Talk with a Hovatek Engineer/Developer. Start Now

Learn Mediatek Software Repairs Online! Enroll



  1. Hovatek Forum
  2. DEVELOPMENT
  3. Android

Unisoc Tiger T606 Unlock Method Fails
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#1

Post: 1 by Vitali

25-10-2023, 12:35 PM


Followed the tutorial

https://www.hovatek.com/forum/thread-32287.html

Code:
]$ sudo ./fastboot oem get_identifier_token
2...
(bootloader) Identifier token:

(bootloader) 5432304d494e49303030303030303130

(bootloader) 303212

OKAY [  0.002s]

Code:
$ ./signidentifier_unlockbootloader.sh 5432304d494e49303030303030303130303212 rsa4096_vbmeta.pem signature.bin
Identifier sign script, ver 0.10
1+0 records in
1+0 records out
45 bytes copied, 8.9e-05 s, 506 kB/s
Identifier sign successfully

Code:
$ sudo ./fastboot flashing unlock_bootloader signature.bin
2downloading 'unlock_message'...
OKAY [  0.002s]
unlocking bootloader...
FAILED (remote: Unlock bootloader fail.)
finished. total time: 0.055s


find 449249 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
AutoResponder
Verified Account
*****
Posts: 483
Threads: 0
Joined: Mar 2023
Reputation: 0
#2

Post: 2 by AutoResponder

25-10-2023, 12:35 PM
Thank you for reaching out for support. Due to high demand, our free support services may experience some delays in response time. We apologize for any inconvenience this may cause.
Alternatively, we offer private support where you can receive dedicated attention and prompt support. These sessions are designed to provide personalized solutions to your specific needs.
If you are interested in scheduling a private session, please visit https://www.hovatek.com/remote
find 455749 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#3

Post: 3 by Vitali

25-10-2023, 01:26 PM
Here the vbmetas
https://www.androidfilehost.com/?fid=163...1192788560

There are no permissions issues (anyway I run commands with sudo)

Code:
$ ls -l
total 9996
-rwxrwxrwx 1 root root 9158624 Oct 25 13:01 fastboot
-rwxrwxrwx 1 root root    3243 Oct 25 13:01 rsa4096_vbmeta.pem
-rwxrwxrwx 1 root root     512 Oct 25 13:30 signature.bin
-rwxrwxrwx 1 root root     512 Oct 25 13:22 signature2.bin
-rwxrwxrwx 1 root root     512 Oct 25 13:23 signature3.bin
-rwxrwxrwx 1 root root     512 Oct 25 14:05 signature4.bin
-rwxrwxrwx 1 root root    2507 Oct 25 13:01 signidentifier_unlockbootloader.sh
-rwxrwxrwx 1 root root    3002 Oct 25 13:01 start.sh
-rwxrwxrwx 1 root root       0 Oct 25 13:01 start.sh~
-rwxrwxrwx 1 root root 1048576 Oct 25 14:29 vbmeta.img

Not sure if the openssl version is important but here we go

Code:
$ openssl version
OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)
(This post was last modified: 25-10-2023, 01:39 PM by Vitali.)
find 449249 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#4

Post: 4 by Vitali

25-10-2023, 04:12 PM
Trying to track down the vbmeta private key, not sure which partition holds this info

Code:
$ python2 avbtool.py info_image --image ../vbmeta.img
Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     576 bytes
Auxiliary Block:          16320 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:           0
Flags:                    0
Release String:           'avbtool 1.2.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          boot
      Rollback Index Location: 1
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vendor_boot
      Rollback Index Location: 18
      Public key (sha1):       d5e356325cc1abaab31a4f029b4244a13a3fbe7a
    Chain Partition descriptor:
      Partition Name:          dtbo
      Rollback Index Location: 6
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vbmeta_system
      Rollback Index Location: 2
      Public key (sha1):       331c88700f82403cc678db0669f22a3f3f6030e3
    Chain Partition descriptor:
      Partition Name:          vbmeta_vendor
      Rollback Index Location: 4
      Public key (sha1):       9526c71eac87a9e6843dea820f1fa87e3101a25b
    Chain Partition descriptor:
      Partition Name:          vbmeta_odm
      Rollback Index Location: 7
      Public key (sha1):       f60a85896fdab562703e3fdf807977403523d433
    Chain Partition descriptor:
      Partition Name:          vbmeta_system_ext
      Rollback Index Location: 3
      Public key (sha1):       6bfbf18e675ca53872a759f3c9ab18b6fb69e0ce
    Chain Partition descriptor:
      Partition Name:          vbmeta_product
      Rollback Index Location: 5
      Public key (sha1):       9a13100614de1f4f231de3be63ae8eb0ac01d543
    Chain Partition descriptor:
      Partition Name:          l_modem
      Rollback Index Location: 11
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_ldsp
      Rollback Index Location: 12
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_gdsp
      Rollback Index Location: 13
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          pm_sys
      Rollback Index Location: 14
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_agdsp
      Rollback Index Location: 15
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Prop: com.android.build.boot.os_version -> '13'
    Prop: com.android.build.boot.security_patch -> '2023-08-05'
    Prop: com.android.build.system.os_version -> '13'
    Prop: com.android.build.system.security_patch -> '2023-08-05'
    Prop: com.android.build.vendor.os_version -> '13'
    Prop: com.android.build.vendor.security_patch -> '2023-08-05'
find 449249 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
maxpayne
Senior Member
*****
Posts: 2,622
Threads: 20
Joined: Oct 2016
Reputation: 5
#5

Post: 5 by maxpayne

26-10-2023, 10:39 AM
(25-10-2023, 12:35 PM)Vitali Wrote:  
Code:
$ sudo ./fastboot flashing unlock_bootloader signature.bin
2downloading 'unlock_message'...
OKAY [  0.002s]
unlocking bootloader...
FAILED (remote: Unlock bootloader fail.)
finished. total time: 0.055s

What is your phone model?
find 54949 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#6

Post: 6 by Vitali

26-10-2023, 11:40 AM
(26-10-2023, 10:39 AM)maxpayne Wrote:  
(25-10-2023, 12:35 PM)Vitali Wrote:  
Code:
$ sudo ./fastboot flashing unlock_bootloader signature.bin
2downloading 'unlock_message'...
OKAY [  0.002s]
unlocking bootloader...
FAILED (remote: Unlock bootloader fail.)
finished. total time: 0.055s

What is your phone model?

Doogee T20 Mini
https://www.doogee.cc/products/t20mini.html
find 449249 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#7

Post: 7 by Vitali

26-10-2023, 12:59 PM
By the way, OEM unlocking is activated

[Image: buz0uoL.png]
find 449249 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
maxpayne
Senior Member
*****
Posts: 2,622
Threads: 20
Joined: Oct 2016
Reputation: 5
#8

Post: 8 by maxpayne

27-10-2023, 05:59 AM
(25-10-2023, 04:12 PM)Vitali Wrote:  Trying to track down the vbmeta private key, not sure which partition holds this info

Code:
$ python2 avbtool.py info_image --image ../vbmeta.img
Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     576 bytes
Auxiliary Block:          16320 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:           0
Flags:                    0
Release String:           'avbtool 1.2.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          boot
      Rollback Index Location: 1
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vendor_boot
      Rollback Index Location: 18
      Public key (sha1):       d5e356325cc1abaab31a4f029b4244a13a3fbe7a
    Chain Partition descriptor:
      Partition Name:          dtbo
      Rollback Index Location: 6
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vbmeta_system
      Rollback Index Location: 2
      Public key (sha1):       331c88700f82403cc678db0669f22a3f3f6030e3
    Chain Partition descriptor:
      Partition Name:          vbmeta_vendor
      Rollback Index Location: 4
      Public key (sha1):       9526c71eac87a9e6843dea820f1fa87e3101a25b
    Chain Partition descriptor:
      Partition Name:          vbmeta_odm
      Rollback Index Location: 7
      Public key (sha1):       f60a85896fdab562703e3fdf807977403523d433
    Chain Partition descriptor:
      Partition Name:          vbmeta_system_ext
      Rollback Index Location: 3
      Public key (sha1):       6bfbf18e675ca53872a759f3c9ab18b6fb69e0ce
    Chain Partition descriptor:
      Partition Name:          vbmeta_product
      Rollback Index Location: 5
      Public key (sha1):       9a13100614de1f4f231de3be63ae8eb0ac01d543
    Chain Partition descriptor:
      Partition Name:          l_modem
      Rollback Index Location: 11
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_ldsp
      Rollback Index Location: 12
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_gdsp
      Rollback Index Location: 13
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          pm_sys
      Rollback Index Location: 14
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_agdsp
      Rollback Index Location: 15
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Prop: com.android.build.boot.os_version -> '13'
    Prop: com.android.build.boot.security_patch -> '2023-08-05'
    Prop: com.android.build.system.os_version -> '13'
    Prop: com.android.build.system.security_patch -> '2023-08-05'
    Prop: com.android.build.vendor.os_version -> '13'
    Prop: com.android.build.vendor.security_patch -> '2023-08-05'

From this output, they used different key from the rsa 4096 so it wont work
find 54949 Find
find Reply
https://www.hovatek.com/forum/images/default_avatar.png
Vitali
Enthusiastic Member
Posts: 13
Threads: 2
Joined: Dec 2022
Reputation: 0
#9

Post: 9 by Vitali

27-10-2023, 10:58 AM
(27-10-2023, 05:59 AM)maxpayne Wrote:  
(25-10-2023, 04:12 PM)Vitali Wrote:  Trying to track down the vbmeta private key, not sure which partition holds this info

Code:
$ python2 avbtool.py info_image --image ../vbmeta.img
Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     576 bytes
Auxiliary Block:          16320 bytes
Algorithm:                SHA256_RSA4096
Rollback Index:           0
Flags:                    0
Release String:           'avbtool 1.2.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          boot
      Rollback Index Location: 1
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vendor_boot
      Rollback Index Location: 18
      Public key (sha1):       d5e356325cc1abaab31a4f029b4244a13a3fbe7a
    Chain Partition descriptor:
      Partition Name:          dtbo
      Rollback Index Location: 6
      Public key (sha1):       99da738df9e7ebab2d0250d1b52549f1a9b2e747
    Chain Partition descriptor:
      Partition Name:          vbmeta_system
      Rollback Index Location: 2
      Public key (sha1):       331c88700f82403cc678db0669f22a3f3f6030e3
    Chain Partition descriptor:
      Partition Name:          vbmeta_vendor
      Rollback Index Location: 4
      Public key (sha1):       9526c71eac87a9e6843dea820f1fa87e3101a25b
    Chain Partition descriptor:
      Partition Name:          vbmeta_odm
      Rollback Index Location: 7
      Public key (sha1):       f60a85896fdab562703e3fdf807977403523d433
    Chain Partition descriptor:
      Partition Name:          vbmeta_system_ext
      Rollback Index Location: 3
      Public key (sha1):       6bfbf18e675ca53872a759f3c9ab18b6fb69e0ce
    Chain Partition descriptor:
      Partition Name:          vbmeta_product
      Rollback Index Location: 5
      Public key (sha1):       9a13100614de1f4f231de3be63ae8eb0ac01d543
    Chain Partition descriptor:
      Partition Name:          l_modem
      Rollback Index Location: 11
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_ldsp
      Rollback Index Location: 12
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_gdsp
      Rollback Index Location: 13
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          pm_sys
      Rollback Index Location: 14
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Chain Partition descriptor:
      Partition Name:          l_agdsp
      Rollback Index Location: 15
      Public key (sha1):       091427e706e215c2401809261f049dc21fb64e2c
    Prop: com.android.build.boot.os_version -> '13'
    Prop: com.android.build.boot.security_patch -> '2023-08-05'
    Prop: com.android.build.system.os_version -> '13'
    Prop: com.android.build.system.security_patch -> '2023-08-05'
    Prop: com.android.build.vendor.os_version -> '13'
    Prop: com.android.build.vendor.security_patch -> '2023-08-05'

From this output, they used different key from the rsa 4096 so it wont work

Do you know how I can be able to find the new key?
find 449249 Find
find Reply
https://www.hovatek.com/forum/uploads/avatars/avatar_415583.jpg?dateline=1641029370
Gargoyle
Contributor
Posts: 423
Threads: 5
Joined: Sep 2021
Reputation: 2
#10

Post: 10 by Gargoyle

27-10-2023, 11:16 AM
The key can only be obtained from the manufacturer.
find 415583 Find
find Reply
« Next Oldest | Next Newest »




Users browsing this thread: 1 Guest(s)
YouTubeWhatsappTelegram

© 2023. Powered by Hovatek...just a button away! Software by MyBB.