Bricked Itel A18 After Flashing VBMeta, I Can't Access Recovery or Bootloader. Please
Bricked Itel A18 After Flashing VBMeta, I Can't Access Recovery or Bootloader. Please
19-05-2026, 10:23 AM
(15-05-2026, 08:08 PM)t3chJunki3 What allows the paid tools to flash and fix it when the free ones can't? Also, where can i legitimately rent one?
They have custom loaders/exploits which you'll hardly find in free tools (unless there's a publicised leak/exploit).
Boxes / Dongles don't officially encourage renting (they prefer you buy a subscription yourself), so I don't have a source to recommend.
(15-05-2026, 08:08 PM)t3chJunki3 Also, I've built the vbmeta but the site won't let me attach anything right now for some reason
You need to zip any file before you attach it.
I checked your avbtool.py; there's only one instance of AVB_VERSION_MINOR = 2 in your avbtool.py (line 42)
This post was last modified: 19-05-2026, 10:27 AM by hovatek.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
19-05-2026, 04:26 PM
(19-05-2026, 10:23 AM)hovatek I checked your avbtool.py; there's only one instance of AVB_VERSION_MINOR = 2 in your avbtool.py (line 42)
I changed the "avb_version_minor = 2" to "avb_version_minor = 1" and built a new vbmeta. However, I'm still unable to upload as I could before, even after zipping it.
EDIT: for some reason i can only upload files after posting and then editing the post
Anyways here's the new image :
(19-05-2026, 10:23 AM)hovatek They have custom loaders/exploits which you'll hardly find in free tools (unless there's a publicised leak/exploit).
Boxes / Dongles don't officially encourage renting (they prefer you buy a subscription yourself), so I don't have a source to recommend.
I'm not sure I'll be able to get my hands on one. Any alternatives? Like unsinging the fld binaries or patching them somehow, maybe.
Could you please help me by building a custom vbmeta with a new boot public key for me and signing the
boot.img with the private key.
I'd really appreciate it.
This post was last modified: 19-05-2026, 04:37 PM by t3chJunki3.
19-05-2026, 04:50 PM
(19-05-2026, 04:26 PM)t3chJunki3 Could you please help me by building a custom vbmeta with a new boot public key for me and signing the
boot.img with the private key.
I'd really appreciate it.
The images are in this file : https://drive.google.com/file/d/1zuAGDRE...sp=sharing
19-05-2026, 05:30 PM
(19-05-2026, 04:26 PM)t3chJunki3 ..
Everything looks OK except one small change left to be made to your padding script.
Change
Code:
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')to
Code:
f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00')
f.seek(0xffe3d)
f.write(b'\x40')Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
20-05-2026, 09:36 AM
(19-05-2026, 05:30 PM)hovatek Change
.....
to
Code:f.write(b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00') f.seek(0xffe3d) f.write(b'\x40')
Done :
One other thing. I noticed that in the vbmeta I first built and flashed, the public key I had generated from the "rsa4096_vbmeta.pem" and used for my boot is identical to the "Public key (sha1)" in the vbmeta. Could that be an issue?
Also in the stock boot and dtbo share the same public key.
This post was last modified: 20-05-2026, 09:38 AM by t3chJunki3.
26-05-2026, 04:43 PM
(20-05-2026, 09:36 AM)t3chJunki3 ...
They're now a replica of each other (vbmeta_stock.img and vbmeta_custom.img). This confirms that your keys and padding scripts are correct.
(20-05-2026, 09:36 AM)t3chJunki3 One other thing. I noticed that in the vbmeta I first built and flashed, the public key I had generated from the "rsa4096_vbmeta.pem" and used for my boot is identical to the "Public key (sha1)" in the vbmeta. Could that be an issue?
I believe you mean something like this
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 13568 bytes
Public key (sha1): 2597c218aae470a130f61162feaae70afd97f011
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: boot
Rollback Index Location: 1
Public key (sha1): 2597c218aae470a130f61162feaae70afd97f011
This is expected. Since you have used the same private key to sign both your boot.img and vbmeta.img, they'll have the same public key
(20-05-2026, 09:36 AM)t3chJunki3 Also in the stock boot and dtbo share the same public key.
It just means they were both originally signed with the same private key
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
01-06-2026, 02:37 PM
(26-05-2026, 04:43 PM)hovatek .....Thank you so much for your help and patience with the vbmeta build. I managed to get the phone booting again.
I would now like to back up the full ROM. How should I go about doing that?
Which partitions store the IMEI information?
I also want to use the online TWRP builder to create a TWRP recovery. How would I build and flash it if my phone is currently rooted using a Magisk-patched boot image?
Would I need new private and public keys, or can I use the same keys that I used for the boot and vbmeta images?
04-06-2026, 10:42 AM
(01-06-2026, 02:37 PM)t3chJunki3 I would now like to back up the full ROM. How should I go about doing that?
Which tool and version did you use to flash?
(01-06-2026, 02:37 PM)t3chJunki3 Would I need new private and public keys, or can I use the same keys that I used for the boot and vbmeta images?
You can use the same keys to sign the generated TWRP
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
05-06-2026, 12:11 PM
(04-06-2026, 10:42 AM)hovatek Which tool and version did you use to flash?
I used spreadtrum flash
(04-06-2026, 10:42 AM)hovatek You can use the same keys to sign the generated TWRP
So i can use those same keys to sign any image i want to flash?
Can I flash the twrp while magisk is installed?
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)