T606 Blackview Tab80 LTE 4/64

gdv-it
Enthusiastic Member

7

23-12-2024, 09:51 PM

#1

Hello all.

I am trying to modify my T606 Tablet and have some Problems with it.
The Tablet is Unlocked by the Unisoc Exploid.

- I cannot get to Fastboot or Recovery by Hardware Buttons. PWR+VOLDOWN take it to Bootloader. Other Combinations do noting.

- If i use SPD_DUMP, i can backup nearly all Partitions. I cannot backup super.bin because the tab is rebooting after some specific time in FDL2. Can only backup approx. 25% of the 5GB of data.

- if i Modify some Partitions like uboot or vbmeta, the Tablet wont boot. Sure that SecureBoot and AVB2 is enabled

- i dont understand the whole SecureBoot Chain. Is it posible to modify the U-Boot to execute unsigned code? Or how is the U-Boot Partition protected agains changes?

Any chance to disable SecureBoot and flash a GSI?

i have attached the UBoot-Log Partition.

Partition List

Code:

  0                            splloader     256KB

  1                               prodnv      64MB

  2                             miscdata       1MB

  3                                 misc       1MB

  4                            trustos_a       6MB

  5                            trustos_b       6MB

  6                                sml_a       1MB

  7                                sml_b       1MB

  8                              uboot_a       3MB

  9                              uboot_b       3MB

 10                            uboot_log      16MB

 11                                 logo       8MB

 12                            fbootlogo       8MB

 13                           l_fixnv1_a       2MB

 14                           l_fixnv2_a       2MB

 15                           l_fixnv1_b       2MB

 16                           l_fixnv2_b       2MB

 17                         l_runtimenv1       2MB

 18                         l_runtimenv2       2MB

 19                              persist       2MB

 20                            l_modem_a      25MB

 21                            l_modem_b      25MB

 22                          l_deltanv_a       1MB

 23                          l_deltanv_b       1MB

 24                             l_gdsp_a      10MB

 25                             l_gdsp_b      10MB

 26                             l_ldsp_a      20MB

 27                             l_ldsp_b      20MB

 28                            l_agdsp_a       6MB

 29                            l_agdsp_b       6MB

 30                             pm_sys_a       1MB

 31                             pm_sys_b       1MB

 32                             teecfg_a       1MB

 33                             teecfg_b       1MB

 34                         hypervsior_a      10MB

 35                         hypervsior_b      10MB

 36                               boot_a      64MB

 37                               boot_b      64MB

 38                        vendor_boot_a     100MB

 39                        vendor_boot_b     100MB

 40                          init_boot_a       8MB

 41                          init_boot_b       8MB

 42                                dtb_a       8MB

 43                                dtb_b       8MB

 44                               dtbo_a       8MB

 45                               dtbo_b       8MB

 46                                super    5600MB

 47                                cache      64MB

 48                             blackbox     500MB

 49                             vbmeta_a       1MB

 50                             vbmeta_b       1MB

 51                             metadata      64MB

 52                            sysdumpdb      10MB

 53                      vbmeta_system_a       1MB

 54                      vbmeta_system_b       1MB

 55                      vbmeta_vendor_a       1MB

 56                      vbmeta_vendor_b       1MB

 57                  vbmeta_system_ext_a       1MB

 58                  vbmeta_system_ext_b       1MB

 59                     vbmeta_product_a       1MB

 60                     vbmeta_product_b       1MB

 61                         vbmeta_odm_a       1MB

 62                         vbmeta_odm_b       1MB

 63                         avbmeta_rs_a       1MB

 64                         avbmeta_rs_b       1MB

 65                         common_rs1_a       8MB

 66                         common_rs1_b       8MB

 67                         common_rs2_a      16MB

 68                         common_rs2_b      16MB

 69                             userdata   52673MB

Attached Files

uboot_log.zip
Size: 1.09 MB / Downloads: 0

gdv-it
Enthusiastic Member

7

23-12-2024, 11:00 PM

#2

Some Notes: Got root by patching boot_b.img with magisk. Dont understand why the system boots with a modified boot_b.img !?

This post was last modified: 23-12-2024, 11:01 PM by gdv-it.

gdv-it
Enthusiastic Member

7

27-12-2024, 05:07 PM

#3

Better Notes: generated TWRP by Hovatek TWRP Generator is running fine. The vendor_boot Partition is used as Recovery, so in the configurator you need to upload the vendor_boot_b.img (A or B by current Bootslot).

gdv-it
Enthusiastic Member

7

30-12-2024, 11:16 AM

#4

Can anybody help me?

The Bootloader is unlocked verify is disabled and i can boot TWRP from "vendor_boot". Also Magisk Root is done by patching the "boot" partition.

But iam still unable to Flash a Custom super.img or a modified VBMETA.
super.img is correctly packed and boots with vendors system.img and system_ext.img.
If i modify them with a repacked vendor.img or a gsi vendor.img, the tab bootloops.

If i flash a modified vbmeta, the tab hang.

If i modify the u_boot partition by changing only one Character for example in the Debug-Strings, the tab stays in the bootloader and screen keeps off.

Any Ideas how to process installing a custom rom?

This post was last modified: 30-12-2024, 11:16 AM by gdv-it.

gdv-it
Enthusiastic Member

7

30-12-2024, 06:12 PM

#5

Note: by executing "verity 0" from spd_dump, the vbmetas got modified ( i think the flag is set from 0 to 2 as documented by google) . So u_boot sets the kernel Parameters from androidboot.veritymode=enforced to androidboot.veritymode=disabled.

Now, a modified super.img with a repacked system.img (erofs) is booting fine.

maxpayne
Intern

4,059

01-01-2025, 11:51 AM

#6

(30-12-2024, 11:16 AM)gdv-it Any Ideas how to process installing a custom rom?

It seems to be a Doke OS thing.
Did you have to sign the TWRP and magisk patched boot before flashing?

This post was last modified: 01-01-2025, 11:55 AM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

gdv-it
Enthusiastic Member

7

01-01-2025, 07:27 PM

#7

vendor_boot(TWRP) and boot(with magisk) are unsigned but accepted by bootloader.
The trick is, to unlock the bootloader by exploit (since dokeOS has no OEM Unlock option in developer options) AND set vbmeta flags. So the uBoot starts the kernel without verified-boot.

After trying to generate several super.imgs, there is one working custom rom. CrDroid GSI. All other GSIs wont boot.

maxpayne
Intern

4,059

02-01-2025, 09:42 AM

#8

(01-01-2025, 07:27 PM)gdv-it After trying to generate several super.imgs, there is one working custom rom. CrDroid GSI. All other GSIs wont boot.

Does flashing this GSI directly to the system partition (without having to repack a new super image) work?

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

gdv-it
Enthusiastic Member

7

03-01-2025, 05:22 PM

#9

The device has no separate system partition. System is only embedded in the super.img.

justshez
Intern

2,363

06-01-2025, 11:58 AM

#10

(03-01-2025, 05:22 PM)gdv-it The device has no separate system partition. System is only embedded in the super.img.

You can reboot to fastbootd and try that

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions