Unisoc (SPD) tablet Alldocube iPlay 20 finally rooted! Any tips on changing ROM?
Unisoc (SPD) tablet Alldocube iPlay 20 finally rooted! Any tips on changing ROM?
(13-01-2021, 07:00 PM)googlenow It would be greate if anyone can share patched vbmeta.img and boot.img for 20201208, i failed to generate mine for a long time.
Thanks
(13-01-2021, 09:22 PM)blackx12(13-01-2021, 07:00 PM)googlenow It would be greate if anyone can share patched vbmeta.img and boot.img for 20201208, i failed to generate mine for a long time.
Thanks
Yes Its done.
I have root on iPlay20(T1011S)-EN-20201208
fastboot flash vbmeta vbmeta_sign_custom.img
fastboot flash boot boot_with_root.img
https://drive.google.com/drive/folders/1...sp=sharing
The only thing is, I have red SafetyNet
python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
fastboot flash boot magisk_patched.img
avbtool: Image size of 36700160 exceeds maximum image size of 36630528 in order to fit in a partition size of 36700160.
fastboot: error: Couldn't parse partition size '0x'.
fastboot flash:raw boot magisk_patched.img
(05-04-2021, 05:26 PM)tes.tender Hello @ all
I managed to produce a signed boot.img for the latest Firmware (20201208) with also the latest available Magisk (V22.0) in a few easy steps.
No need to struggle with custom vbmeta.img
I like to share with you how I made it:
Requirements:
- the Firmware file which you like to root from the manufacturer homepage (e.g. "iPlay20(T1011S)-EN-20201208.pac") and the according update tool ("ResearchDownload") and of course this firmware should allready be installed on your device
- the MagiskManager App (in the version you like to root with) installed on your device
- a running linux (e.g. an Ubuntu USB-LiveLinux stick) with python installed (openSSL may also be needed)
- AVBtool and rsa4096_vbmeta.pem <- have a look @ https://www.hovatek.com/forum/thread-32664.html for these two files
(- may be you also need the "Android Image Kitchen" <- google for it, I'm sure you'll find it)
(- an unlocked bootloader is of course mandatory)
Step by Step:
1. extract stock boot.img out of the .pac file like described @ http:// https://www.hovatek.com/forum/thread-6236.html
2. copy it to your device, and patch it with Magisk Manager App
3. copy the patched boot.img to the Linux machine in the same folder where you allready placed "AVBtool" and the "rsa4096_vbmeta.pem"
4. In this step all the magic happens:
open a new terminal and "cd" into to the directory where all the files of step 3 are stored and then type the following command:
(please alter "magisk_patched.img" according to your actual filename of the patched boot.img of step 3)Code:python avbtool add_hash_footer --image magisk_patched.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096
5. thats it... your patched boot.img is now signed and ready for flashing to your device via fastboot
Code:fastboot flash boot magisk_patched.img
Troubleshooting:
at step 4 you may encounter the following error:
This is the point where the "Android Image Kitchen" kicks in. To solve the issue simply unpack and directly repack your patched boot.img of step 3Code:avbtool: Image size of 36700160 exceeds maximum image size of 36630528 in order to fit in a partition size of 36700160.
afterwards just go on with step 4 and 5
at step 5 you may encounter the following error:
in this case just add a ":raw" after "flash" in the fastboot command of step 5Code:fastboot: error: Couldn't parse partition size '0x'.
Code:fastboot flash:raw boot magisk_patched.img
If you somehow end up in a bootloop -> don't panic. You can restore your device in a few seconds without loosing your data.
Just open the "ResearchDownload" tool and load the .pac file which matches your current installed firmware then click the second icon (settings) and untick every "FileID" on the main page except for "FDL1" and "FDL2" and "BOOT". Close the settings window with "OK" and click the third icon (start download). Now connect your device with your PC and press the "Power button" and the "Vol.- button" simultaneously until the flashing process starts.
Regards testender
(06-04-2021, 02:34 PM)gouki9999 ...
but I got a question ,I tried repack the img (exceeds maximum image wrong) with Android image kitchen , i got a cutting size img (not 36700160 or 36630528, it just 18024448 bytes) so I can't flash it with a wrong size error ...
(09-10-2020, 11:32 PM)tstm I got root!
There was a few details missing. For this tablet the flag needs to be 0, not 2. I ran `avbtool info_image` on both the custom vbmeta and the original, and found that there were two differences. I had used `system` and `vendor` instead of `vbmeta_system` and `vbmeta_vendor` and that the flag was 0 in the original - changing those fixed the thing!
The first thing for me was to make the custom vbmeta without any changes work. After I had that, I decided to try magisk recovery.img, using Magisk Manager 8.0.2. That did not work, trying to boot into recovery just brought me a menu with a lot of chinese written on it.
Then I went for boot.img with the same Magisk version, patched it and signed it using my key and original size. Voila! I booted into the OS and I have root. The vbmeta image command line to do this was:
Code:avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 \
--chain_partition boot:1:keys/CUSTOM_KEY.bin \
--chain_partition dtbo:10:keys/vbmeta_dtbo_signature.hex \
--chain_partition recovery:2:keys/vbmeta_recovery_signature.hex \
--chain_partition socko:11:keys/vbmeta_socko_signature.hex \
--chain_partition odmko:12:keys/vbmeta_odmko_signature.hex \
--chain_partition vbmeta_system:3:keys/vbmeta_vbmeta_system_signature.hex \
--chain_partition vbmeta_vendor:4:keys/vbmeta_vbmeta_vendor_signature.hex \
--chain_partition l_modem:6:keys/vbmeta_l_modem_signature.hex \
--chain_partition l_ldsp:7:keys/vbmeta_l_ldsp_signature.hex \
--chain_partition l_gdsp:8:keys/vbmeta_l_lgdsp_signature.hex \
--chain_partition pm_sys:9:keys/vbmeta_pm_sys_signature.hex \
--padding_size 16384 \
--output vbmeta_custom.img
python vbmeta_pad.py
Where CUSTOM_KEY.bin is the one I made for myself and signed the magisk-patched boot.img with.
Now, I have root and Magisk is working. Would you guys have any suggestions on how I should go about eg. installing LineageOS? Should I just try to overwrite `system` with LineageOS, or should there be some other way?
Could I help port TWRP on the Alldocube iPlay 20 somehow? What would be needed to get a compile/modification going for the Unisoc chipset and this particular tablet?
(08-11-2021, 02:49 PM)VD-FLASH While reading this, I thought my problem was the same. But I figured out that it wasn't. At first, I also created a custom vbmeta image with flag 2 and it resulted in boot loop. Later, by reading your post, I made another vbmeta image with flag 0. But it ended up in boot loop again. My tablet is an iBall iTab movies pro ( iBall IT-KSA0012). It's powered with the same Unisoc SC9863a chipset. I was able to unlock it's bootloader using the tutorial on this site via modified fastboot. But sadly, I've not been able to do anything further than that. I'm still stuck at creating custom vbmeta image. It always boot loops. Any help for me?