Teclast T40 Pro T1B1 Root

Teclast T40 Pro T1B1 Root - Help

Gargoyle
Contributor

541

03-09-2022, 10:01 AM

#11

It seems that the tablet does not use partition b, only partition a, please try to flash the last two files normally, without turning off dm-verity,

fastboot flash boot_a boot.img
fastboot flash vbmeta_a vbmeta-sign.img

If the device boots without any problems, flash the previous patched files in the same way.

If XDA users say that the device can be rooted, it shouldn't be a problem, the fault will be in the flashing method.

The files that are shared on XDA are for the T40 Plus EEA firmware, if I'm not mistaken you have the ROW versions, I don't know what the difference is.

This post was last modified: 03-09-2022, 10:13 AM by Gargoyle.

thkgop001
Enthusiastic Member

12

03-09-2022, 01:40 PM

#12

(03-09-2022, 10:01 AM)Gargoyle It seems that the tablet does not use partition b, only partition a, please try to flash the last two files normally, without turning off dm-verity,

fastboot flash boot_a boot.img
fastboot flash vbmeta_a vbmeta-sign.img

If the device boots without any problems, flash the previous patched files in the same way.

If XDA users say that the device can be rooted, it shouldn't be a problem, the fault will be in the flashing method.

The files that are shared on XDA are for the T40 Plus EEA firmware, if I'm not mistaken you have the ROW versions, I don't know what the difference is.

No luck with the above - same boot loop after flashing (the first stock files). I guess there's no point in me trying the patched files?

However, I know that the EEA firmware successfully manages to load on my device, and Android seems to work fine with all the expected functionality.

Do you think we can try signing again with the EEA img files?

If so, here they are:
https://www.filemail.com/d/txwfscbtafwccdp

Please help?

Gargoyle
Contributor

541

03-09-2022, 02:44 PM

#13

magisk-boot-sign.img
stock-boot-sign-only.img
vbmeta-custom-sign.img

[ Login to download]

Edit:
I have verified the functionality on my device, I just can't use the boot.img from your device as mine has 4GB of RAM, yours is 8GB, but the device boots without problems.
I used the firmware
T40 Pro(T1B1)_Android 11.0_EEA_V1.04_SZ

This post was last modified: 04-09-2022, 11:32 PM by Gargoyle.

Attached Files

Screenshot_20220904-230701.png
Size: 110.86 KB / Downloads: 3

Screenshot_20220905-000810.png
Size: 91.88 KB / Downloads: 2

Screenshot_20220905-000820.png
Size: 47.7 KB / Downloads: 2

Screenshot_20220905-000903.png
Size: 75.16 KB / Downloads: 2

Screenshot_20220905-000833_50.png
Size: 772.36 KB / Downloads: 2

thkgop001
Enthusiastic Member

12

04-09-2022, 08:34 AM

#14

(03-09-2022, 02:44 PM)Gargoyle magisk-boot-sign.img
stock-boot-sign-only.img
vbmeta-custom-sign.img

[ Login to download]

Thank you for this.

Stuck in a boot loop just on vbmeta flash. And same result (boot loop) whether I choose to reboot immediately after vbmeta flash or if I flash the patched magisk right after the vbmeta.

I've decided to redo all my steps using Ubuntu Live... Maybe my Windows 11 is just not configured correctly. With Ubuntu, I guess I should be able to sign the imgs myself now. Though I'll try your files first.

Last attempt at this root today so I'm hoping to make some progress. I'll revert with feedback.

Not sure why this device is so stubborn! Guess there's something very basic that may be flawed in my steps...

Cheers

thkgop001
Enthusiastic Member

12

04-09-2022, 12:26 PM

#15

(03-09-2022, 02:44 PM)Gargoyle magisk-boot-sign.img
stock-boot-sign-only.img
vbmeta-custom-sign.img

[ Login to download]

Here's how I far I got before I had to put this down for now...

Got Ubuntu Live (22.04.1 LTS) running
Installed python2 and got it to be the default interpreter
Patched my stock (I reverted to ROW firmware since I was not getting anywhere with the EEA firmware - same bootloops) boot.img - using both Magisk23 and Magisk25 on my Tablet and moved them to my Ubunto workspace
Managed to sign my patched boot files using rsa4096_vbmeta.pem using avbtool with no errors
Flashed (the XDA user's) vbmeta - again, the only way I can do this without a bootloop is (though I know you told me this is wrong, but I can't get any other way to work)
sudo ./fastboot --disable-verity --disable-verification flash vbmeta_b vbmeta-sign-custom.img
Then flashed the (patched and signed) Magisk23 boot.img

Back to the dreaded bootloop

Files attached herewith - what on Earth am I doing wrong??!!!
https://www.filemail.com/d/zqagrrsbkbnbdak

One suspicion: Am I using a wrong vb_meta?

Gargoyle
Contributor

541

05-09-2022, 03:04 PM

#16

I think the error will be that you flash inactive slot b "fastboot --disable-verity --disable-verification flash vbmeta_b vbmeta-sign-custom.img"

fastboot flash boot_a magisk-boot-sign.img
fastboot flash vbmeta_a vbmeta-sign-custom.img

If necessary, flash slot a and b
fastboot flash boot_b magisk-boot-sign.img
fastboot flash vbmeta_b vbmeta-sign-custom.img

--disable-verity --disable-verification I don't think it will be necessary, if the vbmeta will be created correctly.

Edit:
Find out which slot is active,
adb reboot-fastboot
fastboot getvar all

you will see
(bootloader) current-slot: a or b

You can also see on the attached screen that I don't have an unlocked bootloader, it boots into the system without any problems.

Edit2:

The vbmeta from your last link is bad as it contains the wrong key
" Partition Name: l_agdsp
Rollback Index Location: 11
Public key (sha1): 2597c218aae470a130f61162feaae70afd97f011
"
When you compare the stock-vbmeta with your custom, notice the difference, Rollback Index Location: 11
python avbtool info_image --image vbmeta-sign-custom.img
python avbtool info_image --image stock-vbmeta-sign.img

If you signed magisk_23_patched_signed-23000_W0ifo.img with the rsa4096_vbmeta.pem file, use the vbmeta I sent you in the post above, or create a new one with the keys attached.

Here are the keys from your stock-vbmeta-sign.img, where boot_key.bin is extracted from rsa4096_vbmeta.pem to sign magisk patched boot.img
[ Login to download]

This post was last modified: 05-09-2022, 03:53 PM by Gargoyle.

Attached Files

screen-2022-09-05-[1].jpg
Size: 73.86 KB / Downloads: 4

thkgop001
Enthusiastic Member

12

06-09-2022, 05:35 AM

#17

(05-09-2022, 03:04 PM)Gargoyle I think the error will be that you flash inactive slot b "fastboot --disable-verity --disable-verification flash vbmeta_b vbmeta-sign-custom.img"

fastboot flash boot_a magisk-boot-sign.img
fastboot flash vbmeta_a vbmeta-sign-custom.img

If necessary, flash slot a and b
fastboot flash boot_b magisk-boot-sign.img
fastboot flash vbmeta_b vbmeta-sign-custom.img

--disable-verity --disable-verification I don't think it will be necessary, if the vbmeta will be created correctly.

Edit:
Find out which slot is active,
adb reboot-fastboot
fastboot getvar all

you will see
(bootloader) current-slot: a or b

You can also see on the attached screen that I don't have an unlocked bootloader, it boots into the system without any problems.

Edit2:

The vbmeta from your last link is bad as it contains the wrong key
" Partition Name: l_agdsp
Rollback Index Location: 11
Public key (sha1): 2597c218aae470a130f61162feaae70afd97f011
"
When you compare the stock-vbmeta with your custom, notice the difference, Rollback Index Location: 11
python avbtool info_image --image vbmeta-sign-custom.img
python avbtool info_image --image stock-vbmeta-sign.img

If you signed magisk_23_patched_signed-23000_W0ifo.img with the rsa4096_vbmeta.pem file, use the vbmeta I sent you in the post above, or create a new one with the keys attached.

Here are the keys from your stock-vbmeta-sign.img, where boot_key.bin is extracted from rsa4096_vbmeta.pem to sign magisk patched boot.img
[ Login to download]

Hi Gargoyle

Thank you for this. I'll give it a shot this weekend and let you know how it goes.

Unfortunately real life takes over for me during the week... Huh

Cheers

kelvinchinedu
Contributor

1,535

30-10-2022, 09:03 PM

#18

(28-08-2022, 07:16 PM)thkgop001 Hi HovaTek team,

Requesting your help on my attempt to root Teclast T40 Pro T1B1.

At the moment, I get stuck a boot loop after flashing the Magisk-patched boot.img
Here are my steps as of now:

2.

Enter fastbootd

Flash the attached vbmeta using

fastboot flash vbmeta vbmeta-sign-custom.img

When rebooting, it still gets stuck in a boot loop - though the end of the loop is the Teclast splash screen with the moving circuitry

I managed to get around this boot loop by repeating Step 1 and then flashing the attached vbmeta using

fastboot --disable-verity --disable-verification flash vbmeta_b vbmeta-sign-custom.img

At this point, I can boot into Android consistently.

3.

Enter fastbootd

Flash attached patched boot using

fastboot flash boot magisk.img

When rebooting, it gets stuck in a boot loop - this time the boot loop is much shorter.

I see this text on the device screen - right at the top

INFO: LOCK FLAG IS : UNLOCK!!!

Then it reboots over and over.

4.

At this point, I found your posts here

https://www.hovatek.com/forum/thread-32678.html

https://www.hovatek.com/forum/thread-32664.html

https://www.hovatek.com/forum/thread-32666.html

But I'm getting stuck right here with this error:

avbtool add_hash_footer: error: argument --image: invalid FileType('rab+') value: 'boot2.img'

This error is the same on both (1) my Windows 11 (with python 2 installed) as well as (2) my WSL-Ubuntu under my Windows.

I've attached my imgs, avbtool, rsa4096_vbmeta, etc here
https://www.filemail.com/d/uuukszxuglgqksi

Please could you help me?

U flash vbmeta to inactive slot which is not supposed to be.just flash vbmeta without adding _b

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions