Bricked Itel A18 After Flashing VBMeta, I Can't Access Recovery or Bootloader. Please
Bricked Itel A18 After Flashing VBMeta, I Can't Access Recovery or Bootloader. Please
05-05-2026, 09:33 AM
(05-05-2026, 09:01 AM)t3chJunki3 ..
Would you mind taking a look at my vbmeta images to confirm whether I built the custom one correctly?
1. You set flag as 2. Always leave it as 0 because changing this causes issues with many devices
2. You signed boot (in vbmeta) with a custom public key. This means you have a private key, which you'll use to sign the boot.img, and the public key used for the boot partition when generating your vbmeta must have been generated from the private key used to sign the boot.img. I suggest you first use the original public key for boot (don't change it yet)
3. You also need to consider your padding script.
If you stick to all stock keys for your first build, it's easy to compare and be sure your keys and padding script are correct.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
05-05-2026, 10:23 AM
(05-05-2026, 09:33 AM)hovatek 1. You set flag as 2. Always leave it as 0 because changing this causes issues with many devicesI signed the boot image using the private key from your site. Do you mean using the original public key for my patched boot?
2. You signed boot (in vbmeta) with a custom public key. This means you have a private key, which you'll use to sign the boot.img, and the public key used for the boot partition when generating your vbmeta must have been generated from the private key used to sign the boot.img. I suggest you first use the original public key for boot (don't change it yet)
3. You also need to consider your padding script.
If you stick to all stock keys for your first build, it's easy to compare and be sure your keys and padding script are correct.
The stock vbmeta has a DHTB value of 00 40 00 00, so I used the 00 40 00 00 padding script from your guide.
Could rebooting the phone before flashing the signed boot image have caused this issue, or could this just be as a result of not leaving the flags value as 0?
Also, what’s the difference between paid flashing tools and free ones that allows them to flash my phone? And is there a legitimate site where I can rent one?
05-05-2026, 11:31 AM
(05-05-2026, 10:23 AM)t3chJunki3 The stock vbmeta has a DHTB value of 00 40 00 00, so I used the 00 40 00 00 padding script from your guide.
Could rebooting the phone before flashing the signed boot image have caused this issue, or could this just be as a result of not leaving the flags value as 0?
As I said, first build a vbmeta leaving the flag as 0 and not changing the public key for boot. We can then compare both and confirm if your keys and padding script are correct.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
07-05-2026, 12:56 PM
(05-05-2026, 11:31 AM)hovatek As I said, first build a vbmeta leaving the flag as 0 and not changing the public key for boot. We can then compare both and confirm if your keys and padding script are correct.
Okay, I've done that. Please have a look for me. Thank you.
Attached Files
15-05-2026, 08:19 AM
(07-05-2026, 12:56 PM)t3chJunki3 Okay, I've done that. Please have a look for me. Thank you.
There's a difference in your DHTB (which might not matter, but I just wish to check).
Open your avbtool in a text editor. Look for
Code:
AVB_VERSION_MINOR = 2and change it to
Code:
AVB_VERSION_MINOR = 1Then regenerate the custom vbmeta and share
This post was last modified: 15-05-2026, 08:20 AM by hovatek.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
15-05-2026, 12:02 PM
(15-05-2026, 08:19 AM)hovatek(07-05-2026, 12:56 PM)t3chJunki3 Okay, I've done that. Please have a look for me. Thank you.
There's a difference in your DHTB (which might not matter, but I just wish to check).
Open your avbtool in a text editor. Look for
Code:AVB_VERSION_MINOR = 2
and change it to
Code:AVB_VERSION_MINOR = 1
Then regenerate the custom vbmeta and share
I've opened the AVB tool on my phone and found several instances where AVB_VERSION_MINOR = 2 appears in the code. Should I change all of them to 1?
I'll build the vbmeta as soon as I have access to my laptop.
Also, aside from rooting, how can I get the phone to boot again by flashing the stock vbmeta back, since fdl2 returns an "incompatible partition" error? I dont have access to recovery, fastboot or bootloader modes.
15-05-2026, 12:44 PM
(15-05-2026, 12:02 PM)t3chJunki3 I've opened the AVB tool on my phone and found several instances where AVB_VERSION_MINOR = 2 appears in the code. Should I change all of them to 1?
There should be just 1.
Share your avbtool.py
(15-05-2026, 12:02 PM)t3chJunki3 Also, aside from rooting, how can I get the phone to boot again by flashing the stock vbmeta back, since fdl2 returns an "incompatible partition" error? I dont have access to recovery, fastboot or bootloader modes.
You'll need a paid tool
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
15-05-2026, 01:07 PM
(15-05-2026, 12:44 PM)hovatek You'll need a paid tool
What allows the paid tools to flash and fix it when the free ones can't? Also, where can i legitimately rent one?
(15-05-2026, 12:44 PM)hovatek There should be just 1.
Share your avbtool.py
Here:
This post was last modified: 15-05-2026, 01:18 PM by t3chJunki3.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)