Ulefone Armor 18TDecember 27 2022 19:44:49

Recently my old phone ( Armor 3W ) finally died, after dropping it once too many times and cycling with it in the rain once too often. After looking through the internet for the next rugged phone to buy, and seeing many other options with thermal cameras, I decided on the 18T. This because the build and camera placement appeared the most sensible out of all rugged phones.

Just like the older armor 3W this thing is a beast. Knowing that this thing will last me a while, I set out to root it. Rooting it was easy enough with Magisk, as the stock firmware can easily be found online. Flashing a patched kernel however leaves us with an ugly orange/red state message. You can see this message below, for a different phone.


This was quickly fixed using ghidra to patch the little kernel ( lk.img ) that runs before the bootloader. And to think that military intelligence used to be a joke, ghidra is an awesome tool to use.

After this, I had to deal with the system being a/b and thus unwriteable. Luckily there is a thread on doing this that can be found here. Armed with lpunpack I set out to modify the system to be read/write. That was easy enough following the guide, however the system as it was had very little in the way of inode entries. With no way to copy the /system partition even using magisk --clone, and have a bootable system, I instead reformatted and cloned the vendor and product partitions - which is where I stored all directories I had with many small files.
Having to unpack and repack the image often ( lpunpack and lpmake are included in the ROM because of it), I wrote a small script to automate this process.

#!/bin/sh 
SYSTEM_A="system_a.img"
VENDOR="vendor_a.img"
PRODUCT="product_a.img"


get_size(){
   du -b $1 | grep -o [0-9]*
}

total_size(){
   echo   $(get_size $SYSTEM_A)  +$(get_size $VENDOR) +$(get_size $PRODUCT)  | bc
}

rm $1 2>/dev/null
echo "Total size: $( total_size )"
lpmake --super-name super --metadata-size 65536 --device super:7516192768  --metadata-slots 2 --group main:$( total_size ) --partition system_a:none:$( get_size $SYSTEM_A ):main --image system_a=$SYSTEM_A --partition system_b:none:0:main --partition product_a:none:$( get_size $PRODUCT ):main --image product_a=$PRODUCT  --partition product_b:none:0:main --partition vendor_a:none:$( get_size $VENDOR):main --image vendor_a=$VENDOR --partition vendor_b:none:0:main --output=$1

With this script in hand, I set out to use resize2fs to optimize the partition sizes, and create a new super image. After this, I rebooted to the bootloader, flashed it, and went on to boot it. With this new image running I proceeded to tweak the selinux configurations to allow all tools to run - figuring that it not booting after modifying system had to do with selinux permissions. An example of how you would do this at runtime can be found below:

 magiskpolicy --live "allow shell * * *"    
 magiskpolicy --live "allow appdomain * * *"    
 magiskpolicy --live "allow untrusted_app * * *"    

After patching the sepolicy, I was able to include all the tools I reasonably need on this device, including ssh, git, and a lot of data recovery binaries. The result of that is the firmware you can find below this post. I hope it's useful for anyone.

File	armor_18t.7z
Size	1.79GB
crc32	2144025216
md5	eb3182841f0b717b7695823ff6535250
sha512	e6a14724459cd072a4a399639d857f1f2e6c6c89fedda76a7baedce0c1f53535b188887ab67d64dee730987d71e2dab6d42e6959d54c74a3953016013c0bff5d