[Android General] wori:
I finally got my cubot pocket. I like my devices without GAPPS so I unlocked the bootloader and finally managed to flash a GSI.

This post contains: observations and general hints for this level of development, a guide to unlock the bootloader and what I did so far to flash a GSI.

Unlocking the bootloader​

This works similar to other Spreadtrum/Unisoc-based devices.

The crucial thing is to issue get_identifier_token from fastboot -> reboot to bootloader. If you issue it in adb reboot fastboot, it will say OKAY and may also print a four character string, but this is not the token you're looking for.

Also, when you flash the unlock_bootloader signature.bin, it will prompt you on the phone, but you have to react differently than described on the phone - see below.

enable Android developer mode (Settings -> About Phone -> tap "build number" >= 7x)

enable OEM unlocking (Settings -> System -> Developer Options -> OEM unlocking)

enable ADB (Settings -> System -> Developer Options -> USB debugging)

adb reboot fastboot

choose "reboot to bootloader"

$ fastboot oem get_identifier_token

proceed as described here

finally:

$ fastboot flashing unlock_bootloader signature.bin

this prompts you to press volume up to cancel, volume down to confirm.

But volume down and power don't have any effect, instead volume up starts wiping user.

wiping takes a bit longer than I'd expect, for me 433 s.

Congratulations, you now own your phone a bit more than before!

Flashing GSIs (probably applies to ROMs in general)​

It's a Treble-enabled arm64 A/B device. Flashing GSIs should be possible.

It looks to me like the A/B is crippled as all the _b partitions are 0-sized, probably to save space.

get and unpack necessary files as necessary: boot.img, vbmeta-sign.img, a ROM that you want, p.ex. AndyYan's Lineage GSI

fastboot resize-logical-partition product_a 38000

fastboot flash system [unpacked ROM file]

I also factory reset it afterwards

General/random notes​

there are two different things reachable as "bootloader":

in fastboot switch to bootloader. The device displays the Cubot splash and from the display it looks stuck, but it exposes a fastboot interface -> useful

$ adb|fastboot reboot bootloader

shows the droid with open service door, saying "no command". It also exposes adb, but I don't see a way how to authorise it. Maybe via the debug UART? I didn't yet read the UART when I stumbled upon this. Currently it seems useless to me.

there are test points for the debug UART easily reachable once you disassemble it.

I didn't see anything with a 3.3V USB UART adapter, but a logic analyser with 1.4 V threshold works -> it probably uses 1.8 V logic level. UART-wise it's 115200 8n1.

I think I don't have anything to hook up to the TX currently.

UART log of boot

it's easy to softbrick this device, and I haven't found a nice way out of softbricked yet. Two not-so-nice-ways

- drain the battery, which obviously requires lots of patience

- disassemble the device and disconnect the battery

then flash the original ROM from the cubot site following the instructions there.

Once it bootloops, I didn't manage to power it off or get into fastboot / recovery using the device's keys.

the device reconfigures it's USB during boot and there's a limited time for the SPDFlashTool's mode that flashes complete firmwares. That means that it's not really feasible to run SPDFlashTool inside a VM.

the phone actually does something with the battery detached but USB power attached. For example, it's possible to flash it with the SPDFlashTool. However, it doesn't boot the linux kernel / Android, this seems to be inhibited.

This is in contrast to many other devices that are not laptops for which the PMIC does not provide power to the system when the battery is disconnected.

Old notes / how not to do it: Flashing GSIs (probably applies to ROMs in general)​

it's a Treble-enabled arm64 A/B device. Flashing GSIs should be possible.

It looks to me like the A/B is crippled as all the _b partitions are 0-sized, probably to save space.

system_a is a bit below 1 GB ( 0x3CF5D000 B) which is likely smaller than any interesting GSI.

attempting to flash yields

Resizing 'system' FAILED (remote: 'Not enough space to resize partition')

There's the general hint to delete the product partition by running

fastboot delete-logical-partition product

then it's actually possible to flash a GSI, however:

the device bootloops :poop: -> log

From the log I realised I need to modify vbmeta, so:

it does android verified boot / AVB which from my understanding the easiest way forward is to disable it by:

creating a vbmeta.img with

$ avbtool make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img

the padding necessary might be 16384 instead, according to the hovatek thread below.

it might be necessary to pad it additionally. There's a tutorial and a script here

when I flash both the hovatek-unpadded avbtool-4096-padded and hovatek-padded avbtool-16384-padded vbmeta, the device bootloops :poop: -> log

I guess the next step would be to unpack the vendor PAC ROM and check how the vbmeta image looks there.

Since with the original vbmeta it looks like it's restarting when it's already running linux / android, another way to go at this might be to change the kernel cmdline: instruct it to not do verity - Does anyone know how this is possible?