This forum uses cookies
This forum makes use of cookies to store your login information if you are registered, and your last visit if you are not. Cookies are small text documents stored on your computer; the cookies set by this forum can only be used on this website and pose no security risk. Cookies on this forum also track the specific topics you have read and when you last read them. Please confirm whether you accept or reject these cookies being set.

A cookie will be stored in your browser regardless of choice to prevent you being asked this question again. You will be able to change your cookie settings at any time using the link in the footer.

Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[Howto] Root TB Android Nougat with Magisk
#1
I would like to share the way how I have rooted the TB with Magisk.


Long way:

Install Magisk Manager apk on TB. You can get it from here: https://magiskmanager.com/downloading-magisk-manager
You will also need the binaries from here: https://github.com/topjohnwu/Magisk/rele...-v17.1.zip
Copy this zip file to TB eg. to the Download folder.
You will also need a the boot.img, but not the one that is on the partition. Magisk wants a boot.img with included kernel. As I already compiled the Android 7, I found the right boot.img in the folder out/target/product/rk3288. If you don't have it, it should be possible to build such an image with the rktools. But I have not yet checked it out, how to do this.
Copy this boot.img also to the Download folder of the TB.
Now with installed Magisk Manager select Install and then Patch Boot Image File. You will get an patched boot.img that need to be unpacked and repacked without kernel. Use the File Manager to point Magisk to the boot.img.
Code:
.
.
.
****************************
Patched image is placed in
/storage/emulated/0/Download/patched_boot.img
****************************
- All done!
   

Now we need this patched_boot.img on the host machine.
Code:
path/to/unmkbootimg -i patched_boot.img
kernel written to 'kernel' (8544024 bytes)
ramdisk written to 'ramdisk.cpio.gz' (1750373 bytes)
You can get this tool here:https://forum.xda-developers.com/showthr...?t=1877807
The kernel we don't need further, we will pack the ramdisk to our new boot.img.
Code:
path/to/rkcrc -k ramdisk.cpio.gz newboot.img
This is now the image we can flash to the TB. Of course the TB need to in bootloader mode now.
Code:
sudo path/to/rkflashtool w boot < newboot.img
sudo path/to/rkflashtool b
Now we are there:
       


Short way:

Here you can download the patched ready to flash boot.img:
https://www.dropbox.com/s/o04lpfz8lwp050...t.img?dl=0
Then you need to flash the image to the TB.
Code:
sudo path/to/rkflashtool w boot < newboot.img
sudo path/to/rkflashtool b
If someone know about how to write the image with dd to the sdcard, feel free to comment it here.
Of course the Magisk Manager must also be installed.

[edit]
The boot.img with kernel that can be uploaded to TB and modified by Magisk (not for flashing to Tinker Boards boot partition!):https://www.dropbox.com/s/rcj16ud29mdm5hr/boot.img?dl=0

[edit]
Found the right values to read and write boot.img direct to sdcard.

To read:
Code:
sudo dd if=/dev/sdx of=boot.img bs=512 skip=122880 count=65536

To write:
Code:
sudo dd of=/dev/sdx if=newboot.img bs=512 seek=122880

I made it once with my sdcard and it worked. But please be careful, a typo in dd command can destroy your image and you have to reinstall the image again. Always a good idea to make a backup before.
[-] The following 2 users Like lobo's post:
  • networx, tastebin
Reply
#2
Very nice, ty for your tutorial I will test as soon as possible.

To use the dd command, you need to know the input and output device.
If you make any mistake (for example use sdc instead of sda) you will erase your disk.

Etcher ( https://etcher.io/ ) is a better way to burn the image. If someone need to use dd, please read a full tuto to understand how it works and why it's really good and dangerous.
Reply
#3
(10-29-2018, 09:00 AM)caminin Wrote: Very nice, ty for your tutorial I will test as soon as possible.

To use the dd command, you need to know the input and output device.
If you make any mistake (for example use sdc instead of sda) you will erase your disk.

Etcher ( https://etcher.io/ ) is a better way to burn the image. If someone need to use dd, please read a full tuto to understand how it works and why it's really good and dangerous.
Thank you. Yes, you are right. But it is not the general use of dd I miss. I need the correcet values of skip, seek and count to give the user the possibility to extract the boot partition from sdcard. Not every user is able to put the TB into bootloader mode and read and write with rkflashtool.
Reply
#4
hi,
I have a problem, rkflashtool dont work,
i boot into bootloader and then rkflashtool tell me, that is has no connection to the Tinker Board

what did I wrong?
Reply
#5
(10-29-2018, 11:47 PM)Domo Wrote: hi,
I have a problem, rkflashtool dont work,
i boot into bootloader and then rkflashtool tell me, that is has no connection to the Tinker Board

what did I wrong?
Maybe it is not in bootloader mode. Have you already unlocked the Tinker Board? Here is how to unlock: http://opensource.rock-chips.com/wiki_Fa...the_Device
Note that since I have Nougat on my TB I need to boot to android and give a command 'adb shell reboot bootloader', but it boots to fastboot instead! Then I give the command 'sudo fastboot -i 0x2207 reboot bootloader' and the TB enters bootloader. The jumpers beside the hdmi port don't work on my TB. (edit: now they work, they have been soldered poor.)
Reply
#6
(10-30-2018, 04:44 AM)lobo Wrote:
(10-29-2018, 11:47 PM)Domo Wrote: hi,
I have a problem, rkflashtool dont work,
i boot into bootloader and then rkflashtool tell me, that is has no connection to the Tinker Board

what did I wrong?
Maybe it is not in bootloader mode. Have you already unlocked the Tinker Board? Here is how to unlock: http://opensource.rock-chips.com/wiki_Fa...the_Device
Note that since I have Nougat on my TB I need to boot to android and give a command 'adb shell reboot bootloader', but it boots to fastboot instead! Then I give the command 'sudo fastboot -i 0x2207 reboot bootloader' and the TB enters bootloader. The jumpers beside the hdmi port don't work on my TB.

Thanks, now it work, but I have two questions, how can I see the device is rootet now ? and can you upload your boot.img you used with Magisk ?
Reply
#7
(10-30-2018, 08:40 PM)Domo Wrote:
(10-30-2018, 04:44 AM)lobo Wrote:
(10-29-2018, 11:47 PM)Domo Wrote: hi,
I have a problem, rkflashtool dont work,
i boot into bootloader and then rkflashtool tell me, that is has no connection to the Tinker Board

what did I wrong?
Maybe it is not in bootloader mode. Have you already unlocked the Tinker Board? Here is how to unlock: http://opensource.rock-chips.com/wiki_Fa...the_Device
Note that since I have Nougat on my TB I need to boot to android and give a command 'adb shell reboot bootloader', but it boots to fastboot instead! Then I give the command 'sudo fastboot -i 0x2207 reboot bootloader' and the TB enters bootloader. The jumpers beside the hdmi port don't work on my TB.

Thanks, now it work, but I have two questions, how can I see the device is rootet now ? and can you upload your boot.img you used with Magisk ?
Fine that it works now. Install termux and give command su inside the shell, then it will pop up the permission dialog of Magisk and you can see termux in the list like on the screenshot.
Reply
#8
Uploaded the boot.img, see first post.
Reply
#9
Here is how I found the right values for boot partition on sdcard.
I copied the first 256M from sdcard to a file and searched for the partition entry with bless hex editor. I found that it must be added 2000h blocks to the offset of the partition.
Now need the parameters.txt and it is easy to calculate the right values.
parameters.txt from Nougat (not Marshmallow)
Code:
FIRMWARE_VER:7.1
MACHINE_MODEL:rk3288
MACHINE_ID:007
MANUFACTURER:RK3288
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 3288
CHECK_MASK: 0x80
PWR_HLD: 0,0,A,0,1
CMDLINE: console=ttyFIQ0 androidboot.baseband=N/A androidboot.selinux=permissive androidboot.hardware=rk30board androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(uboot),0x00002000@0x00004000(trust),0x00002000@0x00006000(misc),0x00008000@0x00008000(resource),0x0000C000@0x00010000(kernel),0x00010000@0x0001C000(boot),0x00010000@0x0002C000(recovery),0x00038000@0x0003C000(backup),0x00040000@0x00074000(cache),0x00400000@0x000B4000(system),0x00008000@0x004B4000(metadata),0x00019000@0x004BC000(vendor0),0x00019000@0x004D5000(vendor1),-@0x004EE000(userdata)

The boot partition 0x00010000@0x0001C000(boot) is at 1C000h + 2000h in blocks of 512, in decimal 122880 blocks. The size is 10000h, in decimal 65536.

The value 122880 must be used as seek to put the pointer to this position for the output file.

Code:
sudo dd of=/dev/sdx if=newboot.img bs=512 seek=12288
Where sdx is the device name for the sdcard. Can vary, depending of the used OS.
Reply
#10
As we have problems with fastboot (our fastboot.exe seems not to support -i option), can anyone provide a magisk patches version of this modified image by jamess? https://tinkerboarding.co.uk/forum/threa...ml#pid8622
Maybe i can spend some beer for the helpful member Wink
Best regards,
Peter
__________________________________________
driving smart FM IoT projects
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)