Teclast P98 4G ( A8H8 )

[yuv]

Thanks, hocuspocus69 -- how did you flash (SP flashtools or dd?) and if you used SP flashtools, what scatter file did you use to flash?

I will not have time to make any progress today and probably not tomorrow either. A work deadline rained on me this morning and on top of that my son started a fever. I am working from home and taking care of him. Since the tablet once rooted and cleaned will be his birthday present, he may not see the new gadget in the house.

I have Carliv 1.0 for Linux (thanks for the pointer) and I started to look into the differences of the results produced by bcgngm's mtk-tools.

Chainfire's SuperSU is, as far as I know, the only rooting solution from KitKat that survived in Lollipop. so I downloaded v2.49 beta, unpacked it, and started to read and understand what META-INF/com/google/android/update-binary (which is actually a script, not a binary) does. For experienced ROM cooks like you or rrileypm (an opportunity to say thank him for RileyROM, which is the most user-friendly entry point into the world of ROM-cooking I have seen so far), this job is probably easier than to me. I foresee changes to init.rc.

Other than that, the last evening was otherwise busy so I did not advance much in my quest to master MTK Android. I am trying to devise a method to come up with clean piping over the adb that does not require rooting / busybox. "adb shell" converts linefeeds (0x0a) to carriage-return + linefeed (0x0d 0x0a), corrupting the output. There are recipes around to filter with sed or perl, but none of them yields reliable results because there can be a true (0x0d 0x0a) sequence in the dump. I am searching to see if there is a base64 or similar encoder in Android, preferably in the default ROM, to make something like this work:

adb shell "dd if=/dev/block/platform/mtk-msdc.0/by-name/logo | base64"  | dd of=/tmp/logo.b64

I also still have tons of notes to clean and put into my trove of documentation.

[hocuspocus69]

I use spflashtool with my modified scatter file x 2gb system partition and 8gb userspace

[vincenzod]

Hello everyone.
I have the Teclast P98 A8H8 with Lollipop too.
How is your tablet? My is slow for a 8 cores 2gb RAM tablet.
I have something about 400 mb of free ram and the rom is generally slow.
Do you think is a software problem or a hardware problem?

Thanks

[giouncino]

Android generally use all the available RAM, and make it free only when an app asks for that!

How can you say is "slow"? It can reach 40.000 points on antutu, it's a really fast device, considering the retina resolution....

[giouncino]

At the moment is one of the very BEST and fastest tablet on Chinese market!

[vincenzod]

Hi Giouncino thank you for the reply!
Please take a look at this vide I made today http://youtu.be/lm7dYdLaRWQ
what you think about?

[vincenzod]

yuv please can you pass me links to your boot.img and system.img ? thanks

[hocuspocus69]

This is my teclast t98 c6r3 specification made with hardware info

TECLAST T98 4G(C6R3)
System (Android 4.4.4)
Model T98 4G(C6R3)
Manufacturer TECLAST
Device T98 4G(C6R3)
Product T98 4G(C6R3)
Brand TECLAST
Android Version 4.4.4 (Kit Kat)
API Level 19
Build ID KTU84P
Fingerprint HTT:4.4.4/KTU84P/1431935589:user/test-keys

Display (2048x1536)
Size 2048x1536
Refresh Rate 52,54 Hz
Default Orientation Portrait
Physical Size 8" (20,32 cm)
Logical Size Extra Large
Density 320 dpi (Extra High)
Pixels Per Inch X: 320; Y: 320

Processor (ARMv7)
Processor ARMv7 Processor rev 2 (v7l)
Cores 8
Max Frequency 1690 Mhz
Instruction Sets armeabi-v7a, armeabi
SIMD Instructions NEON

Memory (1886 MB)
System RAM 1886 MB
JVM Max Memory 256 MB
Internal Storage 7935 MB
External Storage 19318 MB

Back Camera (13 megapixel)
Summary
Max Picture Size 4160x3120 (4:3)
Zoom 4x
Autofocus Supported (Continuous)
Orientation 90°

Front Camera (2,1 megapixel)
Summary
Max Picture Size 1920x1088
Zoom 4x
Autofocus Supported (Continuous)
Orientation 270°

OpenGL 1.1 (Mali-T760)
General
Renderer Mali-T760
Version OpenGL ES-CM 1.1
Vendor ARM

OpenGL 3.0 (Mali-T760)
General
Renderer Mali-T760
Version OpenGL ES 3.0
Vendor ARM
GLSL Version OpenGL ES GLSL ES 3.00

Sensors (9)
ACCELEROMETER
Vendor MTK
Range 32.0 m/s²
Resolution 0.00390625 m/s²
Power 0.13 mA
Delay On Trigger

PROXIMITY
Vendor MTK
Range 1.0 cm
Resolution 1.0 cm
Power 0.13 mA
Delay On Trigger

LIGHT
Vendor MTK
Range 10240.0 lx
Resolution 1.0 lx
Power 0.13 mA
Delay On Trigger

GYROSCOPE
Vendor MTK
Range 34.91 rad/s
Resolution 0.0107 rad/s
Power 6.1 mA
Delay On Trigger

Orientation Sensor
Vendor AOSP
Range 360.0°
Resolution 0.00390625°
Power 6.48 mA
Delay On Trigger

MAGNETOMETER
Vendor MTK
Range 600.0 μT
Resolution 0.0016667 μT
Power 0.25 mA
Delay On Trigger

Rotation Vector Sensor
Vendor AOSP
Range 1.0
Resolution 5.9604645E-8
Power 6.48 mA
Delay On Trigger

Gravity Sensor
Vendor AOSP
Range 19.6133 m/s²
Resolution 0.00390625 m/s²
Power 6.48 mA
Delay On Trigger

Linear Acceleration Sensor
Vendor AOSP
Range 19.6133 m/s²
Resolution 0.00390625 m/s²
Power 6.48 mA
Delay On Trigger

[hocuspocus69]

http://forum.xda-developers.com/andr...d-5-0-t3165663
for ORIGINAL LOLLIPOP STOCK ROM P98_4G八核版 (A8H8)_V1.04_20150602版固件
inside scatter.txt and all SPFLASHable image untouch

[spzjulien]

My gf have teclast P98 4G A8H6 with kitkat.. I guess, hope i can flash loolipop... From A8H8... Anyone try ?

[yuv]

Hi all,

Life was busy and my P98-4G has collected some dust. Tonight I had time again, after almost two weeks, to toy with it.

vincenzod : sorry, the cloud servers I have are currently full, and anyway, it seems that there is a copy on XDA-Developers.

I have downloaded the XDA-Developers copy. The scatter file is slightly different than the one I crafted based on the output of

cat /proc/emmc

My scatter file has one partition more:

- partition_index: SYS20
  partition_name: intsd
  file_name: NONE
  is_download: false
  type: EXT4_IMG
  linear_start_addr: 0xe1000000
  physical_start_addr: 0xe1000000
  partition_size: 0x0
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

I guess it is the internal sdcard partition, and in the download from XDA-Developers it is simply rolled in into a larger userdata partition.

I have not checked the other files in the XDA-Developers download. At the moment I am stuck in that I cannot flash with SP FlashTools. In Windows under VirtualBox the tablet is recognized but nothing starts. In Linux I have to start SP FlashTools as superuser to give it access to the ports (I had written an udev rule for the USB, but then it opens a com port at /dev/ttyACM0 and I did not have the patience to keep playing with user privileges). But then it hangs:

Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
add@/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3

add@/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0

add@/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/tty/ttyACM0

vid is 0e8d

device vid = 0e8d

pid is 0003

device pid = 0003

com portName is: /dev/ttyACM0

Total wait time = -1438134544.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
COM port is open. Trying to sync with the target...
Failed to Connect DA: S_BROM_DOWNLOAD_DA_FAIL
BROM Exception! ( BROM ERROR : S_BROM_DOWNLOAD_DA_FAIL (2004)

[H/W] Fail to download DA to baseband chip's internal SRAM!
[HINT]:
1. There's an cable communication problem between FlashTool and BootROM.
2. Target might be shutdown unexpectedly or target lost power supply.
[ACTION]
1. Try again.
2. Proceed H/W checking in download cable and target side com port.
3. Monitor if power-drop occured in target side.)((ConnectDA,../../../qt_flash_tool/Conn/Connection.cpp,127))

To enter META/Preload mode, I press the volume down button, connect the USB cable, wait about 10-12 seconds, then the logo appears and it goes into META mode, with a Chinese menu that I don't understand. Has anybody translated that menu?

Thanks
Yuv

[hocuspocus69]

yuv Google translation... this is meta mode on Teclast T98 4G I think is the same

[yuv]

Thanks, hocuspocus69, what kind of picture did you upload to Google Translate. I tried feeding these two images to Google's OCR, to no avail. I also tried to identify the Chinese character with http://ce.linedict.com/#/cnen/home:

• First screen: https://drive.google.com/open?id=1w3...JJaTXjZhJYqf4U
• Second screen: https://drive.google.com/open?id=1wM...BrldqzMD2Mitos

The meta mode of the P98-4G(A8H8) is slightly different than the meta mode of your T98-4G:

• There is no "automatic test" entry on the first page
• There is no "debugging test item"
• The restart phone entry's text is different, but the effect seems to be the same

I get on the second screen after selecting the first entry ("manual test") and pressing sequentially the three buttons power, volume up, volume down. It does not seem that the order of the sequence matters. Once I am on the second screen, the volume down button cycles through the tests, some of which last longer than others (the SIM one in particular, maybe because I have no SIM card inserted). At some point I had no more patience and instead of pressing volume down I triggered the reset pin in the back. I wish I could read Chinese. The owner of a convenience store nearby is Chinese, I'll see if I can enlist his help.

In the meantime, I would be curious to see the Version Info of other P98 / T98. It is easy:

• Power off the tablet
• Press and hold the Volume Down button
• Insert a USB cable
• You can release the Volume Down button after the Teclast logo displays
• When the Factory Mode menu appears, press Volume Up button to cycle through the options
• Cycle until the Version Info option is highlighted. It is the second from the bottom in my P98-4G(A8H8), just between the clear eMMC and restart phone. If in doubt, check visually with the translation provided by hocuspocus69.
• Press the Power On button to select the option. Wait (there is a lag)
• Take a picture! Edit sensitive information such as Bar code and IMEI numbers and upload. THANKS!
• Press the Volume Down button once to exit Version Info
• Press the Volume Up button to cycle until the Restart Phone option is highlighted.
• Press the Power On button and the tablet restarts.
• If in doubt at any step of the process, carefully use a needle to push the reset button behind the hole on the back side of the tablet next to the USB connector.

Thanks in advance to those who share their Version Info pictures. Time for me to start the working day.
Yuv

[hocuspocus69]

T98 4g c6r3

[yuv]

Rooted! Not Flashed¡

TL;DR: Another evening is over. I had a rooted device in my hand, then I did a factory reset and I still can't flash.

Rooting is still kind of "unstable." A power off / reboot unrooted the tablet, but before the power cycle I was able to do the following:

• Root Verifier (from f-droid) said the device is rooted, SuperSU2.49 is the Superuser App, and busybox is not installed.
• AFWall+ (also from f-droid and the most important reason to have root IMHO) worked: I could set and verify the iptable rules. However, I was unable to install the script to prevent data leaks during system startup. It uses its own busybox.
• I browsed /system with the Amaze file browser.

What did not work:

• On the first boot after rooting, SuperSU prompted that "the SU binary needs to be updated." I do not have a custom recovery yet, so I selected "Normal" and it failed. It also failed to remove the cruft from my previous rooting attempts. The Kinguser app is still there (and it even survived the factory reset). It is Kinguser that handled app permissions, not SuperSU.
• Titanium Backup said it could not acquire root privileges using the "/system/xbin/su" command.
• On the second boot and any subsequent boot, Root Verifier said the device is no longer rooted.

Procedure

This is pretty much exactly what I did. I copied / adapted the commands from SuperSU's META-INF/com/google/android/update-binary. Thanks to Chainfire for that great tool! His update-binary script is designed to cover many scenarios and a bit overkill for the manual rooting of a single device, but it makes an interesting learning experience. Many of the commands that I typed are redundant in the case of the P98-4G(A8H8), so error messages are expected. Do not worry about them, or better, try to understand them.

• Connect the tablet to the PC (I use Xubuntu)
• Download SuperSU beta v2.49
• Unzip and rename the folder supersu
• Enter the following commands

cd ~/Downloads
unzip BETA-SuperSU-v2.49zip
mkdir rootclast
mv BETA-SuperSU-v2.49zip ~/rootclast/supersu
cd rootclast
adb root
adb push supersu /tmp
adb shell

• Before continuing, check that the adb shell prompt ends with a # and not with a $, then copy & paste these blocks of commands (all from Chainfire's SuperSu, lines starting with # are my comments and not necessary)

# six slightly different attempts to change the context of a file.  The ones with -h throw errors
ch_con() {
  LD_LIBRARY_PATH=$SYSTEMLIB /system/toolbox chcon -h u:object_r:system_file:s0 $1
  LD_LIBRARY_PATH=$SYSTEMLIB /system/bin/toolbox chcon -h u:object_r:system_file:s0 $1
  chcon -h u:object_r:system_file:s0 $1
  LD_LIBRARY_PATH=$SYSTEMLIB /system/toolbox chcon u:object_r:system_file:s0 $1
  LD_LIBRARY_PATH=$SYSTEMLIB /system/bin/toolbox chcon u:object_r:system_file:s0 $1
  chcon u:object_r:system_file:s0 $1
}

# three different attempts to change the context of a file
ch_con_ext() {
  LD_LIBRARY_PATH=$SYSTEMLIB /system/toolbox chcon $2 $1
  LD_LIBRARY_PATH=$SYSTEMLIB /system/bin/toolbox chcon $2 $1
  chcon $2 $1
}

# three different attempts to create a symbolic link, and then change its contest
ln_con() {
  LD_LIBRARY_PATH=$SYSTEMLIB /system/toolbox ln -s $1 $2
  LD_LIBRARY_PATH=$SYSTEMLIB /system/bin/toolbox ln -s $1 $2
  ln -s $1 $2
  ch_con $2
}

set_perm() {
  chown $1.$2 $4
  chown $1:$2 $4
  chmod $3 $4
  ch_con $4
  ch_con_ext $4 $5
}

cp_perm() {
  rm $5
  if [ -f "$4" ]; then
    cat $4 > $5
    set_perm $1 $2 $3 $5 $6
  fi
}

toolbox_mount() {
  DEV=
  POINT=
  FS=
  for i in `cat /etc/fstab | grep "$1"`; do
    if [ -z "$DEV" ]; then
      DEV=$i
    elif [ -z "$POINT" ]; then
      POINT=$i
    elif [ -z "$FS" ]; then
      FS=$i
      break
    fi
  done
  mount -t $FS -o rw $DEV $POINT
  mount -t $FS -o rw,remount $DEV $POINT

  DEV=
  POINT=
  FS=
  for i in `cat /etc/recovery.fstab | grep "$1"`; do
    if [ -z "$POINT" ]; then
      POINT=$i
    elif [ -z "$FS" ]; then
      FS=$i
    elif [ -z "$DEV" ]; then
      DEV=$i
      break
    fi
  done
  if [ "$FS" = "emmc" ]; then
    mount -t ext4 -o rw $DEV $POINT
    mount -t ext4 -o rw,remount $DEV $POINT
    mount -t f2fs -o rw $DEV $POINT
    mount -t f2fs -o rw,remount $DEV $POINT
  else
    mount -t $FS -o rw $DEV $POINT
    mount -t $FS -o rw,remount $DEV $POINT
  fi
}

# here starts the actual work
SYSTEMLIB=/system/lib64

# Mount /system, /data and rootfs
mount /system
mount /data
mount -o rw,remount /system
mount -o rw,remount /system /system
mount -o rw,remount /
mount -o rw,remount / /

toolbox_mount /system
toolbox_mount /data

# ignored the code related to bad recovery detection

# why do we have to make a copy of the toolbox I don't know, but I do
cat /system/bin/toolbox > /system/toolbox
chmod 0755 /system/toolbox
ch_con /system/toolbox

# next is a script to determine API/ABI/architecture and locate the target

# The API is 21
API=$(cat /system/build.prop | grep "ro.build.version.sdk=" | dd bs=1 skip=21 count=2)
# The ABI is arm
ABI=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi=" | dd bs=1 skip=19 count=3)
# The ABILONG is arm64-v8a
ABILONG=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi=" | dd bs=1 skip=19)
# ABI2 is empty
ABI2=$(cat /system/build.prop /default.prop | grep -m 1 "ro.product.cpu.abi2=" | dd bs=1 skip=20 count=3)
SUMOD=06755
SUGOTE=false
SUPOLICY=false
INSTALL_RECOVERY_CONTEXT=u:object_r:system_file:s0
MKSH=/system/bin/mksh
# these are just defaults changed by the logic below
PIE=
ARCH=arm
APKFOLDER=false
APKNAME=/system/app/Superuser.apk
APPPROCESS=false
APPPROCESS64=false

# here comes the logic
if [ "$ABI" = "x86" ]; then ARCH=x86; fi;
if [ "$ABI2" = "x86" ]; then ARCH=x86; fi;
if [ "$API" -eq "$API" ]; then
  if [ "$API" -ge "17" ]; then
    SUGOTE=true
    PIE=.pie
    if [ "$ABILONG" = "armeabi-v7a" ]; then ARCH=armv7; fi;
    if [ "$ABI" = "mip" ]; then ARCH=mips; fi;
    if [ "$ABILONG" = "mips" ]; then ARCH=mips; fi;
  fi
  if [ "$API" -ge "18" ]; then
    SUMOD=0755
  fi
  if [ "$API" -ge "20" ]; then
    if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=arm64; SYSTEMLIB=/system/lib64; APPPROCESS64=true; fi;
    if [ "$ABILONG" = "mips64" ]; then ARCH=mips64; SYSTEMLIB=/system/lib64; APPPROCESS64=true; fi;
    if [ "$ABILONG" = "x86_64" ]; then ARCH=x64; SYSTEMLIB=/system/lib64; APPPROCESS64=true; fi;
    APKFOLDER=true
    APKNAME=/system/app/SuperSU/SuperSU.apk
  fi
  if [ "$API" -ge "19" ]; then
    SUPOLICY=true
    if [ "$(LD_LIBRARY_PATH=$SYSTEMLIB /system/toolbox ls -lZ /system/bin/toolbox | grep toolbox_exec > /dev/null; echo $?)" -eq "0" ]; then
      INSTALL_RECOVERY_CONTEXT=u:object_r:toolbox_exec:s0
    fi
  fi
  if [ "$API" -ge "21" ]; then
    APPPROCESS=true
  fi
fi
if [ ! -f $MKSH ]; then
  MKSH=/system/bin/sh
fi

# now it makes sense to check that they are all set properly
echo "DBG [$API] [$ABI] [$ABI2] [$ABILONG] [$ARCH] [$MKSH]"

# the original script extract the files here, but we have pushed an already extracted folder

# the original script disable OTA survival here.
# does not seem to be applicable in this context, arm64/chattr.pie does not exist

# skipped removing of old files and other root tools for now.
# probably should have gone through it

# skipped making free space, with no consequences

# now the main course: placing the files
# this block displayed a lot of errors, because it is designed to be universal.
# commands that are not specific to the device fail
# NEXT TIME: instead of copy&pasting all block at once, run the commands individually
# to understand what works and what not.
mkdir /system/bin/.ext
set_perm 0 0 0777 /system/bin/.ext
cp_perm 0 0 $SUMOD $BIN/su /system/bin/.ext/.su
cp_perm 0 0 $SUMOD $BIN/su /system/xbin/su
cp_perm 0 0 0755 $BIN/su /system/xbin/daemonsu
if ($SUGOTE); then
  cp_perm 0 0 0755 $BIN/su /system/xbin/sugote u:object_r:zygote_exec:s0
  cp_perm 0 0 0755 $MKSH /system/xbin/sugote-mksh
fi
if ($SUPOLICY); then
  cp_perm 0 0 0755 $BIN/supolicy /system/xbin/supolicy
  cp_perm 0 0 0644 $BIN/libsupol.so $SYSTEMLIB/libsupol.so
fi
if ($APKFOLDER); then
  mkdir /system/app/SuperSU
  set_perm 0 0 0755 /system/app/SuperSU
fi
cp_perm 0 0 0644 $COM/Superuser.apk $APKNAME
cp_perm 0 0 0755 $COM/install-recovery.sh /system/etc/install-recovery.sh
ln_con /system/etc/install-recovery.sh /system/bin/install-recovery.sh
if ($APPPROCESS); then
  rm /system/bin/app_process
  ln_con /system/xbin/daemonsu /system/bin/app_process
  if ($APPPROCESS64); then
    if [ ! -f "/system/bin/app_process64_original" ]; then
      mv /system/bin/app_process64 /system/bin/app_process64_original
    else
      rm /system/bin/app_process64
    fi
    ln_con /system/xbin/daemonsu /system/bin/app_process64
    if [ ! -f "/system/bin/app_process_init" ]; then
      cp_perm 0 2000 0755 /system/bin/app_process64_original /system/bin/app_process_init
    fi
  else
    if [ ! -f "/system/bin/app_process32_original" ]; then
      mv /system/bin/app_process32 /system/bin/app_process32_original
    else
      rm /system/bin/app_process32
    fi
    ln_con /system/xbin/daemonsu /system/bin/app_process32
    if [ ! -f "/system/bin/app_process_init" ]; then
      cp_perm 0 2000 0755 /system/bin/app_process32_original /system/bin/app_process_init
    fi
  fi
fi
cp_perm 0 0 0744 $COM/99SuperSUDaemon /system/etc/init.d/99SuperSUDaemon
echo 1 > /system/etc/.installed_su_daemon
set_perm 0 0 0644 /system/etc/.installed_su_daemon

# here the script restored files, but I did not make free space, so no need

# Post-installation script
rm /system/toolbox
LD_LIBRARY_PATH=$SYSTEMLIB /system/xbin/su --install

# unmounting failed

exit

• And now...

adb reboot

That was it. After having had root for a few moments, another reboot and root was gone. Factory-reset. Try again tomorrow.

Flashing

For the flashing, I decided to restage Windows on my laptop, because I have gone nowhere neither with Linux-native SPFT, nor with Windows-SPFT inside the VirtualBox.

I found that the CDC driver was missing in my Windows/VirtualBox setup, so I got it from here. At some point Windows said something about HTC Dream drivers installed. Go figure!

On the Linux end I found that the tablet identifies itself differently:

1. In Factory Mode: 0e8d:2006 MediaTek Inc.
2. Without USB debugging: 0bb4:2008 HTC (High Tech Computer Corp.)
3. with USB debugging: 0bb4:201d HTC (High Tech Computer Corp.)
4. And quite puzzling, sometimes I also saw: 0e8d:0003 MediaTek Inc. MT6227 phone

Still trying to figure this out, but first it is time to hit the pillow.
Yuv