12-03-2020, 11:51 PM
If you're into rooting and flashing custom recoveries then Android Verified Boot (AVB) or dmverity is something you should be aware of. We'd dropped a blog post on why dmverity could be causing your phone to get bricked when you try root or flash a custom recovery
A little history
Long ago, one-click root apks were a thing. Not anymore...at least till MTKsu brought back something similar to a few 64 bit Mediatek chipsets. Rooting later moved to flashing a custom recovery and SuperSU.zip...then Magisk came along.
We'd dropped a guide on how to root Android using Magisk Manager and stock boot.img and our Mediatek , Unisoc (Spreadtrum) and Qualcomm auto TWRP porters can give you a working TWRP in seconds.
All this was pretty straightforward till dmverity came along. In the first version, you needed to patch the boot.img. Magisk already does that so no worries there. Android 9 came along with AVB in the vbmeta partition...and things became a little more interesting.
Flashing a blank vbmeta before flashing a magisk patched boot or TWRP custom recovery was the way around...till signed vbmeta came along. What this now means for device's with vbmeta-sign is that you must flash a customised but signed vbmeta before you can tamper with checked partitions.
This guide is going to show you how to do that on Unisoc / Spreadtrum (SPD)
Back to present day...
Luckily, many Unisoc OEMs were lazy enough to use the same key to sign vbmeta, this guide capitalizes on that. I used Ubuntu for this guide because AVBtool kept giving errors. I'll update the guide if a fix for Windows is found.
Requirements
- Before proceeding with the guide below, ensure that you've been able to successfully unlock the bootloader of your device using this guide. If you were unable unlock the bootloader of your device then it's likely the OEM of your device used a custom private key (.pem) and the guide on this thread will NOT work for your device unless you've somehow manage to get the key your OEM used to sign vbmeta. If you have you OEM's key then replace "rsa4096_vbmeta.pem" in the list of requirements with your OEM's key
- vbmeta-sign.img extracted from a pac file for your model
- A Linux based PC. Windows PC users should install python and openssl and ensure to add both to PATH or use Linux Live USB (LiLi) or use VMware or VirtualBox
- Once booted to the Linux OS, ensure to check if python is installed and if it's not then install python
- Download zipped AVBtool (unzip after downloading) @ [ Login / Register to download free]
- Download zipped rsa4096_vbmeta.pem (unzip after downloading) @ [ Login / Register to download free]
- Download vbmeta_pad.py based on your phone's android from the links below (unzip after downloading)
- For Android 8.x devices, download this zipped vbmeta_pad.py
- For Android 9 devices, download zipped vbmeta_pad.py @ [ Login / Register to download free]
- For Android 8.x devices, download this zipped vbmeta_pad.py
- Extract the public keys from your vbmeta-sign.img as explained @ https://forum.hovatek.com/thread-32667.html and copy them into a folder named keys. We provided our vbmeta-sign.img and extracted public keys at the guide. Only use ours if your vbmeta-sign matches ours.
- The modified file you intend to flash to the device (e.g boot.img, recovery.img etc). You only need this to extract certain info
- Know how to check file info using AVBtool (avbtool info_image) as explained @ https://forum.hovatek.com/thread-32666.html
- Generate a custom signing .pem key using OpenSSL or you could stick with using rsa4096_vbmeta.pem used to sign vbmeta.
- Check and take note of the padding size of your original vbmeta image using this guide
Steps to create a custom signed vbmeta.img for Unisoc using AVBtool
Follow the steps below to use AVBtool to create a custom signed vbmeta image for Unisoc / Spreadtrum (SPD)
See the video below or @ https://youtu.be/hcUv9EsR4kY
- The files and folders you have should look something like this:
![[Image: custom-signed-vbmeta-requirements.png]](data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=)
- With all the required files in the same folder, launch Terminal by right-clicking in the folder and clicking Open Terminal
- Run the avbtool info_image command against vbmeta-sign.img, copy out the output and save in a notepad. The vbmeta-sign in our example has a padded size of 16384 and DHTB checksum which needs to be added to the custom vbmeta image later on.
- Generate a public key from the (custom) private key you've decided to use to sign your images going forward. I'll be using an OpenSSL generated key (hovatek.pem) as my custom private key for this guide. Feel free to use rsa4096_vbmeta.pem if you like.
Code:python avbtool extract_public_key --key hovatek.pem --output keys/hovatek.bin
- This command will generate a file named hovatek.bin to the keys folder which will be my public key for signing any partition I wish to flash to
- Generate a vbmeta-sign-custom.img file by running the command below. Note that I intend to flash a custom file to recovery partition so instead of using recovery's public key extracted from vbmeta-sign.img, I'll use my newly generated public key for recovery. Feel free to do same for other partitions you intend to flash to
Code:python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/key_boot.bin --chain_partition system:3:keys/key_system.bin --chain_partition vendor:4:keys/key_vendor.bin --chain_partition product:10:keys/key_product.bin --chain_partition dtbo:9:keys/key_dtbo.bin --chain_partition recovery:2:keys/hovatek.bin --chain_partition l_modem:5:keys/key_l_modem.bin --chain_partition l_ldsp:6:keys/key_l_ldsp.bin --chain_partition l_gdsp:7:keys/key_l_gdsp.bin --chain_partition pm_sys:8:keys/key_pm_sys.bin --chain_partition dtb:11:keys/key_dtb.bin --padding_size 16384 --output vbmeta-sign-custom.img
Note: the value for --algorithm was obtained from reading the vbmeta-sign
- Now I have a 16kb vbmeta-sign-custom.img file. I now need to add DHTB back to the same position as in vbmeta-sign.img . vbmeta_pad.py is the script for that. Run the code below:
Code:python vbmeta_pad.py
- vbmeta-sign-custom.img should now become a 1MB file like vbmeta-sign.img . Now, you can flash vbmeta-sign-custom.img via fastboot
![[Image: custom-signed-vbmeta-requirements.png]](https://blog.hovatek.com/bpyeki/uploads/2020/03/custom-signed-vbmeta-requirements.png)
Important Notice
- Your boottloader will only accept images signed with the key from which you generated your custom public key
- If you must flash back your stock rom, ensure to flash back your stock vbmeta-sign.img first
- Avoid trying to flash images which haven't been signed with the keys your bootloader is expecting to avoid an endless wait in Research Download tool or stuck at writing in fastboot
- Credits goes to Petercxy
Video Transcript
Quote:In this video tutorial, I'll be explaining how to create a custom signed vmbeta image. These are the files you're going to need: the public keys, you can extract these ones from the stock vbmeta, I'll link to a guide on how to do that. I also have my AVBtool. I have my hovatek.pem. Its a private key which I created with OpenSSL, I'll link to that also. I have my rsa.pem which is my key used to sign my vbmeta image. Once you launch terminal as I did while talking, you run this command. this command is to run a check on the stock vbmeta image so I can get the information I need for future commands like the algorithm used and hashes.
Next, I'm going to create a public key using my private key. I'm using hovatek.pem. You can decide to use the rsa.pem as your private key also even though you're using it to sign vbmeta image. When I run this command, its going to create a file named hovatek.bin in the keys folder. This public key is going to be used to sign any partition I intend to flash a custom image to in the future. I'm going to be signing.. I'm going to be flashing to only recovery so I'm going to be signing only the recovery partition using this public key OK? Now, I'm going to run this command. This command is going to create my custom signed vbmeta image.
Now, I'm using the default public keys (extracted) from my stock vbmeta but for recovery, I'm going to replace the public key with my hovatek.bin public key. That means if I want to flash a recovery image to the recovery partition, I'll need to sign that recovery image using the hovatek.pem . I'll link to a guide on how to do that. Now, this command is going to create a vbmeta image which is 16kb. That's because the stock also has a padded size of 16kb but the overall size of stock is 1MB. That's because there's some Checksum that needs to be applied to a certain position. That's what this script is for, vbmeta_pad.py.
So you run this command also and this is going to generate a 1MB file. This is very identical to the stock. I'm going to run a command to see the information about or of this custom vbmeta image. When you compare it to the stock, you're going to see that its very identical; maybe the flag will just be different, which is 2 to disable verity checks and the hash for recovery partition is going to be different. Every other thing is going to be identical to what I have in stock and they're both the same signature.
You're going to need the keys your OEM used to sign your stock vbmeta if not this guide is not going to work. Unisoc uses the same key across, at least so far uses the same key across their models so I have my vbmeta. You can now flash it using fastboot.
Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
