Teclast M40 How to unlock bootloader?

Search This thread


Senior Member
Feb 15, 2013
Sadly it is not working : ( It will reboot into android after flashing, but if I try to adb reboot fastboot / recovery, it will lock up on reboot, and stays that way, need to reflash boot partition.
You need to look for TWRP donors based on android 11 from the MTK processor with a combined boot with recovery


Senior Member
Jul 26, 2010
LG G7 ThinQ
LG V40
You need to look for TWRP donors based on android 11 from the MTK processor with a combined boot with recovery
Update I flashed linage 17.1 via fastbootd but it wont boot, i deleted vendor system product logical partitions and only left system_a but linage wont boot it just goes to bootloader, i flashed stock boot.img and vbmeta and it will wont boot gsi.

stock firmware is android 11 but i want to use only android 10 gsi

i tired to boot twrp to flash on the A/B partition but i get getting these errors

fastboot boot twrp.img and i get error too many links tried on usb 3.0 and 2.0

then i ran

sudo ./fastboot boot twrp.img and i get error status read failed (protocol error) in linux
Last edited:


Feb 24, 2016
Cevabınız için teşekkürler. Cihazda desen kilidi olduğu için ayarlara giremiyorum. Yukarıda söylediğim gibi, cihazı devre dışı bulma seçeneğim olduğunu düşünüyorum. Google aracılığıyla hala kilidini açamadım. Bu nedenle, kalıbı cihazdan kaldırabilir miyim diye fabrika ayarlarına sıfırlamaya çalışıyorum. Geliştiriciyi etkinleştirmediğim için bilgisayara bağlanamıyorum.
Sesi açma + açma ve Sesi açma ve kısma + açma dizilerini denedim, ancak kurtarma işlemine girmiyor.
Kurtarma Modu için M40 tablet kapatıldığında aşağıdaki sıra izlenmelidir. Güç düğmesine bastıktan sonra, ses kısma düğmesine basılacaktır. Teclast Logosu göründüğünde, her iki tuş da serbest bırakılacaktır. Kurtarma Modu aktif olacaktır.


Jan 12, 2021
Is anyone running Android 11 on their M40? Can the M40 Pro software be used on an M40 to upgrade it to Android 11?


Senior Member
Dec 28, 2010
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    If you suceeded to runlock bootloader, You can replace stock system to gsi system. You need to prepare linux PC (or live usb) and vbmeta.img (included in stock rom).

    When you flash, you should use linux PC (Windows pc won't recognize fastbootd mode) and android SDK's adb/fastboot (do not use apt-get install adb/fastboot.).
    Download from here -> https://developer.android.com/studio/index.html#downloads

    If you want to repalce to Gapps included rom, you need to delete product partiton
    > ./fastboot delete-logical-partition product

    I tried Android 11 GSI, but boot-looped in OS. Android 10 GSI rom works fine and less error happens.
    I got Havoc installed successfully following your method. I also learned that it is not necessary to flash vbmeta-custom.img for installation of magisk to ShapeShift-OS.

    For Havoc (without root), the steps are:-
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system havoc.img
    -> recovery -> wipe data/factory rest -> reboot

    For ShapeShift-OS (with root), the steps are:-
    Install stock rom without gapp (no delete-logical-partition product)
    # ./fastboot erase system
    # ./fastboot flash system havoc.img
    # ./fastboot flash boot boot_magisk.img
    -> recovery -> wipe data/factory rest -> reboot

    Thats it!! Thanks a lot.
    The ShapeShift-OS to Havoc part works also on my N9H1 to flash from Stock-Rom to CrDroid with root.

    Here's my way to get rooted CrDroid starting from new flashed Stockfirmware M40(N9H1)_Android 10.0_V1.03_0D24 without GAPPs:

    Rooting des M40 N9H1 if all Files created
    OEM unlocked
    USB debugging activited
    Bootloader unlocked (Hovatec modified fastboot for linux)

    modified Files (from Stockrom M40(N9H1)_Android 10.0_EEA_V1.00_SZ):
    vbmeta-sign.img -> vbmeta—sign-custom.img
    boot.img -> magisk_patched_boot_repacked.img

    Save these files!! you don’t have create it new since Android 10 Firmware in use
    Create Working Dir and put all files into it, includig adb/fastboot. Open terminal in this folder

    1. for rooting 1.a and 1.b use always first:

    ./adb devices
    ./adb reboot-bootloader
    sudo -i
    sudo usermod -aG plugdev root
    cd /Rooting_Workfolder/
    ./fastboot reboot fastboot

    1.a Rooting Stock-ROM:

    ./fastboot --disable-verification flash vbmeta vbmeta-sign-custom.img
    ./fastboot flash:raw boot magisk_patched_boot_repacked.img
    ./fastboot reboot

    that’s it!!!

    1.b Rooting Custom Image (CrDroid) without GAPPS*:

    Install stock rom without gapps M40(N9H1)_Android 10.0_V1.03_0D24
    (no delete-logical-partition product)
    root it with saved files

    ./fastboot erase system
    ./fastboot flash system CrDr-system.img
    ./fastboot flash:raw boot magisk_patched_boot_repacked.img
    -> recovery -> wipe data/factory reset -> return fastbootd
    ./fastboot reboot

    that’s it!!!

    Thanks a lot once more to jngiag

    This is how I install. Please fine tune it if needed.

    Flashing Gsi Image without root

    1) Bootloader unlocked.
    2) Download "platform-tools_r30.0.5-linux" and extracted it in Ubuntu & named folder as "adb" (or any name)
    3) Copy gsi rom (ShapeShiftOS-1.2.1_arm64-ab_gapps.img) & rename it as "system.img" (or any name) to adb folder
    4) Copy vbmeta-sign.img to "adb" folder
    5) Enable Usb Debugging in Developer option (in stock rom)
    6) In Ubuntu
    # ./adb devices -> Enable authorisation in tablet
    # ./adb reboot-bootloader (boot into fastboot, not fastbootd)
    # ./fastboot devices
    # ./fastboot reboot fastboot (this will boot into fastbootd mode)
    -> Enter Recovery (tablet) -> wipe data/factory reset (format data as necessary)
    (keep stock rom setting if not format - works but not the best)
    -> Enter fastboot
    # ./fastboot --disable-verity --disable-verification flash vbmeta vbmeta-sign.img
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system system.img
    # ./fastboot reboot

    # = linux command prompt
    Install gsi rom (ShapeShift-OS) with root

    1) Stock rom installed with root (magisk)
    2) Go to fastbootd (don't wipe data/factory reset in recovery)
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system ShapeShift-OS.img
    # ./fastboot --disable-verification flash vbmeta vbmeta-sign-custom.img
    (skip this if booted with unrooted boot.img earlier)
    # ./fastboot flash boot boot_magisk.img ("boot_magisk.img" created in 2b)
    # ./fastboot reboot

    3) Go to fastbootd -> recovery -> wipe data/factory rest -> reboot

    4) In ShapeShift-OS -> Uninstall magisk manager -> install app-debug.apk
    (magisk manager canary) -> Additional steps -> Done

    vbmeta-sign-custom.img and boot_magisk.img to be prepared separately following
    guides provided on Hovatek website.
    I have found a method of Teclast P20HD to unlock bootloader which can be found in "https://forum.xda-developers.com/android/help/teclast-p20hd-android-10-tablet-4g-t4141997" and "https://forum.hovatek.com/thread-32287.html", but I'm not sure if that method also works on Teclast M40. If that method works can I restore the bootloader to lock state instead of relock state so I can keep the warranty.

    I succeeded in unlocking bootloader of M40 by hovatek's method, but didn't try rooting it.(https://forum.hovatek.com/thread-32674.html)

    Here's M40 stock rom. In case you need to recover it...