[Android General] exglynco:
Successfully rooted Simbans 10" Excello Tab using Magisk Manager & SP Flash Tool

Rooting the Simbans 10' Excello Tab. Please note the usual warnings before you attempt rooting an Android device. You're probably voiding your warranty. You risk bricking your device. Neither I, nor the website where you found my words, assumes responsibility for your actions

I bought a 10" Simbans Excello Tab running Android Pie (9) for $130 USD in March 2020. I've rooted all of the ~20 Android devices I've owned. It seemed to me that $130 was a bargain price, but rooting it would be difficult. I found no reports of other owners successfully rooting the Excello Tab. I couldn't even find the OEM firmware for it on the mfr website, so I emailed them on the 4th of July asking for the firmware.

At my request, Simbans added the Excello firmware to its website (https://www.simbans.com/restore.html) on 5 July 2020, along with an SP flash tool, and both PDF and video flashing instructions. Prior to my request, Simbans only listed firmware for its Tango and Picasso tablets. N.B. Although I refer to the Excello firmware by different names, it's ExcelloTab 9.0 Base V1.rar on the official Simbans download site. Similarly, what I call the SP Flash Tool is the Reinstall Tool for Android 9.zip on Simbans' website.

The SP flash tool was a clue to how to root the Excello. SP flash tool is for flashing firmware onto Mediatek chips, which are used in several different phone and tablet brands, including the Excello Tab.

PREPARE YOUR PC. Download the Excello firmware rar file, SP Flash Tools zip, and Extract your SP Flash Tools zip file into a folder, and the Excello firmware rar file into another folder. Although most of you will be using Windows, n.b. there are Linux versions of the SP Flash Tool, and the 64 bit Linux version saved me from a hard brick situation. While you're doing that, download the Windows 10 MTK VCOM USB preloader drivers for your desktop computer.. Thoroughly vet your Windows drivers, following online guides. When you connect your powered off Excello Tab to your PC with SP Flash Tool running, you want to see the VCOM driver recognized (check with Device Manager). When you connect it with MTK Droid and Root Tool (which doesn't support Android >4.5) running, you want to see a different MTK USB driver recognized.

PREPARE YOUR EXCELLO TAB. Enable Developer Options and turn USB debugging on. You do not need to unlock the bootloader (so leave OEM unlocking off in Developer Options) to root the Excello Tab. Download and install root checker and Magisk Manager apps onto your Excello Tab.

In order to root the Excello, you need to hack the Excello's boot.img boot partition. But, we didn't get that file in the Excello firmware archive from Simbans. We will have to capture the Excello's boot partition. We do it by reading back the boot.img partition from RAM. There doesn't appear to be a simple boot.img file loaded onto the Excello. It'builds the boot partition from other files, like a boot-sign.img file.

Change the SP Flash Tool to allow capturing partitions, like the boot.img boot partition. Go to your SP Flash Tools folder, and edit the option.ini file in the SP Flash Tools archive. It's a text file, so use a text editor like Windows' Notepad or Ubuntu's Gedit. Find the [ReadBack] section of the file, and change ShowByScatter=false to ShowByScatter=true. Save your changes.

Run the SP Flash Tool as administrator by running the (Windows) flash_tool.exe with shift-right click on the file, or (Linux) sudo ./flash_tool.sh program. Set it up by selecting the Download tab near the top of the window. Choose your Download agent from the extracted firmware folder. Use the MTK_AllInOne_DA.bin choice. The correct Scatter-loading file for our Excello Tabs is the MT8163_Android_scatter.txt file. If you placed all of the extracted files from your Excello firmware rar file in the same location as the scatter file, the SP Flash tool will populate the fields for boot, recovery, etc. Correct any errors now, before you try to flash or use something that's so out of place that it bricks your device. You can click on any erroneous files and correct their path or name.

When you're ready to capture/readback your boot partition, select the Readback tab, and select only the boot partition. Make sure your Excello Tab is powered down and unplugged from the computer that's running the SP FLash tool. Choose the Read Back action. The tool will wait for you to connect your device. Hold the Volume Down button on your Excello Tab, connect the device, and release the volume down button when the red bar appears at the bottom of the tool window. The boot partition gets written as ROM_10 in your SP Flash tool folder. The boot partition will differ on different MT chip architectures, and different partitions. If your next action was to readback your Excello's (MT8163's) recovery partition, it would be saved as ROM_11, and so on.

If the readback succeeds, a green check mark icon appears on the tool screen, and your boot partition has been captured in a 10.8 MB ROM_10 file located in the SP Flash Tool folder..

Disconnect your Excello, power it up, copy the ROM_10 file to your Excello in a location you will remember, and rename it boot.img. I put mine in my Excello's internal memory's Downloads folder.

Run the Magisk Manager app on your Excello, It will tell you Magisk is not up to date. Click the INSTALL choice, confirm with yes, and choose Select and Patch a file as your method, Navigate to your just-saved boot.img file, and let Magisk do its thing. When it finishes, you will have a rooting magisk_patched.img to replace your stock boot.img. Copy the magisk_patched.img to your Excello firmware folder.

Before you flash your modified boot.img file (magisk_patched.img) to root your Excello, you have to modify your MT8163_Android_scatter.txt file (it's in your firmware folder) to only flash up to and including the boot partition. Load that scatter file in your text editor, and find the partition_name: boot. For the MT8163 chip, it's in the section starting with partition_index: SYS10. As you read about partition_index SYS10, you realize that SYS10 is where ROM_10 gets its name from. Different MT chips have different architectures. An MT6753 chip's boot partition will be in SYS8. After you've deleted all the sections following our 8163's SYS10, save the modded file with another name, like MT8163_Android_scatteredmoddedBOOTONLY.txt.

To root your Excello Tab, run the SP Flash Tool as administrator. Change the scatter file to the one you just modified. Choose the Download tab. The scatter file should only give you the boot partition as a familiar target. Check that partition, and select the magisk_patched.img. Power down your Excelo. Press the Download action on the SP Flash Tool. Hold the Excello's Volume Down button and connect the Excello to your PC running the SP Flash Tool. Release the button when the red bar appears on the flash tool. When the flashing completes with a green check mark icon, unplug the Excello. Boot it up, run Magisk Manager and your root checker. You should have a rooted tablet.

At one point, I hard bricked my Excello. It was my fault, but my Excello wouldn't respond to its power button There was an apparent Windows driver problem, as my Excello Tab wasn't recognized by my Windows PC when bricked, so the SP flash tool errored out with an unrecognized device. Luckily, there's a 64 bit Linux version of the SP Flash tool, and the Linux kernel read the MediaTec chip, allowing the Linux version of the SP flash tool to successfully flash the OEM firmware to unbrick the Excello, readback/create the boot.img, and flash the Magisk_patched.img to root the Excello Tab tablet.

If any of these instructions are confusing or contradictory, ask for clarification before you turn your beautiful $130 10" bargain tablet into the most expensive paperweight you ever bought.