Need help rooting Ulefone Armor 18t (EDIT: managed to get it rooted)

[Generic123.]

I just received an Ulefone armor 18t and I'm trying to get the phone rooted through a magisk patched boot image. Whenever I attempt to flash the patched image, the phone always ends up bootlooping and gives me the 'android system may be corrupt' message. I've tried flashing an empty vbmeta in order to try to disable secure boot, but it still isn't working.
Does anyone have any other suggestions or have any ideas as to what could be causing my phone to not boot?

Posted this on reddit; just reposting this for more exposure

EDIT: I managed to root my phone by patching my boot.img with an older version of magisk (24.3) and then updating to v25 after.

 

[foamrotreturns]

I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?

 

[Generic123.]

I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?

Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:

Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options

I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"

If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"

 

[wenyendev]

Have you tried flashing boot.img in fastboot to sort out bootlooping?

 

[foamrotreturns]

I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.

This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.

Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?

Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:

Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options

I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"

If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"

Yes, I was the person replying to you on Reddit. Thank you again for the help over there.

Have you tried flashing boot.img in fastboot to sort out bootlooping?

The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.

 

[wenyendev]

I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.

This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.

Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?



Yes, I was the person replying to you on Reddit. Thank you again for the help over there.

The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.

I am no specialist in unbricking devices. But you may try as follows

- Download the ROM, GApps (Optional), Magisk (Optional).

- Wipe System, Data, Dalvik, Cache.

- Flash the ROM, GApps (Optional), Magisk (Optional).

- Reboot and Enjoy.

 

[H2Owned]

I tried to root mine, but I was unsuccessful.
I used mtkclient to pull out the boot_b.img and vbmeta_b.img from my device. Having these backups were helpful to get me out of bootloops.

I tried 3 different magisk versions: 24.3, 25.2, and a patched version linked in mtkclient's github readme.
I also tried the vbmeta recommendations described by OP in this thread, but I still could not get myself past the 'android system may be corrupt' loop.
I reverted my boot and vbmeta partitions back to the version I backed up via mtkclient, and escaped the bootloop. But no root.

Interestingly, the checksum of the boot_b.img in my phone does not match the checksum of the boot.img provided in Ulefone's official release. I am assuming my phone received an OTA update while the version in the Ulefone official GoogleDrive remained old, but I was not able to track down a changelog for rom updates/release history.
Unsure what to try next, open to ideas.

 

[914mrx]

Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.

413.83 GB folder on MEGA

860 files and 617 subfolders

mega.nz

I have donwload a new firmware to my Armor X7 Pro and is very stable.

 

[H2Owned]

Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.

413.83 GB folder on MEGA

860 files and 617 subfolders

mega.nz

I have donwload a new firmware to my Armor X7 Pro and is very stable.

I checked the Mega link you provided, and the latest version for the Power Armor 18T is the same as in the Ulefone Google Drive location. I did not compare checksums though, so I cannot confirm the content is identical.
Where did you find this mega folder link? Any chance Ulefone also publishes a changelog or provides older firmware releases in the same location you found the Mega link?

 

[914mrx]

Hello, found this link on 4PDA a long time ago, about the others questions i don´t know. Sorry.

 

[hitanshugaur]

I spent whole night doing everything but all failed. Unlocked OEM and Usb debugging enabled, tried kingroot, vroot, supersu, downloaded drivers and everything...but somehow I couldn't get through any of it.

Any idea anyone how to do this?

 

[hitanshugaur]

Here's why the phone is not being rooted as per the customer service.

 

[Samo-z]

Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.

413.83 GB folder on MEGA

860 files and 617 subfolders

mega.nz

I have donwload a new firmware to my Armor X7 Pro and is very stable.

hello,
i download ROM file from mega. I have SPMDT tool. Scatter files can be to set. DA files is not correct to select. What is wrong?

 

[914mrx]

Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.

 

[Samo-z]

Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.

Hello,
I am solved problem with upgrade. Now have problem with FLIR kamera. No have icon for start IR camera. I can't start it.I think that new upgrade no made for all ulefone model.
How is Foamrotreturns solved problem with FLIR camera?