Hovatek Forum DEVELOPMENT Android Rooting T900 android 7.0
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


Rooting T900 android 7.0

Rooting T900 android 7.0

boleofr
boleofr
boleofr
Newbie
4
19-12-2017, 01:43 PM
#1



Hello guys,

I bought a T900 from aliexpress (fake MT8752), and it came unrooted.
Tested many tools (one click, Kingoroot, kingroot and so on) and wasn't able to acheive this.
Running MRT tools (i do own a dongle), i sucessflully retreive the rom .... but i still need a custorm recovery ...


I read this thread http_s://www.hovatek.com/forum/thread-20399.html, but as i'm not rooted, i can't use flashify. Tried to overwrite the philz recovery from fastboot mode but it fails (not flashed)...

Any suggestion ? 

Here are "generated" scatter file, extracted boot.img, recovery.img and cache.img, just in case...
http_s://mega.nz/#!CUdEWTZR!AHsLlbG03-mQg7HAnzaTaw02fsuJtzp-Pwl8Cnvr00A

Code:

############################################################################################################
#
#  General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
  info:
    - config_version: 
      platform: MT6735
      project: 
      storage: EMMC
      boot_channel: MSDC_0
      block_size: 0x20000
############################################################################################################
#
#  Layout Setting
#
############################################################################################################
- partition_index: SYS0
  partition_name: preloader
  file_name: preloader.bin
  is_download: true
  type: SV5_BL_BIN
  linear_start_addr: 0x0
  physical_start_addr: 0x0
  partition_size: 0x40000
  region: EMMC_BOOT_1
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: BOOTLOADERS
  reserve: 0x00

- partition_index: SYS1
  partition_name: proinfo
  file_name: proinfo
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0000080000
  physical_start_addr: 0x0000080000
  partition_size: 0x0x0000300000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS2
  partition_name: nvram
  file_name: nvram
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0000380000
  physical_start_addr: 0x0000380000
  partition_size: 0x0x0000500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS3
  partition_name: protect1
  file_name: protect1
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0000880000
  physical_start_addr: 0x0000880000
  partition_size: 0x0x0000A00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS4
  partition_name: protect2
  file_name: protect2
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0001280000
  physical_start_addr: 0x0001280000
  partition_size: 0x0x0000A00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS5
  partition_name: lk
  file_name: lk.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0001C80000
  physical_start_addr: 0x0001C80000
  partition_size: 0x0x0000200000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS6
  partition_name: para
  file_name: para
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0001E80000
  physical_start_addr: 0x0001E80000
  partition_size: 0x0x0000080000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS7
  partition_name: boot
  file_name: boot.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0001F00000
  physical_start_addr: 0x0001F00000
  partition_size: 0x0x0001000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS8
  partition_name: recovery
  file_name: recovery.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0002F00000
  physical_start_addr: 0x0002F00000
  partition_size: 0x0x0001000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS9
  partition_name: logo
  file_name: logo.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0003F00000
  physical_start_addr: 0x0003F00000
  partition_size: 0x0x0001400000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS10
  partition_name: expdb
  file_name: expdb
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0005300000
  physical_start_addr: 0x0005300000
  partition_size: 0x0x0000A00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS11
  partition_name: seccfg
  file_name: seccfg
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0005D00000
  physical_start_addr: 0x0005D00000
  partition_size: 0x0x0000080000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS12
  partition_name: oemkeystore
  file_name: oemkeystore
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0005D80000
  physical_start_addr: 0x0005D80000
  partition_size: 0x0x0000200000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS13
  partition_name: secro
  file_name: secro.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x0005F80000
  physical_start_addr: 0x0005F80000
  partition_size: 0x0x0000600000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS14
  partition_name: keystore
  file_name: keystore
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0006580000
  physical_start_addr: 0x0006580000
  partition_size: 0x0x0000800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS15
  partition_name: tee1
  file_name: tee1
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0006D80000
  physical_start_addr: 0x0006D80000
  partition_size: 0x0x0000500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS16
  partition_name: tee2
  file_name: tee2
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0007280000
  physical_start_addr: 0x0007280000
  partition_size: 0x0x0000500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS17
  partition_name: nvdata
  file_name: nvdata
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0007780000
  physical_start_addr: 0x0007780000
  partition_size: 0x0x0002000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS18
  partition_name: metadata
  file_name: metadata
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0009780000
  physical_start_addr: 0x0009780000
  partition_size: 0x0x0002080000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS19
  partition_name: system
  file_name: system.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x000B800000
  physical_start_addr: 0x000B800000
  partition_size: 0x0x0060000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS20
  partition_name: cache
  file_name: cache.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x006B800000
  physical_start_addr: 0x006B800000
  partition_size: 0x0x0019000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS21
  partition_name: custom
  file_name: custom
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0084800000
  physical_start_addr: 0x0084800000
  partition_size: 0x0x0025800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS22
  partition_name: frp
  file_name: frp
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x00AA000000
  physical_start_addr: 0x00AA000000
  partition_size: 0x0x0000800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS23
  partition_name: userdata
  file_name: userdata.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x00AA800000
  physical_start_addr: 0x00AA800000
  partition_size: 0x0x069C380000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS24
  partition_name: flashinfo
  file_name: flashinfo
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x0746B80000
  physical_start_addr: 0x0746B80000
  partition_size: 0x0x0001000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

Regards
xerxes
xerxes
xerxes
Senior Member
8,355
19-12-2017, 05:09 PM
#2
(19-12-2017, 01:43 PM)boleofr Hello guys,

I bought a T900 from aliexpress (fake MT8752), and it came unrooted.
Tested many tools (one click, Kingoroot, kingroot and so on) and wasn't able to acheive this.
Running MRT tools (i do own a dongle), i sucessflully retreive the rom .... but i still need a custorm recovery ...


I read this thread http_s://www.hovatek.com/forum/thread-20399.html, but as i'm not rooted, i can't use flashify. Tried to overwrite the philz recovery from fastboot mode but it fails (not flashed)...

Any suggestion ? 

Here are "generated" scatter file, extracted boot.img, recovery.img and cache.img, just in case...
http_s://mega.nz/#!CUdEWTZR!AHsLlbG03-mQg7HAnzaTaw02fsuJtzp-Pwl8Cnvr00A


Regards

State your device exact build no.

Here's TWRP @ https://mega.nz/#!RGJm3DSC!aOiz_xMXtTW2v...NSkHRpT2vQ
Follow the rooting guide @ https://www.hovatek.com/forum/thread-15267.html but use the TWRP for your phone I provided above. 
Once rooted, upload a screenshot of root confirmation using root checker @ https://play.google.com/store/apps/detai...heck&hl=en
This post was last modified: 19-12-2017, 05:10 PM by xerxes.
boleofr
boleofr
boleofr
Newbie
4
19-12-2017, 08:34 PM
#3
Thanks innagee

I went a step forward, as i was able to fully unlock the bootloader (both in android settings and using fastboot oem unlock)...
I succeed both bricking the device with an broken recovery and flash the original back.

Then i download your file, and flash it but i seems exactly as the original one (black screen white texte message : no command).... 
Note : Can't use sp flash tool (error 8417 , scatter file is invalid Sad) but as i was able to flash another one  previously, i'm sure about the method with fastboot is ok)

Regarding tablet specs here is what i can see ... + Mother board is tagged S109 MB v1.5
This post was last modified: 19-12-2017, 10:33 PM by boleofr.
Attached Files
.png
sptool.png
Size: 115.17 KB / Downloads: 1
hovatek
hovatek
hovatek
Administrator
49,570
20-12-2017, 11:27 AM
#4
(19-12-2017, 08:34 PM)boleofr ...
Regarding tablet specs here is what i can see ... + Mother board is tagged S109 MB v1.5

Root your phone using the technique at https://www.hovatek.com/forum/thread-21427.html
You can then use Flashify as in the link you refered to in your opening post

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
boleofr
boleofr
boleofr
Newbie
4
20-12-2017, 01:55 PM
#5



Wonderful !! Got it rooted !
Many many thanks !!

Here is an archive with both original and patched boot.img
http_s://mega.nz/#!2dNCkTbZ!XX9NWYgaLvPTC4BmVHMzKhHcVQ3JthBkXIQVXajFWOU
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram