Need help rooting Ulefone Armor 18t (EDIT: managed to get it rooted) - Android Q&A, Help & Troubleshooting

I just received an Ulefone armor 18t and I'm trying to get the phone rooted through a magisk patched boot image. Whenever I attempt to flash the patched image, the phone always ends up bootlooping and gives me the 'android system may be corrupt' message. I've tried flashing an empty vbmeta in order to try to disable secure boot, but it still isn't working.
Does anyone have any other suggestions or have any ideas as to what could be causing my phone to not boot?
Posted this on reddit; just reposting this for more exposure
EDIT: I managed to root my phone by patching my boot.img with an older version of magisk (24.3) and then updating to v25 after.

---

I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?

---

foamrotreturns said:
I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?
Click to expand...
Click to collapse
Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:
Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options
I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"
If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"

---

Have you tried flashing boot.img in fastboot to sort out bootlooping?

---

I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.
This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.
Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?
Generic123. said:
Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:
Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options
I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"
If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"
Click to expand...
Click to collapse
Yes, I was the person replying to you on Reddit. Thank you again for the help over there.
wenyendev said:
Have you tried flashing boot.img in fastboot to sort out bootlooping?
Click to expand...
Click to collapse
The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.

---

foamrotreturns said:
I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.
This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.
Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?
Yes, I was the person replying to you on Reddit. Thank you again for the help over there.
The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.
Click to expand...
Click to collapse
I am no specialist in unbricking devices. But you may try as follows
- Download the ROM, GApps (Optional), Magisk (Optional).
- Wipe System, Data, Dalvik, Cache.
- Flash the ROM, GApps (Optional), Magisk (Optional).
- Reboot and Enjoy.

---

I tried to root mine, but I was unsuccessful.
I used mtkclient to pull out the boot_b.img and vbmeta_b.img from my device. Having these backups were helpful to get me out of bootloops.
I tried 3 different magisk versions: 24.3, 25.2, and a patched version linked in mtkclient's github readme.
I also tried the vbmeta recommendations described by OP in this thread, but I still could not get myself past the 'android system may be corrupt' loop.
I reverted my boot and vbmeta partitions back to the version I backed up via mtkclient, and escaped the bootloop. But no root.
Interestingly, the checksum of the boot_b.img in my phone does not match the checksum of the boot.img provided in Ulefone's official release. I am assuming my phone received an OTA update while the version in the Ulefone official GoogleDrive remained old, but I was not able to track down a changelog for rom updates/release history.
Unsure what to try next, open to ideas.

---

Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.

---

914mrx said:
Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.
Click to expand...
Click to collapse
I checked the Mega link you provided, and the latest version for the Power Armor 18T is the same as in the Ulefone Google Drive location. I did not compare checksums though, so I cannot confirm the content is identical.
Where did you find this mega folder link? Any chance Ulefone also publishes a changelog or provides older firmware releases in the same location you found the Mega link?

---

Hello, found this link on 4PDA a long time ago, about the others questions i don´t know. Sorry.

---

I spent whole night doing everything but all failed. Unlocked OEM and Usb debugging enabled, tried kingroot, vroot, supersu, downloaded drivers and everything...but somehow I couldn't get through any of it.
Any idea anyone how to do this?

---

Here's why the phone is not being rooted as per the customer service.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

914mrx said:
Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.
Click to expand...
Click to collapse
hello,
i download ROM file from mega. I have SPMDT tool. Scatter files can be to set. DA files is not correct to select. What is wrong?

---

Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.

---

914mrx said:
Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.
Click to expand...
Click to collapse
Hello,
I am solved problem with upgrade. Now have problem with FLIR kamera. No have icon for start IR camera. I can't start it.I think that new upgrade no made for all ulefone model.
How is Foamrotreturns solved problem with FLIR camera?

---

Samo-z said:
Hello,
I am solved problem with upgrade. Now have problem with FLIR kamera. No have icon for start IR camera. I can't start it.I think that new upgrade no made for all ulefone model.
How is Foamrotreturns solved problem with FLIR camera?
Click to expand...
Click to collapse
Were you able to root the phone and flash custom ROM?

---

I am trying to rot my mediatek device following the instruction on this page:-
Unlock Bootloader on MediaTek Devices using MTKClient
In this comprehensive tutorial, we will show you detailed steps to unlock the bootloader on your MediaTek device using MTKClient.
Everything has went smooth but I am getting I/O error and I am not sure how do i unlock bootloader, and hnce install TWRP to install a better ROM.
Here is the log:-
Port – Device detected
Preloader – CPU: MT6877(Dimensity 900)
Preloader – HW version: 0x0
Preloader – WDT: 0x10007000
Preloader – Uart: 0x11002000
Preloader – Brom payload addr: 0x100a00
Preloader – DA payload addr: 0x201000
Preloader – CQ_DMA addr: 0x10212000
Preloader – Var1: 0xa
Preloader – Disabling Watchdog…
Preloader – HW code: 0x959
Preloader – Target config: 0xe0
Preloader – SBC enabled: False
Preloader – SLA enabled: False
Preloader – DAA enabled: False
Preloader – SWJTAG enabled: False
Preloader – EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader – Root cert required: False
Preloader – Mem read auth: True
Preloader – Mem write auth: True
Preloader – Cmd 0xC8 blocked: True
Preloader – Get Target info
Preloader – BROM mode detected.
Preloader – HW subcode: 0x8a00
Preloader – HW Ver: 0xca00
Preloader – SW Ver: 0x0
Preloader – ME_ID: 32993668EB4B4D231D8C1EBAAE7B7B58
Preloader – SOC_ID: 70D2AEEC41FAFC8277AC77DAC843F110913450DFDAC62279F70FD82135670657
DA_handler – Device is unprotected.
DA_handler – Device is in BROM-Mode. Bypassing security.
PLTools – Loading payload from mt6877_payload.bin, 0x264 bytes
PLTools – Kamakiri / DA Run
Kamakiri – Trying kamakiri2..
DeviceClass – USBError(5, ‘Input/Output Error’)
Traceback (most recent call last):
File “C:\Python 3.10.9\mtk”, line 814, in
mtk = Main(args).run(parser)
File “C:\Python 3.10.9\mtkclient\Library\mtk_main.py”, line 615, in run
mtk = da_handler.configure_da(mtk, preloader)
File “C:\Python 3.10.9\mtkclient\Library\mtk_da_cmd.py”, line 101, in configure_da
mtk = mtk.bypass_security() # Needed for dumping preloader
File “C:\Python 3.10.9\mtkclient\Library\mtk_class.py”, line 155, in bypass_security
if plt.runpayload(filename=self.config.payloadfile):
File “C:\Python 3.10.9\mtkclient\Library\pltools.py”, line 102, in runpayload
if self.kama.payload(payload, addr, True, exploittype):
File “C:\Python 3.10.9\mtkclient\Library\kamakiri.py”, line 139, in payload
if self.exploit2(payload, addr):
File “C:\Python 3.10.9\mtkclient\Library\kamakiri.py”, line 117, in exploit2
ptr_send = unpack(“<I", self.da_read(self.mtk.config.chipconfig.send_ptr[0][1], 4))[0] + 8
TypeError: a bytes-like object is required, not 'NoneType'
What do i do now? I've followed all the steps, not sure why is it giving I/O error. I tried with second usb on other port but got the same message.
Kindly suggest how to rectify this.
My device is Ulefone Armour 18t, Processor: MediaTek Dimensity 900
Phone tech specs:-
Ulefone Power Armor 18T
Please help.. :-(
Kind Regards
Hitanshu Gaur

---

Generic123. said:
I just received an Ulefone armor 18t and I'm trying to get the phone rooted through a magisk patched boot image. Whenever I attempt to flash the patched image, the phone always ends up bootlooping and gives me the 'android system may be corrupt' message. I've tried flashing an empty vbmeta in order to try to disable secure boot, but it still isn't working.
Does anyone have any other suggestions or have any ideas as to what could be causing my phone to not boot?
Posted this on reddit; just reposting this for more exposure
EDIT: I managed to root my phone by patching my boot.img with an older version of magisk (24.3) and then updating to v25 after.
Click to expand...
Click to collapse
Hi mate, I patched the boot.img of the official ROM with Magisk after installing it on the phone and then selecting 'install' button and selecting boot.ing file of the official ROM and it was successful. But what do I do next? How do I root the phone after this?

---

hitanshugaur said:
Hi mate, I patched the boot.img of the official ROM with Magisk after installing it on the phone and then selecting 'install' button and selecting boot.ing file of the official ROM and it was successful. But what do I do next? How do I root the phone after this?
Click to expand...
Click to collapse
Here a complete how to https://www.droidwin.com/patch-stock-boot-image-flash-magisk/

---

joke19 said:
Here a complete how to https://www.droidwin.com/patch-stock-boot-image-flash-magisk/
Click to expand...
Click to collapse
I have been able to do everything, now the instructions in the last one are confusing.
Step 2A and 2B are causing confusion and hence a bootloop error.
In 2A he is asking to 'copy' the patched file to the platform-tools folder and the file as per him is stored by the name of magisk_patched.img whereas in reality when I did it was saved as magisk_patched._1vjUh.img. I have copied this to the platform-tools folder as directed
In 2B he is asking to patch again with a newer version and yet again as per him that file will be saved as magisk_patched.img too. Now how can one folder have two files with the exact same name?
Now the confusion is: Does he want us to 'cut paste' the patched image from the older version to the platform-tools folder and rename it to magisk_patched.img ; and leave the new version's patched file in the phone's internal memory and rename that one too magisk_patched.img as well?
If this is done then won't there be a conflict while rooting? because two patched .img are from different versions of a software?