Magisk: Patched boot image file from Nokia 5.1 Plus Android 10 internal failed to boot

[HikariCalyx]

Used Magisk canary ef9d077c (20401) build for patching.
Note this is not involved with MTK-SU method, and the bootloader is properly unlocked.

SoC: MediaTek Helio P60 (MT6771)

- Device platform: arm64-v8a
- Copying image to cache
2034+0 records in
2034+0 records out
2082816 bytes transferred in 0.055 secs (37869381 bytes/sec)
1410+1 records in
1410+1 records out
1443916 bytes transferred in 0.032 secs (45122375 bytes/sec)
- Unpacking boot image
Parsing boot image: [/data/user_de/0/com.topjohnwu.magisk/install/boot.img]
HEADER_VER      [2]
KERNEL_SZ       [9501520]
RAMDISK_SZ      [6847099]
SECOND_SZ       [0]
RECOV_DTBO_SZ   [0]
DTB_SZ          [172390]
OS_VERSION      [10.0.0]
OS_PATCH_LEVEL  [2020-04]
PAGESIZE        [2048]
NAME            []
CMDLINE         [bootopt=64S3,32N2,64N2 buildvariant=user]
CHECKSUM        [aaf674e53ab37d8e2df026e1db6fab86f0095393000000000000000000000000]
KERNEL_DTB      [172326]
KERNEL_FMT      [gzip]
RAMDISK_FMT     [gzip]
- Checking ramdisk status
Loading cpio: [ramdisk.cpio]
- Stock boot image detected
- Patching ramdisk
Loading cpio: [ramdisk.cpio]
Add entry [init] (0750)
Patch with flag KEEPVERITY=[true] KEEPFORCEENCRYPT=[true]
Loading cpio: [ramdisk.cpio.orig]
Backup mismatch entry: [init] -> [.backup/init]
Create directory [.backup] (0000)
Add entry [.backup/.magisk] (0000)
Dump cpio: [ramdisk.cpio]
Loading dtbs from [dtb]
DT_TABLE v0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 

****************************
 Output file is placed in 
 /storage/emulated/0/Download/magisk_patched.img 
****************************
- All done!

Here's the original boot image link: https://github.com/AndroidDumps/nokia_pda_dump/raw/Panda_00WW-user-10-QP1A.190711.020-00WW_3_110-release-keys/boot.img

[HikariCalyx]

UPDATE: Same to Nokia 3.1 Plus Android 10 internal with MT6765 (Helio P22).

https://github.com/AndroidDumps/nokia_roon_sprout_dump/blob/Rooster_00WW-user-10-QP1A.190711.020-00WW_4_120-release-keys/boot.img?raw=true

Noticed the security patch level of this boot image is October 5, 2019, definitely unrelated to MTK-SU.

[osm0sis]

Any change with 20406? It's got rewritten init logic.

Has Magisk ever worked on this device?

[HikariCalyx]

Found the problem.

After PDA-311A build, the phone is upgraded to AVB2.
Since Nokia 5.1 Plus X5 doesn't have vbmeta partition, the vbmeta info is included in boot.img.

Therefore, the patched boot.img has to be flashed like that (as MTK A/B devices like that have to define slot manually in fastboot command):

fastboot --disable-verity --disable-verification flash boot_a magisk_patched.img

The phone can be rooted, but still not ideal for OTA installation along with root.

Output of avbtool info_image --image PDA-0-311A-00WW-boot.img:

Footer version:           1.0
Image size:               33554432 bytes
Original image size:      16527360 bytes
VBMeta offset:            16527360
VBMeta size:              2944 bytes
--
Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     320 bytes
Auxiliary Block:          2368 bytes
Algorithm:                SHA256_RSA2048
Rollback Index:           0
Flags:                    0
Release String:           'avbtool 1.1.0'
Descriptors:
    Chain Partition descriptor:
      Partition Name:          vendor
      Rollback Index Location: 4
      Public key (sha1):       9577bc6c0772975ecce93c4d8a178662c728dadf
    Chain Partition descriptor:
      Partition Name:          system
      Rollback Index Location: 2
      Public key (sha1):       f4eb033903e2622aebb584b78fc4f95ad958e59b
    Prop: com.android.build.boot.os_version -> '10'
    Prop: com.android.build.boot.security_patch -> '2019-06-06'
    Hash descriptor:
      Image Size:            16527360 bytes
      Hash Algorithm:        sha256
      Partition Name:        boot
      Salt:                  e027723b68c14f1e7b8a0e39bad9125f74edbdbf189cf281f0167a251a48b5bd
      Digest:                fed5c4b2f8903218d1d8a9d974e9340533f64697accf679601db8ff39b4f34b4
    Hash descriptor:
      Image Size:            48016 bytes
      Hash Algorithm:        sha256
      Partition Name:        dtbo
      Salt:                  5ddcc247e4ea9a81a683cad389e9d5417a2164bfa879dd02bdb5123e3e69b741
      Digest:                32556173be9c3c87a0bf4318f767a14a0f7514f5d4ea74ac605de7a456f9a2f0

As comparison, here's the output of avbtool info_image --image PDA-0-215C-00CN-boot.img:

avbtool: Given image does not look like a vbmeta image.

Guess @topjohnwu will find that out gradually🤔

Original boot image link got revoked, so have to extract it from the full OTA zip below:
https://android.googleapis.com/packages/ota-api/nokia_pdasprout_panda00ww/ace851ea59294177f677018648d6c0614317510e.zip