Hovatek Forum DEVELOPMENT Android Unisoc (SPD) tablet Alldocube iPlay 20 finally rooted! Any tips on changing ROM?
Try our Online TWRP Builder..its free!
Can't login? Please, reset your password.


Unisoc (SPD) tablet Alldocube iPlay 20 finally rooted! Any tips on changing ROM?

Unisoc (SPD) tablet Alldocube iPlay 20 finally rooted! Any tips on changing ROM?

Pages (4): Previous 1 2 3 4
googlenow
googlenow
googlenow
Newbie
3
13-01-2021, 07:00 PM
#31



It would be greate if anyone can share patched vbmeta.img and boot.img for 20201208, i failed to generate mine for a long time.
Thanks
blackx12
blackx12
blackx12
Newbie
4
13-01-2021, 09:22 PM
#32
(13-01-2021, 07:00 PM)googlenow It would be greate if anyone can share patched vbmeta.img and boot.img for 20201208, i failed to generate mine for a long time.
Thanks


Yes Its done.

I have root on iPlay20(T1011S)-EN-20201208

fastboot flash vbmeta vbmeta_sign_custom.img

fastboot flash boot boot_with_root.img

https://drive.google.com/drive/folders/1...sp=sharing

The only thing is, I have red SafetyNet
googlenow
googlenow
googlenow
Newbie
3
14-01-2021, 04:00 PM
#33
(13-01-2021, 09:22 PM)blackx12
(13-01-2021, 07:00 PM)googlenow It would be greate if anyone can share patched vbmeta.img and boot.img for 20201208, i failed to generate mine for a long time.
Thanks


Yes Its done.

I have root on iPlay20(T1011S)-EN-20201208

fastboot flash vbmeta vbmeta_sign_custom.img

fastboot flash boot boot_with_root.img

https://drive.google.com/drive/folders/1...sp=sharing

The only thing is, I have red SafetyNet

Thank you very much, it works on my iplay20. Thanks a lot!!!
tes.tender
tes.tender
tes.tender
Newbie
1
05-04-2021, 05:26 PM
#34
Hello @ all

I managed to produce a signed boot.img for the latest Firmware (20201208) with also the latest available Magisk (V22.0) in a few easy steps.
No need to struggle with custom vbmeta.img

I like to share with you how I made it:

Requirements:
- the Firmware file which you like to root from the manufacturer homepage (e.g. "iPlay20(T1011S)-EN-20201208.pac") and the according update tool ("ResearchDownload") and of course this firmware should allready be installed on your device
- the MagiskManager App (in the version you like to root with) installed on your device
- a running linux (e.g. an Ubuntu USB-LiveLinux stick) with python installed (openSSL may also be needed)
- AVBtool and rsa4096_vbmeta.pem <- have a look @ https://www.hovatek.com/forum/thread-32664.html for these two files
(- may be you also need the "Android Image Kitchen" <- google for it, I'm sure you'll find it)
(- an unlocked bootloader is of course mandatory)

Step by Step:
1. extract stock boot.img out of the .pac file like described @ http:// https://www.hovatek.com/forum/thread-6236.html
2. copy it to your device, and patch it with Magisk Manager App
3. copy the patched boot.img to the Linux machine in the same folder where you allready placed "AVBtool" and the "rsa4096_vbmeta.pem"
4. In this step all the magic happens:
open a new terminal and "cd" into to the directory where all the files of step 3 are stored and then type the following command:
Code:

python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
(please alter "magisk_patched.img" according to your actual filename of the patched boot.img of step 3)
5. thats it... your patched boot.img is now signed and ready for flashing to your device via fastboot
Code:

fastboot flash boot magisk_patched.img

Troubleshooting:
at step 4 you may encounter the following error:
Code:

avbtool: Image size of 36700160 exceeds maximum image size of 36630528 in order to fit in a partition size of 36700160.
This is the point where the "Android Image Kitchen" kicks in. To solve the issue simply unpack and directly repack your patched boot.img of step 3
afterwards just go on with step 4 and 5

at step 5 you may encounter the following error:
Code:

fastboot: error: Couldn't parse partition size '0x'.
in this case just add a ":raw" after "flash" in the fastboot command of step 5
Code:

fastboot flash:raw boot magisk_patched.img

If you somehow end up in a bootloop -> don't panic. You can restore your device in a few seconds without loosing your data.
Just open the "ResearchDownload" tool and load the .pac file which matches your current installed firmware then click the second icon (settings) and untick every "FileID" on the main page except for "FDL1" and "FDL2" and "BOOT". Close the settings window with "OK" and click the third icon (start download). Now connect your device with your PC and press the "Power button" and the "Vol.- button" simultaneously until the flashing process starts.

Regards testender
This post was last modified: 05-04-2021, 05:36 PM by tes.tender.
gouki9999
gouki9999
gouki9999
Newbie
1
06-04-2021, 02:34 PM
#35



(05-04-2021, 05:26 PM)tes.tender Hello @ all

I managed to produce a signed boot.img for the latest Firmware (20201208) with also the latest available Magisk (V22.0) in a few easy steps.
No need to struggle with custom vbmeta.img

I like to share with you how I made it:

Requirements:
- the Firmware file which you like to root from the manufacturer homepage (e.g. "iPlay20(T1011S)-EN-20201208.pac") and the according update tool ("ResearchDownload") and of course this firmware should allready be installed on your device
- the MagiskManager App (in the version you like to root with) installed on your device
- a running linux (e.g. an Ubuntu USB-LiveLinux stick) with python installed (openSSL may also be needed)
- AVBtool and rsa4096_vbmeta.pem <- have a look @ https://www.hovatek.com/forum/thread-32664.html for these two files
(- may be you also need the "Android Image Kitchen" <- google for it, I'm sure you'll find it)
(- an unlocked bootloader is of course mandatory)

Step by Step:
1. extract stock boot.img out of the .pac file like described @ http:// https://www.hovatek.com/forum/thread-6236.html
2. copy it to your device, and patch it with Magisk Manager App
3. copy the patched boot.img to the Linux machine in the same folder where you allready placed "AVBtool" and the "rsa4096_vbmeta.pem"
4. In this step all the magic happens:
open a new terminal and "cd" into to the directory where all the files of step 3 are stored and then type the following command:
Code:

python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
(please alter "magisk_patched.img" according to your actual filename of the patched boot.img of step 3)
5. thats it... your patched boot.img is now signed and ready for flashing to your device via fastboot
Code:

fastboot flash boot magisk_patched.img

Troubleshooting:
at step 4 you may encounter the following error:
Code:

avbtool: Image size of 36700160 exceeds maximum image size of 36630528 in order to fit in a partition size of 36700160.
This is the point where the "Android Image Kitchen" kicks in. To solve the issue simply unpack and directly repack your patched boot.img of step 3
afterwards just go on with step 4 and 5

at step 5 you may encounter the following error:
Code:

fastboot: error: Couldn't parse partition size '0x'.
in this case just add a ":raw" after "flash" in the fastboot command of step 5
Code:

fastboot flash:raw boot magisk_patched.img

If you somehow end up in a bootloop -> don't panic. You can restore your device in a few seconds without loosing your data.
Just open the "ResearchDownload" tool and load the .pac file which matches your current installed firmware then click the second icon (settings) and untick every "FileID" on the main page except for "FDL1" and "FDL2" and "BOOT". Close the settings window with "OK" and click the third icon (start download). Now connect your device with your PC and press the "Power button" and the "Vol.- button" simultaneously until the flashing process starts.

Regards testender


thx for your sharing ,I've tried boot & re-sign the boot.img servral days before, seems like that I got the very simular steps with yours

but I got a question ,I tried repack the img (exceeds maximum image wrong) with Android image kitchen , i got a cutting size img (not 36700160 or 36630528, it just 18024448 bytes) so I can't flash it with a wrong size error

so can you tell me what the size number of your recpacked img with AIK?
X3non
X3non
X3non
Recognized Contributor
22,062
07-04-2021, 09:38 AM
#36
(06-04-2021, 02:34 PM)gouki9999 ...
but I got a question ,I tried repack the img (exceeds maximum image wrong) with Android image kitchen , i got a cutting size img (not 36700160 or 36630528, it just 18024448 bytes) so I can't flash it with a wrong size error ...

you're not meant to flash it but rather proceed with the next step which is to add hash footer using avbtool
go through his post again
darkhandz
darkhandz
darkhandz
Newbie
1
09-10-2021, 05:08 PM
#37
(05-04-2021, 05:26 PM)tes.tender Hello @ all
...

Thank you, follow these steps, I managed to make it works.
This post was last modified: 11-10-2021, 09:42 AM by hovatek.
VD-FLASH
VD-FLASH
VD-FLASH
Techie Member
47
08-11-2021, 02:49 PM
#38
(09-10-2020, 11:32 PM)tstm I got root!

There was a few details missing. For this tablet the flag needs to be 0, not 2. I ran `avbtool info_image` on both the custom vbmeta and the original, and found that there were two differences. I had used `system` and `vendor` instead of `vbmeta_system` and `vbmeta_vendor` and that the flag was 0 in the original - changing those fixed the thing!

The first thing for me was to make the custom vbmeta without any changes work. After I had that, I decided to try magisk recovery.img, using Magisk Manager 8.0.2. That did not work, trying to boot into recovery just brought me a menu with a lot of chinese written on it.

Then I went for boot.img with the same Magisk version, patched it and signed it using my key and original size. Voila! I booted into the OS and I have root. The vbmeta image command line to do this was:

Code:

avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:keys/CUSTOM_KEY.bin \
--chain_partition dtbo:10:keys/vbmeta_dtbo_signature.hex \
--chain_partition recovery:2:keys/vbmeta_recovery_signature.hex \
--chain_partition socko:11:keys/vbmeta_socko_signature.hex \
--chain_partition odmko:12:keys/vbmeta_odmko_signature.hex \
--chain_partition vbmeta_system:3:keys/vbmeta_vbmeta_system_signature.hex \
--chain_partition vbmeta_vendor:4:keys/vbmeta_vbmeta_vendor_signature.hex \
--chain_partition l_modem:6:keys/vbmeta_l_modem_signature.hex \
--chain_partition l_ldsp:7:keys/vbmeta_l_ldsp_signature.hex \
--chain_partition l_gdsp:8:keys/vbmeta_l_lgdsp_signature.hex \
--chain_partition pm_sys:9:keys/vbmeta_pm_sys_signature.hex \
--padding_size 16384 \
--output vbmeta_custom.img

python vbmeta_pad.py

Where CUSTOM_KEY.bin is the one I made for myself and signed the magisk-patched boot.img with.

Now, I have root and Magisk is working. Would you guys have any suggestions on how I should go about eg. installing LineageOS? Should I just try to overwrite `system` with LineageOS, or should there be some other way?

Could I help port TWRP on the Alldocube iPlay 20 somehow? What would be needed to get a compile/modification going for the Unisoc chipset and this particular tablet?

While reading this, I thought my problem was the same. But I figured out that it wasn't. At first, I also created a custom vbmeta image with flag 2 and it resulted in boot loop. Later, by reading your post, I made another vbmeta image with flag 0. But it ended up in boot loop again. My tablet is an iBall iTab movies pro ( iBall IT-KSA0012). It's powered with the same Unisoc SC9863a chipset. I was able to unlock it's bootloader using the tutorial on this site via modified fastboot. But sadly, I've not been able to do anything further than that. I'm still stuck at creating custom vbmeta image. It always boot loops. Any help for me?
hovatek
hovatek
hovatek
Administrator
49,570
10-11-2021, 12:23 PM
#39
(08-11-2021, 02:49 PM)VD-FLASH While reading this, I thought my problem was the same. But I figured out that it wasn't. At first, I also created a custom vbmeta image with flag 2 and it resulted in boot loop. Later, by reading your post, I made another vbmeta image with flag 0. But it ended up in boot loop again. My tablet is an iBall iTab movies pro ( iBall IT-KSA0012). It's powered with the same Unisoc SC9863a chipset. I was able to unlock it's bootloader using the tutorial on this site via modified fastboot. But sadly, I've not been able to do anything further than that. I'm still stuck at creating custom vbmeta image. It always boot loops. Any help for me?

Create a thread for this by clicking Ask Question at the top

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Pages (4): Previous 1 2 3 4
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram