[TECLAST] P20HD (new android 10 tablet w/ 4g phone) : TWRP unavailable => cannot root

Search This thread

Rainbow_Dash

Senior Member
Nov 23, 2014
444
1,150
Samsung Galaxy S4
Samsung Galaxy S5
This rooting process works with the Teclast P20HD and vonino imart pro (sameish tablet but rebranded. This is what i have, but on teclast firmware since i couldn't find mine) and maybe other sc9863a devices
Proceed at your own risk
I'm using a mac for most of this process but it's best to have a linux machine. If you have windows just use a linux vm(you may have usb issues.Haven't tried this)

Firstly unlock your bootloader using method described here
Afterwards download this zip file. It contains mostly everything that i used apart from a stock fw which will come in handy if you mess this process up.

Now there are 2 ways you can approach this

I don't really reccomend this way since it skips over a lot of important stuff you may want to understand. Also if something goes wrong it's almost impossible to debug.

After your bootloader in unlocked do the following:
adb reboot bootloader
fastboot flash vbmeta vbmeta_bootpatched.img
it should succeed. If it gets stuck at writing then something is wrong and go to the longer method.
fastboot flash boot boot-memegisk-signed.img
(maybe patch with magisk and sign your own bootimg. This is very firmware/device dependant.)
here if it gets stuck at writing you may want to try entering fastboot mode again.
fastboot reboot
adb install magisk.apk

Magisk should pop up in the installed applications and you have root.

This is way better since you'll actually be learning what actually goes on and maybe solve issues yourself. Also way easier to debug

I'm too lazy to explain line by line of what goes on here so here's a summary: Grab boot.img from stock firmware.pac file. Load it and patch in magisk, adb pull to pc. Dump all partition public keys from vbmeta-sign.img(in firmware dump) using hex editor. Create our own custom public key with openssl. Repack magisked boot.img to decrease its size with android image kitchen (for some reason). Sign said repacked bootimg with our key. Create custom vbmeta with old partition signatures except we use for boot our own. Flash vbmeta and boot. Install magisk. Profit?

Commands used :
Code:
python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 --chain_partitio boot:1:keys/kekkey.bin --chain_partition dtbo:10:keys/dtbo.bin --chain_partition recovery:2:keys/recovery.bin --chain_partition socko:11:keys/socko.bin --chain_partition odmko:12:keys/odmko.bin --chain_partition vbmeta_system:3:keys/vbmeta_system.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor.bin --chain_partition l_modem:6:keys/l_modem.bin --chain_partition l_ldsp:7:keys/l_ldsp.bin --chain_partition l_gdsp:8:keys/l_gdsp.bin --chain_partition pm_sys:9:keys/pmsys.bin --padding_size 16384 --output vbmeta_custom.img

python vbmeta_pad.py

python avbtool add_hash_footer --image image-new.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

Download the firmware file somewhere in this thread. Open UpgradeTool and load pac file. Hit start. Connect tablet. If it's bootlooping hold power and vol - until the tool picks it up and begins flashing. Release keys and wait till flashing is completed. Tablet should boot up stock. If it's power off just press vol - and connect usb

Large credits to the Hovatek forum. There is an unreal amount of resource there for these meme unisoc devices that no one else seems to care about. This was where i started from when researching root for this device.

Hope this helps.
 
Last edited:
  • Like
Reactions: maska65 and nejcov

R-james

Member
Aug 4, 2010
36
3
This rooting process works with the Teclast P20HD and vonino imart pro (sameish tablet but rebranded. This is what i have, but on teclast firmware since i couldn't find mine) and maybe other sc9863a devices
Proceed at your own risk
I'm using a mac for most of this process but it's best to have a linux machine. If you have windows just use a linux vm(you may have usb issues.Haven't tried this)

Firstly unlock your bootloader using method described here
Afterwards download this zip file. It contains mostly everything that i used apart from a stock fw which will come in handy if you mess this process up.

Now there are 2 ways you can approach this

I don't really reccomend this way since it skips over a lot of important stuff you may want to understand. Also if something goes wrong it's almost impossible to debug.

After your bootloader in unlocked do the following:
adb reboot bootloader
fastboot flash vbmeta vbmeta_bootpatched.img
it should succeed. If it gets stuck at writing then something is wrong and go to the longer method.
fastboot flash boot boot-memegisk-signed.img
(maybe patch with magisk and sign your own bootimg. This is very firmware/device dependant.)
here if it gets stuck at writing you may want to try entering fastboot mode again.
fastboot reboot
adb install magisk.apk

Magisk should pop up in the installed applications and you have root.

This is way better since you'll actually be learning what actually goes on and maybe solve issues yourself. Also way easier to debug

I'm too lazy to explain line by line of what goes on here so here's a summary: Grab boot.img from stock firmware.pac file. Load it and patch in magisk, adb pull to pc. Dump all partition public keys from vbmeta-sign.img(in firmware dump) using hex editor. Create our own custom public key with openssl. Repack magisked boot.img to decrease its size with android image kitchen (for some reason). Sign said repacked bootimg with our key. Create custom vbmeta with old partition signatures except we use for boot our own. Flash vbmeta and boot. Install magisk. Profit?

Commands used :
Code:
python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 --chain_partitio boot:1:keys/kekkey.bin --chain_partition dtbo:10:keys/dtbo.bin --chain_partition recovery:2:keys/recovery.bin --chain_partition socko:11:keys/socko.bin --chain_partition odmko:12:keys/odmko.bin --chain_partition vbmeta_system:3:keys/vbmeta_system.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor.bin --chain_partition l_modem:6:keys/l_modem.bin --chain_partition l_ldsp:7:keys/l_ldsp.bin --chain_partition l_gdsp:8:keys/l_gdsp.bin --chain_partition pm_sys:9:keys/pmsys.bin --padding_size 16384 --output vbmeta_custom.img

python vbmeta_pad.py

python avbtool add_hash_footer --image image-new.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

Download the firmware file somewhere in this thread. Open UpgradeTool and load pac file. Hit start. Connect tablet. If it's bootlooping hold power and vol - until the tool picks it up and begins flashing. Release keys and wait till flashing is completed. Tablet should boot up stock. If it's power off just press vol - and connect usb

Large credits to the Hovatek forum. There is an unreal amount of resource there for these meme unisoc devices that no one else seems to care about. This was where i started from when researching root for this device.

Hope this helps.

You should really include this as txt/html files on the zip archive.
 

silverbyte

Member
Nov 23, 2020
7
0
@Rainbow_Dash

GREAT that all works, but now what? my device is not rooted. Magisk is installed but how to actually get it rooted from here? Root Checker showing its not rooted. downloaded the zip, installed manager (but doesn't look like it got installed) and nothing...
 
Last edited:

silverbyte

Member
Nov 23, 2020
7
0
This rooting process works with the Teclast P20HD and vonino imart pro (sameish tablet but rebranded. This is what i have, but on teclast firmware since i couldn't find mine) and maybe other sc9863a devices
Proceed at your own risk
I'm using a mac for most of this process but it's best to have a linux machine. If you have windows just use a linux vm(you may have usb issues.Haven't tried this)

Firstly unlock your bootloader using method described here
Afterwards download this zip file. It contains mostly everything that i used apart from a stock fw which will come in handy if you mess this process up.

Now there are 2 ways you can approach this

I don't really reccomend this way since it skips over a lot of important stuff you may want to understand. Also if something goes wrong it's almost impossible to debug.

After your bootloader in unlocked do the following:
adb reboot bootloader
fastboot flash vbmeta vbmeta_bootpatched.img
it should succeed. If it gets stuck at writing then something is wrong and go to the longer method.
fastboot flash boot boot-memegisk-signed.img
(maybe patch with magisk and sign your own bootimg. This is very firmware/device dependant.)
here if it gets stuck at writing you may want to try entering fastboot mode again.
fastboot reboot
adb install magisk.apk

Magisk should pop up in the installed applications and you have root.

This is way better since you'll actually be learning what actually goes on and maybe solve issues yourself. Also way easier to debug

I'm too lazy to explain line by line of what goes on here so here's a summary: Grab boot.img from stock firmware.pac file. Load it and patch in magisk, adb pull to pc. Dump all partition public keys from vbmeta-sign.img(in firmware dump) using hex editor. Create our own custom public key with openssl. Repack magisked boot.img to decrease its size with android image kitchen (for some reason). Sign said repacked bootimg with our key. Create custom vbmeta with old partition signatures except we use for boot our own. Flash vbmeta and boot. Install magisk. Profit?

Commands used :
Code:
python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 --chain_partitio boot:1:keys/kekkey.bin --chain_partition dtbo:10:keys/dtbo.bin --chain_partition recovery:2:keys/recovery.bin --chain_partition socko:11:keys/socko.bin --chain_partition odmko:12:keys/odmko.bin --chain_partition vbmeta_system:3:keys/vbmeta_system.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor.bin --chain_partition l_modem:6:keys/l_modem.bin --chain_partition l_ldsp:7:keys/l_ldsp.bin --chain_partition l_gdsp:8:keys/l_gdsp.bin --chain_partition pm_sys:9:keys/pmsys.bin --padding_size 16384 --output vbmeta_custom.img

python vbmeta_pad.py

python avbtool add_hash_footer --image image-new.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

Download the firmware file somewhere in this thread. Open UpgradeTool and load pac file. Hit start. Connect tablet. If it's bootlooping hold power and vol - until the tool picks it up and begins flashing. Release keys and wait till flashing is completed. Tablet should boot up stock. If it's power off just press vol - and connect usb

Large credits to the Hovatek forum. There is an unreal amount of resource there for these meme unisoc devices that no one else seems to care about. This was where i started from when researching root for this device.

Hope this helps.

GREAT that all works, but now what? my device is not rooted. Magisk is installed but how to actually get it rooted from here? Root Checker showing its not rooted. downloaded the zip, installed manager (but doesn't look like it got installed) and nothing...
 

silverbyte

Member
Nov 23, 2020
7
0
Did you follow all the steps in the instructions provided?

Yes I followed the following steps below (bootloader already unlocked following hovatek website)

- adb reboot bootloader
- fastboot flash vbmeta vbmeta_bootpatched.img (succeeded)
- fastboot flash boot boot-memegisk-signed.img (succeeded)
- fastboot reboot
- adb install magisk.apk

Now I see magisk installed. Downloaded the ZIP file. but can't do anything with it.
I downloaded rootchecker but the devices shows as not rooted.
 
Feb 23, 2021
5
1
Hi!

My question is a bit offtopic but I didn't want to open a new thread. Can anyone provide me a link to a global ROM (with Google)? For my N6H7 there is only the chinese one (V1.06)on the Teclast website. Unfortunately, the one uploaded to Needrom does not contain Google, contrary to the description. I would be very grateful to them. Have a nice Weekend!

N6H7 v1.05 EEA rom (with gapps) - https://mega.nz/file/zcQWBTRL#RY9F-cF_gKtNt_vLnGvuXSLtL5GBgOmOfBEi-9wDlqQ
You can upgrade to v1.06 via OTA.

Got this file by emailing teclast support they uploaded it to 1drv, but their link no longer works.
They refused to upload chinese version though. Can you upload it somewhere for me that doesn't require money to download? Thanks
 
Feb 23, 2021
5
1
There is also the latest original firmware with no GAPPS:
P20HD(N6H7)_Android 10.0_ROW_V1.05_SZ.zip : https://drive.google.com/file/d/1-8L_cSVxXBuvLs-AVdSRRm3qmj6ASIkW/view?usp=sharing

Both your links seems to be the same EEA file.

As for rooting - unlocking bootloader is trivial, just follow instructions above.
You can also use my script, if you like go language more than bash https://gist.github.com/0e1b55a867958defd9be7894cde92062
You still need modified fastboot though.
I haven't tried rooting yet.
 
  • Like
Reactions: maska65

R-james

Member
Aug 4, 2010
36
3
N6H7 v1.05 EEA rom (with gapps) - https://mega.nz/file/zcQWBTRL#RY9F-cF_gKtNt_vLnGvuXSLtL5GBgOmOfBEi-9wDlqQ
You can upgrade to v1.06 via OTA.

Got this file by emailing teclast support they uploaded it to 1drv, but their link no longer works.
They refused to upload chinese version though. Can you upload it somewhere for me that doesn't require money to download? Thanks
How did you contact teclast support- What was the email adress you used to ask for the file??
 
  • Like
Reactions: maska65

maska65

Member
Feb 24, 2021
8
3
How did you contact teclast support- What was the email adress you used to ask for the file??
The firmwares are availlable from Teclast official site. On main page click to donwload in the menu and put the identifier ID: My is N6H7 and the site post the link to download from onedrive.live.com.
See the pictures uno, due, tre.
How did you contact teclast support- What was the email adress you used to ask for the file??
 

Attachments

  • uno.png
    uno.png
    88.9 KB · Views: 25
  • due.png
    due.png
    61.6 KB · Views: 29
  • tre.png
    tre.png
    35.6 KB · Views: 28
  • Like
Reactions: hdxzrhikvvtbcuiiam
Feb 23, 2021
5
1
The firmwares are availlable from Teclast official site. On main page click to donwload in the menu and put the identifier ID: My is N6H7 and the site post the link to download from onedrive.live.com.
See the pictures uno, due, tre.

Unfortunately ROW version still contains gapps.
If anyone can download from pan.baidu (or needrom), I'd be grateful.
https://www.teclast.com/tools/pad/showtools.php - chinese firmwares
https://pan.baidu.com/s/1ZzVDIxJ3fBFLWXY3d6Cr1w - v1.07 N6H7 firmware (password: zieq)

can the boot logo be changed too?

No idea

How did you contact teclast support- What was the email adress you used to ask for the file??

 

ssaandur

New member
Jan 10, 2021
2
1
I have the n6h3 model with 1.02 EEA version (with GAPPS).
What is the difference between the different firmware? (N6H1 - N6H3 - N6H7)?
On my N6H3 can i install the N6H7 firmware?
Thanks in advance.
 
  • Like
Reactions: FAP31

maska65

Member
Feb 24, 2021
8
3
Today I unlock the bootloader (VERY EASY)
I used this tutorial: https://forum.hovatek.com/thread-32287.html

Here is the terminal output:

[email protected]:~$ sudo -i
[email protected]:~# sudo usermod -aG plugdev root
[email protected]:~# cd /media/user/modified_fastboot
[email protected]:/media/user/modified_fastboot# ./fastboot devices
0123456789ABCDEF fastboot
[email protected]:/media/user/modified_fastboot# ./fastboot oem get_identifier_token
...
(bootloader) Identifier token:

(bootloader) 30313233343536373839414243444546

OKAY [ 0.010s]
finished. total time: 0.010s
[email protected]:/media/user/modified_fastboot# ./signidentifier_unlockbootloader.sh 30313233343536373839414243444546 rsa4096_vbmeta.pem signature.bin
Identifier sign script, ver 0.10
1+0 record dentro
1+0 record fuori
48 bytes copied, 0,000129106 s, 372 kB/s
Identifier sign successfully
[email protected]:/media/user/modified_fastboot# ./fastboot flashing unlock_bootloader signature.bin
downloading 'unlock_message'...
OKAY [ 0.000s]
unlocking bootloader...
Info:Unlock bootloader success! OKAY [322.050s]
finished. total time: 322.050s
[email protected]:/media/user/modified_fastboot# ./fastboot reboot
rebooting...

finished. total time: 0.050s
[email protected]:/media/user/modified_fastboot#
 

Attachments

  • IMG_0301.JPG
    IMG_0301.JPG
    1.1 MB · Views: 15
  • IMG_0302.JPG
    IMG_0302.JPG
    4.2 MB · Views: 15
Last edited:

aryanhington

Senior Member
Aug 21, 2020
64
4
Today I unlock the bootloader (VERY EASY)
I used this tutorial: https://forum.hovatek.com/thread-32287.html

Here is the terminal output:

[email protected]:~$ sudo -i
[email protected]:~# sudo usermod -aG plugdev root
[email protected]:~# cd /media/user/modified_fastboot
[email protected]:/media/user/modified_fastboot# ./fastboot devices
0123456789ABCDEF fastboot
[email protected]:/media/user/modified_fastboot# ./fastboot oem get_identifier_token
...
(bootloader) Identifier token:

(bootloader) 30313233343536373839414243444546

OKAY [ 0.010s]
finished. total time: 0.010s
[email protected]:/media/user/modified_fastboot# ./signidentifier_unlockbootloader.sh 30313233343536373839414243444546 rsa4096_vbmeta.pem signature.bin
Identifier sign script, ver 0.10
1+0 record dentro
1+0 record fuori
48 bytes copied, 0,000129106 s, 372 kB/s
Identifier sign successfully
[email protected]:/media/user/modified_fastboot# ./fastboot flashing unlock_bootloader signature.bin
downloading 'unlock_message'...
OKAY [ 0.000s]
unlocking bootloader...
Info:Unlock bootloader success! OKAY [322.050s]
finished. total time: 322.050s
[email protected]:/media/user/modified_fastboot# ./fastboot reboot
rebooting...

finished. total time: 0.050s
[email protected]:/media/user/modified_fastboot#

have you flashed any of the partitions?
 
  • Like
Reactions: maska65

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    friend, there are two links, take a closer look
    Yeah, but thought it 'll be a good idea to link to the SPD Research Tool page since it explains how to use the software among other things.
  • 2
    This rooting process works with the Teclast P20HD and vonino imart pro (sameish tablet but rebranded. This is what i have, but on teclast firmware since i couldn't find mine) and maybe other sc9863a devices
    Proceed at your own risk
    I'm using a mac for most of this process but it's best to have a linux machine. If you have windows just use a linux vm(you may have usb issues.Haven't tried this)

    Firstly unlock your bootloader using method described here
    Afterwards download this zip file. It contains mostly everything that i used apart from a stock fw which will come in handy if you mess this process up.

    Now there are 2 ways you can approach this

    I don't really reccomend this way since it skips over a lot of important stuff you may want to understand. Also if something goes wrong it's almost impossible to debug.

    After your bootloader in unlocked do the following:
    adb reboot bootloader
    fastboot flash vbmeta vbmeta_bootpatched.img
    it should succeed. If it gets stuck at writing then something is wrong and go to the longer method.
    fastboot flash boot boot-memegisk-signed.img
    (maybe patch with magisk and sign your own bootimg. This is very firmware/device dependant.)
    here if it gets stuck at writing you may want to try entering fastboot mode again.
    fastboot reboot
    adb install magisk.apk

    Magisk should pop up in the installed applications and you have root.

    This is way better since you'll actually be learning what actually goes on and maybe solve issues yourself. Also way easier to debug

    I'm too lazy to explain line by line of what goes on here so here's a summary: Grab boot.img from stock firmware.pac file. Load it and patch in magisk, adb pull to pc. Dump all partition public keys from vbmeta-sign.img(in firmware dump) using hex editor. Create our own custom public key with openssl. Repack magisked boot.img to decrease its size with android image kitchen (for some reason). Sign said repacked bootimg with our key. Create custom vbmeta with old partition signatures except we use for boot our own. Flash vbmeta and boot. Install magisk. Profit?

    Commands used :
    Code:
    python avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 0 --chain_partitio boot:1:keys/kekkey.bin --chain_partition dtbo:10:keys/dtbo.bin --chain_partition recovery:2:keys/recovery.bin --chain_partition socko:11:keys/socko.bin --chain_partition odmko:12:keys/odmko.bin --chain_partition vbmeta_system:3:keys/vbmeta_system.bin --chain_partition vbmeta_vendor:4:keys/vbmeta_vendor.bin --chain_partition l_modem:6:keys/l_modem.bin --chain_partition l_ldsp:7:keys/l_ldsp.bin --chain_partition l_gdsp:8:keys/l_gdsp.bin --chain_partition pm_sys:9:keys/pmsys.bin --padding_size 16384 --output vbmeta_custom.img
    
    python vbmeta_pad.py
    
    python avbtool add_hash_footer --image image-new.img --partition_name boot --partition_size 36700160 --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096

    Download the firmware file somewhere in this thread. Open UpgradeTool and load pac file. Hit start. Connect tablet. If it's bootlooping hold power and vol - until the tool picks it up and begins flashing. Release keys and wait till flashing is completed. Tablet should boot up stock. If it's power off just press vol - and connect usb

    Large credits to the Hovatek forum. There is an unreal amount of resource there for these meme unisoc devices that no one else seems to care about. This was where i started from when researching root for this device.

    Hope this helps.
    1
    @vindieu

    Compile TWRP by yourself.
    How-to: https://forum.xda-developers.com/showthread.php?t=1943625

    TWRP isn't needed to root a tablet's/phone's Android.
    1
    Is there a flashable image available for your device?

    If so, you can extract the boot image from this archive using payload dumper (search Google for more info)

    1: Now you have the boot image (on your PC), move it to your device - i.e. Downloads

    2: Install Magisk Manager on your device.

    3: Follow the instructions at this thread on how to use Magisk Manager to patch your transferred boot image - https://r.tapatalk.com/shareLink/to...1&share_fid=3793&share_type=t&link_source=app

    4: Transfer the newly patched image back to your PC.

    5: Use Fastboot to reboot your device using the image on your PC - see above thread for how to do this (no need to flash the modified boot image back to your device - you'll actually be booting the device using the patched image on your PC - this ensures that if anything goes wrong, you can just reboot your device).

    6: Assuming all has gone to plan, your device is now rooted (temporarily) so you can now install Magisk using Magisk Manager (this will modify the boot image on your device).

    7: Disconnect PC and reboot your device normally (i.e. System) - you should now find Magisk is installed when you open Magisk Manager.

    Hope this helps

    Sent from my AC2003 using Tapatalk
    1
    friend, there are two links, take a closer look
    Yeah, but thought it 'll be a good idea to link to the SPD Research Tool page since it explains how to use the software among other things.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone