[HELP] Alcatel Joy Tab 2 TWRP and Root????

Search This thread

zhoushiyi213

Member
May 20, 2020
6
3
Hey good news - bkerler includes a new function in his awesome mtkclient tool: seccfg in stage2. According to the description this generates unlock seccfg.bin for the device. While there are still some bugs in the script combining the binary strings, it does generates similar format to the original, locked seccfg.bin I pulled from my 9032z, after fixing some of the bugs. I haven't got a chance to test yet since my tablet provides the internet for my home, just to post here to provide possible direction :)

By the way messing with memory write for RTC_PDN1_FAST_BOOT and RTC_WRTGR doesn't making anything different, assuming RTC_BASE is at 0x4000.
 
  • Like
Reactions: ThankfulDev

zhoushiyi213

Member
May 20, 2020
6
3
Good news, it is root-able now!

Thanks to bkerler, mtkclient can successfully unlock and root this tablet. I followed the steps at his github repo and it worked without a problem! Cheers!

By the way I'm using the February ROM during the process.

The only glitch: "mtk reset" doesn't actually reboot the phone; long-press (~20 seconds) volume-up and power twice to reboot to recovery and you can reboot from there.
 
  • Like
Reactions: ThankfulDev
May 21, 2021
17
2
Good news, it is root-able now!

Thanks to bkerler, mtkclient can successfully unlock and root this tablet. I followed the steps at his github repo and it worked without a problem! Cheers!

By the way I'm using the February ROM during the process.

The only glitch: "mtk reset" doesn't actually reboot the phone; long-press (~20 seconds) volume-up and power twice to reboot to recovery and you can reboot from there.
Can anyone verify this? Might try later
 
  • Like
Reactions: ThankfulDev

Cruel5anity

Member
Mar 15, 2020
20
4
Can anyone verify this? Might try later
Good news, it is root-able now!

Thanks to bkerler, mtkclient can successfully unlock and root this tablet. I followed the steps at his github repo and it worked without a problem! Cheers!

By the way I'm using the February ROM during the process.

The only glitch: "mtk reset" doesn't actually reboot the phone; long-press (~20 seconds) volume-up and power twice to reboot to recovery and you can reboot from there.
How did you bypass secure boot?
 
  • Like
Reactions: ThankfulDev

Cruel5anity

Member
Mar 15, 2020
20
4
Good news, it is root-able now!

Thanks to bkerler, mtkclient can successfully unlock and root this tablet. I followed the steps at his github repo and it worked without a problem! Cheers!

By the way I'm using the February ROM during the process.

The only glitch: "mtk reset" doesn't actually reboot the phone; long-press (~20 seconds) volume-up and power twice to reboot to recovery and you can reboot from there.
how did you disable verified boot?
 

Alain+

Member
Apr 10, 2021
6
2
Has anyone tried to dump all partitions with the miracle box or with the NCK box? Sometimes when attempts with SPFT fail I have to use these alternatives, although there are so many other tools, these two are my favorites. Unfortunately I do not have this device, it belongs to a boy who needs it for his studies and also because of his visual difficulties, imagine any mistake would be fatal.
 

graffix420

Member
Dec 21, 2021
8
0
Is there any way to recover this tablet? I took a backup before messing with it, but now it's not booting. I can see the device, but there are apparently no partitions on it, mtkclient can't see any. I had magisk installed, but modules had stopped working, so I was trying to reset/reinstall.
 
Last edited:

akadriu

New member
Jul 17, 2018
2
1
This model the only way to work with would be to unlock the bootloader in brom mode. make a full system dump on said status and then maybe can use magisk to patch the boot.img.
i have a couple of these 9032z and 9032w (metro and t-mobile respectively) I have gone so far to unlock bootloader dump nvram data but there's no way to patch this device for me so far.
 

Python618

Member
May 7, 2021
22
4
Illinois
This model the only way to work with would be to unlock the bootloader in brom mode. make a full system dump on said status and then maybe can use magisk to patch the boot.img.
i have a couple of these 9032z and 9032w (metro and t-mobile respectively) I have gone so far to unlock bootloader dump nvram data but there's no way to patch this device for me so far.
I do believe there was an available emmc/partition dump and scatter file floating around if that helps.. Someone posted a guide on hovatek on the first page in this thread. Maybe you can use this img file to try a patch as well.
This model the only way to work with would be to unlock the bootloader in brom mode. make a full system dump on said status and then maybe can use magisk to patch the boot.img.
i have a couple of these 9032z and 9032w (metro and t-mobile respectively) I have gone so far to unlock bootloader dump nvram data but there's no way to patch this device for me so far.
 

Cruel5anity

Member
Mar 15, 2020
20
4
Okay, I snooped a little bit, it's the kernel we need to make a twrp and apparently you can unpack the boot.img to get the kernel... I am confirming working root rn. I got smartpack off of f-droid... If we can use the kernel from boot.img to create an unofficial twrp can we flash it with smartpack?
 

Python618

Member
May 7, 2021
22
4
Illinois
Okay, I snooped a little bit, it's the kernel we need to make a twrp and apparently you can unpack the boot.img to get the kernel... I am confirming working root rn. I got smartpack off of f-droid... If we can use the kernel from boot.img to create an unofficial twrp can we flash it with smartpack?
If you are still trying to get a emmc/partition dump with scatter file I can help. You can run mtk-bypass at bootrom to disable security, then follow the guide here: forum.hovatek.com/thread-21970.html

Two things to keep in mind:
1. You need to specify a preloader file in sp flash tool for it to work. You can get it from its ota update, or use mine attached.
2. At boortom operations it's easy for the processor to freeze. Don't follow their drain battery method; our tablet can be force-reboot to recovery by holding power+volume up for >15 seconds or so.
 

Cruel5anity

Member
Mar 15, 2020
20
4
Trying to port twrp
Got to the step where I'm editing twrp.fstab with contents of recovery.fstab
Need advice...
TWRP.fstab is from a different device, and I don't know equivalents to some of the partitions....
Do I delete those and write in the partitions from recovery.fstab?
 

Cruel5anity

Member
Mar 15, 2020
20
4
Took method 2 copy/pasted the partitions from recovery.fstab and formatted like the rest... Imma pray this works
 

Cruel5anity

Member
Mar 15, 2020
20
4
Rescued with mtk client tools

Anybody with proper experience making twrp recoveries wanna take a crack? It dumped recovery.bin but the Android image kitchen unpacked it and it has most of the needed files...
 

Cruel5anity

Member
Mar 15, 2020
20
4
Got i to boot with the custom recovery installed but it won't boot to the custom recovery... Just bootloop s...
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Got i to boot with the custom recovery installed but it won't boot to the custom recovery... Just bootloop s...

    Is that the one where it bootloops at the twrp logo? Cuz if it is I never even saw the twrp logo.
    It has an hboot which is a ram boot, an eboot which I dont remember what that does. Then the fareboot which I think is the "set me on fire" boot loop your getting. Oh and vendor specified Hal.. So far mtk tools have been a bust, and and fast boot go about as far as we all are now.. We need Vampire Lord back on this thing. That dude was a savage! And fully prepared to reverse engineer that entire o.s. I believe!!
    2
    The Alcatel joy tab 2 9032Z
    It's locked up tighter then bill gates wallet
    But there's hope yet I found some stuff today ... here's what I do know
    <Alcatel joy tab 2 9032z is TCL 9032z>
    <Manufactured by TCL communication ltd>
    <Baseband
    MOLY.LR12A.R3.TC5.PR2.SP.V2.PG
    CUSTOM BUILD
    alps-mp-90.mpl-V9.77>
    <Android 10 security update may 5 2021>
    < MTK chipset (media tech)>
    <Kernel version = 4.9.190>
    <Software version
    1C5NUPN1><hardware version 3>
    Custom design sold to T-Mobile and Metro PCs by T-Mobile
    ...........................................
    The fastboot mode is locked out which is the first hurdle ... Most adb options are locked out in the adb windows power shell due to vendor lockout ... I found a flash tool which might work am trying it tonight the ... SP FLASH TOOL 5.2112 ... I'ma try to pop its root with magisk .... I'm looking for a recovery as we speak I'll update with a working method as soon as I have one .... Wish me luck entering this fort Knox of a tablet
    2
    The beginning of this thread are the steps I followed, I have root so I was able to use the TWRP app to dump recovery image. I'll try grabbing a copy of stock recovery image when I get home.
    1
    UPDATE .... ALCATEL 9032Z =18 ..... ME = 0 ... HALF TIME LOL
    well still at it ... Did find some new information regarding this really hateful non giving tablet ... See attached doc
    1
    Guys, why don't you create a group on Telegram or another site regarding this device?
    Did this ever get made? Would love to contribute in any way. I noticed a comment in this thread mentioning a video showing the process but that account never follow through. I found a youtube page under that handle with 0 uploads. I would be willing to showcase the procedure once it's dialed in.