EVR-AL00 root situation

[freeza]

Thanks to xda member @fatouraee the EVR-AL00 firmware has been posted here. I've taken the time to download and dissect it and found a few interesting tidbits.

For starters it appears to be a engineering or internal build

build.prop lists it as an August security patch, so it is old.

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=PPR1.180610.001
ro.build.version.incremental=eng.root.20181019.195045
ro.build.version.sdk=28
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=9
ro.build.version.base_os=
config.disable_consumerir=true
ro.build.version.security_patch=2018-08-05
ro.build.version.min_supported_target_sdk=17
ro.build.date=Fri Oct 19 19:50:42 CST 2018
ro.build.date.utc=1539949842
ro.build.type=eng
ro.build.user=root
ro.build.host=sh0514826b41539948706875-7099393-jgmgb
ro.build.tags=test-keys
ro.build.system_root_image=true
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=arm64-v8a
ro.product.cpu.abilist=arm64-v8a,armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=arm64-v8a
ro.product.manufacturer=unknown
ro.product.locale=en-US
ro.wifi.channels=
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=generic_a15-eng 9 PPR1.180610.001 eng.root.20181019.195045 test-keys
ro.build.fingerprint=Huawei/generic_a15/generic_a15:9/PPR1.180610.001/root10191950:eng/test-keys
ro.build.characteristics=default
# end build properties
#
# from device/emui/generic_a15/system.prop
#
persist.sys.cpuset.enable=1
persist.sys.cpuset.subswitch=16
persist.sys.iaware.cpuenable=true
persist.sys.fast_h_duration=2000
persist.sys.fast_h_max=50
persist.sys.max_rdh_delay=0
ro.config.enable_rcc=true
ro.config.hw_sensorhub=true
system_init.hwextdeviceservice=1
bastet.service.enable=true
dalvik.vm.boot-dex2oat-threads=4

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.control_privapp_permissions=log
ro.opa.eligible_device=true
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=9_201806
ro.bionic.ld.warning=1
ro.art.hiddenapi.warning=1
ro.treble.enabled=true
persist.sys.dalvik.vm.lib.2=libart.so
dalvik.vm.isa.arm64.variant=generic
dalvik.vm.isa.arm64.features=default
dalvik.vm.isa.arm.variant=cortex-a15
dalvik.vm.isa.arm.features=default
ro.kernel.android.checkjni=1
dalvik.vm.lockprof.threshold=0
dalvik.vm.image-dex2oat-filter=verify-at-runtime
net.bt.name=Android
dalvik.vm.stack-trace-dir=/data/anr
ro.expect.recovery_id=0xf227db076aec861e23fda4c530f3156b69ef8804000000000000000000000000

ro.build.display.id=System-FAC 9.0.0.062(00IE)

ro.comp.sys_support_vndk=

But, here's where things get interesting!

It appears to be rooted already. Of course, with no up to date software available, you will more than likely be stuck on this build until shipping/retail firmware becomes available. Someone should take one for the team and flash it.

Join our developer telegram group here for help flashing and testing out theories so that we may soon develop a method and guide to post on XDA regarding root and/or rebrand.

 

[AngelDeath]

What did you use to extract the img files?

And we need to do a form or comparison of the two and see where the differences are for rebranding. and its possibility. Because rooting wouldnt be an issue to inject into a L29 rom before flashing, or at least i dont think

 

[freeza]

What did you use to extract the img files?

And we need to do a form or comparison of the two and see where the differences are for rebranding. and its possibility. Because rooting wouldnt be an issue to inject into a L29 rom before flashing, or at least i dont think

i used a tool to convert to ext4 then simply browsed with 7zip

you could also probably mount it in linux with no problems.

 

[antiochasylum]

i used a tool to convert to ext4 then simply browsed with 7zip

you could also probably mount it in linux with no problems.

Granted the August security patch. Would the ro.build of 10/19 perhaps say it's a newer build however just old patch?

 

[freeza]

Granted the August security patch. Would the ro.build of 10/19 perhaps say it's a newer build however just old patch?

It's possible. But then again I would assume they were simply pushing builds out quick to iron out bugs, then once it was ready, simply updated it to the latest patch.

 

[AngelDeath]

It's possible. But then again I would assume they were simply pushing builds out quick to iron out bugs, then once it was ready, simply updated it to the latest patch.

Thanks for the direction, last question, have you had trouble opening the update app from the L29 rom? I used the Huawei Update extractor, but if fails with a trustfirmware invalid header error, unchecking verify header checksum in settings let it extract, but then I cant extract the system.img file every app I use crashes, but yet I've had no issues with any of the other img files or from the AL00 rom.

 

[ajsmsg78]

Thanks for the direction, last question, have you had trouble opening the update app from the L29 rom? I used the Huawei Update extractor, but if fails with a trustfirmware invalid header error, unchecking verify header checksum in settings let it extract, but then I cant extract the system.img file every app I use crashes, but yet I've had no issues with any of the other img files or from the AL00 rom.

You're probably going to have to mount it in Linux as root. I had to do that on previous Huawei devices . Then you can zip the system and save it.

On previous devices I've used HwOta8 along with the stock rom to roll back to over firmware. I'm not sure if that would still apply to Pie devices.

 

[AngelDeath]

You're probably going to have to mount it in Linux as root. I had to do that on previous Huawei devices . Then you can zip the system and save it.

On previous devices I've used HwOta8 along with the stock rom to roll back to over firmware. I'm not sure if that would still apply to Pie devices.

Great...every img opens with no issues except this system img file from L29.

Well digging through the Product.img file there seems to be two things I found interesting. The first there is another model # "EVR-L09" which doing a search isnt coming up with anything on google. The other is there seems to be a apk to enroll OKGoogle as the hot word, which I think is the obvious, but when I pulled the apk to try and install it, it comes back that the apk does not have a certificate.

 

[Steamer2499]

Great...every img opens with no issues except this system img file from L29.

Well digging through the Product.img file there seems to be two things I found interesting. The first there is another model # "EVR-L09" which doing a search isnt coming up with anything on google. The other is there seems to be a apk to enroll OKGoogle as the hot word, which I think is the obvious, but when I pulled the apk to try and install it, it comes back that the apk does not have a certificate.

All we need now is a working "TWRP"...

 

[ajsmsg78]

Great...every img opens with no issues except this system img file from L29.

Well digging through the Product.img file there seems to be two things I found interesting. The first there is another model # "EVR-L09" which doing a search isnt coming up with anything on google. The other is there seems to be a apk to enroll OKGoogle as the hot word, which I think is the obvious, but when I pulled the apk to try and install it, it comes back that the apk does not have a certificate.

Here's a link to download the L29 9.0.0.108 system/vendor/cust that I extracted:
https://www.androidfilehost.com/?w=files&flid=285746


And here is the AL00 System:
https://www.androidfilehost.com/?fid=11410963190603853598

 

[AngelDeath]

Here's a link to download the L29 9.0.0.108 system that I extracted:

https://www.androidfilehost.com/?fid=11410963190603853592

Thanks, any chance you can pull these two as well?

Cust.img
Vendor.img

 

[ajsmsg78]

Thanks, any chance you can pull these two as well?

Cust.img
Vendor.img

Sure, give me a few and I'll add them to the last post. Ok good to go, updated the link.

 

[AngelDeath]

I'll look at them tomorrow, but in the mean time if anyone is curious the hotword for ok google is located in product.img. One thing I saw unless I read it wrong, the recovery images are the same size in both so I'm going to guess the partiton table are going to be the same. And if anyone wants to disect the apk, its attached below

 

[mac231us]

I'll look at them tomorrow, but in the mean time if anyone is curious the hotword for ok google is located in product.img. One thing I saw unless I read it wrong, the recovery images are the same size in both so I'm going to guess the partiton table are going to be the same. And if anyone wants to disect the apk, its attached below

I would compare the files too forget how I did this-recall finding differences even when the size was the same on Samsung models (Latin America versus ROW models for one of their Tablet phones the T705 versus T705M)


edit must have been diff image but it was some offline (not online) checker-there were small differences in the BL and modem on those devices even though they appeared identical size-wise on those devices from what I recall (nevermind that there were actual hardware differences in the radio between those two unlike in the case of the L00 and L29-at least the bands and connectivity appear common)

 

[AngelDeath]

I would compare the files too forget how I did this-recall finding differences even when the size was the same on Samsung models (Latin America versus ROW models for one of their Tablet phones the T705 versus T705M)


edit must have been diff image but it was some offline (not online) checker-there were small differences in the BL and modem on those devices even though they appeared identical size-wise on those devices from what I recall (nevermind that there were actual hardware differences in the radio between those two unlike in the case of the L00 and L29-at least the bands and connectivity appear common)

I have two offline programs that compare, I'll see what I find and let you know.

 

[AngelDeath]

I have two offline programs that compare, I'll see what I find and let you know.

A quick look by two different apps (Getting an update to one of them for final comparison) shows that either both the Recovery_Vendor.img and Recovery_ramdisk.img are complete different based on comparison, or because one is a internal rooted rom (AL00) and the L29 isnt, could be why there is such a massive difference in coding. Basically the whole file is different in both, My whole screen is red except the last 3 hex lines. But checking to see if updating the app makes a difference (probably not).

 

[freeza]

I should be receiving my device hopefully sometime next week. Looking forward to seeing what's possible

 

[AngelDeath]

I should be receiving my device hopefully sometime next week. Looking forward to seeing what's possible

Here is a comparison of the ramdisk.img. To me I think the large difference is one is internal testing, the other is released. But just looking at this, you can see from the legend on the left its all red meaning its completely different, but yet its exactly the same partition size, got to see the rest.

 

[fatouraee]

Here is a comparison of the ramdisk.img. To me I think the large difference is one is internal testing, the other is released. But just looking at this, you can see from the legend on the left its all red meaning its completely different, but yet its exactly the same partition size, got to see the rest.

Just PMd you

 

[AngelDeath]

Just PMd you

Got it