Rooting a Blackview Tab 18 with a Mediatek G99 (MT6789) chip

ghostdunks
Newbie

3

26-04-2024, 03:21 AM

#1

Hello, I bought a Blackview Tab 18 tablet with the understanding(mistaken obviously!!) that it could be easily rooted. I'm quite new to Android(and rooting) so hopefully someone can help a rookie with some basic questions.

I was happily following the steps in this guide(https://www.getdroidtips.com/root-any-blackview-device/) until it got to the step where I had to extract the boot image using MTK Droid Tool. As I played with it more, it seems like this software is really outdated, my device is not supported and whoever made up that guide is telling porkie pies about it supporting my device. From what I can tell, the chip in my tablet, a Helio G99(MT6789?) is a mediatek chip which is really locked down and there isn't any software available out there which can actually be used to extract the boot image from the device? I've heard mention of mtk client, but that doesn't seem to support this chip either. Is there any software available which can be used to extract the boot image for my device?

So if I can't actually extract the boot image from my device, I have to either find a matching firmware/ROM from somewhere on the web or from Blackview customer support, use Magisk to patch the boot image, then flash the patched boot image to my device using fastboot, which will then "root" it?

If anyone has any tips/guides on how to root this tablet, I would be eternally grateful for any help.

kelvinchinedu
Contributor

1,503

28-04-2024, 07:31 PM

#2

Unlock your bootloader first and backup boot using wwr or mtkclient

Gargoyle
Contributor

539

28-04-2024, 10:01 PM

#3

(28-04-2024, 07:31 PM)kelvinchinedu Unlock your bootloader first and backup boot using wwr or mtkclient

I'm sure none of the above tools will work,
it is a relatively new chipset with V6 protocol.

Option is to download the factory firmware,
I know it's available, or use one of the paid tools
"Infinity CM2 Dongle, Pandora Tool, EFT Pro, etc"

"By the way, if something goes wrong and causes a boot loop, if it is not possible to boot into fastboot, you will have to use the paid tools for recovery, or send it to service, there is no free option yet."

This post was last modified: 28-04-2024, 10:06 PM by Gargoyle.

ghostdunks
Newbie

3

30-04-2024, 08:12 AM

#4

Managed to root it successfully. I unlocked the bootloader first(relatively simple, just needed to enable option in developer options, then used "fastboot flashing unlock" in bootloader mode to unlock bootloader). Then managed to get stock factory firmware from Blackview support, which had the stock boot.img file. Loaded Magisk onto the device, copied the stock boot.img file over, used magisk to patch it, resulting in a patched boot.img. Then used SP Flash Tool V6 to upload(or as per the software, "download") just the boot.img file onto the device, using the DownloadAgent file from the factory firmware. Once the patched boot image was uploaded onto the device, it was rooted.

Hope that helps anyone else looking to do this

Gargoyle
Contributor

539

30-04-2024, 02:15 PM

#5

(30-04-2024, 08:12 AM)ghostdunks Managed to root it successfully. I unlocked the bootloader first(relatively simple, just needed to enable option in developer options, then used "fastboot flashing unlock" in bootloader mode to unlock bootloader). Then managed to get stock factory firmware from Blackview support, which had the stock boot.img file. Loaded Magisk onto the device, copied the stock boot.img file over, used magisk to patch it, resulting in a patched boot.img. Then used SP Flash Tool V6 to upload(or as per the software, "download") just the boot.img file onto the device, using the DownloadAgent file from the factory firmware. Once the patched boot image was uploaded onto the device, it was rooted.

Hope that helps anyone else looking to do this

Only download agent without auth file or did they provide both files?

ghostdunks
Newbie

3

30-04-2024, 03:17 PM

#6

I only specified the download agent(flash.xml? or may have been DA_BR.bin) in SP Flash tool when uploading the patched boot.img file. Didn't specify an authentication file in the flash tool, and there's no ".auth" file in the factory firmware they provided

Seemed to work ok

kelvinchinedu
Contributor

1,503

04-05-2024, 03:04 PM

#7

Use mtk byepass with splashtool and wwr
To backup by booting to Brom mode with volume up and down and connect

Or use the almighty TFT unlock tools software to backup with internet

Gargoyle
Contributor

539

04-05-2024, 03:13 PM

#8

(04-05-2024, 03:04 PM)kelvinchinedu Use mtk byepass with splashtool and wwr
To backup by booting to Brom mode with volume up and down and connect

Or use the almighty TFT unlock tools software to backup with internet

mtkclient or mtk-bypass not supported Helio G99 "MT6789"

joshob1987
Newbie

1

12-12-2024, 04:36 PM

#9

(30-04-2024, 08:12 AM)ghostdunks Managed to root it successfully. I unlocked the bootloader first(relatively simple, just needed to enable option in developer options, then used "fastboot flashing unlock" in bootloader mode to unlock bootloader). Then managed to get stock factory firmware from Blackview support, which had the stock boot.img file. Loaded Magisk onto the device, copied the stock boot.img file over, used magisk to patch it, resulting in a patched boot.img. Then used SP Flash Tool V6 to upload(or as per the software, "download") just the boot.img file onto the device, using the DownloadAgent file from the factory firmware. Once the patched boot image was uploaded onto the device, it was rooted.

Hope that helps anyone else looking to do this

I have a similar tablet (Doogee T20 Ultra) that also runs on the Helio g99 chipset (MT6789) that I need to root and I want to be sure about this. You weren't required to flash a vbmeta image prior to flashing the Magisk patched boot image with SP Flash Tool V6? I've seen other instructions that use the traditional fastboot commands instead of SP flash tool v6 but they require the flashing of a vbmeta image first to avoid a boot loop. I have the vbmeta image from the stock firmware ROM but I'd prefer to just flash the patched boot image with the SP flash tool and DA binary.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions