Database Info

Lenovo IdeaTab A2107A -F -H Tablet [FAQ]

Lenovo IdeaTab A2107A -F -H Tablet [FAQ]
We need a clearing house of concise information for the A2107A to address FAQ
(Much of this information can be useful to other MTK devices)
-----------------------------------------------------------------------------------------------------------
Please reply to this thread with any FAQ items you wish to see here.
-----------------------------------------------------------------------------------------------------------
Q: Why are you doing this? Creating a FAQ?
A: Because my brain hurts and I'm a slow reader. There are a few A2107A threads, but the main one has well over 1800 posts. We need to learn, not just follow recipes. We need to build our understanding with unhindered flow of information.
Q: What are the main threads for A2107A users?
A:
Lenovo IdeaTab a2107
Lenovo IdeaTab A2107A-F roms
Lenovo IdeaTab A2107A-F
A2107A-H Firmware update, Custom Rom and CWM Recovery (calling feature - unlocked)
[ROM] SE for Lenovo A2107A-F and A2107A-H
Q: Should I buy an A2107A?
A: At this point (Sept 2013), new ones are not a good value, but used/refurbs can be a good value. Lenovo themselves have better values: A1000 and A3000. I would like to know and post if these have 3G GSM SIMs? UPDATE: If you really want a 3G SIM tablet, this may be still king. The A1000 has no SIM. The A3000 has an LTE SIM.
Q: Are there custom ROMs? (NEW)
A: Depends on what "custom" means to you. I've stripped some stock ones down: http://forum.xda-developers.com/showthread.php?p=46201425 and makbro collected some... chinese, foxtrot, pemergency: http://forum.xda-developers.com/showpost.php?p=37409096&postcount=800 which I also mirrored here: https://drive.google.com/?authuser=0#folders/0B8PcIZoLeGNuWS1JUnA2UXdPYUE
Q: What is different about MTK devices from my phone (Motorola, Samsung, etc)?
A: MediaTek SoCs are cheap. They seem to be unique in that they allow for some low level fiddling where others don't. The low level fiddling is done with MediaTek software called SP Flash Tool (Smart Phone Flash Tool).
Q: It seems, this little beast is a lot more complicated to mess with, than other devices?
A: MediaTek devices are a pain in some respects... but once you use and understand MediaTek's SP Flash Tool -- you actually bypass a lot of complexity. You are able to write blocks anywhere in flash. And also, read blocks anywhere from flash. So you are in full control.
Q: Can I get an update.zip and put it on my sdcard?
A: Some folks (myself included) have grabbed OTAs, but they are not full flashes, they are just updates. Lenovo has not released official update.zip files for these devices. You may find something, I'd like to know. (You have other paths with CWM Recovery and also SP Flash Tools)
Q: What is the difference between a -H and a -F model?
A: There are 3 distinct hardware profiles: -H with 1 GSM SIM slot, -H with 2 GSM SIM, and -F with no SIM. Check the A2107A wiki here: http://forum.xda-developers.com/wiki/Lenovo_IdeaTab_A2107A
Q: Are there different Official ROMs?
A: Yes, there are at least different -H ROMs for US, Europe, and China. The Chinese ROMs enable a Phone App on the -H. To my knowledge there is just one -F ROM.
Q: What are the current stock ROMs?
A: If you have a US -H and OTA it as of Sept 2013 -- you will get Android 4.0.4 (ATT build A2107A_A404_000_033_121011_ATT)
A: If you have a US -F and OTA it as of Sept 2013 -- you will get Android 4.0.3 (build A2107A-F_S486_130221).
Q: Can I root after an OTA?
A: Yep, root4.03.zip etc should work fine. [Assuming there will never be 4.1 OTAs]
Q: Can I flash -H to a -F?
A: First, ask why do you want to do this? The phone software on a Tablet without phone (SIM) hardware won't get you anywhere. Yes, you can flash -H onto -F, and you will likely not like the results. It is jerky and sluggish and has some errors. For example audio breaks up horribly and swiping between homescreens is jittery. You'll want to go back to a -F ROM, and it's hard.
Q: Does the -F model have FM Radio hardware?
A: Yes! Tapping into it though is not easy. It's not as simple as grabbing the FM_Radio_1.0.apk from the -H ROM and installing it. Apparently the kernel driver on -F is missing, because the app wants to close and can't find any signals. On the SAME -F device, using the -H ROM, I'm able to hear FM Radio.
Q: Who do we owe thanks to?
A: Lots of folks, but makbro, FoxtrotKZ, and pemergency have to be at the top of the list.
Q: Are there custom ROMs for the -H?
A: Yes, check out makbro's post http://forum.xda-developers.com/showpost.php?p=37409096&postcount=800
Q: Are there recovery ROMs for the -H?
A: Yes, check makbro's post above and ClearSky or ANTIKIRPICH are within makbros posted SP_Flash_Tool_FULL_A2107.rar here:
https://docs.google.com/file/d/0By3a11Z9icECSXVLWUl4djc3WTg/edit?pli=1
(this is a very good rar/zip/tarball to grab, almost all you need... props go to FoxtrotKZ)
Q: Are there custom ROMs for the -F?
A: ShilohDaniel has stripped the stock ROM and I believe added some things -- calling it "A2107A-F Bare Bones ROM." thread: http://forum.xda-developers.com/showthread.php?t=2213225
Q: Are there recovery ROMs for the -F?
A: Not really. Once I broke my -F I pushed ClearSky (-H) on it. It was semi-operational, but then getting the right partitioning back to -F was horrible. In this respect, getting CWM on and going with Bare Bones ROM wouldn't get you fixed. I hope to change that.
Q: Will Lenovo release more OTAs? JB?
A: No, they already have a new line-up. They are "done" with these devices. The only thing that would change that is if a partner like AT&T needs a security fix.
Q: Is there a JellyBean ROM for either the A2107A-F or the A2107A-H?
A: No, are you volunteering?
Q: Does Lenovo respond to questions on their forums?
A: Probably not the questions that you would ask. Their answers are more "Well have you tried turning it off and then on again?" When I asked if there were model variants they had no idea. They didn't know if different features were enabled (with different ROMs) in different countries. Their online support chat was able to find a few product PDFs that show several long model numbers. (those PDFs are on the wiki)
Q: Can I use all these untrusted tools inside a VMware virtual machine instead of my daily rig?
A: Yes. I encourage it. Also, if you are using VMware snapshots or VirtualBox snapshots you can roll back and try different drivers. It seems trying to replace ADB USB drivers that don't work with MTDRT is very hard. Rolling back is much easier than trying to expunge the already installed driver so you can try another.
Q: What is MTK Droid Tools?
A: A Windows app that will convert a "firmware.info" to a scatter.txt file.
A: This tool is also able to root some devices and do a backup. I imagine if it gets that far it can restore too.
Q: What is MTK Rom Studio?
A: A Windows app that will convert a "firmware.info" to a scatter.txt file too I think. (I haven't used it)
Q: Why would I want a *_scatter.txt file?
A: It contains the partition information for your device. This is something you need to feed SP Flash Tool so it can flash the bits in the right places. You can make one from a working device by dumping a "firmware.info" file with a tool like the gscript backup method or presumably MTK Droid Tools will build you one right off, I'm sure doing the same thing to get the data which is dumped to firmware.info.
Q: Can I brick my -F or -H?
A: Probably not. There is a Meta Mode that you can get into even if your PRELOADER is broken/overwritten. I verified this today by writing zeroes to the first 16K of flash, broke my -F, then wrote over a known good firmware. makbro believes it's unbrickable and also yuweng has good info: http://forum.xda-developers.com/showpost.php?p=34914486&postcount=3
Q: How do I get into Meta Mode?
A1: While plugged into PC... Hold down Reset, hold VolUp, release Reset, release VolUp
A2: While off... hold VolUp, plug into PC, release VolUp
A3: While off... hold Reset, plug into PC, hold VolUp, release Reset, release VolUp
Q: Can someone help me unbrick my tablet?
A: I haven't seen a bricked A2107A-* that I could not fix. Please post to the original Lenovo IdeaTab a2107 thread.
Q: How do I use SP Flash Tool?
A: I'd like to write a FAQ on it too since there are many pitfalls, but I fear I don't have enough time to do everything. For now, here is a tutorial: http://forum.xda-developers.com/showthread.php?t=1982587
Q: What should I know about SP Flash Tool?
A: SP Flash Tool allows you to read or write any chunk of nvram/flash. It's normal operation though is to load a *scatter.txt file which describes different image chunks and allows you to "download" (write) them to MTK devices. You can think of the NVRAM as a disk (block device) and this scatter file describing the sizes of PARTITIONS. I think in one error I ran across even says your PMT (partition table?) doesn't match. So the download will write blocks of your NVRAM from image files on your WIndows computer.
Q: When I try to Download (write) a scatter and set of image files to my tablet with SP Flash Tool, I get a PMT does not match. What is causing this?
A: Well, for some reason you have to "Format". Not only do the Format, but you must select "Whole Flash". (assuming this next part) Then it write the PMT to your tablet to match the scatter file you have loaded. At this point you can Download (write) successfully. You will want to have a good backup of your NVRAM block or /data/nvram directory first!
Q: What is a PMT?
A: A partition table that holds the addresses to all the other partitions. I believe the PMT block is created by SP Flash Tool dynamically from scatter file. It's comparing the scatter file with what is sitting at the PMT address on the flash. If these two mismatch, you get the error you mentioned. If you want to force a new PMT that matches your scatter file's layout, you have to do a "Format" in SP Flash Tool. This will get you back to a PMT on flash that matches your scatter file, then SP Flash Tool will be happy and allow you to use Download (write to flash). SPFT is very picky about the scatter file matching the PMT on flash, even the __NODL_ in the scatter has to match the PMT.
Q: How do I get into Factory Mode?
A: Turn Off completely. (no power from USB, you might even hit the reset button)
A: Press and hold Power On and VolUp for 12 sec
A: Observe a menu similar to recovery but with tests etc
Q: How do I get into Recovery Mode?
A: Turn Off completely. (no power from USB, you might even hit the reset button)
A: Press and hold Power On for 4 sec, release, then hold VolUp and VolDown at the same time for up to 10 sec
A: Observe the stock Recovery or CWM if you've replaced the stock
Q: Why is SP Flash Tool giving me errors?
A: SP Flash Tool is not quality software, IMHO. I've had it give me BROM ERROR:S_DL_GET_DRAM_SETTING_FAIL(5054))... over and over, then I exited out and got back into the program and flashing worked fine. Also, make sure you have PRELOADER etc files associated with the blocks even though you don't have them selected to Download/write to flash. For some reason, SPFT checks these things even if they are irrelevant.
Q: I don't have a scatter file, or I have an incorrect scatter file... how do I create one if my device won't boot?
A: Interestingly enough, SPFT reads the PMT during a Download/write. It puts all the values of the PMT in it's log file. You can go look at the log file and fix your scatter file. This is cheating... knowing exactly what your scatter file needs to look like to match your device.
Q: I renamed the scatter file from MT6575_Android_scatter_emmc.txt to my_failed_attempt_scatter.txt is that ok?
A: Obviously you didn't know to ask this question and it's just contrived.... but yes you just screwed up, the file name of the scatter matters. I hate this, I lost like 2 weeks to this. Don't rename it. I've found some names that work, but just don't go there, leave the name and organize things with directories instead of file names.
(Some dumb Questions I had early on... that didn't seem to be answered clearly)
Q: How do a SBF or ODIN a A2107A
A: MediaTek's method is through software called SP Flash Tool. This is similar in function to Motorola SBF or Samsung ODIN.
Q: How do I get into Fastboot?
A: I don't think you do on MTK devices.
Q: How do I boot into the Bootloader?
A: Not sure if they have a bootloader menu. I think this is irrelevant. After an OTA, I was never able to. But with all the methods of gaining root and flashing, I guess I don't see why you need it.
Q: Does this device have a locked bootloader? Can I unlock it?
A: I'm not sure. If it does, you could probably overwrite the bootloader easy enough. Can the stock bootloader boot a homebrewed kernel? So far, I have seen no one produce a homebrew kernel for either the -F or -H. Hacks come from the stock kernels or the Lenovo A750 phone.
Q: Can the A2107A run Cyanogenmod (CM9, CM10)?
A: No. Cyanogenmod may run on MTK (MediaTek) chips soon, but even after that it will be a bunch of work.
Q: Why do I want to root my device?
Q: How do I root my device?
Q: Why do I want to install a custom recovery like CMW (Clockwork Mod) Recovery?
Q: How do I install CWM?
<-- Click Thanks If you found the information here useful, please!

Backup / root / recovery
Lenovo IdeaTab A2107A -F -H Tablet FAQ
CONTINUED DETAILS!
(but applicable for MT65xx devices)
Backup -- Post 3
Root -- Post 4
Recovery -- Post 5

Topic #1 - Backup
Before you start rooting, I highly recommend getting a full dump of your ROM. And why not? MediaTek makes it easy! At the very least, get a dump of the NVRAM partition. And if you really want to be risky, you'll just get a copy of /data/nvram.
Why Backup?
* First, so you can get back to a factory state.
* This is really good if you return your device or have it serviced.
* It's also good if you are going to sell it.
* Last, if you break it (semi-brick it) you can go back to this known working state.
Methods:
* SP Flash Tool - covered here
* rua1's MKDRT MediaTek Droid Root Tool - covered elsewhere
* Mobile Uncle backup of MEI - may cover here soon
SP Flash Tool BACKUP
If you are big on making images of hard drives, your going to like this tool. But, SP Flash Tool has some bugs and is designed a bit weird.
There are 4 main features to be concerned about: "Format", "Download" (write partition blocks), "Read back" memory, "Write memory".
To backup, you really want to be using the Read memory tab of the interface. But first, you need to make the tool happy.
replaces http://forum.xda-developers.com/showthread.php?p=46595925
Perfect Total Backup of your Firmware
Here is a cookbook for doing a total backup of your MTK device with MediaTek's SP Flash Tool. No rooting, you might even do this before you ever boot! I have basically done this with both of my devices before I fiddled too much. I recommend doing it before you do anything really.
1. Install VCOM Drivers. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuUTFIT1J2eXNFd28
2. Install SP Flash Tool. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuVDluTXk4QXdQaUU
3. Grab a -H scatter file with accompanying block images, just to make SP Flash happy. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuM3lxakdIU2hvWTA
4. Run SP Flash Tool, Open Scatter File
5. Don't play with anything, go into the "Read back" tab (This will read your flash to a file on your PC)
6. Click on any items in the list, then click the "Remove" button
7. Now click the "Add" button
8. Double click on the "N/A" under Read Flag
9. Type a file name to write to, like "WHOLE_ROM"
10. Now it will popup a window "Readback block start address"
11. Leave "Hex" selected, Start Address" 0x0000, Length: 0x323E4000, Click OK
12. Click the "Read back" button
13. SPFT now waits for you to connect your device and put it in Meta Mode
14. Without plugging your tablet in, tap the Reset Button on the back under the camera
15. Hold VolUp, plug in USB, Release VolUp (putting it in Meta Mode) <--- Important
16. You will see the progress bar moving. Total backup takes forever, because in this mode SPFT seems to not do USB HIGHSPEED
That's IT! Go to bed, check on it in the morning.
If you ever restore, just go into Recovery and Wipe Data and Cache. (as these are large and we didn't back them up above)
Note: "Length" in Step 11 is extra long. If you have a 4 or 8GB model it actually backs up part of your cache partition block too. But this is the right length for the 16GB model and it doesn't hurt to backup too much.
(If anyone would like to share there's with me, that would be great. I only want stock dumps though, for comparison purposes.)

Topic #2 - Root
Note: MediaTek is very different as you have low level access to their Flash. Ask
yourself if you really need root. MediaTek's tool SP Flash Tool is very powerful. You can dump your stock rom, replace your recovery image, or blow on another SPFT ROM. So, unless you want your STOCK ROM ROOTED, you can probably skip rooting your stock ROM in the first place.
Why Root?
You have very little ability to do backups or change your device without rooting it. You can use vendor tools to do backup/restore of your user data, whatever they determine is your user data. You can use Android "Factory Reset" which just wipes the data and cache partitions. If you want to do more, you need to root.
More access like:
* Complete backups of ROM (although a bit sketchy to backup a running system)
* Install busybox
* Install apps requiring root, Root Explorer and WiFi sharing
* Install drivers, like OpenVPN, alternative wireless drivers, OTG, FM Radio?
* Install sshd server etc
* Do custom theming?
* Performance tweaks
* Remove APKs from /system/apps (scary)
Different Methods - I think all rely on the same mechanism
1. 4.03root.zip (requires working ADB and Windows)
2. setools/seroot (syserr's port of 4.03root.zip to linux shell, instead of .bat)
3. SRS Root (requires working ADB and Windows)
4. rua1's MKDRT MediaTek Droid Root Tool (requires working ADB and Windows)

Topic #3 - CWM (Clock Work Mod) Recovery
Why?
CWM Recovery is awesome. It allows you to install custom ROMs as long as they are "CWM" compatible. CWM Recovery is a lot like a typical stock Recovery but better. For new people, a Recovery is basically a minimal Android system that allows you to do maintenance on the device and reload etc the main operating system. On MTK devices the Recovery image sits on the RECOVERY partition. You usually press certain buttons early in the boot process to "boot into Recovery."
Different Methods
* SP Flash Tool
* MobileUncle (requires root)
* rua1's MKDRT MediaTek Droid Root Tool (requires root)
* dd / flash_image (requires root)
SP Flash Tool Method
Disconnect Tablet from PC
Run SP Flash Tool (exe)
Select Scatter File
Uncheck all block partition checkboxes except for Recovery.
Click on the Recovery text/tag and then find the CWM Recovery image you desire.
Select Download, SPFT waits for device
Hit reset on Tablet
Press VolUp, connect USB, Release VolUp (to get to Meta Mode)
SPFT ALWAYS finds device this way.
You should see progress bars moving, and it complete

lenovo s6000-h
hi syserr,
your reading was really interesting and help me a lot to better understand the device i just bought.
i think it's quit similar. I m looking/searching information as much as i can at the moment.
thks

fragargon said:
hi syserr,
your reading was really interesting and help me a lot to better understand the device i just bought.
i think it's quit similar. I m looking/searching information as much as i can at the moment.
thks
Click to expand...
Click to collapse
I get paid with "Thanks." So, thanks! :good:
I've often wondered if forums are the right structure to capture this information. When I finally decided to dive in deep, I had to make notes of which posts had good information - it took 3 days of solid reading to make sense of it all. There are plenty of posts that have incorrect information or irrelevant information.
Good luck.

I need some help!
Thank you for helping
But I can not I download:
S6000-H (16GB model, WiFi and 3G)
S6000_A422_000_015_130503_WW_SMS.rar - 495.90 MB
I have problems installing the program and set the theme on the device
I'm not familiar with these settings. Explain the preliminary
My device: S6000-H_A422_101_022_131101_WW_SMS
Put a new link for download. Please
Who can help????

Scatter file
syserr said:
Topic #1 - Backup
Before you start rooting, I highly recommend getting a full dump of your ROM. And why not? MediaTek makes it easy! At the very least, get a dump of the NVRAM partition. And if you really want to be risky, you'll just get a copy of /data/nvram.
Why Backup?
* First, so you can get back to a factory state.
* This is really good if you return your device or have it serviced.
* It's also good if you are going to sell it.
* Last, if you break it (semi-brick it) you can go back to this known working state.
Methods:
* SP Flash Tool - covered here
* rua1's MKDRT MediaTek Droid Root Tool - covered elsewhere
* Mobile Uncle backup of MEI - may cover here soon
SP Flash Tool BACKUP
If you are big on making images of hard drives, your going to like this tool. But, SP Flash Tool has some bugs and is designed a bit weird.
There are 4 main features to be concerned about: "Format", "Download" (write partition blocks), "Read back" memory, "Write memory".
To backup, you really want to be using the Read memory tab of the interface. But first, you need to make the tool happy.
replaces http://forum.xda-developers.com/showthread.php?p=46595925
Perfect Total Backup of your Firmware
Here is a cookbook for doing a total backup of your MTK device with MediaTek's SP Flash Tool. No rooting, you might even do this before you ever boot! I have basically done this with both of my devices before I fiddled too much. I recommend doing it before you do anything really.
1. Install VCOM Drivers. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuUTFIT1J2eXNFd28
2. Install SP Flash Tool. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuVDluTXk4QXdQaUU
3. Grab a -H scatter file with accompanying block images, just to make SP Flash happy. I'd use this: https://docs.google.com/file/d/0B8PcIZoLeGNuM3lxakdIU2hvWTA
4. Run SP Flash Tool, Open Scatter File
5. Don't play with anything, go into the "Read back" tab (This will read your flash to a file on your PC)
6. Click on any items in the list, then click the "Remove" button
7. Now click the "Add" button
8. Double click on the "N/A" under Read Flag
9. Type a file name to write to, like "WHOLE_ROM"
10. Now it will popup a window "Readback block start address"
11. Leave "Hex" selected, Start Address" 0x0000, Length: 0x323E4000, Click OK
12. Click the "Read back" button
13. SPFT now waits for you to connect your device and put it in Meta Mode
14. Without plugging your tablet in, tap the Reset Button on the back under the camera
15. Hold VolUp, plug in USB, Release VolUp (putting it in Meta Mode) <--- Important
16. You will see the progress bar moving. Total backup takes forever, because in this mode SPFT seems to not do USB HIGHSPEED
That's IT! Go to bed, check on it in the morning.
If you ever restore, just go into Recovery and Wipe Data and Cache. (as these are large and we didn't back them up above)
Note: "Length" in Step 11 is extra long. If you have a 4 or 8GB model it actually backs up part of your cache partition block too. But this is the right length for the 16GB model and it doesn't hurt to backup too much.
(If anyone would like to share there's with me, that would be great. I only want stock dumps though, for comparison purposes.)
Click to expand...
Click to collapse
I do not understand. How Lenght you have used : 0x323E4000
11. Leave "Hex" selected, Start Address" 0x0000, Length: 0x323E4000, Click OK
The scatter file, there is no partition at this address
Yours scatter file :
EBR2 0x23e0000
{
}
ANDROID 0x23e4000
{
}
CACHE 0x224e4000
{
}
USRDATA 0x425e4000
{
}
FAT 0x626e4000
{
}
__NODL_BMTPOOL 0xffffffffffff0050
{
}
I used to read back:
0x3c3c00000 + from firmware.info
0x00600000 = preloader
0x3c9c00000 – CACHE scatter file with MTKDroid

I used to read back:
0x3c3c00000 + from firmware.info
0x00600000 = preloader
0x3c9c00000 – CACHE scatter file with MTKDroid
Click to expand...
Click to collapse
when doing this with a hex calculator i got : 3C4200000 - check this wit a hex calculator

Explain how it is with hex
fragargon said:
when doing this with a hex calculator i got : 3C4200000 - check this wit a hex calculator
Click to expand...
Click to collapse
OK , OK I understand.
But the address you left partition to get 3C4200000 - cache or else.explain how
This is scater file: posted by you:
MT6575_Android_scatter_emmc
PRELOADER 0x0
{
}
DSP_BL 0x40000
{
}
MBR 0x600000
{
}
EBR1 0x604000
{
}
__NODL_PMT 0x660000
{
}
__NODL_NVRAM 0xa60000
{
}
__NODL_SECCFG 0xd60000
{
}
UBOOT 0xd80000
{
}
BOOTIMG 0xde0000
{
}
RECOVERY 0x13e0000
{
}
SEC_RO 0x19e0000
{
}
__NODL_MISC 0x1fe0000
{
}
LOGO 0x2040000
{
}
__NODL_EXPDB 0x2340000
{
}
EBR2 0x23e0000
{
}
ANDROID 0x23e4000
{
}
CACHE 0x224e4000
{
}
USRDATA 0x425e4000
{
}
FAT 0x626e4000
{
}
__NODL_BMTPOOL 0xffffffffffff0050
{
}

Alex1948 said:
OK , OK I understand.
But the address you left partition to get 3C4200000 - cache or else.explain how
Click to expand...
Click to collapse
this value 0x3C4200000 is the sum of=> 0x3C4200000 = 0x3c3c00000 (from firmware.info) + 0x00600000 (preloader)
Code:
partname size start adress map to
android 0x0000000040000000 0x0000000010980000 2 /dev/block/mmcblk0p6
cache 0x0000000007e00000 0x0000000050980000 2 /dev/block/mmcblk0p7
usrdata 0x0000000349fa0000 0x0000000058780000 2 /dev/block/mmcblk0p8
whilst this is not really friendly I'll try answer.
when hex number i advice you to use an hex calculator because this is 16 base not 10base that's why you would be better using a hex calculator.
this all about readback the memory for backup purpose so according to my file:
I do not understand. How Lenght you have used
Click to expand...
Click to collapse
take my file as example and i would bump the partition cache, i would do:
readback: start adress:0x0000000050980000
: size : 0x0000000007e00000 = 126 Mb
: lenght: 0x0000000050980000+0x0000000007e00000 = 0x0000000058780000 (end adress)
this should result by a file.img of 126Mb with by spft on readback memory starting adress at 0x0000000050980000 and ending at 0x0000000058780000.
you can see that this overlapted the next partition 0x0000000058780000 (userdata) so i bet that spft does this to not overlapted start adress of next partition:
0x0000000050980000+0x0000000007e00000-0x00000000000001=0x000000005877ffff
i hope this explanation is readable and will answer your question.

What Scatter file ?
fragargon said:
this value 0x3C4200000 is the sum of=> 0x3C4200000 = 0x3c3c00000 (from firmware.info) + 0x00600000 0x3c3c00000 (from firmware.info) + 0x00600000 (preloader)
Code:
partname size start adress map to
android 0x0000000040000000 0x0000000010980000 2 /dev/block/mmcblk0p6
cache 0x0000000007e00000 0x0000000050980000 2 /dev/block/mmcblk0p7
usrdata 0x0000000349fa0000 0x0000000058780000 2 /dev/block/mmcblk0p8
whilst this is not really friendly I'll try answer.
when hex number i advice you to use an hex calculator because this is 16 base not 10base that's why you would be better using a hex calculator.
this all about readback the memory for backup purpose so according to my file:
take my file as example and i would bump the partition cache, i would do:
readback: start adress:0x0000000050980000
: size : 0x0000000007e00000 = 126 Mb
: lenght: 0x0000000050980000+0x0000000007e00000 = 0x0000000058780000 (end adress)
this should result by a file.img of 126Mb with by spft on readback memory starting adress at 0x0000000050980000 and ending at 0x0000000058780000.
you can see that this overlapted the next partition 0x0000000058780000 (userdata) so i bet that spft does this to not overlapted start adress of next partition:
0x0000000050980000+0x0000000007e00000-0x00000000000001=0x000000005877ffff
i hope this explanation is readable and will answer your question.
Click to expand...
Click to collapse
My bewilderment came from that and MTKDroid do the same, add preloader - in my case CACHE : 0x3c3c00000 (from firmware.info) + 0x00600000(preloader) = 0x3C9C0000(that we used from READ BACK with SPFT).
I understand that the scatter file created with MTKDroid Tool is not good ???

Alex1948 said:
My bewilderment came from that and MTKDroid do the same, add preloader - in my case CACHE : 0x3c3c00000 (from firmware.info) + 0x00600000(preloader) = 0x3C9C0000(that we used from READ BACK with SPFT).
I understand that the scatter file created with MTKDroid Tool is not good ???
Click to expand...
Click to collapse
lol :silly:
sometimes you should read back what you wrote, i really don't understand what you mean but i am sure you are not reading what i have wrote because this
================+++>
============++>
=========+>
in my case CACHE : 0x3c3c00000 (from firmware.info) + 0x00600000(preloader) = 0x3C9C0000(that we used from READ BACK with SPFT).
Click to expand...
Click to collapse
i wish you a good night! :cyclops:

????
fragargon said:
lol :silly:
sometimes you should read back what you wrote, i really don't understand what you mean but i am sure you are not reading what i have wrote because this
================+++>
============++>
=========+>
i wish you a good night! :cyclops:
Click to expand...
Click to collapse
Please forgive me greatly.
I asked a simple question : if scatter file made ​​with MTKDroid TOOL is good or no , work or no.
So , good night !

fragargon said:
i hope this explanation is readable and will answer your question.
Click to expand...
Click to collapse
Thanks for trying to explain, it's appreciated!
Alex1948 said:
Please forgive me greatly.
I asked a simple question : if scatter file made ​​with MTKDroid TOOL is good or no , work or no.
So , good night !
Click to expand...
Click to collapse
I believe "MTK Droid Root & Tools" does give you a good scatter file, but I've actually never used it.
Background: During the time I used it, I had major problems with ADB drivers on Windows. I ended up soft-bricking my device by playing with the "Test" tab in SP Flash Tools. So when I came back to working on things again, with a new device to donate the ROM, I wanted to be absolutely sure I knew what I was doing. First thing was "Read back" the ENTIRE ROM of the new device. This is an insurance policy. I had made backups with the GScript mtk*backup.sh scripts that run ON the unit, so I never went back to MTK DRT.​Something I think everyone that wants to do HEX math should to is start playing with the python interpreter... it is AWESOME. :good:
Code:
$ more MT6575_Android_scatter_emmc.txt
....
ANDROID 0x123e4000
{
}
CACHE 0x324e4000
{
}
USRDATA 0x525e4000
{
}
FAT 0x726e4000
{
}
__NODL_BMTPOOL 0xffffffffffff0050
{
}
$ python
Python 2.7.3 (default, Sep 26 2013, 16:35:25)
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> hex(0x324e4000-0x123e4000)
'0x20100000'
Alex1948, if you are wondering why the length of my full/entire/whole dumps seems arbitrary... my answer is in some cases I was guessing at large enough numbers. My device (A2107A-*) has at least 5 different partitioning schemes from the factory. I want extra length, I didn't want to tell someone to read too short.
Why I am reading to the start address of CACHE is because that is the end of ANDROID. This is just looking at the physical real addresses in the scatter file. How those addresses are calculated from firmware.info/dumchar_info is a different story. I think you are aware of adding the 0x600000. This is only added to the lines in the file that are not preloader or dsp_bl:
Code:
$ more dumchar.txt
preloader 0x0000000000040000 0x0000000000000000 2 /dev/[B]misc[/B]-sd
dsp_bl 0x00000000005c0000 0x0000000000040000 2 /dev/misc-sd
mbr 0x0000000000004000 0x0000000000000000 2 /dev/[B]block[/B]/mmcblk0
ebr1 0x000000000005c000 0x0000000000004000 2 /dev/block/mmcblk0p1
pmt 0x0000000000400000 0x0000000000060000 2 /dev/block/mmcblk0
nvram 0x0000000000300000 0x0000000000460000 2 /dev/block/mmcblk0
seccfg 0x0000000000020000 0x0000000000760000 2 /dev/block/mmcblk0
uboot 0x0000000000060000 0x0000000000780000 2 /dev/block/mmcblk0
bootimg 0x0000000000600000 0x00000000007e0000 2 /dev/block/mmcblk0
recovery 0x0000000000600000 0x0000000000de0000 2 /dev/block/mmcblk0
sec_ro 0x0000000000600000 0x00000000013e0000 2 /dev/block/mmcblk0p5
misc 0x0000000000060000 0x00000000019e0000 2 /dev/block/mmcblk0
logo 0x0000000000300000 0x0000000001a40000 2 /dev/block/mmcblk0
expdb 0x00000000000a0000 0x0000000001d40000 2 /dev/block/mmcblk0
ebr2 0x0000000000004000 0x0000000001de0000 2 /dev/block/mmcblk0
fac 0x0000000010000000 0x0000000001de4000 2 /dev/block/mmcblk0p6
android 0x0000000020100000 0x0000000011de4000 2 /dev/block/mmcblk0p7
cache 0x0000000020100000 0x0000000031ee4000 2 /dev/block/mmcblk0p2
usrdata 0x0000000020100000 0x0000000051fe4000 2 /dev/block/mmcblk0p3
fat 0x00000000762fc000 0x00000000720e4000 2 /dev/block/mmcblk0p4
bmtpool 0x0000000000a00000 0xffffffffff9f0050 2 /dev/block/mmcblk0
So my code here:
Code:
if block != 'misc':
start = start + 0x600000
Is only adding the offset to the partitions that don't have that "misc" in their block device name.
I'm explaining a lot. I'm hoping somewhere in this you have the answer you are looking for.
We should have discussed this here:
[GUIDE][UTIL][MT65xx] Create Scatter File and Dump Full ROM
http://forum.xda-developers.com/showthread.php?p=47809842

Tks
syserr said:
Thanks for trying to explain, it's appreciated!
I believe "MTK Droid Root & Tools" does give you a good scatter file, but I've actually never used it.
Background: During the time I used it, I had major problems with ADB drivers on Windows. I ended up soft-bricking my device by playing with the "Test" tab in SP Flash Tools. So when I came back to working on things again, with a new device to donate the ROM, I wanted to be absolutely sure I knew what I was doing. First thing was "Read back" the ENTIRE ROM of the new device. This is an insurance policy. I had made backups with the GScript mtk*backup.sh scripts that run ON the unit, so I never went back to MTK DRT.​Something I think everyone that wants to do HEX math should to is start playing with the python interpreter... it is AWESOME. :good:
Code:
$ more MT6575_Android_scatter_emmc.txt
....
ANDROID 0x123e4000
{
}
CACHE 0x324e4000
{
}
USRDATA 0x525e4000
{
}
FAT 0x726e4000
{
}
__NODL_BMTPOOL 0xffffffffffff0050
{
}
$ python
Python 2.7.3 (default, Sep 26 2013, 16:35:25)
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> hex(0x324e4000-0x123e4000)
'0x201000000'
Alex1948, if you are wondering why the length of my full/entire/whole dumps seems arbitrary... my answer is in some cases I was guessing at large enough numbers. My device (A2107A-*) has at least 5 different partitioning schemes from the factory. I want extra length, I didn't want to tell someone to read too short.
Why I am reading to the start address of CACHE is because that is the end of ANDROID. This is just looking at the physical real addresses in the scatter file. How those addresses are calculated from firmware.info/dumchar_info is a different story. I think you are aware of adding the 0x600000. This is only added to the lines in the file that are not preloader or dsp_bl:
Code:
$ more dumchar.txt
preloader 0x0000000000040000 0x0000000000000000 2 /dev/[B]misc[/B]-sd
dsp_bl 0x00000000005c0000 0x0000000000040000 2 /dev/misc-sd
mbr 0x0000000000004000 0x0000000000000000 2 /dev/[B]block[/B]/mmcblk0
ebr1 0x000000000005c000 0x0000000000004000 2 /dev/block/mmcblk0p1
pmt 0x0000000000400000 0x0000000000060000 2 /dev/block/mmcblk0
nvram 0x0000000000300000 0x0000000000460000 2 /dev/block/mmcblk0
seccfg 0x0000000000020000 0x0000000000760000 2 /dev/block/mmcblk0
uboot 0x0000000000060000 0x0000000000780000 2 /dev/block/mmcblk0
bootimg 0x0000000000600000 0x00000000007e0000 2 /dev/block/mmcblk0
recovery 0x0000000000600000 0x0000000000de0000 2 /dev/block/mmcblk0
sec_ro 0x0000000000600000 0x00000000013e0000 2 /dev/block/mmcblk0p5
misc 0x0000000000060000 0x00000000019e0000 2 /dev/block/mmcblk0
logo 0x0000000000300000 0x0000000001a40000 2 /dev/block/mmcblk0
expdb 0x00000000000a0000 0x0000000001d40000 2 /dev/block/mmcblk0
ebr2 0x0000000000004000 0x0000000001de0000 2 /dev/block/mmcblk0
fac 0x0000000010000000 0x0000000001de4000 2 /dev/block/mmcblk0p6
android 0x0000000020100000 0x0000000011de4000 2 /dev/block/mmcblk0p7
cache 0x0000000020100000 0x0000000031ee4000 2 /dev/block/mmcblk0p2
usrdata 0x0000000020100000 0x0000000051fe4000 2 /dev/block/mmcblk0p3
fat 0x00000000762fc000 0x00000000720e4000 2 /dev/block/mmcblk0p4
bmtpool 0x0000000000a00000 0xffffffffff9f0050 2 /dev/block/mmcblk0
So my code here:
Code:
if block != 'misc':
start = start + 0x600000
Is only adding the offset to the partitions that don't have that "misc" in their block device name.
I'm explaining a lot. I'm hoping somewhere in this you have the answer you are looking for.
We should have discussed this here:
[GUIDE][UTIL][MT65xx] Create Scatter File and Dump Full ROM
http://forum.xda-developers.com/showthread.php?p=47809842
Click to expand...
Click to collapse
Thank you very much.I understand something.and conversely :ANDROID 0x123e4000+0x20100000(lenght) = CACHE 0x324e4000
I wrote on the other thread

A3000 hardware
Just a note, in Europe and likely in Asian the A3000 SIM version is dual SIM, organised much the same as the A2107A. One SIM is expected to be used for data (HSDP+, this is the European high speed 3G, up to 42mbs, I get 18mbs off my local tower) and one for SMS and Voice. You can run SMS on the Data SIM if you are provisioned, I do. The European firmware does not support GSM voice (again) but Asian and Middle Eastern does. Why Lenovo does not include voice support in the European firmware is a mystery.
Many thanks for the A2107A FAQ, I'm selling one now, replaced by a A3000.

Not create worry... but I have a very cheap ($75 sale) Lenovo A1000 coming. This has JB, FM Radio, and dual-core. This is going to work out better for a in-dash car system.

Partitioning 16 GB A2107A-H
Does anyone please have an EBR1 and EBR2 (or other means) by which I can repartition my internal SD flash so that the system and other partitions are larger?
I have read about an apk to do this for the 4 GB model, and also the limitation to one of the partitions (32-bit addressing?) to 2 GB, but have not found anything available for the 16 GB model.
Could anyone please advise and/or upload the necessary files?
Also, does anyone have a view on the "best" ROM? It seems all have compromises in some way, including the stock ROM. Pemergency looks good unless someone tells me otherwise.

[Official] Acer Liquid E3 / E380 / ALE3

Hackwerk's Acer Liquid E3 (E380) / ALE3 Topic
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Made by Hackwerk: Feel totally free to press the Thanks button if you like my work. Took a lot of my time!
Post simple/stupid/IDoNotUnderstand questions in the Q&A subthread (button under thread title) please!
-- THIS TOPIC IS NO LONGER FREQUENTLY UPDATED --
Specifications / Features / Hardware
Full specs (and E3/E380 vs E2/V370) at GSMArena
Model / Name: E380 / Acer Liquid E3 (Duo / Single / Duo PLUS) or "ALE3"
SKU/EAN/UPC: HM.HDZEE.004.412EF4E96413 (Duo, black) / 4713147308262 / 887899533860
(HM.HE2EE.002 = Duo, titanium gold / HM.HE0EE.001 = Single, black / HM.HE1EE.001 = Single, titanium gold / HM.HE3EG.001 = Duo PLUS, black)
CPU/GPU: Mediatek MT6589 1.2GHz Quad-core Cortex-A7 / PowerVR SGX544
ROM/RAM: 4GB (or 16GB in PLUS) / 1GB (or 2GB in PLUS)
Screen: 4.7" IPS LCD, 720 x 1280, 16M (part 6M.HDZH7.001)
Camera back/front: 13MP, 4160 x 3120 (flash, autofocus) / 2MP (flash)
Battery: Model BAT-A10 (1ICP4/58/71), Cell PGF355870HT (Samsung)("Fixed", Li-Polymer, 2000mAh, 3.8V)
Other: MicroSD (to 32GB), Dual (Duo) or Single SIM, a-GPS, DTS Sound (Optional NFC (in PLUS?))
Dimensions: 138x69x9 mm (5.35x2.68x 0.35 inch), 135 g (4.73 oz)
Firmware / Software
Firmware: Android 4.4.2 KitKat (original Android 4.2.2 (Jelly Bean))
Kernel: 3.4.67 [email protected] #1 (20140925)(custom kernels made by cyclon1978!)(cyclon1978 custom kernel with inverted Y-ax for replacement screens)
Build: Acer_AV0K0_E380_1.018.00_EMEA_GEN1 (KOT49H)
Radio/band: MOLY.WR8.W1248.MD.WG.MP.V44.P10 (20140909)(APN 2.094)
Recovery: CWM 6.0.5.0 for E380 by vache -hold Volume Up while powering on-
Acer update history / Changelog
French version of the changelogs by Shreps can be found here at the Acer Club (.fr).
WARNING: When updating root will be removed & recovery/bootlogo/bootanimation will be reset to stock! You can easily restore root by our flash method and restore Link2SD apps etc!
Update 2014-04-11
Build: > Acer_AV052_E380_1.012.00_EMEA_GEN1
APN: > 2.062
Apps: Not checked
Fixes: Unknown
Update 2014-06-06
Kernel: 3.4.5 st3@st3-server #1 (20140530)
Build: > Acer_AV052_E380_1.016.00_EMEA_GEN1
Radio: > MOLY.WR8.W1248.MD.WG.MP.V5.P51 (20140424)
APN: > 2.076
Apps: Google Maps, Acer Customer Experience, ALU, Quick mode, Snapnote, Nidus, Live screen, Swype, Touch Panel FW, Google GMS R6 etc?
Fixes: (thanks to Shreps)
Camera focus a little better. (Totally fixed & fast in latest KitKat update (RC18))
GPS a little better. (Totally fixed & very fast and accurate in latest KitKat update (RC18))
Improve power consumption.
Camera shutter sound – set off as default.
Disable vibrator when taking picture.
Long press menu key to launch setting menu.
Disable hall sensor if flip UI is disabled.
Improve Acer RAPID function.
Improve Float APP performance.
Animation scale change to 0.5x
Battery warning message incorrect (user is asked to remove the battery).
Bluetooth connection dropping issue with BMW series 1 carkit.
Beta/RC 10 (635439223707245731) (thanks to vache)
Android: 4.4.2 KitKat (RC10)
Kernel: 3.4.67 [email protected] 20140813 st3.1407926371
Build: Acer_AV0K0_E380_1.010.00_EMEA_GEN1 (KOT49H)
Radio: MOLY.WR8.W1248.MD.WG.MP.V44.P8 (20140811)
APN: 2.089
Beta/RC 14 (635451389186094510) (thanks to vache)
Android: 4.4.2 KitKat (RC14)
Kernel: 3.4.67 [email protected] 20140828 st3.1409221923
Build: Acer_AV0K0_E380_1.014.00_EMEA_GEN1 (KOT49H)
Radio: MOLY.WR8.W1248.MD.WG.MP.V44.P8 (20140811)
APN: 2.0.93
RC 17 (635464579241492804) (thanks to Shreps)
Android: 4.4.2 KitKat (RC17)
Kernel: 3.4.67 [email protected] 20140915 st3.1410756057
Build: Acer_AV0K0_E380_1.017.00_EMEA_GEN1 (KOT49H)
Radio: MOLY.WR8.W1248.MD.WG.MP.V44.P10 (20140909)
APN: 2.0.93
Update 2014-10-07: Acer KitKat Update (RC18)(635475739172038202)(OLD LINK)
Android: 4.4.2 KitKat (RC18)
Kernel: 3.4.67 [email protected] #1 20140925
Build: Acer_AV0K0_E380_1.018.00_EMEA_GEN1 (KOT49H)
Radio: MOLY.WR8.W1248.MD.WG.MP.V44.P10 (20140909)
APN: 2.0.94
Fixes:
GPS is fixed and now very fast and very accurate!
Camera (focus) is fixed and now fast and sharp!
Google Play Store icons (black background when transparant) is fixed.
?
Update 2015-01-28: Final Acer KitKat Update (RC19)(635580282980063641)
Android: 4.4.2 KitKat (Final)(RC19)
Kernel: ?
Build: Acer_AV0K0_E380_1.004.00_EMEA_GEN1s_A44K_A (KOT49H)
Radio: ?
APN: ?
Fixes:
?
Official
The following are official Acer pages/links, but content IS different on all other languages/regions (so try others)!
Support pages (drivers/manuals/source): NL, Global/US.
USB Driver v1.0 AV052 (2014-03-27) (does NOT work with tools (flashing and dumping etc), as you need PDAnet or VCOM drivers for that (see ROM Dump section))
Kernel Sources v20150126 (4.4.2)
Kernel Sources v20150126 (4.2.2)
Manual (ENG)(Duo) (for other manuals follow 1st link)
Acer Club (FR) Forums (semi-official)
ROM Dump / Partitions / Scatter
When stuck / frozen on boot (bootloop) you can always reset by holding Volume Up & Power for over 12 sec!
Carlivs Tutorial is another good, clear and complete overview of all this!
You CAN NOT dump/read your phone with the official Acer drivers (no virtual COM port)!
I now succesfully used PDANet (See Tools / Drivers), but a lot of people seem to use the VCOM drivers (MT6589 VCOM, MTK Preloader etc.
The only tool (see Tools section) working after a lot of trying (!) for me was (old) SP Flash Tool 3.1344, and sometimes the newest 3.1408, both icw MTK Droid 2.5.3!
Read these 5 great (similar) ROM dump / flash tutorials (or read this tutorial about Android partitions):
Tutorial 1
Tutorial 2
Tutorial 3
Tutorial 4
Tutorial 5
-- SEE POST ATTACHMENT FOR CURRENT SCATTER FILE --
In this table you find the partition name (all EMMC) (as found in the scatter file attached to this post, probably made by MTK Droid Root & Tools (see Tools section)), then the start adress and then the length, all in hex.
(This could also be done by connecting to phone (with USB Debug on) and using ADB: "adb shell cat /proc/dumchar_info")
PRELOADER
0x0 0xc00000
MBR
0xc00000 0x80000
EBR1
0xc80000 0x80000
__NODL_PMT
0xd00000 0x400000
__NODL_PRO_INFO
0x1100000 0x300000
__NODL_NVRAM
0x1400000 0x500000
__NODL_PROTECT_F (EXT4 mount as /protect_f)
0x1900000 0x400000 (or 0xA00000?!)
__NODL_PROTECT_S (EXT4 mount as /protect_s)
0x2300000 0xA00000
__NODL_SECCFG
0x2d00000 0x20000
UBOOT
0x2d20000 0x60000
BOOTIMG
0x2d80000 0x600000
RECOVERY
0x3380000 0x600000
SEC_RO
0x3980000 0x600000
__NODL_MISC
0x3f80000 0x80000
LOGO
0x4000000 0x300000
__NODL_EXPDB
0x4300000 0xA00000
ANDROID (EXT4 mount as /system)
0x4d00000 0x3E800000
CACHE (EXT4 mount as /cache)
0x43500000 0x7E00000
USRDATA (EXT4 mount as /data)(can not read it in SP Flash Tool, because "length does not allign"?!)
0x4b300000 0xB4CF00A8
__NODL_BMTPOOL (can not read it in SP Flash Tool, because "length does not allign"?!)
0xffff00a8 0x1500000
ROM Installing / Updating
Basic instructions to update your phone (if not automatically Over The Air (OTA)) with a ROM ZIP using a recovery:
If you have the SP Flash Tool (see Tools), make a backup with that too
Install CWM (or any other custom recovery like Carliv's CTR or TWRP if available for E380)(see Root by Flash)
Download and unzip the ROM update (see Acer Update History and watch new posts)
Copy the FixPack-B.zip to SD card
(Re)Boot into recovery
Make a full backup in recovery (to SD)
Flash the FixPack-B.zip from recovery
Reboot & enjoy the new ROM / updated Android!
Root by flash (preferred method)
WARNING: USE AT YOUR OWN RISK, THIS CAN BE DIFFICULT OR EVEN DANGEROUS!!!
When stuck / frozen on boot (bootloop) you can always reset by holding Volume Up & Power for over 12 sec!
Carlivs Tutorial is another good, clear and complete overview of all this!
Steps 0-4 are to be found explained more thouroughly and with images, in the tutorials in the ROM Dump section. Read them. Read them well!
All tools can be found in the Tools section.
Also, a short (better?) version by Shreps can be found here (or check this ChinaPhoneArena one).
0) Install drivers (see Tools) with a good USB virtual COM port emulation! Most simple is to install PDANet maybe, but lot of people seem to use so called VCOM drivers / MT6589 VCOM / MTK Preloader etc. Other option is the MTK USB All Developer drivers. Make sure connection is OK, and MTK Droid works (when phone is on)!
1) Create scatter file or use the one attached to this post.
2) Read back (stock) recovery (or all) partitions with (old) SP Flash Tool 3.1344 using scatter from 1, or download my stock recovery img here.
3) Download CWM 6.0.5.0 by vache or Carliv Touch Recovery CTR (2.7 for JB, 3.0 for KK) (thanks to vache/Shreps for CWM, thanks to Carliv for CTR!)(or make your own by MTK Droid altering stock recovery image);
4) "Download" (to phone) the custom recovery with (old) SP Flash Tool 3.1344 using scatter from 1, or use mine.
5a) Copy SuperSU zip to SD card, and boot your phone into CWM/Carliv recovery (hold volume up and turn phone on), and then Install zip from SD > install SuperSU.
5b) Te keep your custom CWM: Install SuperSU immediately after boot, and use File / Root Explorer to delete file ".. recovery .." in System folder before booting again!
6) YOU ARE ROOTED!
7) Install BusyBox (see Tools section)
WARNING: USE AT YOUR OWN RISK, THIS CAN BE DIFFICULT OR EVEN DANGEROUS!!!
Root by app
WARNING: ALL METHODS AT YOUR OWN RISK (NOT TROJAN OR MAL-/SPYWARE CHECKED)!!!
You can always first check the Lifehacker Always Actual Root Guide.
Working (confirmed):
Kingo Root APK / 1.5.1.2996 PC
May be working / Not tested:
KingRoot 5.1.0 APK / 3.5.0.1157 PC (MAY BE UNSAFE)
iRoot 3.3.6 APK / 1.8.8 PC by XINYI Network / Mgyun (formerly VRoot)(WORKING BEFORE UPDATE TO KITKAT!)
Root Genius 2.2.84 APK / 3.1.7 PC by Shuame
Baidu Root / MROOT
Voodoo OTA Rootkeeper 2.0.3 (protects root on rooted phones)(WORKING BEFORE UPDATE TO KITKAT!) (Or use SuperSU Pro (paid)!)
NOT (yet) working (anymore)(confirmed):
Please message me your own test results and additions!!!
WARNING: ALL METHODS AT YOUR OWN RISK (NOT TROJAN OR MAL-/SPYWARE CHECKED)!!!
Developing / Custom ROM's
MyROM (4.0.037)(just search thread for newer!) by our friend cyclon1978 (Best rated custom ROM yet!)
CyanogenMod 10.1 for E3 (ported from UMI X2)!
MIUI v6 for E380 by Kenji Zefaneo Hanson, now at version 4.12.28!
MIUI v5 for ALE3 by Artha Bedul, now at version 4.8.29!
EMUI by Artha Bedul, now at version 3.0 R2!
Lollitop version 2 by Awand Mbengi (4.4.2 so only cosmetic 5.01!)
LEWA for E380 by Artha Bedul;
Androium 4.2.0 for E3 by Matx;
4PDA (Russian) thread with customs like MIUI4 and Sony Xperia C (AT YOUR OWN RISK);
FrAndroid (French) thread with customs (cosmetic/themed) (AT YOUR OWN RISK);
Your custom ROM for the E3 here soon?
Kernel sources in the Official section!!!
Tools / Drivers / Fixes / Hacks
Kernel sources can be found in the Official section!!!
Drivers
Google 'Naked' Drivers (see next subsection or Google them)
MTK USB All developer drivers (0.9.2 / 9.2.1)(WATCH OUT FOR VIRUSSES/TROJANS!)
PDANet (4.19)
Google for VCOM drivers / MT6589 VCOM / MTK Preloader etc. (All the same old v 1.1123.0)
Official Acer drivers (see link in first part of post)(probably wont always work, so deinstall or do not use those!)
Google Tools (ADB, Fastboot & Google Naked Drivers
Minimal ADB & Fastboot (1.4.2)(ADB, Fastboot)
15 Seconds ADB Installer (1.4.3)(ADB, Fastboot & Drivers)
Official Google Android SDK (r25.2.3)(Choose "Command line tools only")(ADB, Fastboot & Drivers etc. etc.)(Tutorial here)
Tools
MTK2000 is a great MediaTek-hack site with frequent updates of SP/MTK Flash Tool and MUCH more for MTK!
----- MediaTek Tools -----
SP Flash Tool / Smart Phone Flash Tool (v(5.)1708)(MT65xx)(now also Linux!)(First try 3.1344 or older!)
MTK Flash Tool (v5.1624.00)(MT62xx)
MTK Droid Root & Tools (2.5.3)(create scatter (datamap) file, flash etc.)
MTK Rom Studio (1.1.77.301)(by Linerty)(please use Google)
Multiple MTK (Engineer) Apps / Tools on Google Play
----- Universal Tools -----
Google Apps (Open GApps) packages
Xposed Framework (2.7 for KK)(higher/newest versions for newer custom Android ROMs)
SuperSU (2.79)(Download the ZIP and install ZIP from from sdcard in CWM to root)
BusyBox (49)
Titanium Backup (8.0.0)(backup/restore, and remove or move apps, also system apps)
FDroid App Market (non Google approved Apps, like AdAway add blocker!)(COULD BE DANGEROUS)
Fixes
No current fixes, as all big problems seem fixed in KitKat (RC19)(see Updates section)...
PS. cyclon1978 custom kernel with inverted Y-ax for replacement screens in first part of this post!
Hacks
A MEGA load of hacks/mods available in Xposed Framework, so install it and look for Xposed Modules doing what you want!
Change IMEI of Phone 1 or Phone 2 easily with lots of MTK apps from Google Play store! WARNING: MAY BE VERY ILLEGAL IN YOUR COUNTRY! (Is NOT in mine, NL)
To boot into recovery/fastboot mode, hold Volume Up while powering device on.
To boot into Factory (Test) mode, hold Volume Down while powering device on.
To make Acer's drivers also recovery/fastboot compatible, add this line to your "android_winusb.inf" files in the maps in submap "drivers" (and then install/update drivers in Windows Device Manager): %SingleAdbInterface% = USB_Install, USB\VID_0BB4&PID_0C01
Repartition and extend space to SD with Meteos App here or here (root required)(more partition info here)(not tested yet)
Use external SD for apps with the famous INT2EXT script or check all options like App2SD, Mount2SD, Data2SD etc
PS. cyclon1978 custom kernel with inverted Y-ax for replacement screens in first part of this post!
More?
-- THIS TOPIC IS NO LONGER FREQUENTLY UPDATED --
Made by Hackwerk: Feel totally free to press the Thanks button if you like my work. Took a lot of my time!
Post simple/stupid/IDoNotUnderstand questions in the Q&A subthread (button under thread title) please!
Special thanks for testing and assisting me go to (random order):
Carliv (Touch Recovery), tiliarou, d3nnisd, Dakloos88, Shreps, vache, cyclon1978

I've managed to make a backup using MTK droid and root tool. hackwerk, it seems you are getting ahead of me now can you post your recovery if it's working ? thanks !
Is it safe to install and activate Xposed framework on the E3 ?
I got a notification today about a 8.23 Mb update ! But there is no changelog anywhere and I don't want to install it yet...
Anyone got it ?

tiliarou said:
I've managed to make a backup using MTK droid and root tool. hackwerk, it seems you are getting ahead of me now can you post your recovery if it's working ? thanks !
Is it safe to install and activate Xposed framework on the E3 ?
I got a notification today about a 8.23 Mb update ! But there is no changelog anywhere and I don't want to install it yet...
Anyone got it ?
Click to expand...
Click to collapse
Yes I already have a datamap / scatter file (from MTK Droid) and used it succesfully to dump / backup all blocks to images (recovery.img boot.img android.img etc) on my non-rooted phone! (however USERDATA block fails in SP Flash Tool, and I do not know the end address of the ROM thus cannot dump the last block (__NODL_BMTPOOL))
Made a CWM custom recovery with the Official CWM Builder online, but the new output recovery was larger than my stock input one!?
Big problem for now, as I cannot fit it in the current recovery space?!
Xposed I do not know? However I strongly advise everyone NOT to install / run programs or apps or packages etc which are not on XDA or are closed source! There's a LOT of virussing / spying / trojanning going on in this world.
The official Acer update is only (as far as I found out);
1) Update of the build from Acer_AV052_E380_1.007.00_EMEA_GEN1 > Acer_AV052_E380_1.012.00_EMEA_GEN1
2) Update of the APN version from APN 2.053 > APN 2.062
I colored the 2 changes green in my FP.
So just do it, its fine I guess, and we will get Android 4.4 Kit Kat soon anyways...

Ok, and do you think that with root I would be able to retrieve this last block ?
I can confirm that even after reboot the root is there ! I used Voodoo OTA rootkeeper to make the OTA update, just to be safe and it managed after 2 restores to put back root. I don't know if it was needed.
I don't see any change with this update, just a traduction error corrected in the settings menu (flip cover wake up)...
Would be nice to have a changelog from Acer just to know !
I can also confirm that Xposed Framework is perfectly working on this phone.

tiliarou said:
Ok, and do you think that with root I would be able to retrieve this last block ?
I can confirm that even after reboot the root is there ! I used Voodoo OTA rootkeeper to make the OTA update, just to be safe and it managed after 2 restores to put back root. I don't know if it was needed.
I don't see any change with this update, just a traduction error corrected in the settings menu (flip cover wake up)...
Would be nice to have a changelog from Acer just to know !
I can also confirm that Xposed Framework is perfectly working on this phone.
Click to expand...
Click to collapse
Size of the last 2 partitions is now known and added but the reason it cannot be read by SP Flash Tool is that the sizes are not a multiple of 512 or so!?
Yeah baby! Great news!
I managed to install the ClockworkMod Recovery (rua1 autoCWM 5.5.0.4) made by the MTK Droid Root & Tool, and Downloading it to my phone in the older SP Flash Tool 3.1344!
After that of course installed SuperSU and we are ROOT, by a simpel/safe/clean method!
Links and stuff are in the first post.
Problems/ToDo now:
1) This CWM is removed after a normal (re)boot and replaced by the stock one (Android system recovery 3e). How!? And how to stop this?!
2) Newer CWM (6.0.4.7) like the one the online CWM Builder makes for me (altering my stock image) seems to big for the partition
3) Custom ROM making (CyanogenMod!!!), but let's wait for 4.4 Kit Kat and the sources of that, which will be available in the next months.

Data to Ext SD
We need to extend space to our external SD card, as the internal phone memory is not huge.
However I really really cannot see all differences with pro's and con's anymore between all options, so please help me!
What should we do, with this rooted stock Acer ROM (Android 4.2.2)(with EXT4 partitions and CWM recovery)?
1) Use one of the famous scripts INT2EXT, Data2EXT/D2EXT, Mount2SD/M2SD, Apps2SD/A2SD etc. etc.
1b) For INT2EXT we need Init.d support, so whats the best way to add that? An App like Init.d Toggler or Universal Init.d or so? (4.4 support would be nice!)
2) Just use simple symlinks with Link2SD/L2SD or Apps like FolderMount etc
3) Repartition and make data partition on SD, using Meteos etc
4) Use one of the many Apps to move Apps, like Titanium Backup etc.
What CAN, and SHOULD we try/use? Please advise me?

Have you already seen this behaviour of a custom recovery reverting back to stock after reboot ?
I've always used link2sd with my previous phone, so far I put my apps on sd using the android built-in option on my E3, because I haven't reached the internal storage limit yet...
Are we only 2 having this phone ?^^

tiliarou said:
Have you already seen this behaviour of a custom recovery reverting back to stock after reboot ?
I've always used link2sd with my previous phone, so far I put my apps on sd using the android built-in option on my E3, because I haven't reached the internal storage limit yet...
Are we only 2 having this phone ?^^
Click to expand...
Click to collapse
From what I can see now, you should install SuperSU immediately the first time in CWM, and THEN reboot. SuperSU asks for permission for Acer system update and you should deny that. CWM will then stay. However, you could also update (to 4.4 later) and then flash the CWM again of course.
Yeah the phone is JUST released, so we are the first. Probably some more people will join in the next months!

hackwerk said:
Hackwerk's Acer Liquid E3 (E380) / ALE3 Topic
Specifications / Features / Hardware
Full specs (and E3/E380 vs E2/V370) at GSMArena
Model / Name: E380 / Acer Liquid E3 (Duo) or "ALE3"
SKU/EAN/UPC: HM.HDZEE.004.412EF4E96413 (Duo, Black) / 4713147308262 / 887899533860
(HM.HE2EE.002 = Duo in Silver / HM.HE0EE.001 = Single in black / HM.HE1EE.001 = Single in silver)
CPU/GPU: Mediatek MT6589 1.2GHz Quad-core Cortex-A7 / PowerVR SGX544
ROM/RAM: 4GB (or 16GB) / 1GB (or 2GB)
Screen: 4.7" IPS LCD, 720 x 1280, 16M
Camera back/front: 13MP, 4160 x 3120 (flash, autofocus) / 2MP (flash)
Other: Li-Po 2000mAh battery (fixed), MicroSD (to 32GB), Dual (Duo) or Single SIM, a-GPS, DTS Sound, Optional NFC
Dimensions: 138x69x9 mm (5.35x2.68x 0.35 inch), 135 g (4.73 oz)
Firmware / Software
Firmware: Android 4.2.2 (Jelly Bean)(4.4 Kit Kat available 2014 Q2)
Kernel: 3.4.5 [email protected] #1 (20140227)
Build: Acer_AV052_E380_1.012.00_EMEA_GEN1
Radio/band: MOLY.WR8.W1248.MD.WG.MP.V5.P47 (20140226)(APN 2.062)
Recovery: rua1 autoCWM 5.5.0.4 for E380 (custom by MTK Droid, see Tools section)(stock: Android system recovery 3e)(hold Volume Up while powering on)
ROM Dump / Partitions / Scatter
You CAN NOT dump/read your phone with the official Acer drivers (no virtual COM port)!
I now succesfully used PDANet (drivers), but a lot of people seem to use the VCOM drivers (MT6589 VCOM, MTK Preloader etc.: All the same old v 1.1123.0).
The only tool (see Tools section) working after a lot of trying (!) for me was (old) SP Flash Tool 3.1344, and sometimes the newest 3.1408, both icw MTK Droid 2.5.3!
Read these 5 great (similar) ROM dump / flash tutorials:
Tutorial 1
Tutorial 2
Tutorial 3
Tutorial 4
Tutorial 5
In this table you find the partition name (as found in my created scatter file made by MTK Droid Root & Tools (see Tools section)), then the start adress and then the length, all in hex.
PRELOADER
0x0 0xc00000
MBR
0xc00000 0x80000
EBR1
0xc80000 0x80000
__NODL_PMT
0xd00000 0x400000
__NODL_PRO_INFO
0x1100000 0x300000
__NODL_NVRAM
0x1400000 0x500000
__NODL_PROTECT_F (EXT4 mount as /protect_f)
0x1900000 0x400000
__NODL_PROTECT_S (EXT4 mount as /protect_s)
0x2300000 0xA00000
__NODL_SECCFG
0x2d00000 0x20000
UBOOT
0x2d20000 0x60000
BOOTIMG
0x2d80000 0x600000
RECOVERY
0x3380000 0x600000
SEC_RO
0x3980000 0x600000
__NODL_MISC
0x3f80000 0x80000
LOGO
0x4000000 0x300000
__NODL_EXPDB
0x4300000 0xA00000
ANDROID (EXT4 mount as /system)
0x4d00000 0x3E800000
CACHE (EXT4 mount as /cache)
0x43500000 0x7E00000
USRDATA (EXT4 mount as /data)(can not read it in SP Flash Tool, because "length does not allign"?!)
0x4b300000 0xB4CF00A8
__NODL_BMTPOOL (can not read it in SP Flash Tool, because "length does not allign"?!)
0xffff00a8 0x1500000
Official
The following are official Acer pages/links, but content IS different on all other languages/regions (so try others)!
Product page (UK)
Support page (UK)(drivers/source/manuals)
USB Driver v1.0 AV052 (do NOT work with tools (flashing and dumping etc), as you need PDAnet or VCOM drivers for that (see ROM Dump section))
Kernel Sources v20140307 (4.2.2)
Manual (ENG)(Duo)
Rooting (CWM > SuperSU)
WARNING: USE AT YOUR OWN RISK, THIS CAN BE DIFFICULT OR EVEN DANGEROUS!!!
Steps 0-4 are to be found explained more thouroughly and with images, in the tutorials in the ROM Dump section. Read them. Read them well!
All tools can be found in the Tools section.
0) Install drivers with a good USB virtual COM port emulation. Most simple is to install PDANet (4.15), but lot of people seem to use the VCOM drivers / MT6589 VCOM / MTK Preloader etc. (All the same old v 1.1123.0). Make sure connection is OK, and MTK Droid works (when phone is on)!
1) Create scatter file or use mine.
2) Read back (stock) recovery (or all) partitions with (old) SP Flash Tool 3.1344 using scatter from 1, or download my stock recovery img here.
3) Let MTK Droid alter the recovery image and make a custom CWM one of it.
4) Download (to phone) the custom CWM recovery with (old) SP Flash Tool 3.1344 using scatter from 1, or use mine.
5) Copy SuperSU zip to SD card, and boot your phone into CWM recovery (hold volume up and turn phone on), and then Install zip from SD > install SuperSU. Do it the first time in CWM, because a reboot without root REVERTS recovery to stock (safety by Acer?!)!
6) YOU ARE ROOTED!
7) Install BusyBox (see Tools section)
WARNING: USE AT YOUR OWN RISK, THIS CAN BE DIFFICULT OR EVEN DANGEROUS!!!
Root Tools (Simple / OneClick)
WARNING: ALL METHODS AT YOUR OWN RISK (NOT TROJAN OR MAL-/SPYWARE CHECKED)!!!
Working (confirmed):
Kingo (1.2.1 used)(at your own risk, closed source and controversial)
Voodoo OTA Rootkeeper (keep root after updates, for rooted phones)
May be working / Not tested:
CF Auto Root
Bin4ry v33
OneClickRoot
Universal Rooter 1.1
SRS Root
VRoot
ERoot
Not (yet) working/modded (confirmed):
Framaroot (E2/V370 etc etc)(1.9.1 tested)
MotoChopper = MT6589_rooter = MT6589_rooting_pkg by Dan Rosenberg (@djrbliss)(universal MT6589)(1.1 tested)
SuperOneClick
E350 Liquid Gallant method
Please message me your own test results and additions!!!
WARNING: ALL METHODS AT YOUR OWN RISK (NOT TROJAN OR MAL-/SPYWARE CHECKED)!!!
Developing / Custom ROM's
None yet, but we hope for a CyanogenMod and ClockworkMod Recovery, although this MediaTek support is not expected :crying:
But due to the fact that the E2 and E3 are almost the same (a part from the screen and cams), we hope for mods/ports of for instance:
E2 SC0RPION ROM
E2 JellyXperia ROM
E2 MIUI 5 ROM
Your custom ROM for the E3 here soon?
Kernel sources in the Official section!!!
Tools / Fixes / Hacks
Kernel sources can be found in the Official section!!!
Tools
MTK2000 is a great MediaTek-hack site with frequent updates of SP/MTK Flash Tool and more!
SP Flash Tool / Smart Phone Flash Tool (v3.1408.00)(super tool for MT65xx phones!)(new code/layout from 3.1352 up, and for recovery flash you MUST use older 3.1344 etc!!!)
MTK Flash Tool (v5.1320)(super tool for MT62xx phones!)
MTK Droid Root & Tools (2.5.3)(great tool, to create scatter (datamap) file (Succeeded! See ROM Dump section) etc.)
MTK Rom Studio (1.1.77.266)(by Linerty)
Multiple MTK (Engineer) Apps / Tools on Google Play, like Mobileuncle MTK Tools (2.9.9)
Xposed (2.5.1) Framework (modify ROM without flashing)
Titanium Backup (6.1.5.4)(backup/restore, and remove or move apps, also system apps)
SuperSU (1.94)(install via CWM to root phones etc)
BusyBox (11 / 1.22.1)
Fixes
Bad GPS fix with MobileUncle MTK Tools (or MT GPS EPO Fix)
Camerafix (by ventus00): Drag Camera app to homescreen into "App info" which brings you to "Gallery" app info. Press Force stop > Clear data. What fixed the cam was pressing "Clear defaults" under "Launch by default".
Hacks
To boot into recovery/fastboot mode, hold Volume Up while powering device on.
To make Acer's drivers also recovery/fastboot compatible, add this line to your "android_winusb.inf" files in the maps in submap "drivers" (and then install/update drivers in Windows Device Manager): %SingleAdbInterface% = USB_Install, USB\VID_0BB4&PID_0C01
Repartition and extend space to SD with Meteos App here or here (root required)(more partition info here)(not tested yet)
Use external SD for apps with the famous INT2EXT script or check all options like App2SD, Mount2SD, Data2SD etc
More?
To Do / Problems
Which script/app to use for data > ext SD? See post #6 etc!
Which method to use to get init.d support?
Custom recovery ClockworkMod RUNNING (5.5.0.4 with MTK Droid) but the CWM custom one from CWM Builder online) seems to large :/
Besides the CWM, build and test custom TWRP Recovery, and Carliv Touch Recovery.
No custom ROM like CyanogenMod yet :/
Made by Hackwerk, and feel totally free to press the Thanks button if you like my work. It took a lot of my spare time!
(special thanks to tiliarou for testing, and d3nnisd for the first/old thread)
Click to expand...
Click to collapse
Porting custom roms from Acer Liquid E2 to Acer Liquid E3 it's very simple.
All you need to do is to take boot.img (kernel) from your stock rom and then if you want I can help you to port kernel to your e3

marcogiannetta said:
Porting custom roms from Acer Liquid E2 to Acer Liquid E3 it's very simple.
All you need to do is to take boot.img (kernel) from your stock rom and then if you want I can help you to port kernel to your e3
Click to expand...
Click to collapse
Welcome Marco and thanks!
Our ALE3 stock boot.img and the kernel source (both still 4.2.2) are already available and I really welcome you to help us.
Although we are also very much waiting for the 4.4 Kit Kat release which is almost there (Q2)!
Ps. Is it (still) hard/impossible to get a CyanogenMod (which I LOVE and am very used to) clone running on our ALE3 (because of MediaTek MT6589?)?

Unlock
Can you tell me if any of the above will unlock my new E380 ? Or do I need to wait for a custom ROM to be ported ?
Many thanks.

hackwerk said:
Welcome Marco and thanks!
Our ALE3 stock boot.img and the kernel source (both still 4.2.2) are already available and I really welcome you to help us.
Although we are also very much waiting for the 4.4 Kit Kat release which is almost there (Q2)!
Ps. Is it (still) hard/impossible to get a CyanogenMod (which I LOVE and am very used to) clone running on our ALE3 (because of MediaTek MT6589?)?
Click to expand...
Click to collapse
I own a Acer Liquid E2 and I ported CM11 from Wiko Stairway (MT6589) to my phone thanks to some patches and libs. At the moment developers have to fix camera,bluetooth, hw acceleration and some little bugs.
I can port this roms but I haven't got a Acer Liquid E3 so I can't test them.
EDIT: I'm gonna port these kernels, but I can't upload those roms because of my bad connection
So all you had to do is to download the roms, replace my kernel in the rom and replace libs with stock libs (they are located in system/lib/modules )
Jellyxperia kernel:
https://mega.co.nz/#!8ZVHzTwJ!kQO_A9AJdLx2Mz3u1ctZ5-IhuEUZvFJOb-SxG9LuyJA
MIUI kernel
https://mega.co.nz/#!gJtQVSCQ!5IdxGHxOobBfGblp8Dd7AUM03prNScxaIudSXT5879E
Try and tell me if I succeed

As long as key features of our (ALE3) phone are not supported in custom ROMs, like camera, I will not (try to) flash/test or modify them.
I am not a developer, and I really demand basic features like making a picture
And again, maybe we should start fukkin around when 4.4 (and sources of 4.4?) are released!

hackwerk said:
As long as key features of our (ALE3) phone are not supported in custom ROMs, like camera, I will not (try to) flash/test or modify them.
I am not a developer, and I really demand basic features like making a picture
And again, maybe we should start fukkin around when 4.4 (and sources of 4.4?) are released!
Click to expand...
Click to collapse
You didn't understand me, those bugs (like camera) are only in CM11.
MIUI, Scorpions and Jellyxperia work fine

pwwuk said:
Can you tell me if any of the above will unlock my new E380 ? Or do I need to wait for a custom ROM to be ported ?
Many thanks.
Click to expand...
Click to collapse
What exactly do you mean by unlock? Rooting? Pattern/PIN lock? SIM / network lock?
Rooting:
See the first post (FP) / topic start (TS) if rooting is what you want and try the simple but obscure Kingo method or flash CWM and install SuperSU etc (complicated but trusted / universal method).
SIM / Network lock:
If rooted, you can install all apps (signed and unsigned) and do everything in your phone you want to, so install a SIM unlock app (OWN RISK), or use a complicated but more trusted file edit method (OWN RISK). A good app option seems to be the famous MobileUncle MTK Tools (see Tools section in FP), as it has a Permanent Unlock option for both SIMs in the Engineer Mode (MTK)!
PIN / Pattern:
A million methods via ADB, or (CWM) recovery etc, like these, but just Google man!

marcogiannetta said:
You didn't understand me, those bugs (like camera) are only in CM11.
MIUI, Scorpions and Jellyxperia work fine
Click to expand...
Click to collapse
So you have CM11 running, but with these problems (because of the MT6589), on your ALE2?
And you did (or also) run customs SC0RPION, JellyXperia and MIUI (only/all three?) and without big problems (so I can probably use those on daily basis)?
Which one do you like best? SC0RPION seems most updated, newest and best fitting (ALE2 based), MIUI seems older and simpler, and Jelly is based on an other phone?!
I do not understand how I would be able to port them to our ALE3. Can you explain it more elaborate please?

hackwerk said:
What exactly do you mean by unlock? Rooting? Pattern/PIN lock? SIM / network lock?
Rooting:
See the first post (FP) / topic start (TS) if rooting is what you want and try the simple but obscure Kingo method or flash CWM and install SuperSU etc (complicated but trusted / universal method).
SIM / Network lock:
If rooted, you can install all apps (signed and unsigned) and do everything in your phone you want to, so install a SIM unlock app (OWN RISK), or use a complicated but more trusted file edit method (OWN RISK). A good app option seems to be the famous MobileUncle MTK Tools (see Tools section in FP), as it has a Permanent Unlock option for both SIMs in the Engineer Mode (MTK)!
PIN / Pattern:
A million methods via ADB, or (CWM) recovery etc, like these, but just Google man!
Click to expand...
Click to collapse
Many thanks,
Yes I meant network unlock (use a phone on an alternate network to that to which it is locked)
Three (UK) have kindly agreed to unlock without charge .. So I just need to root as I need to port some sideloaded apps accross from an old HD.
All the best
Peter

hackwerk said:
So you have CM11 running, but with these problems (because of the MT6589), on your ALE2?
And you did (or also) run customs SC0RPION, JellyXperia and MIUI (only/all three?) and without big problems (so I can probably use those on daily basis)?
Which one do you like best? SC0RPION seems most updated, newest and best fitting (ALE2 based), MIUI seems older and simpler, and Jelly is based on an other phone?!
I do not understand how I would be able to port them to our ALE3. Can you explain it more elaborate please?
Click to expand...
Click to collapse
CM11 is still buggy on mt6589, not only on my phone.
I tried those roms and they are bugfree except jellyxperia which is not multilanguage, in fact only english and chinese.
Honestly I prefer Sc0rpion rom because of its performance/battery life.
About porting roms, you should follow these steps:
1 - Download rom you want to port
2 - On your stock rom, go to system/lib/modules and copy all the libs inside this folder on your sd card
3 - Open custom rom zip and replace custom libs (in the same folder) with your libs
4 - Now replace boot.img of the rom with the ported boot.img which I gave you (i.e. ALE3Jellyxperia)
5 - Make a backup of your stock rom, Wipe data/factory reset and flash the zip in CWM
Yesterday I forgot Sc0rpion kernel, so you can download it here:
https://mega.co.nz/#!1Fl1FKbC!-tTMxyfDJl3_GrmvnCdYywXkutZv3trvxl4XyyA_r6k
Please tell me if you have any problem

marcogiannetta said:
CM11 is still buggy on mt6589, not only on my phone.
I tried those roms and they are bugfree except jellyxperia which is not multilanguage, in fact only english and chinese.
Honestly I prefer Sc0rpion rom because of its performance/battery life.
About porting roms, you should follow these steps:
1 - Download rom you want to port
2 - On your stock rom, go to system/lib/modules and copy all the libs inside this folder on your sd card
3 - Open custom rom zip and replace custom libs (in the same folder) with your libs
4 - Now replace boot.img of the rom with the ported boot.img which I gave you (i.e. ALE3Jellyxperia)
5 - Make a backup of your stock rom, Wipe data/factory reset and flash the zip in CWM
Yesterday I forgot Sc0rpion kernel, so you can download it here:
https://mega.co.nz/#!1Fl1FKbC!-tTMxyfDJl3_GrmvnCdYywXkutZv3trvxl4XyyA_r6k
Please tell me if you have any problem
Click to expand...
Click to collapse
Thanks a lot but after my whole journey (see FP) I just finished configging my phone and am very happy at the moment.
I will try it later, but maybe 4.4 (will be released for us, inc kernel source) will be my next step, and I hope CM11 4.4 customly made from/for this!
How did you make these boot.img images for our ALE3 (from ALE2) btw?

hackwerk said:
Thanks a lot but after my whole journey (see FP) I just finished configging my phone and am very happy at the moment.
I will try it later, but maybe 4.4 (will be released for us, inc kernel source) will be my next step, and I hope CM11 4.4 customly made from/for this!
How did you make these boot.img images for our ALE3 (from ALE2) btw?
Click to expand...
Click to collapse
I unpacked ALE2 and ALE3 kernel. Then I packed a kernel with the ramdisk of the ALE2 and the zImage of the ALE3. That's all

Difficult Lenovo Tab2 firmware A7-30F... firmware restoration advice needed

Hi guys I have a Lenovo Tab2 A7-30F (16GB) that I rooted succesfully but ended up bootlooping when I tried swapping the recovery. I know I shouldve made a backup but I didnt however the tab will respond to SP Flash but not ADB or Fastboot.
Im only an intermediate user but Im starting to get to grips with Linux on my dualboot PC
I believe I've got 4 options available as the lady in my life brought me another Lenovo tab A7-20F (8GB) (succesfully rooted aswell kingroot swapped out for SU thanks to a guide found on your site)not quite the same model I know but as far as I can tell the only differences seems to be Capacity and recovery 30F had uk text in recovery 20F seems to be Chinese writing both from UK shops and have a Mediatek 8127 QC 1.3Ghz cpu
Available Resources
Win 10 & Ubuntu
Lenovo T2 A720F (Rooted Functional)
Various Lenovo Zips (but scatterfiles dont seem to be setup correct)
A730F Source code
SPFlash, MTK Droid tools, Android Studio
Me (guidance and education appreciated but by no means clueless) not afraid to go in at the deep end
OPTIONS
SP FLASH
Source Code
SD Card Boot
SP FLASH
1. I have found an update zip and Source code with a scatter file for the tab but the layout appears to be wrong but dont really understand HEX codes but the Partitions seems in the file maybe comparing and modifying the layout might make SP Flash happy with it
2. Scatter from A7-20 tried this option but unable to produce the scatter as its still complaining about root shell, Iv tried ADB insecure but doesnt seem to help (Im no expert so guidance would be appreciated. I am aware that id probably end up with half the capacity if this option would work for me)
Source Code
I got the source code of the lenovo site but being fairly new to linux not exactly sure how to turn it into usable images from what I gather repo and jackchain would be useful tools in that situation although I may of understood this wrong. Im willing to try this option as I do enjoy working with linux bot ubuntu and kali
SD Card Booting
Havent really looked into this method but stands to reason if I could get the tab to boot Iv got a chance of restoring the tab. Im quite happy to experiment maybe even adapt CWM or TKIP to the tab. I always find the best way to learn is from mistakes in the past Iv rooted android phones Samsung GS3 and had no difficulty, but this is the first time Iv found myself in this situation and feel that its fixable with the resources available.
Thanks in advance sorry for the essay.
Si
I would like to learn more about android as I have a keen interest with linux and would like to beable to maybe one day be competent enough to port apps maybe even create them. anyone with the time and knowledge to spare would get an extra xmas card this year

Did you find a solution? Mine is also only recognized by SP Flash Tool, but the tool wouldn't accept the scatter file from Stock ROM

Here is my Scatter, it is not recognized by any version of SP Flash Tool
Code:
############################################################################################################## General Setting #
PRELOADER 0x40000
MBR 0x0
EBR1 0x80000
PRO_INFO 0x100000
NVRAM 0x400000
PROTECT_F 0x900000
PROTECT_S 0x1300000
SECCFG 0x1d00000
UBOOT 0x1d20000
BOOTIMG 0x1d80000
RECOVERY 0x2d80000
SEC_RO 0x3d80000
MISC 0x4380000
LOGO 0x4400000
EXPDB 0x4700000
TEE1 0x5100000
TEE2 0x5600000
KB 0x5b00000
DKB 0x5c00000
ANDROID 0x5d00000
CACHE 0x65d00000
USRDATA 0x6db00000
Please help me, I wan't to see my tablet alive again.

Can no one help me?

i have the same problem
Lenovo TAB 2 A7-30 3G
is stuck on boot and restarting
how can i solve this problem
i cant find the proper rom>

[GUIDE] [ADVANCED] Bootloader Unlock and Root for the T-Mobile LG Velvet (G900TM ONLY)

ONLY WORKS FOR THE G900TM SINCE THAT MODEL HAS A MEDIATEK CHIP, DO NOT TRY THIS ON ANY OTHER VELVET MODEL
Prerequisites:
MTKclient: this is the free tool we will use to unlock the bootloader, follow the installation instructions here or use the provided LiveDVD that has everything ready to go: https://github.com/bkerler/mtkclient
LGUP: Use this patched one: https://tbl-locksmiths.com/d/4-lgup-1163-patched-latest
ADB (Android Debug Bridge): See here on how to install ADB: https://www.xda-developers.com/install-adb-windows-macos-linux/
FOR NOW YOU MUST USE AN UBUNTU OR DEBIAN BASED LINUX DISTRO SINCE MTKCLIENT DOES NOT PLAY NICE WITH AND REQUIRES MORE STEPS TO WORK ON WINDOWS. A VIRTUAL MACHINE WILL WORK FINE FOR THIS TUTORIAL.
UNLOCKING THE BOOTLOADER WILL WIPE YOUR DATA, PLEASE MAKE SURE YOU HAVE BACKED YOUR DATA UP BEFORE ATTEMPTING THIS.
1. If you are on Android 11 already, please downgrade to Android 10 first using the G900TM14k KDZ before attempting this. You can download it here or from another website. https://drive.google.com/file/d/1GYOHiuIbOqO9x_t8E-dvLI3sEKDe6fRS/view?usp=sharing
Spoiler: Nerd explanation 🤓
The reason that we are doing this is because in the Android 11 firmware, the phone’s preloader (first stage bootloader) has the exploit MTKclient needs to crash the phone into BROM mode (Mediatek equivalent to Qualcomm EDL mode) patched out. This means MTKclient will not work with the Android 11 firmware installed, unless you are willing to open up the phone and short some test points! By downgrading to Android 10, the exploitable preloader can be put back onto the device.
2. Install LGUP, then launch it when it is done. Make sure the “refurbish” option is selected, then click the button with the three dots that is circled in the picture.
Spoiler: LGUP
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
3. Select the G900TM14k kdz file. Then click start and wait for the kdz to finish flashing.
Spoiler
4. Now you are ready to use MTKclient. When using it, make sure the phone is powered off, run a command, and then plug the phone into your PC. Follow the instructions here: https://github.com/bkerler/mtkclient#unlock-bootloader
Output should look something like this example output:
Code:
[email protected]:~/Desktop/mtkclient-main$ python mtk e metadata,userdata,md_udc
MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
Port - Device detected :)
Preloader - CPU: MT6885/MT6883/MT6889/MT6880/MT6890(Dimensity 1000L/1000)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x816
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Mtk - We're not in bootrom, trying to crash da...
PLTools - Crashing da...
Preloader
Preloader - [LIB]: upload_data failed with error: DAA_SIG_VERIFY_FAILED (0x7024)
Preloader
Preloader - [LIB]: Error on uploading da data
Preloader - Jumping to 0x0
usb_class - USBError(19, 'No such device (it may have been disconnected)')
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
Port - Device detected :)
Preloader - CPU: MT6885/MT6883/MT6889/MT6880/MT6890(Dimensity 1000L/1000)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x816
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 2DF842BC6706D1EA3150DC28E8B69081
Preloader - SOC_ID: D68B399A7D66DF240C22270698248840AF48675FA82F2F5B8B2048A993A646B3
PLTools - Loading payload from mt6885_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/sugondeseballs/Desktop/mtkclient-main/mtkclient/payloads/mt6885_payload.bin
Port - Device detected :)
Main - Device is protected.
Main - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading stage 1 from MTK_AllInOne_DA_5.2124.bin
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - UFS FWVer: 0x2020
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: SDINEDK4-128G
DAXFlash - UFS CID: 45015344494e45444b342d3132384720
DAXFlash - UFS LU0 Size: 0x1dcd800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DRAM config needed for : 45015344494e45444b342d3132384720
DAXFlash - Sending emi data ...
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - UFS FWVer: 0x2020
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: SDINEDK4-128G
DAXFlash - UFS CID: 45015344494e45444b342d3132384720
DAXFlash - UFS LU0 Size: 0x1dcd800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DA-CODE : 0x161E0
DAXFlash - DA Extensions successfully added
DAXFlash - Formatting addr 0x94a2000 with length 0x2000000, please standby....
DAXFlash - Successsfully formatted addr 0x94a2000 with length 33554432.
Formatted sector 38050 with sector count 8192.
DAXFlash - Formatting addr 0x462800000 with length 0x1962800000, please standby....
DAXFlash - Successsfully formatted addr 0x462800000 with length 109026738176.
Formatted sector 4597760 with sector count 26617856.
DAXFlash - Formatting addr 0x7e08000 with length 0x169a000, please standby....
DAXFlash - Successsfully formatted addr 0x7e08000 with length 23699456.
Formatted sector 32264 with sector count 5786.
[email protected]:~/Desktop/mtkclient-main$ python mtk xflash seccfg unlock
MTK Flash/Exploit Client V1.50 (c) B.Kerler 2018-2021
sej - HACC init
sej - HACC run
sej - HACC terminate
sej - HACC init
sej - HACC run
sej - HACC terminate
sej - HACC init
sej - HACC run
sej - HACC terminate
Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x1 of 0x1, ) 0.05 MB/s
xflashext - Successfully wrote seccfg.
Congrats! Your bootloader is now unlocked!
Now if you want to flash back to Android 11 first and then root, you can! You can either perform the OTA updates needed to get to the latest Android 11 software version, or just download an Android 11 KDZ from one of those websites that hosts LG firmware and flash it with the “Upgrade” option selected in LGUP.
But doing so will replace the exploitable preloader. If you still want MTKclient to work, follow this process:
Download an Android 11 KDZ
Open up LGUP and select the KDZ
Select the “Partition DL” option and press “Start”
When the partition list window pops up, click “Select all” and uncheck the preloader partition, then press OK to start flashing.
Spoiler: Partition list window
ROOTING INSTRUCTIONS (this part can be done in Windows or Linux):
To root, dump both of the boot images from the phone using “python mtk r boot_a boot_a.bin” and “python mtk r boot_b boot_b.bin”. It’s fine to dump only boot_a or boot_b, but make sure to verify which boot slot your phone is in first, then dump the correct image.
Turn the phone back on, then download the Magisk APK file from its Github page, and install it.
Copy the dumped boot images to your phone’s storage.
Then in the Magisk app, tap the Install button in the Magisk box, then tap “Select and patch a file”.
Select your boot image, then press “Let’s go”.
Wait for it to patch the boot image.
When the app finishes patching the boot image it will be in the Downloads folder. If you want to patch the other boot image, repeat this process.
When you have your patched boot images, copy them back to your computer, preferably to the same directory/folder where ADB is installed to.
Make sure USB Debugging is enabled in the developer settings on your phone, then connect the phone to your computer. Allow the computer to access the phone if needed.
Open up a command prompt in the folder where the boot images are and where ADB is installed and type “adb reboot fastboot”.
Wait for the phone to boot to fastboot, then type and run these commands: “fastboot flash boot_a boot_a.bin” and “fastboot flash boot_b boot_b.bin”.
Reboot the phone.
You’re rooted!
Big thanks to @Warlockguitarman, who discovered the bootloader unlock exploit, and Bjoern Kerler, the author of MTKclient and integrated the exploit into the tool. Without them, many Mediatek devices including the T-Mobile Velvet would probably never have root!

Some pictures of my rooted Velvet

If you happen to hard brick your device enough so that it only gets detected as a USB port, here are the unbrick files to get the phone to download mode. You will need to flash these using SP Flash Tool with the "Format all + Download" option. This will nuke your IMEI and serial number, however it is not too difficult to write those back to the phone.
Velvet (MTK) - Google Drive
drive.google.com

Reserved

Thanks for the write-up! quick question: any issues with the fingerprint function? I heard that some LG phones have issues with finger sensor after unlock, not sure if that applies here. I'm assuming this would break the OTA?

Metconnect2000 said:
Thanks for the write-up! quick question: any issues with the fingerprint function? I heard that some LG phones have issues with finger sensor after unlock, not sure if that applies here. I'm assuming this would break the OTA?
Click to expand...
Click to collapse
Hi, the fingerprint still works perfectly after unlocking the bootloader. If you root then you will break OTA updates. But I consider that an improvement for this phone because T-Mobile loves to force OTAs on their phones lol

Wish39 said:
Hi, the fingerprint still works perfectly after unlocking the bootloader. If you root then you will break OTA updates. But I consider that an improvement for this phone because T-Mobile loves to force OTAs on their phones lol
Click to expand...
Click to collapse
Cool. Thanks!

I'm having trouble with unlocking the bootloader. I'm using the Live DVD from the MTKClient, but it seems to be getting stuck with "Status: Handshake failed, retrying..." and "Please disconnect, start mtkclient and reconnect". I'm not too familiar with Linux, I'm just double clicking the "MTK" app on the Live DVD desktop and running the commands from there. My device is powered off when running the commands and downgraded to Android 10. I have tried using the Live DVD on a virtual machine and running on two computers, but it doesn't seem to change anything.
EDIT: Used version 1.52 under the releases tab in Github and was successful. For idiots like me, heres what I did:
1. Download the Live CD provided and run it on a computer
2. On a seperate computer, download the latest release of MTKClient under the releasess tab (version 1.52) and extract to a USB drive
3. Boot into Live USB
4. Copy over MTKClient version 1.52 to Live CD
5. In the MTKClient files, right click and click "Open Terminal Here"
6. Follow original steps above to unlock bootloader
To root, I also used the Live CD since I kept getting issues in Windows
1. In Linux terminal, run "sudo apt-get install android-tools-fastboot" and "sudo apt-get install android-tools-adb"
2. Follow original steps to root phone
3. Make sure you replace "boot_a.bin" with the name of the file that Magisk generated
4. I typed in "fastboot flash boot_a" and then dragged the Magisk generated file and did that for Boot_b too

username32 said:
I'm having trouble with unlocking the bootloader. I'm using the Live DVD from the MTKClient, but it seems to be getting stuck with "Status: Handshake failed, retrying..." and "Please disconnect, start mtkclient and reconnect". I'm not too familiar with Linux, I'm just double clicking the "MTK" app on the Live DVD desktop and running the commands from there. My device is powered off when running the commands and downgraded to Android 10. I have tried using the Live DVD on a virtual machine and running on two computers, but it doesn't seem to change anything.
EDIT: Used version 1.52 under the releases tab in Github and was successful. For idiots like me, heres what I did:
1. Download the Live CD provided and run it on a computer
2. On a seperate computer, download the latest release of MTKClient under the releasess tab (version 1.52) and extract to a USB drive
3. Boot into Live USB
4. Copy over MTKClient version 1.52 to Live CD
5. In the MTKClient files, right click and click "Open Terminal Here"
6. Follow original steps above to unlock bootloader
To root, I also used the Live CD since I kept getting issues in Windows
1. In Linux terminal, run "sudo apt-get install android-tools-fastboot" and "sudo apt-get install android-tools-adb"
2. Follow original steps to root phone
3. Make sure you replace "boot_a.bin" with the name of the file that Magisk generated
4. I typed in "fastboot flash boot_a" and then dragged the Magisk generated file and did that for Boot_b too
Click to expand...
Click to collapse
What were the hardware key combo you used to get to BROM mode? I keep getting the handshake failed error, even though the other LG devices worked before.

Wish39 said:
Hi, the fingerprint still works perfectly after unlocking the bootloader. If you root then you will break OTA updates. But I consider that an improvement for this phone because T-Mobile loves to force OTAs on their phones lol
Click to expand...
Click to collapse
I was unable to do OTA updates even after I restored the stock boot img. It seems like bootloader unlock breaks OTA updates.

lentm said:
I was unable to do OTA updates even after I restored the stock boot img. It seems like bootloader unlock breaks OTA updates.
Click to expand...
Click to collapse
It normally will.I get a strange hex message when it tries to update,and it will tell you to contact LG Support.

Surgemanxx said:
It normally will.I get a strange hex message when it tries to update,and it will tell you to contact LG Support.
Click to expand...
Click to collapse
It didn't matter as we could just do manual update with kdz files, but it feels like something happened on their T-Mobile version development.
We used to get the kdz file every 2-3 months, still nothing even when 20i ota is out already, and still no pending Android 12 updates on T-Mobile list.

lentm said:
It didn't matter as we could just do manual update with kdz files, but it feels like something happened on their T-Mobile version development.
We used to get the kdz file every 2-3 months, still nothing even when 20i ota is out already, and still no pending Android 12 updates on T-Mobile list.
Click to expand...
Click to collapse
I agree!T-Mobile's Velvet is still lagging behind for A12,and I'm assuming because of the Mediatek chipset is the reason being.I currently have the Verizon,and the AT&T versions and they was OTA'd a couple months ago.But,I think their just compiling 1 version for most of these last devices because they have the same Qualcomm chipsets.I have the LG Wing,and it's in the same boat still.It's still sitting at A11 and nothing in the works to go to A12 I have seen.

lentm said:
I was unable to do OTA updates even after I restored the stock boot img. It seems like bootloader unlock breaks OTA updates.
Click to expand...
Click to collapse
Unlocking the bootloader may or may not break OTA updates on T-Mobile/Metro LG devices in my experience.
I had a Metro K51 that had OTA's break after just unlocking its bootloader, meanwhile my T-Mobile Velvet was able to OTA update even after unlocking its bootloader.
T-Mobile LG's use Google Play Services to distribute OTA updates, so it's something with GMS I guess, not sure.

lentm said:
What were the hardware key combo you used to get to BROM mode? I keep getting the handshake failed error, even though the other LG devices worked before.
Click to expand...
Click to collapse
There's no BROM hardware key combo, did you downgrade the phone first?
Easiest way is to downgrade to Android 10, run a command on mtkclient and then simply power off the phone, plug it into your PC and let mtkclient do the work.
The only other way is to disassemble the phone and short the BROM testpoints on the motherboard, then plug the phone into your PC.

Surgemanxx said:
I agree!T-Mobile's Velvet is still lagging behind for A12,and I'm assuming because of the Mediatek chipset is the reason being.I currently have the Verizon,and the AT&T versions and they was OTA'd a couple months ago.But,I think their just compiling 1 version for most of these last devices because they have the same Qualcomm chipsets.I have the LG Wing,and it's in the same boat still.It's still sitting at A11 and nothing in the works to go to A12 I have seen.
Click to expand...
Click to collapse
Korean Wing does have Android 12

Wish39 said:
Korean Wing does have Android 12
Click to expand...
Click to collapse
Yes,built from the Velvet 765g firmware.Nothing for other regions as of yet.

Wish39 said:
Unlocking the bootloader may or may not break OTA updates on T-Mobile/Metro LG devices in my experience.
I had a Metro K51 that had OTA's break after just unlocking its bootloader, meanwhile my T-Mobile Velvet was able to OTA update even after unlocking its bootloader.
T-Mobile LG's use Google Play Services to distribute OTA updates, so it's something with GMS I guess, not sure.
Click to expand...
Click to collapse
If your Velvet was able to OTA update, it's probably because I unchecked preloader with PARTITION D/L option on LGUP when upgrading to Android 12.

A) Since this is a mediatek chipped device, is it not possible to unlock bootloader via adb and fastboot commands from a windows rig?
Then patch the boot image with magisk.
Flash patched image with adb or the smart phone flash tool?
Ive had success with other brands on mediatek android 10 using this method.
--> Here is a guide thats similar to the method ive successfully used to root other devices, but for mediatek android 11 devices
--> Here is another guide specifically for LG devices from the same source as above
--------------------
B) Re: Resources for the method in post 1
1. Anyone have the link to the latest android 11 kdz [G900TM20i]? I cant find a copy for d/l. Seems to be discrepancy whether OTA update will work post-root, and would like to have latest security patch
2. Is there a minimum version of ubuntu to use? I have one in the archives but it has to be at least a few years old. Should it work or do i want to grab a newer version to be sure?
--------------------
Thanks for the guide and help.
I just picked up this mint unlocked t-mobile velvet for less than $150 and so far seem like a nice device. Only gripe is no face unlock. Noticed a faceprint and handprint option in the service menu, but my understanding is that it doesnt serve any function on this device.
One of the main reasons i picked this device up was due to the mediatek chipset, and that mediatek devices are typically rootable with a generic process like i linked above. Im glad to see it can be rooted, even if not via the 'typical method' ive used for others.

@double b26 Hey whats up. The normal fastboot method doesn't work for newer LG devices because those don't have normal fastboot, they only have fastbootd, which is fastboot in userspace. The bootloader unlock commands are missing, so you can't really do anything in there besides flash some partitions while in there.
As of now there isnt a KDZ for G900TM20i, and I recommend you use Ubuntu 20.04 LTS or newer so you dont run into compatibility issues.
Also I believe the handprint and faceprint options in the hidden menu are meant for the G8, guess LG was too lazy to remove those options.

Please help !! I bricked my LG K52

Hi everybody,
I may need the help of someone very experimented in flashing smartphones with Mediatek chipsets,
I wanted to unlock the bootloader of my K52, so I downgraded it to Android 10, then I unlocked it with MTKClient, but it got stuck in a bootloop,
Then, searching how to wipe userdata, I accidentally erased all partitions on the phone,
Now it won't boot anymore, I just can download it in BROM mode, with the "python mtk payload" command,
I've tried this guide, the k52 has exactly the same chipset, but with no chance,
Could anyone help me plz ?
I'd be very grateful ! :3

have install twrp?

arfooux said:
have install twrp?
Click to expand...
Click to collapse
what part of 'wiped my whole flash' do you not understand?
also I'm quite sure you are screwed, speaking from personal experiance, as there are some partitions that just don't come with a stock ROM because they're for calibration and other purposes (I can't say what exactly, but things like the modem drivers to comply with regional authority and some such is a good bet)
so really you'd need a full mtkclient flash dump from a good L52 to then flash onto your bricked one
P.S. my experiance being that even though I've flashed a stock rom to my X626B after a whole flash wipe I only get a bootloop and haven't been able to diagnose the problem on account nobody knows how to get a UART console without a bridge despite not needing one...

Hello,
Thanks for answering,
I have spent hours searching on the web different possible solutions to bring my phone back to life, and here is my progress so far :
- I've been able to extract from a stock ROM KDZ file the following partitions :
- boot : boot.img_1064960 and boot.img_1540096, I don't know if they are boot_a or boot_b, they look pretty similar on hex editor, stripped like .bin dump from ROM, and when I make a Get-FileHash on both with powershell I have exactly the same result (and it's applicable to all files with same name)
- dtbo
- efuse
- ftm
- laf
- lk
- logo
- md1img
- OP_COM1_EU (3 different files, and the third neigher has the same size nor the same contents in hex editor as the other ones, so I guess a and b??)
- preloader
- patched_pgpt
- patched_sgpt
- rct
- scp
- spmfw
- sspm
- super (a lot of files with different sizes)
- tee
- userdata (a lot of files with different sizes)
- vbmeta_COM1_EU
I guess they are in the right format when I compare in hex editor the preloader file I extracted with a *.bin I have found I don't remember where they are the same
- I've managed to generate a scatter file from patched_pgpt with WWR
- I've connected my phone and used bypass_utility (https://github.com/MTK-bypass/bypass_utility) flashed partitions using scatter file with SP Flash Tool (https://spflashtool.com/)
- Now, when I open mtk_gui (https://github.com/bkerler/mtkclient), the tabs read/write/erase partitions are not empty anymore, here is what I have
- boot_para
- proinfo
- para
- efuse
- spare1
- nvcfg
- nvdata
- metadata
- misc2
- ftm
- mt_udc
- expdb
- frp
- protect1
- protect2
- seccfg
- nvram
- persist
- persist_lg
- p_persist_lg
- md1img_a
- spmfw_a
- scp_a
- sspm_a
- lk_a
- tee_a
- spare2
- logo_a
- dtbo_a
- vbmeta_a
- vbmeta_system_a
- vbmeta_vendor_a
- boot_a
- laf_a
- md1img_b
- spmfw_b
- scp_b
- sspm_b
- lk_b
- tee_b
- spare3
- logo_b
- laf_b
- eksst
- encrypt
- rct
- spare4
- power
- mpt
- fota
- els
- carrier
- srtc
- operatorlogging
- super
- OP_a
- OP_b
- userdata
- flashinfo
It pretty looks like what I had before I get stupid enough to erase everything, so I guess I progressed in the right way
Anyway, the phone still doesn't start
I can't get to download mode, fastboot mode, etc
Whe I do python mtk plstage --preloader=preloader_muse6765_64_eh35_q.bin, Windows detects LGE Mobile USB Serial Port on device manager, then disappears after a few seconds and becomes MediaTek USB Port, and loops like this
So I guess something is missing
My question is
Which partitions do I need to flash to at least get Download Mode back ? So that I can use LG software and flash KDZ
I'll keep searching, but if anyone has information, or why not a full ROM dump, I'd be glad
Best regards,
François

Just to give some updates, I've tried another tool to extract the KDZ file : https://gist.github.com/iscgar/e0da0868df7b2f179b000c61f12d1a8c
Now I have clearly named files : 0.boot_a.img, 0.boot_b.img, etc.
So, I'm manually flashing partitions. Each partition is mentioned in the generated scatter file by WWR as on this example :
- partition_index: SYS22
partition_name: md1img_a
file_name: md1img.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x17000000
physical_start_addr: 0x17000000
partition_size: 0x6000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
So, for each one that has a .img file, im doing this
python mtk wo 0x17000000 0x6000000 0.md1img_a.img
with 0x17000000 being the line physical_start_addr and 0x6000000 the line partition_size
all partitions are not in the directory, seccfg, fota, frp, are missing, so, well, we'll see what happens
So far, I have flashed boot_a, boot_b, laf_a, laf_b, lk_a, lk_b, logo_a, logo_b, md1img_a, md1img_b, ssmp_a, ssmp_b, spmfw_a, spmfw_b, rct, tee_a, tee_b, dtbo_a, dtbo_b, efuse, vbmeta_a, vbmeta_b, pgpt, sgpt
I'm not sure about what I have done with OP, I flashed 0.OP_S.img in the OP_a partition
Anyway, so far, I've tried
power : nothing
power + vol up : nothing
power + vol down : nothing
power + both vol buttons : nothing
But, python mtk plstage --preloader=preloader_muse6765_64_eh35_q.bin as usual, LGE device appears for a few seconds on the device manager, and something more, the phone displays the LG K52 boot screen for a few seconds, then turns back off,
Not great yet, the phone is still not usable, but it's encouraging !
I'll keep you informed !

Nothing else than this yet, but satisfying to see progress, I wanted to share this with you
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

I just copied super partition, now when I push power button, it vibrates, displays the LG K52 boot screen, and displays "All Slots are unbootable" in red
I can get neither download mode nor fastboot, but I'm confident I'm getting close to get it working again !

Well, I tried to flash everything again, and now the phone is dead again, no more vibration and no more logo...
I noticed it was possible to communicate with the BROM with a UART interface at a baudrate of 115200, 8 bits, 1 stop bit, no parity and no flow control, I found a document yesterday explaining that a few commands could be called like 'Version', 'Start', 'Jump', but nothing happens when I try with PuTTY,
If somebody can help I'd be very glad !

Okay, after idk how many attemts, I managed to have the phone powerong on again after flashing with SP Flash Tool
buuuuuuut
Something more !!
Now, it doesn't only bootloop when the BL is unllocked, it also displays a message I didn't have at the first time I could power it on again !

I haven't progressed more so far, may anyone have a suggestion ?
I've tried :
- reflashing everything
- removing AVB header in the boot partition img to disable verified boot just in case it would change something (replacing the 256 bytes of the header of AVB in HxD with zeroes)
- the whole process from KDZ to manually reflash partitions with another stock ROM to see if it changes something
- erasing userdata, md_udc and metadata
- python mtk payload --metamode FASTBOOT => won't boot in fastboot
I'm now out of ideas...
It keeps displaying in a bootloop the LG logo, then either "all slots are unbootable" or "Your device cannot be checked for corruption. Lock the bootloader"
All I think I know, is that to reach that far in the startup process, it means we're in the LittleKernel (AM I RIGHT PLEASE CAN ANYONE CONFIRM ? ), and I may have something interesting if I manage to build a custom one with debug symbols, but no source code related to MT6765 anywhere on the internet, I guess I'm kinda stuck...
And at the same time, just to try, I build a custom LK with ARM target from the github source code, it generates a LK and a LK.img, but in Hxd, the first bytes are very very very different, the one from my LG stock ROM starts with IDK how many rows ful of "0xFF" bytes, the built one doesn't..
Does anyone have an idea of what I may want do to find what's wrong with the boot process of my phone ?

Up ?

Maybe I can help you solve this problem, because I use the same mobile phone as you. But after repairing the boot, your phone may lose the serial number, so far, I do not know how to repair the serial number. If I have time, I'll look into it

When I turn it on now, if I push simultaneously PWR, VOL+ and VOL- buttons barcodes with S/N, IMEI and manufacturing dates, and all is zero,
Honestly, I don't mind if I don't have the S/N anymore, I know all the numbers have been wiped out, now event the IMEI consist of zeroes, I've called Orange customer service so they told me the IMEI of the terminal I used with my SIM card between feb 2021 and mar 2023 so I'm gonna have to find a way to reinject it but it's okay I'll find a way, I don't know how yet but, if at least, I can get it starting again I'd already be more than happy