dfa98b13aa1a78907e43b382f51e04d5fc2638300d46cc585ab13d
Flags: 0
Prop: com.android.build.boot.os_version -> '10'
Should I use image size "36700160" for the partition_size value?
Once this is done, I'll move on to #2, creating a new vbmeta.img file. I have followed https://www.hovatek.com/forum/thread-32667.html to extract to public keys from vbmeta-sign.img. Below is the "avbtool info_image" output from the original vbmeta.img:
Code:
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 13568 bytes
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: boot
Rollback Index Location: 1
Public key (sha1): ea410c1b46cdb2e40e526880ff383f083bd615d5
ea410c1b46cdb2e40e526880ff383f083bd615d5
Chain Partition descriptor:
Partition Name: dtbo
Rollback Index Location: 10
Public key (sha1): ea410c1b46cdb2e40e526880ff383f083bd615d5
Chain Partition descriptor:
Partition Name: recovery
Rollback Index Location: 2
Public key (sha1): d9093b9a181bdb5731b44d60a9f850dc724e2874
Chain Partition descriptor:
Partition Name: socko
Rollback Index Location: 11
Public key (sha1): bc688cacacd959cfaafbf0549d080d6fc2d50a08
Chain Partition descriptor:
Partition Name: odmko
Rollback Index Location: 12
Public key (sha1): 425215859f49f31809f16491c2a67e04df79baaf
Chain Partition descriptor:
Partition Name: vbmeta_system
Rollback Index Location: 3
Public key (sha1): e2c66ff8a1d787d7bf898711187bff150f691d27
Chain Partition descriptor:
Partition Name: vbmeta_vendor
Rollback Index Location: 4
Public key (sha1): 9885bf5bf909e5208dfd42abaf51ad9b104ee117
Chain Partition descriptor:
Partition Name: l_modem
Rollback Index Location: 6
Public key (sha1): e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
Chain Partition descriptor:
Partition Name: l_ldsp
Rollback Index Location: 7
Public key (sha1): e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
Chain Partition descriptor:
Partition Name: l_gdsp
Rollback Index Location: 8
Public key (sha1): e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
Chain Partition descriptor:
Partition Name: pm_sys
Rollback Index Location: 9
Public key (sha1): e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
So I am checking https://www.hovatek.com/forum/thread-32664.html for how to create the new vbmeta-sign-custom.img. It shows that I need to run a command like the following:
Code:
python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/key_boot.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/hovatek.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom.img
What is the --flag setting for and what will I need to set it to?
I know I need to list my own partition names and arrange them in the same order. I assume the numbers after the partition name (like "boot:1") will need to match the "Rollback Index Location" numbers?
The other thread for the iplay 20 said that I'll need to include the flag "--include_descriptors_from_image phone/dtbo.img" so I will plan to do that as well (substituting the folder where I have the dtbo.img file saved). I still need to check the padding size, but otherwise does the below seem to be correct?
Code:
python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/rsa4096_vbmeta.bin --chain_partition dtbo:10:keys/key_dtbo.bin --chain_partition recovery:2:keys/key_recovery.bin --chain_partition socko:11:keys/key_socko.bin --chain_partition odmko:12:keys/key_odmko.bin --chain_partition vbmeta_system:3:keys/key_vbmetasystem.bin --chain_partition vbmeta_vendor:4:keys/key_vbmetavendor.bin --chain_partition l_modem:6:keys/key_l_modem.bin --chain_partition l_ldsp:7:keys/key_l_ldsp.bin --chain_partition l_gdsp:8:keys/key_l_gdsp.bin --chain_partition pm_sys:9:keys/key_pm_sys.bin --include_descriptors_from_image phone/dtbo.img --padding_size 16384 --output vbmeta-sign-custom.img
There's no dtb.img in my dump from the PAC file, and no dtb partition in my info_image output - is this correct?
Thanks very much for any help. This has been a very interesting learning experience.