We're hiring! Apply Now

Hovatek Forum MOBILE Android Help disabling AVB (verification specifically) on the Unihertz Tank 01

Help disabling AVB (verification specifically) on the Unihertz Tank 01

Help disabling AVB (verification specifically) on the Unihertz Tank 01

unixman5979
unixman5979
unixman5979
Newbie
2
16-10-2023, 02:58 PM
#1



Hello, I own a Unihertz Tank 01 running Android 12 powered by the MediaTek MT6789 Helio G99. The device has A/B style partition table, an besides the vbmeta partition it also has a vbmeta_system and vbmeta_vendor partition. The bootloader is unlocked, both by toggling OEM unlocking in Developers options as well as by the "fastboot flashing unlock" command.

I achieved root on the device by patching the stock boot.img with magisk then flashing it, but can't seam to disable AVB completely in order to load unsigned lkm. Flashing the empty vbmeta.img provided in the tutorial same as flashing the one generated by avbtool (.\avbtool.py make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img) results in a bootloop.

I have tried flashing them both with the SP Flash Tool, as well as with the "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" command, with and without the flags, and also by specifying precisely to flash to vbmeta_a and vbmeta_ b partitions in all sorts of different combinations. Either way it always results in a bootloop.

The only thing that kinda works is flashing the stock vbmeta.img with "fastboot --disable-verity flash vbmeta vbmeta.img" command, then avbctl reports that verity is disabled, but verification is still on. And as soon as I try to flash vbmeta with the --disable-verification flag, or run the avbctl disable-verification command(witch reports finishing successfully) it bootloops on me again. 

What could be the cause of that ?

P.S. I also tried to flash the magisk patched boot.img before and after vbmeta, do a factory reset once flashed(multiple times..), somebody on the forums said it helps. I even tried flashing the empty vbmeta not only to the vbmeta partition, but also in the vbmeta_system, and vbmeta_vendor partitions and flashing the stock vbmeta_system and vbmeta_vendor for both A and B slots with the fastboot --disable-verity --disable-verification fags But I think it does nothing, judging by the output of "fastboot --disable-verity --disable-verification flash vbmeta_vendor_a vbmeta_vendor.img" :

Warning: skip copying vbmeta_vendor_a image avb footer (vbmeta_vendor_a partition size: 0, vbmeta_vendor_a image size: 4096).
Sending 'vbmeta_vendor_a' (4 KB)                  OKAY [  0.001s]
Writing 'vbmeta_vendor_a'                          OKAY [  0.001s]
Finished. Total time: 0.035s

The vbmeta_vendor_a partition size: 0 part is strange... because the stock firmware and scatter file I have on hand contains it and it is 4KB. It reports the same for vbmeta_system.

I can also provide the output of "avbtool info_image --image stock_vbmeta.img" or "fastboot getvar all" in order to shed some light on the situation.

Any help would be much appreciated !
AutoResponder
AutoResponder
AutoResponder
Verified Account
609
16-10-2023, 02:58 PM
#2
Thank you for reaching out for support. Due to high demand, our free support services may experience some delays in response time. We apologize for any inconvenience this may cause.
Alternatively, we offer private support where you can receive dedicated attention and prompt support. These sessions are designed to provide personalized solutions to your specific needs.
If you are interested in scheduling a private session, please visit https://www.hovatek.com/remote
maxpayne
maxpayne
maxpayne
Intern
4,101
20-10-2023, 12:07 PM
#3
(16-10-2023, 02:58 PM)unixman5979 Hello, I own a Unihertz Tank 01 running Android 12 powered by the MediaTek MT6789 Helio G99. The device has A/B style partition table, an besides the vbmeta partition it also has a vbmeta_system and vbmeta_vendor partition. The bootloader is unlocked, both by toggling OEM unlocking in Developers options as well as by the "fastboot flashing unlock" command.
..

I think this is related to forced encryption. --disable-verification tends to fail when you run with userdata encryption still enabled so disable it first. You can do this by modifying your fstab using a magisk module (so the changes reflect on reboot) .
This post was last modified: 20-10-2023, 12:07 PM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
Join us
WhTlYt