T818A To T818W

[GuestK00136]

Preface

I understand this tablet is old but the ability to 'possibly' obtain root opens up a modicum of options for enthusiasts looking to prolong their investment.

Summary

Was experimenting tonight (3/27/18) and found it IS possible to change models from T818A (AT&T) to T818W (Canadian variant).

This is significant because, to my knowledge and research, no foolproof method exists to introduce root access to T818A (and possibly T818T and T818V).

By changing T818A to T818W, we can hopefully forgo the need to utilize engineering boot images or Kingroot. We can simplify the root process by utilizing Odin and injecting CF-Root.

 

[ashyx]

Preface

I understand this tablet is old but the ability to 'possibility' obtain root opens up a modicum of customization for enthusiasts looking to prolong their investment.

Summary

Was experimenting tonight and found it IS possible to change models from T818A (AT&T) to T818W (Canadian variant).

This is significant because, to my knowledge and research, no foolproof method exists to introduce root access to T818A or T818V.

By changing T818A/V to T818W, we can forego the need to utilize engineering boot images or Kingroot. We can simplify the root process by utilizing Odin and injecting CF-Root.

Current Status

The device is recognized as 'T818W' after multiple restarts and factory resets.

Unfortunately CSC is hit or miss.

Originally, on first flash, there was no CSC listed and as such, every single CSC option was available under 'Settings'. I was able to finally introduce 'RWC' (Rogers) successfully and that eliminated duplicate options.

In addition to the firmware change, in Android Recovery, both 'product.name' and "ro.product.device' reflect the alteration.

On the AT&T Tab S2 9.7", prior to the software flash, the following is seen:

samsung/gts210velteuc/gts210velteatt

After the firmware flash, the syntax is replaced with the following:

gts210veltevl/gts210veltecan

Next Steps

I want to ensure I can go back to T818A from T818W and vice-versa.

I'd also like to see if I can go from T818A to T818V and then to T818W.

If I can do these steps without any alterations to the EFS Partition (e.g, IMEI), I will then attempt root.

If all these methods come back without error, I will provide the necessary steps to use at your discretion.

Misc.

This research was inspired by @ashyx and his efforts to procure root on the AT&T and Verizon versions of the Tab S2 9.7.

What parts were you able to flash with odin? The important part is the bootloader.
Also I think I remember someone posting something similar before, may have even been this model, whereby the firmware from one model successfully flashed to the other. As I recall this was Verizon to Rogers, but as it turned out both had locked bootloaders, so it looked like the bootloader images were the same regardless of carrier.
I'm not 100% on this as it's a while ago.
There's a fairly safe way to determine if the bootloader will allow anything to flashed by simply flashing an unsigned recovery image.

One thing I would like to know is how picky the bootloader is with flashing unsigned cache images.

Anyway keep us posted.

 

[GuestK00136]

@ashyx

Thanks for the response,

When going from T818A to T818W, BL, AP, and CP load successfully however I have to use Prince Cosmy's build of Odin. I found that CSC will sometimes fail when using Rogers, so I keep it set to AT&T.

When reverting back to T818A, I am using the 3.12.7 build of Odin and all four combination files load successfully (BL, AP, CP, and CSC).

 

[ashyx]

@ashyx

Thanks for the response,

When going from T818A to T818W, BL, AP, and CP load successfully however I have to use Prince Cosmy's build of Odin. I found that CSC will sometimes fail when using Rogers, so I keep it set to AT&T.

When reverting back to T818A, I am using the 3.12.7 build of Odin and all four combination files load successfully (BL, AP, CP, and CSC).

Well at least the bootloader flashes OK. When flashing the CSC is it cache.img that fails?

 

[GuestK00136]

It's strange.

Prince Cosmy will install CSC without error.

It's during the reboot, and the subsequent 'Installing System Update..." that it will sometimes error out at 34%.

But it's not consistent behaviour.

However, after using CF-Auto-Root-gts210veltecan-gts210veltevl-smt818w.zip, and on T818W after flashing from T818A via Prince Comsy, I have root.

In the process of testing SuperSU to confirm it works.

 

[ashyx]

It's strange.

Prince Cosmy will install CSC without error.

It's during the reboot, and the subsequent 'Installing System Update..." that it will sometimes error out at 34%.

But it's not consistent behaviour.

However, after using CF-Auto-Root-gts210veltecan-gts210veltevl-smt818w.zip, and on T818W after flashing from T818A via Prince Comsy, I have root.

In the process of testing SuperSU to confirm it works.

Excellent, the fact that CFautoroot even flashed without being rejected is good news. The fact that the script ran is even better news!
I just hope it boots up and is rooted.

Which version of SuperSU did you flash?

 

[GuestK00136]

Okay, just repeated the process from scratch.

I factory reset the device.

Installed the February 2018 build of Nougat from AT&T via Odin.

Both 'product.name' and "ro.product.device' reflect the alteration:

samsung/gts210velteuc/gts210velteatt

Confirmed that the model name in 'Download Mode' and in Android states 'T818A'.

Factory reset the device again.

Launched Prince Comsy's Odin and loaded Roger's February 2018 build of Nougat via Prince Comsy Odin (including CSC which took without error).

Now 'product.name' and "ro.product.device' is replaced with the following:

gts210veltevl/gts210veltecan

Confirmed that the model name in 'Download Mode' and in Android states 'T818W'.

 

[GuestK00136]

For SuperSu, I used 2.82-SR3.
(https://download.chainfire.eu/1129/...Root-gts210veltecan-gts210veltevl-smt818w.zip)

Rebooted three times before loading into 'Welcome screen".

Everything else works flawlessly.

I even managed to change CSC to XAC, which wiped root, and I flashed SuperSU again.

See screenshots.

 

[GuestK00136]

I'm off to work now.

If you need anything else tested or answered, I'll get back to you later this afternoon (I'm in EST).

I'd like to revert back to T818A and test T818T and V (provided I can get proper combination sets).

I'm thinking since T819 is the same hardware, it should work as well but having custom recovery would work wonders so I can do a proper NANDroid backup before something goes to bullocks.

 

[ashyx]

For SuperSu, I used 2.82-SR3.
(https://download.chainfire.eu/1129/...oot-gts210veltecan-gts210veltevl-smt818w.zip)

Rebooted three times before loading into 'Welcome screen".

Everything else works flawlessly.

I even managed to change CSC to XAC, which wiped root, and I flashed SuperSU again.

See screenshots.

Unbelievable, you've discovered a major thing here!
It seems you've managed to flash an unlocked bootloader over the locked bootloader.

Is SuperSU running in systemless or system mode?

Congrats on actually doing this and taking the risk.

 

[GuestK00136]

From the system details, under 'Settings', looks like 'system-less root mode'.

Attached is another screenshot.

 

[ashyx]

From the system details, under 'Settings', looks like 'system-less root mode'.

Attached is another screenshot.

Yep systemless. Which means that a custom recovery can be flashed also.

This is the first time I've ever heard of a Samsung bootloader being overwritten by an unlocked one.
Amazing stuff and you may have opened doors for other devices too.

 

[GuestK00136]

Given your experience, is this something you can create recovery for or do we need to involve other parties?

Thanks!

 

[ashyx]

Given your experience, is this something you can create recovery for or do we need to involve other parties?

Thanks!

Recovery no problem, but I doubt there's any need. TWRP for the T819 should work fine.

 

[GuestK00136]

Restored back to stock T818W using Odin (3.12.7).

Bootloader is unlocked under 'Developer Options'.

TWRP for T815 (twrp_3.1.0-1_sm-t819_14417n) will not boot. See attached screenshot.

TWRP for T819 (twrp_3.1.0-1_sm-t815_13317) works however I've run into a few issues.

Reboot Into Recovery

Whether or not you select the option 'Allow Modifications', if you go to 'Reboot' and attempt to reboot into 'Recovery', the device restarts and proceeds to load into Android.

MTP

Once you 'Allow Modifications', format data and power off, you have the option to mount 'System' on restart.

The problem is that even though MTP is enabled, the device does not appear under 'File Explorer' in Windows.

The Device shows under 'Device Manager' and 'AutoPlay' provides you the option to disconnect but you cannot access the file store.

See screenshots 1 & 2.

ADB does, however, work.

 

[GuestK00136]

TWRP aside, it appears we can now unlock the T818A bootloader by flashing the T818W bootloader through PrinceComsy.

I only have access to two T818A devices so I can only verify this works for AT&T.

If anyone else is reading this and is on Verizon, T-Mobile or have a T819, you may also have the same luck if you are willing to flash the T818W bootloader.

If there is interest, I can provide the software/steps for the community to further investigate.

 

[ashyx]

TWRP aside, it appears we can now unlock the T818A bootloader by flashing the T818W bootloader through PrinceComsy.

I only have access to two T818A devices so I can only verify this works for AT&T.

If anyone else is reading this and is on Verizon, T-Mobile or have a T819, you may also have the same luck if you are willing to flash the T818W bootloader.

If there is interest, I can provide the software/steps for the community to further investigate.

Just out of interest did you ever try flashing CFautoroot with Prince comsey odin when it had the T818a bootloader?

 

[GuestK00136]

Unfortunately not but I understand what you are inferring.

I have one untouched device (locked bootloader) left to test with.

I am happy to try this after the Holiday weekend.

 

[suzook]

Unfortunately not but I understand what you are inferring.

I have one untouched device (locked bootloader) left to test with.

I am happy to try this after the Holiday weekend.

I will be trying to flash a VZ model later on. Will update thread with results.

 

[jhaberman]

Any chance you can share the files used to do this? I would like to attempt it on my T818A as well.