Teclast P98 4G ( A8H8 )

[Matteuz]

I just ordered the Teclast P98 4G tablet, preloaded with Android 5.0, hardware revision A8H8.

Someone is already in possession of such a tablet?

There are notable differences from the previous version A8H6 ??

I hope that in future there is a custom rom.


(sorry for the bad English)

[Matteuz]

edit

[Matteuz]

A8H8 - Android 5.0

[hocuspocus69]

can you share backup system and boot image ?
i cannot find original stock rom
maybe i can port it for teclast t98...
thanx

[Matteuz]

I could not find a way to root this tablet ... it is probably still too early.

Actually I started this thread in the hope that some developers work on this tablet with a custom rom.

[yuv]

can you share backup system and boot image ?
i cannot find original stock rom
maybe i can port it for teclast t98...
thanx

Hi, and thanks for all the good work you are posting here. I have a P98-4G (A8H8) and have done some poking around. I will post something more later on. In the meantime, would something like this work (I am on Linux and although the device is not rooted yet, but I get root access through adb:

adb root
adb root
adb shell
dd if=/dev/block/platform/mtk-msdc.0/by-name/boot of=/sdcard/Download/boot.img
dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/sdcard/Download/system.img
exit
adb pull /sdcard/Download/boot.img
adb pull /sdcard/Download/system.img

Where do you want me to upload the files?

Yuv

[yuv]

I think it did work. System is 1.4GB, and I can play with it.

mkdir -p /tmp/sys
sudo mount -o loop system.img /tmp/sys/

Now I only need to know where to put the files extracted from the latest SuperSU zip to root the tablet. I have downloaded RileyROM from this site (many thanks!) and have started poking at the scatter files. Those published here and in the RileyROM are for the T98 with KitKat, my device is a P98 with Lollipop.

The first step to reverse-engineer a device is to understand how its memory is partitioned. In Linux, I would be looking at /proc/partitions. Indeed, there is some helpful information there, though poking around, /proc/emmc is the interesting one:

adb shell
cat /proc/partitions
cat /proc/emmc > sdcard/Download/partition.info
cat sdcard/Download/partition.info
exit
adb pull sdcard/Download/partition.info

Formatted output:

partno:    start_sect   nr_sects  partition_name
emmc_p1:  00000400 00001800 "proinfo"
emmc_p2:  00001c00 00002800 "nvram"
emmc_p3:  00004400 00005000 "protect1"
emmc_p4:  00009400 00005000 "protect2"
emmc_p5:  0000e400 00000200 "seccfg"
emmc_p6:  0000e600 00000300 "lk"
emmc_p7:  0000e900 00008000 "boot"
emmc_p8:  00016900 00008000 "recovery"
emmc_p9:  0001e900 00003000 "secro"
emmc_p10: 00021900 00000400 "para"
emmc_p11: 00021d00 00004000 "logo"
emmc_p12: 00025d00 00005000 "expdb"
emmc_p13: 0002ad00 00002800 "tee1"
emmc_p14: 0002d500 00002800 "tee2"
emmc_p15: 0002fd00 00010300 "metadata"
emmc_p16: 00040000 002a8000 "system"
emmc_p17: 002e8000 000d4000 "cache"
emmc_p18: 003bc000 03679c00 "userdata"
emmc_p19: 03a35c00 00008000 "flashinfo"

This is on a Lollipop device. Can somebody with a KitKat device post their output, please?

The output is in hexadecimal notation, and of 512 bytes (0x200 bytes) sectors. It is the most important values needed for the scatter file, used by the flashing tool to identify the partitions to be flashed.

I downloaded the RileyROM (KitKat), and the scatter files from this thread, and compared them to the Kernel's output. I found some significant differences and one important similarity:

Similarity: The recovery partition, SYS9 in the scatter file and emmc_p8 in the Kernel's output, is exactly the same. My intuition tells me that it may be relatively safe to flash the recovery partition using the RileyROM. But I am a n00b. Question is: which recovery to use? vbindiff tells me there are significant differences between the TWRP 2.8.4.0 modded by a clever Russian and posted on one of the usual sites; and the TWRP (or CWM) recovery.img that comes with the RileyROM. And I am not sure any of them will work with my device (or brick it). Guidance appreciated.

Important Differences:

• SYS17 system is slightly larger on my tablet: 0x55000000 vs. 0x52000000 on the RileyROM scatter file. Obviously all following partitions are shifted.
• SYS18 cache starts at 0x5D000000 and is significantly larger: 0x1A8000000 instead of 0x7000000
• SYS19 userdata starts at 0x77800000 and is significantly larger: 0x6CF380000
• SYS21 flashinfo is same size, just shifted

Unknown: I cannot link the following entries in the scatter files to any output of /proc/emmc:

• SYS0 preloader. I remember reading something about MTK images requiring some prefix, but I have no idea if this is it and how to deal with this entry in the scatter file.
• SYS1 pgpt and SYS 20 intsd, both of which have operation type INVISIBLE in the scatter file.
• SYS22 sgpt, which has operation type INVISIBLE, like flashinfo.

I have not had time yet to research these. I understand the basic syntax of the scatter file, but am not yet confident to modify/write one myself. I guess wildly that pgpt and sgpt have something to do with GPT partition table (there are two GPTs on traditional hard drives, one at the beginning and one at the end, if I recall correctly). If anybody can point me to some documentation, I would gladly follow directions.
The most important piece of the puzzle that I am still missing is: how to backup the IMEI? ideally in a few adb command line entries.

I can connect to the device with adb from both Linux (Xubuntu 14.04LTS) and a Windows VirtualBox guest. I am more comfortable on the POSIX side of operating systems, though.

My objectives are:

1. Back up completely the device and being able to re-flash it to the exact crapshoot that was delivered to me
2. Root it without downgrading from Lollipop to KitKat
3. Decrapify, cook my custom ROM (as I have done for an MT6577 device a couple of years ago)
4. ...and the ultimate goal is to attempt this

Yuv

[hocuspocus69]

Hi, and thanks for all the good work you are posting here. I have a P98-4G (A8H8) and have done some poking around. I will post something more later on. In the meantime, would something like this work (I am on Linux and although the device is not rooted yet, but I get root access through adb:

adb root
adb root
adb shell
dd if=/dev/block/platform/mtk-msdc.0/by-name/boot of=/sdcard/Download/boot.img
dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/sdcard/Download/system.img
exit
adb pull /sdcard/Download/boot.img
adb pull /sdcard/Download/system.img

Where do you want me to upload the files?

Yuv

Mega.co.nz
For image system and boot
There is a new tool to make backup of system base on mt8752 in beta stage...look on androidiani.com
Good work!!!

[hocuspocus69]

Here is beta test request form

http://spacerom.altervista.org/beta-test-program.html

Here something about it..

http://www.androidiani.com/forum/modding-altri-terminali-mtk/469187-space-mtk-tool-una-nuova-suite-di-funzioni-per-tutti-i-dispositivi-mediatek.html

Bye

[yuv]

Mega.co.nz
For image system and boot

Is there a reason not to use Dropbox, GoogleDrive, OneDrive, iCloud, or any of the other respectable cloud storage sites?

<rant>Why are most Android-related downloads on crappy sites like Mega, Mediafire, and other obstructive, spyware-laden, ugly-looking, shoddy sites that throttle download speed and keeps nagging to sell "premium" downloads?</rant>

http://www.androidiani.com/forum/modding-altri-terminali-mtk/469187-space-mtk-tool-una-nuova-suite-di-funzioni-per-tutti-i-dispositivi-mediatek.html

Bye

Parli italiano?

I filled their form a day or two ago. No response yet. I must admit that I am not particularly impressed by the screenshots, although what is under the hood is more important than UI design. I find that there are way too many tools around, and all of them suffer the same problems. But I will not expand. One rant per post is enough. Actually: one rant per week is enough. No, one per thread and one per month. Anyway, I will find a way to give you access to the system and boot images. Are you familiar with GPG? or with SSH? Can you PM me (or can I PM you)?

[Matteuz]

yuv, thanks for your work !. I hope you can get to the end !.

I have to understand, would you bring Cyanogen on P98 ?? That would be great!



P.s. sei italiano anche te?

[yuv]

I found SP Flash Tool for Linux on http://mtk2000.ucoz.ru/

When I see this kind of downloads, no matter whether for Linux, Mac, Windows, I question the legality of their distribution. The SP Flash Tool has a copyright notice reserving all rights to MediaTek Inc. I would feel much comfortable downloading directly from MediaTek.

The tool has an update checker, but I have not yet sniffed with Wireshark where it connects to check for updates. It seems to be newer than anything I have found so far:

MediaTek SP Flash Tool v5.1504.0
Build 2015/01/27 13:16 (0xede534c)
Comment: [Customer Release] N/A
DA_v7.1504.00.00
(Build-Date: 2015/01/27 13:21:12)
libflashtool.so v7.1504.01.00
Official-Build
(Build-Date: 2015-01-19 10:30:46)

Now I no longer need to boot the Windows virtual machine

[yuv]

More progress to report. I have forwarded copies of my boot.img and system.img to hocuspocus69 who magically returned them to me to try on my device. I am very thankful for the fish, but I prefer to learn fishing. So I did some research. This is my result

Boot and recovery images are not proper file systems. They consist of

• a 2K header, followed by
• a gzipped kernel, follwed by
• a ramdisk, followed by
• an optional (rarely seen) second stage

Source: Android DLS

While the images can be manually unpacked and repacked, I found a useful, well documented shortcut that will do for now. I used unpack-MTK.pl to peek into the modifications that hocuspocus69 applied to the original boot.img file (I will look at system.img in another post).

In the Xubuntu command line:

git clone https://github.com/bgcngm/mtk-tools.git
mkdir boot
cd boot
../mtk-tools/unpack-MTK.pl ../dd/boot.img
cd ..
mkdir boot.hocuspocus
cd boot.hocuspocus
../mtk-tools/unpack-MTK.pl ../dd/boot.img
cd ..
diff --brief -r boot boot.hocuspocus

The last command listed the files that are different, and it listed three files to look at:

• boot/boot.img-args.txt -- an info file generated by unpack-MTK.pl to facilitate repacking
• boot/boot.img-ramdisk/charger -- a symbolic link broken because out of context and otherwise exactly the same in both images
• boot/boot.img-ramdisk/init.rc -- this is where the real differences are. The following code was added at the end of the file:

#RileyROM add init.d support to boot/init.rc
service runparts /system/bin/run-parts /system/etc/init.d
    class core
    user root
    group root
    oneshot

# Init.d support by RileyROM
service sysinit /system/bin/logwrapper /system/bin/busybox run-parts /system/etc/init.d
    class main
    user root
    oneshot

# Added by RileyROM to set su as a daemon for 4.4
service daemonsu /system/xbin/su --daemon
    class main
    user root
    oneshot

#RileyROM preinstall  add preinstall support to boot/init.rc
service preinstall /system/bin/preinstall.sh
    class main
    group root root
    oneshot
    disabled

on property:dev.bootcomplete=1
    start preinstall

I will need to understand in better detail what those line means, for now, I can just repack the boot.ini file:

../mtk-tools/repack-MTK.pl -boot boot.img-kernel.img boot.img-ramdisk boot2.bin

The repacakged boot.ini I created is slightly different in size than hocuspocus69, and both are significantly smaller than the initial partition dump I made out of the device.

The initial partition dump was a blind dd to the end of the partition, so it most likely had a lot of empty space at the end. But the difference between the two modified and repackaged files seemed worth some investigation:

Mine:

0000 0010: [B]C8 BE[/B] 0F 00 00 00 00 44  00 00 00 00 00 [B]00 F0[/B] 40  .......D .......@

0000 0240: [B]8B D2 BF 2E 93 F3 10 6C  B6 7E BB 89 FF 0C 80 07[/B]  .......l .~......  
0000 0250: [B]73 8E 9B B4[/B] 00 00 00 00  00 00 00 00 00 00 00 00  s....... ........

005E 2800: 88 16 88 58 [B]C8 BC[/B] 0F 00  52 4F 4F 54 46 53 00 00  ...X.... ROOTFS..

hocuspocus69:

0000 0010: [B]F8 AE[/B] 0F 00 00 00 00 44  00 00 00 00 00 [B]80 F7[/B] 40  .......D .......@

0000 0240: [B]BA A1 59 F8 52 05 68 22  1F 71 EE E7 0D 2B 1A 97[/B]  ..Y.R.h" .q...+..  
0000 0250: [B]81 14 A6 EF[/B] 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........

005E 2800: 88 16 88 58 [B]F8 AC[/B] 0F 00  52 4F 4F 54 46 53 00 00  ...X.... ROOTFS..

and then, from offset 005E 2A04 everything is completely different.

I repackaged the unpackaged hocuspocus69 version and it yielded a third result. I assume the difference is due to him using a different tool than me to pack the image. The investigation did not yield anything that I can make sense of.

So the situation now is:

• I can recreate a slightly different boot.img than my mentor
• I need to understand the five added commands to init.rc
• I am ready to take a plunge and flash this boot partition, either with SP Flash Tools, or with

adb push boot2.bin /sdcard/Download/
adb root
adb shell
adb dd if=/sdcard/Download/boot2.bin of=/dev/block/platform/mtk-msdc.0/by-name/boot

I have not done that yet. First, let me analyse the changes to system.img

Good night,
Yuv

P.S.: @Matteuz: l'Italia mi sta' molto a cuore e l'italiano e' la seconda lingua che ho imparato, quando ero bambino, ma italiano non sono.

[hocuspocus69]

Great works yuv
for boot image I use Carliv Image Kitchen from XDA http://forum.xda-developers.com/andr...droid-t3013658
really i've never had a problem with version 0.3 working on kitkat image i don't know over lollipop (now there is version 1.0 i've never use it but I think i'ts good enough!)
good for unpacking repacking boot and recovery (like TWRP)
yuv there is also a linux version :-)
everything i've put inside my ROM was extracted from RileyROM so he is the MENTOR
for system i'll explain metod next days
I use
from http://4pda.ru/forum/index.php?showtopic=459926&
MTwintools_v1.0 to unpack and
from http://4pda.ru/forum/index.php?showtopic=496786&st=940
make_ext4fs_new to repack when repacking you must add -l sizeofimage inside CreateSparseEXT4.bat

[hocuspocus69]

yuv boot.img from your p98 lollipop version on my teclast t98 only bootloop
exactly
your backup directly flashed BOOTLOOP
your backup + your system flashed BOOTLOOP
your backup after unpacking repacking with Carliv tool flashed BOOTLOOP
your backup after unpacking editing repacking BOOTLOOP
i think that probably your preloader is different from T98
but i have no good info about flash a different preloader to another tablet (probably brick)
need more info!
so i can't experiment on my tablet T98
Go back to explanation for boot.img
you can use Carliv image kitchen to unpack mtk boot image
add in init.rc
some tweak for sdcard_rw (writable problem on externalSD with some apps)

origin "mkdir /storage 0751 root sdcard_r" MOD "mkdir /storage 0751 root sdcard_rw"
origin "group drm system inet drmrpc sdcard_r ####" MOD "group drm system inet drmrpc sdcard_rw ####"
origin "group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm media sdcard_r system net_bt_stack ####" MOD "group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm media sdcard_rw system net_bt_stack ####"

from 900Supersport bible on freaktab

http://freaktab.com/forum/development-area/rom-hacks-and-mods-development/7812-900supersport-s-guide-to-working-rk-roms?p=165517#post165517

"Code:

#900supersport add init.d support to boot/init.rc
service runparts /system/bin/run-parts /system/etc/init.d
class core
user root
group root
oneshot

these lines are 'I was here' :-)
execute runparts '/system/bin/run-parts' to execute the scripts in /system/etc/init.d.
We created the symlink run-parts (to busybox) earlier within system.
These execute as user root, group root. Finaly oneshot says run this just once on boot."

the other line are from finlessBob

for adding busybox support

starting daemon mode for kitkat

and launch preinstall

then repack your boot with Carliv image kitchen

bye