Teclast M40 How to unlock bootloader?

Search This thread


Senior Member
Feb 15, 2013
Sadly it is not working : ( It will reboot into android after flashing, but if I try to adb reboot fastboot / recovery, it will lock up on reboot, and stays that way, need to reflash boot partition.
You need to look for TWRP donors based on android 11 from the MTK processor with a combined boot with recovery


Senior Member
Jul 26, 2010
LG G7 ThinQ
LG V40
You need to look for TWRP donors based on android 11 from the MTK processor with a combined boot with recovery
Update I flashed linage 17.1 via fastbootd but it wont boot, i deleted vendor system product logical partitions and only left system_a but linage wont boot it just goes to bootloader, i flashed stock boot.img and vbmeta and it will wont boot gsi.

stock firmware is android 11 but i want to use only android 10 gsi

i tired to boot twrp to flash on the A/B partition but i get getting these errors

fastboot boot twrp.img and i get error too many links tried on usb 3.0 and 2.0

then i ran

sudo ./fastboot boot twrp.img and i get error status read failed (protocol error) in linux
Last edited:


Feb 24, 2016
Cevabınız için teşekkürler. Cihazda desen kilidi olduğu için ayarlara giremiyorum. Yukarıda söylediğim gibi, cihazı devre dışı bulma seçeneğim olduğunu düşünüyorum. Google aracılığıyla hala kilidini açamadım. Bu nedenle, kalıbı cihazdan kaldırabilir miyim diye fabrika ayarlarına sıfırlamaya çalışıyorum. Geliştiriciyi etkinleştirmediğim için bilgisayara bağlanamıyorum.
Sesi açma + açma ve Sesi açma ve kısma + açma dizilerini denedim, ancak kurtarma işlemine girmiyor.
Kurtarma Modu için M40 tablet kapatıldığında aşağıdaki sıra izlenmelidir. Güç düğmesine bastıktan sonra, ses kısma düğmesine basılacaktır. Teclast Logosu göründüğünde, her iki tuş da serbest bırakılacaktır. Kurtarma Modu aktif olacaktır.


Jan 12, 2021
Is anyone running Android 11 on their M40? Can the M40 Pro software be used on an M40 to upgrade it to Android 11?


Senior Member
Dec 28, 2010
Last edited:


Mar 13, 2012
I managed to create my own patched boot.img to install magisk 25.1 but now when restarting the tablet seems to be stuck in a bootloop. But if I press both vol up+down then it starts booting normally. I have root and magisk modules, everything works. But why did this happen? I flashed as boot.img but it seems like it installed in the wrong partition? Vol up+down is usually recovery. Model is N9H1 with official rom 1.04 with gapps.

Any ideas?
  • Like
Reactions: siamese007


Jun 24, 2019
Xiaomi Redmi Note 5 Pro
Do you guys have any idea how to update the magisk of the boot.img from the Utility tool made by allexbast for the Teclast M40? Tried patching it with the updated canary but it just put the device to fastboot mode. I'm using the latest A12 Descendant GSI btw.


Oct 17, 2018
Samsung Galaxy A6
Hi, I don't think there is a combination of volume and power buttons to make the tablet boot into fastboot or recovery, at least it's not known to me. If you want to factory reset your tablet, you can download the fireware and use the upgrade tool included in it to flash the fireware to the tablet, but do notice that your data on the tablet will be wiped by doing this. I know this method may seem like a major fuss over a trivial matter but it's the only one I can think of.
You can visit [URL]https://www.teclast.com/en/firmware/[/URL] to download the firmware, If you haven't downloaded it yet.
In the end I did what you told me to do. I downloaded the fireware from the official site and with their program I was able to put the system back in. Thanks


Senior Member
Apr 28, 2007
super thank you for your effort.

what files do I need to run a N9h1 with Magisk and A12?
Last edited:


Dec 2, 2017
Hi all,

I'm trying to install A12, and trying to follow all the procedures describes on Hovatek.

For the moment I have unlocked the bootloader. Now I'm trying to extract public keys from a vbmeta image following https://www.hovatek.com/forum/thread-32667.html

I have downloaded from teclast the pac file for N9H1, there's 2 versions *EEA* and *ROW*. Version EEA gives an error when loading to Research tool so I used ROW version.

In file vbmeta-sign.img I have these partition:

Partition Name: boot
Partition Name: dtbo
Partition Name: recovery
Partition Name: socko
Partition Name: odmko
Partition Name: vbmeta_system
Partition Name: vbmeta_vendor
Partition Name: l_modem
Partition Name: l_ldsp
Partition Name: l_gdsp
Partition Name: pm_sys
Partition Name: l_agdsp
Partition Name: l_cdsp

I create the file for each partition, but when finished and checking the offset it's supposed to be the same for all files, and in my case is not, after repeating the procedure several times to avoid mistakes. Tried also an hex editor in linux and neither.

I would appreciate some help or suggestion.


Top Liked Posts

  • There are no posts matching your filters.
  • 3
    If you suceeded to runlock bootloader, You can replace stock system to gsi system. You need to prepare linux PC (or live usb) and vbmeta.img (included in stock rom).

    When you flash, you should use linux PC (Windows pc won't recognize fastbootd mode) and android SDK's adb/fastboot (do not use apt-get install adb/fastboot.).
    Download from here -> https://developer.android.com/studio/index.html#downloads

    If you want to repalce to Gapps included rom, you need to delete product partiton
    > ./fastboot delete-logical-partition product

    I tried Android 11 GSI, but boot-looped in OS. Android 10 GSI rom works fine and less error happens.
    I got Havoc installed successfully following your method. I also learned that it is not necessary to flash vbmeta-custom.img for installation of magisk to ShapeShift-OS.

    For Havoc (without root), the steps are:-
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system havoc.img
    -> recovery -> wipe data/factory rest -> reboot

    For ShapeShift-OS (with root), the steps are:-
    Install stock rom without gapp (no delete-logical-partition product)
    # ./fastboot erase system
    # ./fastboot flash system havoc.img
    # ./fastboot flash boot boot_magisk.img
    -> recovery -> wipe data/factory rest -> reboot

    Thats it!! Thanks a lot.
    The ShapeShift-OS to Havoc part works also on my N9H1 to flash from Stock-Rom to CrDroid with root.

    Here's my way to get rooted CrDroid starting from new flashed Stockfirmware M40(N9H1)_Android 10.0_V1.03_0D24 without GAPPs:

    Rooting des M40 N9H1 if all Files created
    OEM unlocked
    USB debugging activited
    Bootloader unlocked (Hovatec modified fastboot for linux)

    modified Files (from Stockrom M40(N9H1)_Android 10.0_EEA_V1.00_SZ):
    vbmeta-sign.img -> vbmeta—sign-custom.img
    boot.img -> magisk_patched_boot_repacked.img

    Save these files!! you don’t have create it new since Android 10 Firmware in use
    Create Working Dir and put all files into it, includig adb/fastboot. Open terminal in this folder

    1. for rooting 1.a and 1.b use always first:

    ./adb devices
    ./adb reboot-bootloader
    sudo -i
    sudo usermod -aG plugdev root
    cd /Rooting_Workfolder/
    ./fastboot reboot fastboot

    1.a Rooting Stock-ROM:

    ./fastboot --disable-verification flash vbmeta vbmeta-sign-custom.img
    ./fastboot flash:raw boot magisk_patched_boot_repacked.img
    ./fastboot reboot

    that’s it!!!

    1.b Rooting Custom Image (CrDroid) without GAPPS*:

    Install stock rom without gapps M40(N9H1)_Android 10.0_V1.03_0D24
    (no delete-logical-partition product)
    root it with saved files

    ./fastboot erase system
    ./fastboot flash system CrDr-system.img
    ./fastboot flash:raw boot magisk_patched_boot_repacked.img
    -> recovery -> wipe data/factory reset -> return fastbootd
    ./fastboot reboot

    that’s it!!!

    Thanks a lot once more to jngiag

    This is how I install. Please fine tune it if needed.

    Flashing Gsi Image without root

    1) Bootloader unlocked.
    2) Download "platform-tools_r30.0.5-linux" and extracted it in Ubuntu & named folder as "adb" (or any name)
    3) Copy gsi rom (ShapeShiftOS-1.2.1_arm64-ab_gapps.img) & rename it as "system.img" (or any name) to adb folder
    4) Copy vbmeta-sign.img to "adb" folder
    5) Enable Usb Debugging in Developer option (in stock rom)
    6) In Ubuntu
    # ./adb devices -> Enable authorisation in tablet
    # ./adb reboot-bootloader (boot into fastboot, not fastbootd)
    # ./fastboot devices
    # ./fastboot reboot fastboot (this will boot into fastbootd mode)
    -> Enter Recovery (tablet) -> wipe data/factory reset (format data as necessary)
    (keep stock rom setting if not format - works but not the best)
    -> Enter fastboot
    # ./fastboot --disable-verity --disable-verification flash vbmeta vbmeta-sign.img
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system system.img
    # ./fastboot reboot

    # = linux command prompt
    Install gsi rom (ShapeShift-OS) with root

    1) Stock rom installed with root (magisk)
    2) Go to fastbootd (don't wipe data/factory reset in recovery)
    # ./fastboot erase system
    # ./fastboot delete-logical-partition product (for stock rom with gapp only)
    # ./fastboot flash system ShapeShift-OS.img
    # ./fastboot --disable-verification flash vbmeta vbmeta-sign-custom.img
    (skip this if booted with unrooted boot.img earlier)
    # ./fastboot flash boot boot_magisk.img ("boot_magisk.img" created in 2b)
    # ./fastboot reboot

    3) Go to fastbootd -> recovery -> wipe data/factory rest -> reboot

    4) In ShapeShift-OS -> Uninstall magisk manager -> install app-debug.apk
    (magisk manager canary) -> Additional steps -> Done

    vbmeta-sign-custom.img and boot_magisk.img to be prepared separately following
    guides provided on Hovatek website.
    I have found a method of Teclast P20HD to unlock bootloader which can be found in "https://forum.xda-developers.com/android/help/teclast-p20hd-android-10-tablet-4g-t4141997" and "https://forum.hovatek.com/thread-32287.html", but I'm not sure if that method also works on Teclast M40. If that method works can I restore the bootloader to lock state instead of relock state so I can keep the warranty.

    I succeeded in unlocking bootloader of M40 by hovatek's method, but didn't try rooting it.(https://forum.hovatek.com/thread-32674.html)

    Here's M40 stock rom. In case you need to recover it...