Blackview BL8800 Pro rooting

[derjaeger]

ORIGINAL POST:

Hello,

this is almost a brand new phone, still no resources over the internet about how to root it.
Is anybody working on it?
Does anybody know a viable solution to effectively root BL8800 Pro without any damage?
Thanks

--------------------------------------------

ROOTING PROCEDURE WITH UBUNTU 22.04 - ONLY FOR PHONE FIRMWARE 20220617v02 (big thanks to adamfahdi)​

***WARNING*** THIS IS RISKY: 1 USER REPORTED A BRICKED PHONE WITH BOOT LOOP, ALL OTHERS OK - PLEASE DO NOT CHANGE ANYTHING AND CONTROL SYSTEM VERSION THOROUGHLY​

***WARNING*** THIS PROCEDURE WILL WIPE ALL YOUR PHONE CONTENTS, IT'S LIKE A FACTORY RESET, BACKUP ANYTHING YOU NEED BEFORE ACTING!​

ACTIONS ON BL8800 Pro PHONE​

---> activate developer menu and USB debug on BL8800 Pro
---> check "oem unlocking" in developer menu
---> check "enable USB debug" in developer menu
---> install latest magisk apk (CURRENTLY 25.2)
---> check "enable alternate sources" when installing magisk
---> connect USB cable
---> copy boot.img on phone (downloaded from https://mega.nz/file/rDIAWJaR#TOjmxZl5LdjyVur3lwqP2wgNCm19tNoLhxXioRV8n70 this is for 20220617v02 firmware ONLY!)
---> patch boot.img with magisk
---> copy patched pboot.img on PC

ACTIONS FROM UBUNTU 22.04​

---> open terminal
$ sudo apt install adb fastboot

$ adb devices -l
List of devices attached
BL8800PEEAxxxxxxx unauthorized usb:3-2 transport_id:1
---> authorize PC from BL8800 Pro screen
$ adb devices -l
List of devices attached
BL8800PEEAxxxxxxx device usb:3-2 product:BL8800Pro_EEA model:BL8800Pro device:BL8800Pro transport_id:1

---> check if adb is working correctly and reboot to bootloader
$ adb shell
BL8800Pro:/ $ ls
acct bin cache d data_mirror default.prop etc init.environ.rc lost+found mnt oem proc sdcard sys system_ext apex bugreports config data debug_ramdisk dev init linkerconfig metadata odm postinstall product storage system vendor
BL8800Pro:/ $ reboot bootloader

$ fastboot devices
BL8800PEEAxxxxxxx fastboot
$ fastboot flashing unlock
---> press VolumeUP on phone to choose "Yes" <----- THIS WILL WIPE ALL YOUR PHONE CONTENTS!!!
(bootloader) Start unlock flow
OKAY [ 7.348s]
Finished. Total time: 7.348s


$ fastboot flash boot pboot.img <----- THIS MAY BRICK YOUR PHONE!!!
Sending 'boot_a' (40960 KB) OKAY [ 1.368s]
Writing 'boot_a' OKAY [ 0.177s]
Finished. Total time: 1.563s
$ fastboot reboot

EXTRA: PROCEDURE TO RUN APPS THAT DENY EXECUTION WITH ROOTED PHONE​

Some sleazy apps (banking, ebay, etc.) check if you have rooted your phone and refuse to run/authenticate/etc.
This is how you can solve this, everything done from MAGISK:

1. activate Magisk Hide, in the "App" settings section - rename magisk app to whatever you like
2. activate Zygisk, in the "Magisk" setting section, then reboot
3. in the "Magisk" setting section, select the rogue apps you want to hide rooting from (e.g. ebay)
4. in Magisk modules section install "Shamiko" module downloaded from https://github.com/LSPosed/LSPosed.github.io/releases then reboot
5. in Magisk modules section install "Universal SafetyNet Fix" module downloaded from https://github.com/kdrag0n/safetynet-fix/releases then reboot
6. check in Magisk modules section that both modules are active and running
7. EXTRA: in order to check that safetynet fix is working, you may download "YASNAC" app from play store
8. ENJOY YOUR PHONE!!!

 

[Topo's]

do you only want to root?

 

[Topo's]

Keep in mind:

• Rooting may void the manufacturer’s warranty on your device.
• Rooting will block the firmware OTA updates.

 

[Topo's]

Required Downloads:​

1)Download ADB & Fastboot files
2)Blackview USB Drivers install on your pc
3)Download Other Drivers: Mediatek VCOM Drivers or MTK USB Drivers
4)Download And Install the SP Flash tool on your computer
5)Download the latest Blackview Stock ROM and move it to the PC

 

[Topo's]

• Download and extract the stock ROM to your PC.
• You need to extract the boot image using the MTK Droid Tool
• Attach your device via USB cable and copy only the boot.img file from the extracted folder to your device storage
• Launch Magisk Manager. When a popup appears asking to install Magisk, select INSTALL and choose install again.
• Tap on “Patch Boot Image File”.
• Navigate to internal storage and select your phone’s boot image that you transferred earlier.
• Wait for a couple of seconds. Magisk will start patching the boot image.
• Once the boot image has been patched, copy the “patched_boot.img” from the internal storage and replace it in the same extracted ROM folder on your PC.

 

[Topo's]

To flash stock rom whit the patched image follow this

 

[derjaeger]

Hi, thanks for your answer.
Do these tools also work on linux?
I saw that BL8800 Pro ROM is not available on the page, is there anyother source where I can download or some tool that can make a snapshot from the phone?

I saw that MTK Droid Tool looks like windows only but I am not worried... while the USB drivers are included in linux kernel? Here running ubuntu 22.04, thanks!

 

[derjaeger]

Update: I just obtained two firmare files, one maked EEA (likely for Europe) with date 2022-06-17 and another one marked NEU (likely NotEUrope) with date 2022-06-10, both subversion V02 directly from Blackview customer support. This is listing of EEA version:

-rw-rw-r-- 1 1000 1000 41943040 giu 16 19:59 boot-debug.img
-rw-rw-r-- 1 1000 1000 41943040 giu 16 19:59 boot.img
drwxrwxr-x 2 1000 1000 4096 giu 16 19:59 DATABASE
-rw-rw-r-- 1 1000 1000 136976 giu 16 19:59 dpm.img
-rw-rw-r-- 1 1000 1000 148064 giu 16 19:59 dpm-verified.img
-rw-rw-r-- 1 1000 1000 8388608 giu 16 19:59 dtbo.img
-rw-rw-r-- 1 1000 1000 72960 giu 16 19:59 dtbo-verified.img
-rw-rw-r-- 1 1000 1000 2029376 giu 16 19:59 gz.img
-rw-rw-r-- 1 1000 1000 2033072 giu 16 19:59 gz-verified.img
-rw-rw-r-- 1 1000 1000 1226000 giu 16 19:59 lk.img
-rw-rw-r-- 1 1000 1000 1233392 giu 16 19:59 lk-verified.img
-rw-rw-r-- 1 1000 1000 8420336 giu 16 19:59 logo.bin
-rw-rw-r-- 1 1000 1000 8424032 giu 16 19:59 logo-verified.bin
-rw-rw-r-- 1 1000 1000 440624 giu 16 19:59 mcupm.img
-rw-rw-r-- 1 1000 1000 444320 giu 16 19:59 mcupm-verified.img
-rwxrwxr-x 1 1000 1000 64971072 giu 16 19:59 md1img.img
-rw-rw-r-- 1 1000 1000 64982208 giu 16 19:59 md1img-verified.img
-rw-rw-r-- 1 1000 1000 50656 giu 16 19:59 MT6833_Android_scatter.txt
-rw-rw-r-- 1 1000 1000 83956 giu 16 19:59 MT6833_Android_scatter.xml
-rw-rw-r-- 1 1000 1000 2080 giu 16 19:59 pi_img.img
-rw-rw-r-- 1 1000 1000 5776 giu 16 19:59 pi_img-verified.img
-rw-rw-r-- 1 1000 1000 391996 giu 16 19:59 preloader_tf929_dk_dk029_lepton_6833_r0_eea.bin
-rw-rw-r-- 1 1000 1000 428528 giu 16 19:59 scp.img
-rw-rw-r-- 1 1000 1000 435920 giu 16 19:59 scp-verified.img
-rw-rw-r-- 1 1000 1000 11088 giu 16 19:59 spmfw.img
-rw-rw-r-- 1 1000 1000 14784 giu 16 19:59 spmfw-verified.img
-rw-rw-r-- 1 1000 1000 657344 giu 16 19:59 sspm.img
-rw-rw-r-- 1 1000 1000 661040 giu 16 19:59 sspm-verified.img
-rw-r--r-- 1 1000 1000 5135711316 giu 16 19:59 super.img
-rw-rw-r-- 1 1000 1000 970240 giu 16 19:59 tee.img
-rw-rw-r-- 1 1000 1000 977632 giu 16 19:59 tee-verified.img
-rw-r--r-- 1 1000 1000 2343188 giu 16 19:59 userdata.img
-rw-rw-r-- 1 1000 1000 4096 giu 16 19:59 vbmeta.img
-rw-rw-r-- 1 1000 1000 4096 giu 16 19:59 vbmeta_system.img
-rw-rw-r-- 1 1000 1000 4096 giu 16 19:59 vbmeta_vendor.img

DATABASE/
-rw-rw-r-- 1 1000 1000 202741 giu 16 19:59 APDB_MT6853_S01__W2209
-rw-rw-r-- 1 1000 1000 20943 giu 16 19:59 APDB_MT6853_S01__W2209_ENUM
-rwxrwxr-x 1 1000 1000 11093341 giu 16 19:59 MDDB_InfoCustomAppSrcP_MT6833_S00_TF928_R0_6833_NLWCG_V0_1_9_S220505_1_unlwctg_n.EDB
-rwxrwxr-x 1 1000 1000 746087 giu 16 19:59 MDDB.META_MT6833_S00_TF928_R0_6833_NLWCG_V0_1_9_S220505_1_unlwctg_n.EDB


Is this the correct overall filesystem suitable for modifying before flashing?
Thanks

 

[derjaeger]

One update: trying to feed scatter.xml file to SP Flash Tool gets the complaint that "MT68 platform not supported on this version" (it's MT6833) but versions following 5.1924 don't have the field for scatter.xml file....

SO at the moment I am stopped at full adb shell to the device, but nothing much more.
Btw, in order to avoid problems I am running tests from inside a W10 VM in vitualbox inside linux.

 

[Saper ElektroZłomiarz]

One update: trying to feed scatter.xml file to SP Flash Tool gets the complaint that "MT68 platform not supported on this version" (it's MT6833) but versions following 5.1924 don't have the field for scatter.xml file....

SO at the moment I am stopped at full adb shell to the device, but nothing much more.
Btw, in order to avoid problems I am running tests from inside a W10 VM in vitualbox inside linux.

Hi.
Have you tried the Fastboot method?
I also go astray
I am looking for a way to root and I take risky actions. Perhaps I understand it all wrong, but...
I unlocked the bootloader using MTKClient. Then I wanted to create a scatter myself using MTK Droid Tool to get boot.img from the phone. Unfortunately, MTK Droid Tool did not support (I think) memory.
Would you share the boot.img file, please? I'd like to try the Fastboot method.
Thank you.

 

[derjaeger]

Hello

First of all, I didn't worry about unlocking bootloader as, pressing power+vol_up buttons when phone is off, already lets you enter to a factory stock bootloader with a menu an option of which can also apply patches, so it looks kinda "ready" without the need of injecting something via fastboot (which is, btw, also an option of that menu). I don't know if that applies for you too, I have a European "EEA" latest firmware version installed.

Second, as written in my previous mail, the tool didn't operate with MT68xx devices, so it couldn't therefore extract anything.
((

I think that either an updated version of that tool comes out (but 6.x versions don't have the "scatter" file field) or we could start from that full firmware that Blackview let me download. I can transfer it to you if needed, you find the file list in my other previous mail.

At the moment the basic idea would be, I think as you might have in mind, once the boot.img file is somehow extracted, patch it with magisk, transfer it to the phone and apply it though the bootloader.

Do you agree?
Pasha

 

[Saper ElektroZłomiarz]

@derjaeger
Thank you for your response
I think you are completely right.
I read everything again and noticed that there are only two ROM files, not this whole list, and that there is some doubt about the scatter file and how SP Flash Tool supports it.
So the new firmware has no obvious procedure to upload it and the boot.img file must first be extracted to use Magisk.

It will be best if I wait for a proven method
I will be grateful for the ROM files, they will certainly be useful. Do you have restrictions on their distribution?

Thank you and best regards.
Saper

 

[derjaeger]

Yes, the MT68xx platform is likely to have introduced substantial modifications to the architecture and, therefore, the extraction methods. Is anybody reading this thread aware of new tools?

About the SW, I got no restrictions at all, pls let me know in private how you would like to receive them.

 

[facar]

Have anybody here the Stock ROM for the Blackview BL8800 Pro?

 

[derjaeger]

Hi, I have it, but you gotta wait up to 25th August, as I am now on holiday.

 

[derjaeger]

Sorry, I forgot I had the ready link from the company: https://mega.nz/file/rDIAWJaR#TOjmxZl5LdjyVur3lwqP2wgNCm19tNoLhxXioRV8n70

Please let me know if this helps you to make some progress!

 

[adamfadhi]

WELL DONE!! i been following this threat and failed to flash the boot.img many times as it's not supported by MTk flash tool- Droid tool SP-FLASH. Been working on this for over month now!! Finally after 9 hours of work non stop got it solved i was able to flash the patched boot.img


BE AWARE!!!! ALL YOUR FILES WILL BE DELETED ----- WARRANTY VOIDED !!



Finally

DONATIONS ARE WELCOMED FOR THE HARD WORK!! CASHAPP: $adamkey99


1-Download - Install - Extract -----> Platform Tools.Zip (ADB-Fastboot) etc,, in the ZIP file

2-rename the patched boot file TO boot.img to the same folder Platform Tools

3- Boot to Recovery & connect USB

4- Choose ENTER Fastboot

5- Choose Reboot to bootloader

6- open the folder Patform Tools and open CMD

7- Type the commend "fastboot devices" letters only!! you'll see your device pop up

8- Type the commend "fastboot flashing unlock" letters only!!

9-you'll see your phone in very small letters saying choose if you want to unlock WARRANTY VODIED

10- choose yes

11- type commend "fastboot flash boot boot.img" Letters only!

12-Type commend "fastboot reboot" Letters only!!



ALL DONE

 

[adamfadhi]

how to Gain ROOT???

SUPRIZE ME WITH DONATIONS FOR HARD WORK!! CASHAPP: $adamkey99

1-open settings and Enable Developer options

2- Download-Install Dr Fone Root on your computer HERE'S GOOD LINK TO DOWNLOAD: https://myphoneupdate.com/download-dr-fone-root/

3- connect your device via USB and select file transfer

4- Run Dr Fone Root

5- Accept-install anything might pop up on the phone screen

your phone will reboot multiple times very normal

Congratulations!!! ALL DONE



DONATIONS ARE WELCOMED FOR THE HARD WORK!! CASHAPP: $adamkey99

 

[derjaeger]

Hello Adam, thanks for your replies.

I am not understanding well, in the first one you talk about a patched boot.img but there's no link to it.

In the second one you talk about using a 3rd party app, but is it safe? How do you know it does not install some unwanted stuff?

So I don't understand if you rooted your phone in the 1st or 2nd way, but how is it behaving? Any slowdowns/crashes/unwanted behaviours?

Thanks

 

[adamfadhi]

Hello Adam, thanks for your replies.

I am not understanding well, in the first one you talk about a patched boot.img but there's no link to it.

In the second one you talk about using a 3rd party app, but is it safe? How do you know it does not install some unwanted stuff?

So I don't understand if you rooted your phone in the 1st or 2nd way, but how is it behaving? Any slowdowns/crashes/unwanted behaviours?

Where to get the boot.img??

1- download and extract the stock room for your device using Winrar or any zipping tools : https://mega.nz/file/rDIAWJaR#TOjmxZl5LdjyVur3lwqP2wgNCm19tNoLhxXioRV8n70

2-look inside the stock room folder you just extracted there's boot.img file

3- Copy the boot.img to your device

4- lunch magisk and patch the boot.img you just moved to your device

5- copy the patched boot.img to your pc


now go follow the steps on my first comment
-------------------------------------------------------
No issues at all