Alldocube iPlay 8T (T802)

gemiller
Junior Member

19

08-05-2021, 03:31 AM

#11

Weird, never seen that on Android before.

I'm making progress on rooting, but nothing to share yet. I have to learn avbtool to sign a rooted boot.img.

hovatek
Administrator

50,906

08-05-2021, 11:01 AM

#12

(08-05-2021, 03:31 AM)gemiller ... I have to learn avbtool to sign a rooted boot.img.

see https://www.hovatek.com/forum/thread-32674.html
in your case, it's boot not recovery

Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.

gemiller
Junior Member

19

10-05-2021, 11:24 PM

#13

Next steps to root.

Grab the firmware .pac file from here:

https://www.alldocube.com/en/firmware/

Extract the .img files from the .pac, I used pacextractor from here:

https://github.com/divinebird/pacextractor

This way:

pacextractor 'iPlay8T(T802)-EN-20210115.pac'

Create a patched avbtool. avbtool is a python 2 too that is part of AOSP,
I got a copy here:

https://github.com/youyim/AVBTOOL

The file fails with some python, to fix that, change "2L' to "2' in two places. Where will be obvious when you run it.

The patch avbtool to extrct the public keys for you. Patch details here:

https://forum.xda-developers.com/t/iplay...s.4045699/

Run it this way:

python2 avbtool info_image --image ../iPlay8T\(T802\)-EN-20210115/vbmeta-sign.img

This will put a lot of 1032 byte files in the cwd, each with the public key for one img. A lot easier than using a hex editor!

Here is the result:

kong /mnt/backup/archive/Android/Alldocube/avbtool # python2 avbtool info_image --image ../iPlay8T\(T802\)-EN-20210115/vbmeta-sign.img

Code:

Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     576 bytes
Auxiliary Block:          13568 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:           0
Flags:                    0
Release String:           'avbtool 1.1.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          boot
      Rollback Index Location: 1
      Public key (sha1):       ea410c1b46cdb2e40e526880ff383f083bd615d5
    Chain Partition descriptor:
      Partition Name:          dtbo
      Rollback Index Location: 9
      Public key (sha1):       ea410c1b46cdb2e40e526880ff383f083bd615d5
    Chain Partition descriptor:
      Partition Name:          recovery
      Rollback Index Location: 2
      Public key (sha1):       d9093b9a181bdb5731b44d60a9f850dc724e2874
    Chain Partition descriptor:
      Partition Name:          socko
      Rollback Index Location: 10
      Public key (sha1):       bc688cacacd959cfaafbf0549d080d6fc2d50a08
    Chain Partition descriptor:
      Partition Name:          odmko
      Rollback Index Location: 11
      Public key (sha1):       425215859f49f31809f16491c2a67e04df79baaf
    Chain Partition descriptor:
      Partition Name:          vbmeta_system
      Rollback Index Location: 3
      Public key (sha1):       e2c66ff8a1d787d7bf898711187bff150f691d27
    Chain Partition descriptor:
      Partition Name:          vbmeta_vendor
      Rollback Index Location: 4
      Public key (sha1):       9885bf5bf909e5208dfd42abaf51ad9b104ee117
    Chain Partition descriptor:
      Partition Name:          l_modem
      Rollback Index Location: 5
      Public key (sha1):       e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          l_ldsp
      Rollback Index Location: 6
      Public key (sha1):       e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          l_gdsp
      Rollback Index Location: 7
      Public key (sha1):       e93e7d91ba1a46b81a5f15129b4dc5769bf41f26
    Chain Partition descriptor:
      Partition Name:          pm_sys
      Rollback Index Location: 8
      Public key (sha1):       e93e7d91ba1a46b81a5f15129b4dc5769bf41f26

Sorry, I can't figure out how to preserve the indents when I post.

avbtool with both patches applies is attached.

This post was last modified: 11-05-2021, 10:50 AM by X3non.

hovatek
Administrator

50,906

11-05-2021, 11:13 AM

#14

(10-05-2021, 11:24 PM)gemiller ...

thanks for sharing

Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.

gemiller
Junior Member

19

11-05-2021, 07:11 PM

#15

Here is the AOSP avbtool.py, that works with Python3:

https://cs.android.com/android/platform/...perproject

Attached my patched copy that also dumps the public keys as .pub files;

Attached Files

avbtool.py.gz
Size: 35.21 KB / Downloads: 45

gemiller
Junior Member

19

12-05-2021, 02:02 AM

#16

I recreated the stock vbmeta-sign.img.

Here is how I build the new vbimage with the same keys and settings as the factory one:

Code:

avbtool.py make_vbmeta_image \
          --output vbmeta_custom.img \
          --padding_size 16384 \
          --key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
          --chain_partition boot:1:boot.pub \
          --chain_partition dtbo:9:dtbo.pub \
          --chain_partition recovery:2:recovery.pub \
          --chain_partition socko:10:socko.pub \
          --chain_partition odmko:11:odmko.pub \
          --chain_partition vbmeta_system:3:vbmeta_system.pub \
          --chain_partition vbmeta_vendor:4:vbmeta_vendor.pub \
          --chain_partition l_modem:5:l_modem.pub \
          --chain_partition l_ldsp:6:l_ldsp.pub \
          --chain_partition l_gdsp:7:l_gdsp.pub \
          --chain_partition pm_sys:8:pm_sys.pub
        python ../vbmeta_pad_9/vbmeta_pad.py

I used the vbmeta_pad for Android 9 as the padding in my vbmeta is:

00 40 00 00

And match padding size = 16384

The stock, and the new, image sizes are identical.

When I run avbtool info_image the results are identical, except:

Code:

10c10
< Release String:           'avbtool 1.2.0'
---
> Release String:           'avbtool 1.1.0'

And flashed:

Code:

fastboot --disable-verity  --disable-verification  flash   vbmeta  vbmeta_custom.img

And that worked!

So, on to getting magisk in the boot.img

gemiller
Junior Member

19

12-05-2021, 03:13 AM

#17

More progress. Magisk Manager updated my boot.img to magisk_patched-22100_Mj9m3.img

Extract the public key from rsa4096_vbmeta.pem, reconstruct vbmeta_custom.img to use it to sign boot.img

Code:

avbtool extract_public_key --key rsa4096_vbmeta.pem --output rsa4096_vbmeta.pub

avbtool make_vbmeta_image \
          --output vbmeta_custom.img \
          --padding_size 16384 \
          --key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
          --chain_partition boot:1:../rsa4096_vbmeta.pub \
          --chain_partition dtbo:9:dtbo.pub \
          --chain_partition recovery:2:recovery.pub \
          --chain_partition socko:10:socko.pub \
          --chain_partition odmko:11:odmko.pub \
          --chain_partition vbmeta_system:3:vbmeta_system.pub \
          --chain_partition vbmeta_vendor:4:vbmeta_vendor.pub \
          --chain_partition l_modem:5:l_modem.pub \
          --chain_partition l_ldsp:6:l_ldsp.pub \
          --chain_partition l_gdsp:7:l_gdsp.pub \
          --chain_partition pm_sys:8:pm_sys.pub
        python ../vbmeta_pad_9/vbmeta_pad.py

Sign the magisk boot:

Code:

cp magisk_patched-22100_Mj9m3.img boot-sign.img
avbtool add_hash_footer --image boot-sign.img \
          --partition_name boot --partition_size 36700160 \
          --key ../rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

Then flash with fastboot:

Code:

#  fastboot --disable-verity  --disable-verification --skip-reboot  flash   vbmeta  vbmeta_custom.img
target reported max download size of 536870912 bytes
Sending 'vbmeta' (1024 KB)...
OKAY [  0.037s]
Writing 'vbmeta'...
OKAY [  0.018s]
Finished. Total time: 0.063s

#  fastboot flash   boot boot-sign.img 
target reported max download size of 536870912 bytes
Sending 'boot' (35840 KB)...
OKAY [  1.236s]
Writing 'boot'...
OKAY [  0.365s]
Finished. Total time: 1.606s

It reboots fine, Magisk Manager says I am rooted!

AdAway starts to work in root mode! but fails with "Failed to sync. Not enough Space."
That was fixed by setting "Systemless hosts" in Magisk Manager.

Just one small problem, Root Checker does not think I am rooted? But since AdAway is happy, I don't really care.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions

Important Notice