[General Topics] TouchOdeath:
This is a discussion thread on rooting tablets that have the processor "Allwinner A523".

My particular device model is a JREN JR-J10 Plus. My device runs BigdroidOS 2.5.2.749. Kernel version 5.15.119. Android 13.

-Unlocking Bootloader:

WARNING: This will factory reset your device!

adb reboot bootloader
fastboot oem unlock
fastboot reboot

Once thats done, to know you've done it correctly, on boot you'll see a screen that says "Your device software can't be checked for corruption. Please lock the bootloader.". Also under developer options, you'll notice that 'OEM Unlocking' is now greyed out but enabled.

-FEL Mode:

Allwinner chips including A523, support FEL mode. If you've bricked your device, FEL mode will allow you to possibly unbrick your device. You can read/write to memory and execute code too.

FEL - linux-sunxi.org

linux-sunxi.org

LiveSuit images - linux-sunxi.org

linux-sunxi.org

To enter FEL mode for me is:

1. Turn off device.

2. Hold down Vol down.

3. Hold down power for 2 seconds

4. Let go of power, then immediately press it 3 times. The screen should be off the entire time, which means you did it right.

5. To verify your in FEL mode:

apt install sunxi-tools
sunxi-fel version

If you see an output like this:

AWUSBFEX soc=00001890(unknown) 00000001 ver=0001 44 08 scratchpad=00001500 00000000 00000000

Your in FEL mode.

ERROR: Allwinner USB FEL device not found!

Your NOT in FEL mode

To exit, hold down power button for 6 seconds or more.

-Possible Root Methods exploration:

-FEL MODE

This is probably the most promising method in general. Its low level, should be able to read/write/execute, Especially for backing up Boot.img, init_boot.img, or bootloader.img.

-Identifying what Partition to backup and modify for root:

adb shell ls -lh /dev/block/by-name

You'll get a list of partitions. You'll notice an "_a" and a "_b". So to find out which one your booted in, type this:

adb shell /bin/getprop ro.boot.slot_suffix

For me, it returned "_a". So I'm interested in the following partitions:

/dev/block/by-name/boot_a (high interest)
/dev/block/by-name/bootloader_a
/dev/block/by-name/init_boot_a (high interest)

The solution would be to do:

adb shell dd if=/dev/block/by-name/boot_a of=/sdcard/boot.img
adb shell dd if=/dev/block/by-name/init_boot_a of=/sdcard/init_boot.img
adb shell dd if=/dev/block/by-name/bootloader_a of=/sdcard/bootloader.img

or

adb shell dd if=/dev/block/mmcblk0p5 of=/sdcard/boot.img
adb shell dd if=/dev/block/mmcblk0p9 of=/sdcard/init_boot.img
adb shell dd if=/dev/block/mmcblk0p1 of=/sdcard/bootloader.img

Both should be correct because they're symlinked together.

Problem is Permission denied.

-Patching Boot.img, init_boot.img, or bootloader.img with Magisk:

A common problem I've been running into, is getting a copy of Boot.img, init_boot.img, or bootloader.img. You need one of these partitions to flash Magisk on in order to obtain root.

From the device itself (backup).

From Legit firmware websites:

1. From device manufacturer. This will always be the best option.

A. JREN = http://www.jren.com.cn/​

B. Teclast = https://en.teclast.com/pages/firmwaredownload​

2. From Legit third party websites:

A. https://firmwarefile.com/​

B. https://www.androidmtk.com/​

3. AOSP Generic System Images:

Generic System Images (GSIs) | Platform | Android Developers

developer.android.com

The idea is, if your tablet supports treble:

adb shell getprop ro.treble.enabled

If returns true then you can install one of these system images (Theres more see link above). If it installs, you can use the Boot.img, init_boot.img, or bootloader.img from the website and modify that with Magisk.

-Linux Kernel Exploits

Maybe you could find a code example of a CVE Linux Kernel privilege escalation or perhaps make your own.

-TWRP

At the time of this writing TWRP doesn't exist yet.....

If you could find a TWRP recovery, you could just flash that, then flash Magisk (apk/zip).

adb reboot bootloader
fastboot flash recovery c:\twrp.img

or just temporarily boot into twrp:

adb reboot bootloader
fastboot boot c:\twrp.img

TWRP recovery is probably going to be pretty hard to find because TWRP has to be able to decrypt that device.

-Find solutions from other forums:

This can be kind sometimes be risky. Maybe you can find a forum thread with a root method that will work for other devices (Normally from same manufacturer: maybe TWRP that works for other devices, or maybe a Boot.img, init_boot.img, or bootloader.img from other devices)

-Devices that contain the A523 CPU:

1. JR-J10 Plus

2. Teclast P85T

3. Teclast P30T

4. Teclast P30

5. Teclast P26T

6. Pritom B8

7. Hundai Hytab Plus 8wb3

-See attachments below for A523 CPU Manual:

For more Info:

allwinner_docs/a523_a527_t527 at main · DeciHD/allwinner_docs

Allwinner document collection. Contribute to DeciHD/allwinner_docs development by creating an account on GitHub.

github.com