Unbrick Fire HD 6/7 via preloader [EASY SUCCESS!!!]: - Fire HD 6 and 7 Android Development

Update [Nov 23, 2016] :
powerpoint45 made a separate thread, so please use his method first from this link. Notice that in FireOS 5.3.1 this functionality has been disabled, so nothing happens as people try to read/write memory
Update [Sep 27, 2016] :
Thanks to the great effort by powerpoint45, there is now a custom Linux image specifically created to run AFTV2 tools (here). It will even recognize which addresses you have, so no need to upload any binary blocks anymore! Please use it! Also note that a couple of Fire bricks turned out to be unrecoverable, it seems impossible to read/write the memory, so no luck If you have one of these, please post and explain how you managed to brick it so much.
Update [Sep 16, 2016] :
Thanks to the fantastic effort by powerpoint45 to read UART logs on a bricked FIRE, we now know why downgrades produce dark screen bricks! It looks like the new FireOS 5 bootloaders check the version in eFUSE, and if it's newer than the current, they refuse to boot. Please see this link for details. This is very similar to the issues found on Fire 2015, see this link.
Update [Aug 14, 2016] :
The instructions have been extensively cleaned up for more general use. The unbricking was finally successful for the classic "wrong/older bootloader" (black screen) type of Fire HD bricking (thanks to @n3roxda333 for persisting with his brick !!!). Thus the procedure is fully tested to be used by anybody for pretty much any type of recovery. Yey !!! Again, what this means is that even the black screen bricks can be successfully brought back to life.
Unfortunately, the procedure is somewhat fragile, so you may have to work through various challenges. The key software required : Python 3 (with the pyserial module - "pip install pyserial"), and AFTV2-Tools. If you are on Windows 8/10, make sure to get the proper signed Win 8&10 MediaTek USB VCOM drivers in order to set up the communication between your PC and Fire as quickly as possible. For other OSes, see the posts from @zeroepoch and @hwmod. Very recently, @powerpoint45 has put together an excellent iso with Linux that already has all the necessary software included (see this link, and don't forget to click "Thanks!").
Once you establish communication with the device (a.k.a. "handshake"), it's important to establish that the read_mmc procedure is stable, and does not hang. If it hangs, you'll have to find another computer that is stable There seems to be no other way around this instability issue at the moment. Please see a couple of other key posts on how to get AFTV2 tools working, first from the author of the AFTV2 tools himself - @zeroepoch (link), and then @hwmod who used this method to unbrick Fire 2015 (link).
Instructions.
1. Setup Python 3, download the required AFTV2 tools, install the preloader drivers (if needed), and establish the handshake with the device (this is the generic part of the procedure, independent of the specific Amazon device, use the posts by @hwmod (link) and @zeroepoch (link) to understand and fix any issues so that you can handshake successfully):
Code:
C:\extra\android\kindle_root\aftv2-tools>handshake.py
Waiting for preloader...
[COLOR="Red"](now plug in fully turned off Fire HD, it'll get turned on by the USB power, and I already had preloader drivers from the prior bricked
Fire HD, so handshake completed just fine). If the device is in the weird state, plug it in, and hold the Power button. At some point it'll start rebooting, and the preloader should handshake if you got all the other prerequisites taken care of[/COLOR]
Found port = COM8
Handshake complete!
Note that under Linux sometimes USB ports stop working (when they worked before!), see this link on how to fix such a condition (and click "Thanks!").
2. On each 2014 Fire HD the partitions we need to write into have unique offsets relative to 0x0. So before writing anything it's necessary to figure out what this unique offset is. A way to do is to read a bunch of blocks, and then determine in a hex editor which are meaningful. This allows to determine the correct unique offset. Run the following read commands to get the data blocks, zip all of the *part files, and post it here. In this step you will also find out if your setup is stable. If the read commands hang, that is a bad sign, you will need another computer (or perhaps a different OS on the same hardware, as in dual boot Linux on a Windows machine)
Code:
read_mmc.py 0x0000000 0x1000 0x0000000.part
read_mmc.py 0x0080000 0x1000 0x0080000.part
read_mmc.py 0x0100000 0x1000 0x0100000.part
read_mmc.py 0x0180000 0x1000 0x0180000.part
read_mmc.py 0x0200000 0x1000 0x0200000.part
read_mmc.py 0x0280000 0x1000 0x0280000.part
read_mmc.py 0x0300000 0x1000 0x0300000.part
read_mmc.py 0x0380000 0x1000 0x0380000.part
read_mmc.py 0x0400000 0x1000 0x0400000.part
read_mmc.py 0x0480000 0x1000 0x0480000.part
read_mmc.py 0x0500000 0x1000 0x0500000.part
read_mmc.py 0x0580000 0x1000 0x0580000.part
read_mmc.py 0x0600000 0x1000 0x0600000.part
read_mmc.py 0x0680000 0x1000 0x0680000.part
read_mmc.py 0x0700000 0x1000 0x0700000.part
read_mmc.py 0x0780000 0x1000 0x0780000.part
read_mmc.py 0x0800000 0x1000 0x0800000.part
read_mmc.py 0x0880000 0x1000 0x0880000.part
read_mmc.py 0x0900000 0x1000 0x0900000.part
read_mmc.py 0x0980000 0x1000 0x0980000.part
read_mmc.py 0x0a00000 0x1000 0x0a00000.part
read_mmc.py 0x0a80000 0x1000 0x0a80000.part
read_mmc.py 0x0b00000 0x1000 0x0b00000.part
read_mmc.py 0x0b80000 0x1000 0x0b80000.part
read_mmc.py 0x0c00000 0x1000 0x0c00000.part
read_mmc.py 0x0c80000 0x1000 0x0c80000.part
read_mmc.py 0x0d00000 0x1000 0x0d00000.part
read_mmc.py 0x0d80000 0x1000 0x0d80000.part
read_mmc.py 0x0e00000 0x1000 0x0e00000.part
read_mmc.py 0x0e80000 0x1000 0x0e80000.part
read_mmc.py 0x0f00000 0x1000 0x0f00000.part
read_mmc.py 0x0f80000 0x1000 0x0f80000.part
read_mmc.py 0x1000000 0x1000 0x1000000.part
read_mmc.py 0x1080000 0x1000 0x1080000.part
read_mmc.py 0x1100000 0x1000 0x1100000.part
read_mmc.py 0x1180000 0x1000 0x1180000.part
read_mmc.py 0x1200000 0x1000 0x1200000.part
read_mmc.py 0x1280000 0x1000 0x1280000.part
read_mmc.py 0x1300000 0x1000 0x1300000.part
read_mmc.py 0x1380000 0x1000 0x1380000.part
read_mmc.py 0x1400000 0x1000 0x1400000.part
read_mmc.py 0x1480000 0x1000 0x1480000.part
read_mmc.py 0x1500000 0x1000 0x1500000.part
read_mmc.py 0x1580000 0x1000 0x1580000.part
read_mmc.py 0x1600000 0x1000 0x1600000.part
read_mmc.py 0x1680000 0x1000 0x1680000.part
read_mmc.py 0x1700000 0x1000 0x1700000.part
read_mmc.py 0x1780000 0x1000 0x1780000.part
read_mmc.py 0x1800000 0x1000 0x1800000.part
read_mmc.py 0x1880000 0x1000 0x1880000.part
read_mmc.py 0x1900000 0x1000 0x1900000.part
read_mmc.py 0x1980000 0x1000 0x1980000.part
read_mmc.py 0x1a00000 0x1000 0x1a00000.part
read_mmc.py 0x1a80000 0x1000 0x1a80000.part
read_mmc.py 0x1b00000 0x1000 0x1b00000.part
read_mmc.py 0x1b80000 0x1000 0x1b80000.part
read_mmc.py 0x1c00000 0x1000 0x1c00000.part
read_mmc.py 0x1c80000 0x1000 0x1c80000.part
read_mmc.py 0x1d00000 0x1000 0x1d00000.part
read_mmc.py 0x1d80000 0x1000 0x1d80000.part
read_mmc.py 0x1e00000 0x1000 0x1e00000.part
read_mmc.py 0x1e80000 0x1000 0x1e80000.part
read_mmc.py 0x1f00000 0x1000 0x1f00000.part
read_mmc.py 0x1f80000 0x1000 0x1f80000.part
read_mmc.py 0x2000000 0x1000 0x2000000.part
read_mmc.py 0x2080000 0x1000 0x2080000.part
read_mmc.py 0x2100000 0x1000 0x2100000.part
read_mmc.py 0x2180000 0x1000 0x2180000.part
read_mmc.py 0x2200000 0x1000 0x2200000.part
read_mmc.py 0x2280000 0x1000 0x2280000.part
read_mmc.py 0x2300000 0x1000 0x2300000.part
read_mmc.py 0x2380000 0x1000 0x2380000.part
read_mmc.py 0x2400000 0x1000 0x2400000.part
read_mmc.py 0x2480000 0x1000 0x2480000.part
read_mmc.py 0x2500000 0x1000 0x2500000.part
read_mmc.py 0x2580000 0x1000 0x2580000.part
read_mmc.py 0x2600000 0x1000 0x2600000.part
read_mmc.py 0x2680000 0x1000 0x2680000.part
read_mmc.py 0x2700000 0x1000 0x2700000.part
read_mmc.py 0x2780000 0x1000 0x2780000.part
read_mmc.py 0x2800000 0x1000 0x2800000.part
read_mmc.py 0x2880000 0x1000 0x2880000.part
read_mmc.py 0x2900000 0x1000 0x2900000.part
read_mmc.py 0x2980000 0x1000 0x2980000.part
read_mmc.py 0x2a00000 0x1000 0x2a00000.part
read_mmc.py 0x2a80000 0x1000 0x2a80000.part
read_mmc.py 0x2b00000 0x1000 0x2b00000.part
read_mmc.py 0x2b80000 0x1000 0x2b80000.part
read_mmc.py 0x2c00000 0x1000 0x2c00000.part
read_mmc.py 0x2c80000 0x1000 0x2c80000.part
read_mmc.py 0x0400000 0x4000 0x00a.part
read_mmc.py 0x0408000 0x4000 0xPRO_INFOa.part
read_mmc.py 0x0500000 0x4000 0xPMTa.part
read_mmc.py 0x0900000 0x1000 0xTEE1a.part
read_mmc.py 0x1300000 0x1000 0xUBOOTa.part
read_mmc.py 0x0780000 0x4000 0x00b.part
read_mmc.py 0x0788000 0x4000 0xPRO_INFOb.part
read_mmc.py 0x0880000 0x4000 0xPMTb.part
read_mmc.py 0x0c80000 0x1000 0xTEE1b.part
read_mmc.py 0x1680000 0x1000 0xUBOOTb.part
read_mmc.py 0x0a00000 0x4000 0x00c.part
read_mmc.py 0x0a08000 0x4000 0xPRO_INFOc.part
read_mmc.py 0x0b00000 0x4000 0xPMTc.part
read_mmc.py 0x0f00000 0x1000 0xTEE1c.part
read_mmc.py 0x1900000 0x1000 0xUBOOTc.part
If you are skilled with binary editors, you can examine these *.part files using Appendix 1 as a reference, and if you find a match for LK partition, choose the respective option in Appendix 1.
3. After the correct addresses have been figured out, use the supplied addresses to read the partition headers, and save these just in case (before you do the reading again in Step 5 !!!). The read commands will be provided to you once you upload the zip file. Here is an example of what this will look like :
Code:
[strike]
read_mmc.py 0x0400000 0x4000 00.part
read_mmc.py 0x0408000 0x4000 PRO_INFO.part
read_mmc.py 0x0500000 0x4000 PMT.part
read_mmc.py 0x0900000 0x4000 TEE1.part
read_mmc.py 0x0e00000 0x4000 TEE2.part
read_mmc.py 0x1300000 0x4000 UBOOT.part
read_mmc.py 0x1380000 0x4000 boot.part
read_mmc.py 0x1b80000 0x4000 recovery.part
read_mmc.py 0x2380000 0x4000 KB.part
read_mmc.py 0x2480000 0x4000 DKB.part
read_mmc.py 0x2580000 0x4000 MISC.part
read_mmc.py 0x2600000 0x4000 persisbackup.part
read_mmc.py 0x3600000 0x4000 system.part
read_mmc.py 0x4e600000 0x4000 cache.part
read_mmc.py 0x85600000 0x4000 userdata.part
[/strike]
4. Download 453_padded_img.zip from below and unpack. These are zero padded 4.5.3 bootloaders + TWRP. I had to pad them with zeroes since AFTV2 tools will discard the last chunk of the file if it's not in blocks of 256 bytes (?).
To restore 4.5.3 bootloaders & TWRP, you will run commands similar to the ones below (will take from 30-40 minutes to 5-6 hours in total). Again, do note that your addresses will be different, so do not use the commands below as is, before getting the unique offset for your Fire HD which will be provided after you post the zip file from Step 2 !!! If you try to figure out these addresses yourself, and do it incorrectly, you may permanently brick, and this time without ANY recovery
Code:
[strike]write_mmc.py 0x0900000 453p_tee1.img
write_mmc.py 0x1300000 453p_uboot.img
write_mmc.py 0x1b80000 453p_twrp.img[/strike]
(if you are getting this message "...Already done", you need to delete lastaddr.txt file in the aftv2-tools folder, thanks to @Kramar111 for pointing this out !!! )
5. Repeat the read commands from Step 3, save the outputs (again, using your unique addresses provided to you in this thread !). Make sure you are not overwriting the outputs from Step 3.
6. Send the command to disconnect, and hopefully the device will reboot. Hold the "Vol+" button to get into TWRP. Then either flash the proper bootloaders in TWRP (to make whatever ROM you already have installed bootable again), or replace the entire ROM as per these instructions (link). If you choose the wrong bootloaders again, you will have to repeat Step 4 to get TWRP back (!!!)
Code:
C:\extra\android\kindle_root\aftv2-tools>read32.py 0 1
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
[COLOR="Red"]
(and the device turns off here, and will reboot)[/COLOR]
7. Once you reboot to TWRP, proceed to the post discussing how to install rooted FireOS via TWRP:
http://forum.xda-developers.com/fire-hd/general/how-to-upgrade-to-lollipop-root-gapps-t3163950
Appendix 1
These are currently known addresses (so if you are skilled, you can try to use a HEX editor to figure out if your UBOOT (LK) partition matches any of these). In general, LK is the easiest to identify. If not, post the blocks in the forum, and the addresses will be supplied to you. Remember, your addresses could end up being different from the choices provided below !!!
Option A. LK @ 0x1300000
Reading the partitions for quality control :
Code:
read_mmc.py 0x0400000 0x4000 00.part
read_mmc.py 0x0408000 0x4000 PRO_INFO.part
read_mmc.py 0x0500000 0x4000 PMT.part
read_mmc.py 0x0900000 0x4000 TEE1.part
read_mmc.py 0x0e00000 0x4000 TEE2.part
read_mmc.py 0x1300000 0x4000 UBOOT.part
read_mmc.py 0x1380000 0x4000 boot.part
read_mmc.py 0x1b80000 0x4000 recovery.part
read_mmc.py 0x2380000 0x4000 KB.part
read_mmc.py 0x2480000 0x4000 DKB.part
read_mmc.py 0x2580000 0x4000 MISC.part
read_mmc.py 0x2600000 0x4000 persisbackup.part
And writing TWRP & related :
Code:
write_mmc.py 0x0900000 453p_tee1.img
write_mmc.py 0x1300000 453p_uboot.img
write_mmc.py 0x1b80000 453p_twrp.img
Option B. LK @ 0x1680000
Reading the partitions for quality control :
Code:
read_mmc.py 0x0780000 0x4000 00.part
read_mmc.py 0x0788000 0x4000 PRO_INFO.part
read_mmc.py 0x0880000 0x4000 PMT.part
read_mmc.py 0x0c80000 0x4000 TEE1.part
read_mmc.py 0x1180000 0x4000 TEE2.part
read_mmc.py 0x1680000 0x4000 UBOOT.part
read_mmc.py 0x1700000 0x4000 boot.part
read_mmc.py 0x1f00000 0x4000 recovery.part
read_mmc.py 0x2700000 0x4000 KB.part
read_mmc.py 0x2800000 0x4000 DKB.part
read_mmc.py 0x2900000 0x4000 MISC.part
read_mmc.py 0x2980000 0x4000 persisbackup.part
And writing TWRP & related :
Code:
write_mmc.py 0x0c80000 453p_tee1.img
write_mmc.py 0x1680000 453p_uboot.img
write_mmc.py 0x1f00000 453p_twrp.img
Option C. LK @ 0x1900000
Reading the partitions for quality control :
Code:
read_mmc.py 0x0a00000 0x4000 00.part
read_mmc.py 0x0a08000 0x4000 PRO_INFO.part
read_mmc.py 0x0b00000 0x4000 PMT.part
read_mmc.py 0x0f00000 0x4000 TEE1.part
read_mmc.py 0x1400000 0x4000 TEE2.part
read_mmc.py 0x1900000 0x4000 UBOOT.part
read_mmc.py 0x1980000 0x4000 boot.part
read_mmc.py 0x2180000 0x4000 recovery.part
read_mmc.py 0x2980000 0x4000 KB.part
read_mmc.py 0x2a80000 0x4000 DKB.part
read_mmc.py 0x2b80000 0x4000 MISC.part
read_mmc.py 0x2c00000 0x4000 persisbackup.part
And writing TWRP & related :
Code:
write_mmc.py 0x0f00000 453p_tee1.img
write_mmc.py 0x1900000 453p_uboot.img
write_mmc.py 0x2180000 453p_twrp.img
Other stuff of interest:
On Fire 2015, one could get UART logs from a bricked Fire via the following instructions (by connecting a FT232RL USB-to-TTL-Serial adapter to a 5-pin micro USB plug). Unfortunately, this procedure does not work on Fire HD 2014.
http://forum.xda-developers.com/showpost.php?p=65585385&postcount=16
http://forum.xda-developers.com/showpost.php?p=65587440&postcount=17
http://forum.xda-developers.com/showpost.php?p=65588189&postcount=18
Here is a sample log from my AFTV2 tools trials on my Fire HD (Windows XP, Python 3.4). And your addresses will be different, so don't write anything just yet (my comments below are in red) :
C:\extra\android\kindle_root\aftv2-tools>python -m pip install pyserial==3.0.1
(the latest 3.1.1 pyserial would not work under WinXP)
C:\extra\android\kindle_root\aftv2-tools>handshake.py
Waiting for preloader...
(now plug in fully turned off Fire HD, it'll get turned on by the USB power, and I already had preloader drivers from the prior bricked Fire HD, so handshake completed just fine)
Found port = COM8
Handshake complete!
C:\extra\android\kindle_root\aftv2-tools>read_mmc.py 0x1400000 0x1000 tee2.part
Addr: 0x1400000
Addr: 0x1400200
Addr: 0x1400400
Addr: 0x1400600
Addr: 0x1400800
Addr: 0x1400a00
Addr: 0x1400c00
Addr: 0x1400e00
C:\extra\android\kindle_root\aftv2-tools>write_mmc.py 0x1400000 tee2.part
Addr: 0x1400000
Addr: 0x1400200
Addr: 0x1400400
Addr: 0x1400600
Addr: 0x1400800
Addr: 0x1400a00
Addr: 0x1400c00
Addr: 0x1400e00
C:\extra\android\kindle_root\aftv2-tools>write_mmc.py 0x1400000 tee2.part
Addr: 0x1400000
...Already done
Addr: 0x1400200
...Already done
Addr: 0x1400400
...Already done
Addr: 0x1400600
...Already done
Addr: 0x1400800
...Already done
Addr: 0x1400a00
...Already done
Addr: 0x1400c00
...Already done
Addr: 0x1400e00
...Already done
(if you are getting this message "...Already done", you need to delete lastaddr.txt file in the aftv2-tools folder, thanks to @Kramar111 for pointing this out !!! )
C:\extra\android\kindle_root\aftv2-tools>read32.py 0 1
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
(and the device turns off here, and will reboot)
I've also poked around, and found the Fire HD preloader sitting in /dev/block/mmcblk0boot0 (see the attached file). It does not seem to have any ANTI-ROLLBACK strings, but still bricks. It's definitely smaller than the version from Fire 2015, but the beginning of it looks similar. There is also another partition, /dev/block/mmcblk0boot1, which seems to contain all the key data for the device.
@moroxoro, @notorious.dds, @CJD14, @DoLooper, @Gimzie, @kirito9, @sd_shadow, @Drevenu, @kyle12345109876, @Kramar111, @zeroepoch, @hwmod

I have a bricked Fire HD 6 (4th Gen) and would like to try this, but this wasn't my device. I'm just trying to help a friend. I'm not even sure what android/amazon version it was on before bricked. All he told me was he updated to 4.5.5 and then it bricked.
I will probably edit this as I get more info from him. Good thing you've started here @bibikalka

OK, the key data are the addresses. The info is from these posts :
http://forum.xda-developers.com/fire-hd/development/uart-port-fire-hd6-t2991474 (thank you @powerpoint45 !!!)
http://forum.xda-developers.com/fire-hd/help/internal-memory-structure-hidden-t3122246
So these are hex values for 512 byte sectors :
Code:
[PART] 1: 00000100 00000040 'PRO_INFO'
[PART] 2: 00002000 00000800 'PMT'
[PART] 3: 00002800 00002800 'TEE1'
[PART] 4: 00002800 00005000 'TEE2'
[PART] 5: 00000400 00007800 'UBOOT'
[PART] 6: 00004000 00007C00 'boot'
[PART] 7: 00004000 0000BC00 'recovery'
[PART] 8: 00000800 0000FC00 'KB'
[PART] 9: 00000800 00010400 'DKB'
[PART] 10: 00000400 00010C00 'MISC'
[PART] 11: 00008000 00011000 'persisbackup'
[PART] 12: 00258000 00019000 'system'
[PART] 13: 001B8000 00271000 'cache'
[PART] 14: 018F3FDF 00429000 'userdata'
This leads to :
Note, these are not correct, see post #1
Part Address Length
TEE1 0x0500000 0x0500000
UBOOT 0x0F00000 0x0080000
recovery 0x1780000 0x0800000
And, these commands should save the partitions (if my math is correct !!!) :
./read_mmc.py $((0x0500000)) $((0x0500000)) tee1.part
./read_mmc.py $((0x0F00000)) $((0x0080000)) uboot.part
./read_mmc.py $((0x1780000)) $((0x0800000)) recovery.part
One may read only the first few blocks, and see if the addresses are good.

Wow, nice to see that more progress has been made! The thread title states that this guide is for if you downgraded to an older lollipop version, but would it also work if you upgraded to 4.5.3 - 4.5.5.1? That kindle that I bricked was sent to Amazon and they sent back a refurbished one. I would be happy to post the addresses later though!

Yahoo !!! I could try the steps, and everything seems to be working! See post #1 for updates.
Fortunately, I did not have to unbrick anything, so we'll wait for reports where this is actually useful.

bibikalka said:
Yahoo !!! I could try the steps, and everything seems to be working! See post #1 for updates.
Fortunately, I did not have to unbrick anything, so we'll wait for reports where this is actually useful.
Click to expand...
Click to collapse
Happy to hear this method work on the Fire HD 7 !!!
As i said in a previous post of the OT it seems this method could work on the entire line of Mediatek new SoCs.
We have to say thanks to @zeroepoch for these Python helpers, they are really useful and will save many "bricked" devices.
.:HWMOD:.

Hi,I'm Japanese. Sorry,I,m not good at English
I instlled mtk-drivers to my PC.
(http://forum.xda-developers.com/elephone-m2/help/windows-10-mtk-vcom-usb-drivers-32-64-t3267033)
I tried
1. handshake.py is OK
2. read_mmc.py 0x0F00000 0x1000 tee1.part
read_mmc.py 0x1400000 0x1000 tee2.part
read_mmc.py 0x1900000 0x1000 uboot.part
read_mmc.py 0x1980000 0x1000 boot.part
read_mmc.py 0x2180000 0x1000 recovery.part
is OK
3.write_mmc.py 0x0F00000 453_tee1.img is OK about 10min
write_mmc.py 0x1900000 453_uboot.img is OK about 1min
write_mmc.py 0x2180000 453_twrp.img is OK about 15min
4.read_mmc.py 0x1400000 0x1000 tee2.part is OK
5.write_mmc.py 0x1400000 tee2.part is OK
6. read32.py 0 1
Log is this
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
0:
<===
Traceback (most recent call last):
File "D:\aftv2-tools\read32.py", line 69, in <module>
ret = read32(addr, size)
File "D:\aftv2-tools\read32.py", line 49, in read32
data = dev.read(4)
File "C:\Python34\lib\site-packages\serial\serialwin32.py", line 269, in read
raise SerialException('call to ClearCommError failed')
serial.serialutil.SerialException: call to ClearCommError failed
I can't unbrick yet.
HD6 stuck on black screen...
Please tell me the step-by-step instructions!

Liz-kawa said:
Hi,I'm Japanese. Sorry,I,m not good at English
2. read_mmc.py 0x0F00000 0x1000 tee1.part
read_mmc.py 0x1400000 0x1000 tee2.part
read_mmc.py 0x1900000 0x1000 uboot.part
read_mmc.py 0x1980000 0x1000 boot.part
read_mmc.py 0x2180000 0x1000 recovery.part
is OK
I can't unbrick yet.
HD6 stuck on black screen...
Please tell me the step-by-step instructions!
Click to expand...
Click to collapse
First, please hold "Pwr" button for a really long time, like 1 minute. Try it a few times, perhaps, it'll come up?
Then, please do this :
read_mmc.py 0x0F00000 0x1000 tee1.part2
read_mmc.py 0x1900000 0x1000 uboot.part2
read_mmc.py 0x2180000 0x1000 recovery.part2
Then make a *zip of these 3 files (*.part2), and upload it here. I want to see if the new images were indeed written to the Fire.

Dear bibikalka
Then make a *zip of these 3 files (*.part2), and upload it here. I want to see if the new images were indeed written to the Fire.[/QUOTE]
I try your advice. I attached here.

Liz-kawa said:
Dear bibikalka
Then make a *zip of these 3 files (*.part2), and upload it here. I want to see if the new images were indeed written to the Fire.
I try your advice. I attached here.
Click to expand...
Click to collapse
If you still have old pieces of partitions from the commands below that you ran last time, please zip them and post them here (all *.part files):
read_mmc.py 0x0F00000 0x1000 tee1.part
read_mmc.py 0x1400000 0x1000 tee2.part
read_mmc.py 0x1900000 0x1000 uboot.part
read_mmc.py 0x1980000 0x1000 boot.part
read_mmc.py 0x2180000 0x1000 recovery.part
I want to make sure that the addresses are the same on your Fire, and that these *part files look OK.
Your short pieces of partitions look OK (part2 files you've uploaded). Just to be double sure, try to write them again (unlikely to work, but hey, it's simple!) :
(First, delete lastaddr.txt file in the aftv2-tools folder if it's there)
write_mmc.py 0x0F00000 453_tee1.img
write_mmc.py 0x1400000 453_tee1.img
write_mmc.py 0x1900000 453_uboot.img
write_mmc.py 0x2180000 453_twrp.img
(the address @ 0x1400000 will also have TEE2 updated)
Then hold Power button for 1 min several times.
If we still cannot get this to work, it'd be probably helpful to get the UART port output. This requires more than software, but would provide some useful diagnostics :
http://forum.xda-developers.com/fire-hd/development/uart-port-fire-hd6-t2991474

bibikalka said:
If you still have old pieces of partitions from the commands below that you ran last time, please zip them and post them here (all *.part files):
read_mmc.py 0x0F00000 0x1000 tee1.part
read_mmc.py 0x1400000 0x1000 tee2.part
read_mmc.py 0x1900000 0x1000 uboot.part
read_mmc.py 0x1980000 0x1000 boot.part
read_mmc.py 0x2180000 0x1000 recovery.part
Click to expand...
Click to collapse
Thank you for your analysis. I will attach the necessary files. For the second half, I will try later.

Liz-kawa said:
Thank you for your analysis. I will attach the necessary files. For the second half, I will try later.
Click to expand...
Click to collapse
OK, for some reason your tee2.part looks like junk. I wonder how it happened. Can the write command be failing ? Or Tee1 file is too long ? Still, it should not matter ...
In the list of your commands you first wrote to TEE1, and then read from TEE2 again. So could the 1st write command screw up the TEE2 address range ?
Update: I've removed TEE2 address from the new instructions, I am not sure what's going on there ...

bibikalka said:
Your short pieces of partitions look OK (part2 files you've uploaded). Just to be double sure, try to write them again (unlikely to work, but hey, it's simple!) :
(First, delete lastaddr.txt file in the aftv2-tools folder if it's there)
write_mmc.py 0x0F00000 453_tee1.img
write_mmc.py 0x1400000 453_tee1.img
write_mmc.py 0x1900000 453_uboot.img
write_mmc.py 0x2180000 453_twrp.img
(the address @ 0x1400000 will also have TEE2 updated)
Click to expand...
Click to collapse
I ran your advice twice, but my machine can not be recovered after all.
Thank you for your help.

@bibikalka I've started trying to unbrick the Fire HD 6 that I have here but I'm having a bit of trouble with the first part...handshake. I know you need the preloader drivers which I installed and do have (see attached images) but I'm not sure if there is a different way of installing the preloader drivers for Amazon.
I tried the handshake with my other MTK device to make sure that I do indeed have the preloader drivers but it's was working (see attached images).
Any help you can provide would be great.
EDIT: I solved it.
What I did was use "mdmcpq.inf" or "usb2ser_win7.inf" (I'm sorry, but I'm not sure which because I was just trying all) from the win_drivers of the aftv2-tools folder. I right clicked on the MT65XX preloader and manually installed the driver by selecting the .inf file previously mentioned.

Liz-kawa said:
I ran your advice twice, but my machine can not be recovered after all.
Thank you for your help.
Click to expand...
Click to collapse
Are you still around ???
I want to understand why your TEE2 looks nothing like what it should be. Do you mind running a few commands for me ? Thanks!

bibikalka said:
Are you still around ???
I want to understand why your TEE2 looks nothing like what it should be. Do you mind running a few commands for me ? Thanks!
Click to expand...
Click to collapse
It is still there. I would like to respond to your wish.

Liz-kawa said:
It is still there. I would like to respond to your wish.
Click to expand...
Click to collapse
OK, please read this data:
read_mmc.py 0x0A00000 0x8000 00.part3
read_mmc.py 0x0A08000 0x1000 pro_info.part3
read_mmc.py 0x0B00000 0x1000 pmt.part3
read_mmc.py 0x1400000 0x1000 tee2.part3
read_mmc.py 0x13FF000 0x1000 tee2_pre.part3
Then zip all these *part3 files, and post them here. I still cannot figure out why your TEE2 is full of junk ...
By the way, do you have an 8 Gb or 16 Gb Fire ?
Update :
It looks like one could read the UART log via the micro-USB connector :
http://forum.xda-developers.com/showpost.php?p=65585385&postcount=16
http://forum.xda-developers.com/showpost.php?p=65587440&postcount=17
http://forum.xda-developers.com/showpost.php?p=65588189&postcount=18
We really need to get this for a bricked Fire HD, otherwise it's all work in the dark ... Unfortunately, this route still requires a bit of special hardware ...

bibikalka said:
OK, please read this data:
read_mmc.py 0x0A00000 0x8000 00.part3
read_mmc.py 0x0A08000 0x1000 pro_info.part3
read_mmc.py 0x0B00000 0x1000 pmt.part3
read_mmc.py 0x1400000 0x1000 tee2.part3
read_mmc.py 0x13FF000 0x1000 tee2_pre.part3
Then zip all these *part3 files, and post them here. I still cannot figure out why your TEE2 is full of junk ...
Click to expand...
Click to collapse
Now late, but it will send the necessary files.
Before you erase(#10), I ran once "write_mmc.py 0x1400000 453_tee1.img".
I have 8GB Fire.
Thank you for your analysis and help.

Liz-kawa said:
Now late, but it will send the necessary files.
Before you erase(#10), I ran once "write_mmc.py 0x1400000 453_tee1.img".
I have 8GB Fire.
Thank you for your analysis and help.
Click to expand...
Click to collapse
So it seems that there is garbage data in many key partitions. So either your addresses are different than mine. Or, the whole bunch of partitions got somehow corrupted. At this point it's not possible to tell ... Perhaps, we'll get another data point soon, and then we can revisit this issue.
It does not seem like there could be much progress without being able to read the UART logs via :
http://forum.xda-developers.com/showpost.php?p=65585385&postcount=16
http://forum.xda-developers.com/showpost.php?p=65587440&postcount=17
http://forum.xda-developers.com/showpost.php?p=65588189&postcount=18
Btw, it seems like it'd be a $3-4 budget (and ~ 1 month of wait), to get the materials to build the serial port reader from eBay. An easy route is to hook up :
1) USB OTG cable to Fire, converting 5 pin micro USB to the regular USB (female)
2) USB (male) to serial (4 split pins)
3) FT232RL USB-to-TTL-Serial adapter hooked up to 2)
4) another male-male USB cable connecting 3) to a computer

Liz-kawa said:
Now late, but it will send the necessary files.
Before you erase(#10), I ran once "write_mmc.py 0x1400000 453_tee1.img".
I have 8GB Fire.
Thank you for your analysis and help.
Click to expand...
Click to collapse
OK, I think I may have good news for you. I've tried my 2nd Fire HD (with Lollipop), and the addresses appear different ! Please run these commands, zip the files, and post them here :
read_mmc.py 0x0C80000 0x1000 tee1.part
read_mmc.py 0x1180000 0x1000 tee2.part
read_mmc.py 0x1680000 0x1000 uboot.part
read_mmc.py 0x1700000 0x1000 boot.part
read_mmc.py 0x1F00000 0x1000 recovery.part
If the new addresses are correct, we may be able to still unbrick !!! But before we write anything, let's make sure that the addresses are correct.
Update : I think KB and DKB partitions got destroyed with the earlier attempts, so if the unbrick does not work, I'll provide you with new ones to overwrite KB and DKB.

Related

Reflashing the EEPROM

Hello all...
as in these threads for the Hermes:
http://forum.xda-developers.com/showthread.php?t=322225
and
http://forum.xda-developers.com/showthread.php?t=296936
and
http://forum.xda-developers.com/showthread.php?t=299451
I seemed to have screwed up my EEPROM while flashing to WM6 via HardSPL, the problem is that there was a power outage halfway through the process and now ANY ROM that I flash it to there is NO WIFI... It is there, it just won't work.
I have read that this is due to my EEPROM being screwed up due to bad flashing. Before I say that the MoBo is fried, I would like to try to reflash the EEPROM part
I have tried to mmty and putty and plink while no commands are able to be registered on the s200.
Could anyone with some expertise assist me in rewriting my EEPROM (I have the SPL from a 2.20 official ROM) - I assume that I need to write it back via putty, but I cannot seem to send commands to the device!
PLEASE HELP!
Thanks in advance for any assistance in this matter.
same here...i tried but cant get the commands to work like you...pls let me know if you find a solution.
Off course it will not work, different doc and different addresses
It is your cid block at n1, not the SPL, please use pdocread.exe like this
Pdocread.exe -n 0 0 0xaf0000 spl.nb
pdocread -n 1 0 0x40000 cidblock.bin
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
compress the files using 7-zip ultra compression and send them to my mail
I'll try to help
or the MAC adress can be found @ offset 3e5c in gsmdata.bin
long live Palestine
Jeff said:
I seemed to have screwed up my EEPROM while flashing to WM6 via HardSPL,
Click to expand...
Click to collapse
I think it is not hard SPL
Code:
hard spl G3
99DCC: 00 0D
99DCE: A0 00
99DCF: E1 1A
99DEC: 00 13
99DEE: A0 00
99DEF: E1 0A
99DFC: 00 0F
99DFE: A0 00
99DFF: E1 1A
99FCC: 00 0D
99FCE: A0 00
99FCF: E1 1A
99FEC: 00 13
99FEE: A0 00
99FEF: E1 0A
99FFC: 00 0F
99FFE: A0 00
99FFF: E1 1A
paradis_pal
Chopin,
Mail sent as requested... Thank you IMMENSELY for your attention and assistance.
Pdocread.exe -n 0 0 0xaf0000 spl.nb returns this error:
"ERROR: ITReadDisk : read 00008000 bytes - A device attached to the system is not functioning."
However the other two were successful...
Is this because the SPL is bugged?
I sent you mail back
Again it is not the SPL, sorry the command I wrote was wrong
Pdocread.exe -n 0 0 0x1f0000 spl.nb
Waiting your test, and there is no risk as you have a backup
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
and send the file again
and tell me what is the size of the pdocread and pdocwrite
use the new itsutils tools
and what do u have g3 or g4?
Just to add my $0.02... this thread has helped me somewhat with my Kaiser and @chopin: http://youtube.com/watch?v=MZTGYxVGzQg
seattleweb said:
Just to add my $0.02... this thread has helped me somewhat with my Kaiser and @chopin: http://youtube.com/watch?v=MZTGYxVGzQg
Click to expand...
Click to collapse
youtube is forbbiden in Syria, what is this?
@Jeff
I checked your cidblock.bin and it is correct
but gsmdata.bin is corrupted, try to flash it again
YouTube Link
It is
Arvo Pärt: Silouans Song / Vienna Philharmonic Women
A NEW message now!
"pdocwrite -n 1 -b 0x4000 gsmdata.bin 0x40000 0x4000
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: ITWriteDisk - The drive cannot locate a specific area or track on the disk."
This is with the newer versions of Pdocwrite with the GOOD GSMData...
I am lost at this point...
pdocwrite -n 1 gsmdata.bin 0x40000 0x4000
The Mystery thickens...
With the 104K Pdocwrite I get:
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: could not read 0x0 bytes of preceeding sector data at 0x40000
With the 140K Pdocwrite I get:
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: ITReadDisk : read 00004000 bytes - Data error (cyclic redundancy check).
wrong information for me, no one rea this please
You have mail!
Chopin said:
Off course it will not work, different doc and different addresses
It is your cid block at n1, not the SPL, please use pdocread.exe like this
Pdocread.exe -n 0 0 0xaf0000 spl.nb
pdocread -n 1 0 0x40000 cidblock.bin
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
compress the files using 7-zip ultra compression and send them to my mail
I'll try to help
or the MAC adress can be found @ offset 3e5c in gsmdata.bin
long live Palestine
Click to expand...
Click to collapse
Glad u back from silence...
Nice to see u here
Jeff said:
You have mail!
Click to expand...
Click to collapse
Now I need help
Why in the new itsutils tools the gsm data @ offset 0x10000 with block size 0x4000
In the old one @offset 0x40000 with the same block size?
Is it a joke?
@jeff
But first back up GSM data and send it to my mail
Use the updated change MAC address tool it works now, to restore and write GSM data
kram3r said:
Glad u back from silence...
Nice to see u here
Click to expand...
Click to collapse
thanks my other man
nice to have some people like me, becasue a lot hate me
IT WORKED!
I WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I now have Wifi Back on my Prophet!!!!
All hail Chopin for his concern for the welfare of others, many should make him an example!
Dude, I owe you some virtual beer or something...
I am indebted to you, thank you from the bottom of my heart.
"You shouldn't worry about what some think of you, what you think of yourself is more important." - Jeff
you are welcome
just say please if you like me, Long live Palestine

[UTIL][ALL][MT65XX] Partitions Resizer

Hi every one.
Only for rooted MT65XX phones, tested with MT6592, MT6589 and MT6582.
In Mediatek phones, the total storage space is shared between the ANDROID (/system), CACHE, DATA (on witch apps will be installed) and FAT (Phone Storage, like an internal SDCARD)
With this tool you can decide witch space to give to eatch part, by resizing any of those 4 partitions.
It is useful if you have already an external SDCARD and you do not need the Phone Storage, so with this program, you can give the DATA the max of space.
0- Do a full backup of your rom in the recovery (important!)
1- Do a backup with MtkDroidTools and create, always with MtkDroidTools, the files for SPFlashTool.
2- With this program, open the scatter freshly created in step 1, resize as you want, and apply changes. (to avoid resizing the partitions you do not want to resize, disable their resize using the small colored buttons)
The new scatter will be created in the same folder than the original as 'MT65XX_Android_Scatter_MOD.txt'
3- Do a "firmware upgrade" with SPFlashTool and the new modded scatter
4- Enter the recovery and do a full restore.
It is a Java program (jar file) so you can execute it under any OS, with java installed : www.java.com
the sources are in the jar file, or here : https://code.google.com/p/jmtkdataresizer
ChangeLog:
=========
- V1.0 : first version, only data/fat resizer
- V2.0 : can resize the 4 partitions ANDROID/CACHE/DATA/FAT, and add the possibilty to disable resize for some partitions (the small colored buttons)
- V2.1 : some cosmetic and minor changes
- V2.2 : can now accept scatters without FAT size information (in this case, only other partitions can be resized)
- V2.3 : add the ability to use firmware.info if present, if not it will ask for the FAT partition size, if the scatter does not contains this info : thank you iZLeeP
- V2.31: can handle now scatter without FAT partition.
- V2.32: correct a bug with some firmware.info files
Tips:
1- the file firmware.info is created by MtkDroidTools while backuping, copy it in the same directory than the scatter or its parent, it will be detected and used if needed.
2- if you want to be sur that the new modded scatter is correct, open it with this program and try to resize : if the apply button is enabled --> OK (do not apply, just a test)
Enjoy
dreambo said:
Hi every one.
Only for rooted MT65XX phones, tested with MT6592, MT6589 and MT6582.
In Mediatek phones, the total storage space is shared with the DATA (on witch apps will be installed) and FAT (Phone Storage, like an internal SDCARD)
With this is a tool you can decide witch space to give to eatch part, by resizing the DATA/FAT partitions.
It is useful if you have already an external SDCARD and you do not need the Phone Storage, so with this program, you can give the DATA the max of space.
1- First do a backup with MtkDroidTools and create, always with MtkDroidTools, the files for SPFlashTool.
2- With this program, open the scatter freshly created in step 1, resize as you want, and apply changes.
The new scatter will be created in the same folder than the original as 'MT65XX_Android_Scatter_MOD.txt'
3- Flash it with SPFlashTools (firmware update) and enjoy.
It is a Java program (jar file) so you can execute it under any OS, with java installed : www.java.com
Click to expand...
Click to collapse
Hi awesome tool!
Thanks but can you share/make a system partitioner tool, I can resize my "SYSTEM" partition. It's 890 Mb I want it around 1.4 Gb
Tech N You said:
Hi awesome tool!
Thanks but can you share/make a system partitioner tool, I can resize my "SYSTEM" partition. It's 890 Mb I want it around 1.4 Gb
Click to expand...
Click to collapse
A good idea
Il will add that in the future version.
The cache partition must be touched too!
It will be so ANDROID/CACHE/DATA/FAT resizer (ANDROID= /system) it will be complicated.
It will be my next goal.
Thank you for your interest
dreambo said:
A good idea
Il will add that in the future version.
The cache partition must be touched too!
It will be so ANDROID/CACHE/DATA/FAT resizer (ANDROID= /system) it will be complicated.
It will be my next goal.
Thank you for your interest
Click to expand...
Click to collapse
Awesome will be waiting :laugh::good:
dreambo said:
Hi every one.
Only for rooted MT65XX phones, tested with MT6592, MT6589 and MT6582.
In Mediatek phones, the total storage space is shared between the DATA (on witch apps will be installed) and FAT (Phone Storage, like an internal SDCARD)
With this tool you can decide witch space to give to eatch part, by resizing the DATA/FAT partitions.
It is useful if you have already an external SDCARD and you do not need the Phone Storage, so with this program, you can give the DATA the max of space.
1- First do a backup with MtkDroidTools and create, always with MtkDroidTools, the files for SPFlashTool.
2- With this program, open the scatter freshly created in step 1, resize as you want, and apply changes.
The new scatter will be created in the same folder than the original as 'MT65XX_Android_Scatter_MOD.txt'
3- Flash it with SPFlashTools (firmware update) and enjoy.
It is a Java program (jar file) so you can execute it under any OS, with java installed : www.java.com
Click to expand...
Click to collapse
@dreambo any update on system partitioner increaser?
For this WE max, sure.
Sent from my 709v92_jbla828 using XDA Free mobile app
dreambo said:
For this WE max, sure.
Sent from my 709v92_jbla828 using XDA Free mobile app
Click to expand...
Click to collapse
Sorry didn't catch your phrase
Sent from my bobobibi
Excuse me, I want to say maximum this week-end, my English is very French
Sent from my 709v92_jbla828 using XDA Free mobile app
dreambo said:
Excuse me, I want to say maximum this week-end, my English is very French
Sent from my 709v92_jbla828 using XDA Free mobile app
Click to expand...
Click to collapse
Oh no problem please take your time
Sent from my bobobibi
Tech N You said:
Oh no problem please take your time
Click to expand...
Click to collapse
It is here, please test it and tell me if it works for you.
thank you
Awesome :good:
Sent from 8x-1000 Using XXX ROM (Xceptional XPERIA Xperiance)
dreambo said:
It is here, please test it and tell me if it works for you.
thank you
Click to expand...
Click to collapse
Hey the apply button isn't working! :crying:
LOG here
The DATA and FAT partitions must be found!
Please check your scatter, MBR, EBR1 and EBR2 files
Partitions: {}
totalSize=15528361984 byte (100%)
Before:
sysSize=947912704 byte (6%)
cacheSize=134217728 byte (1%)
dataSize=4294967296 byte (28%)
fatSize=10151264256 byte (65%)
Tech N You said:
Hey the apply button isn't working! :crying:
LOG here
The DATA and FAT partitions must be found!
Please check your scatter, MBR, EBR1 and EBR2 files
Partitions: {}
totalSize=15528361984 byte (100%)
Before:
sysSize=947912704 byte (6%)
cacheSize=134217728 byte (1%)
dataSize=4294967296 byte (28%)
fatSize=10151264256 byte (65%)
Click to expand...
Click to collapse
The apply button is disabled when the program can not find the partitions, given in the scatter, in the boot sectors MBR, EBR1 and EBR2.
Can you give me those 4 files : scatter, MBR, EBR1 and EBR2 (if exists) ?
dreambo said:
The apply button is disabled when the program can not find the partitions, given in the scatter, in the boot sectors MBR, EBR1 and EBR2.
Can you give me those 4 files : scatter, MBR, EBR1 and EBR2 (if exists) ?
Click to expand...
Click to collapse
Sure attaching them here
dreambo said:
The apply button is disabled when the program can not find the partitions, given in the scatter, in the boot sectors MBR, EBR1 and EBR2.
Can you give me those 4 files : scatter, MBR, EBR1 and EBR2 (if exists) ?
Click to expand...
Click to collapse
@dreambo Here are the files. See the attached files and remove ".txt" from MBR EBR1 and EBR2 had to rename them as XDA won't let them upload
Tech N You said:
@dreambo Here are the files. See the attached files and remove ".txt" from MBR EBR1 and EBR2 had to rename them as XDA won't let them upload
Click to expand...
Click to collapse
He is the log I have with those files:
Code:
FAT and DATA sizes must be present in the scatter file!
Please check your scatter (it is made by MtkDroiTools ?)
You can manualy add DATA and FAT sizes in the scatter using MtkDroiTools
Partitions: {ANDROID={0=EBR1}, USRDATA={2=EBR1}, CACHE={1=EBR1}, FAT={0=EBR2}}
totalSize=5377097728 byte (100%)
Before:
sysSize=947912704 byte (18%)
cacheSize=134217728 byte (2%)
dataSize=4294967296 byte (80%)
fatSize=0 byte (0%)
I am not sure that those files are the same you have test in you previous post, the log was different, the probleme was the boot records (perhaps not in the same folder than the scatter) and not the scatter (patition sizes was found) but Now, the boot records are OK (partitions was found) but not the scatter : the FAT size is 0!
If I merge the 2 logs, I can add the fat size from the previous log, to the scatter you give me, and the result is OK :
Code:
Partitions: {ANDROID={0=EBR1}, USRDATA={2=EBR1}, CACHE={1=EBR1}, FAT={0=EBR2}}
totalSize=15528361984 byte (100%)
Before:
sysSize=947912704 byte (6%)
cacheSize=134217728 byte (1%)
dataSize=4294967296 byte (28%)
fatSize=10151264256 byte (65%)
So, just open you scatter you give me in text editor, and replace the line "partition_size: 0x0" with this "partition_size: 0x25D100000" in the FAT section (partition_index: SYS19) and you will be able to resize your partitions.
do not forgot, the scatter and boot records (MBR, EBR1 and EBR2) must be in the same folder!
I am waiting your feedback.
dreambo said:
He is the log I have with those files:
Code:
FAT and DATA sizes must be present in the scatter file!
Please check your scatter (it is made by MtkDroiTools ?)
You can manualy add DATA and FAT sizes in the scatter using MtkDroiTools
Partitions: {ANDROID={0=EBR1}, USRDATA={2=EBR1}, CACHE={1=EBR1}, FAT={0=EBR2}}
totalSize=5377097728 byte (100%)
Before:
sysSize=947912704 byte (18%)
cacheSize=134217728 byte (2%)
dataSize=4294967296 byte (80%)
fatSize=0 byte (0%)
I am not sure that those files are the same you have test in you previous post, the log was different, the probleme was the boot records (perhaps not in the same folder than the scatter) and not the scatter (patition sizes was found) but Now, the boot records are OK (partitions was found) but not the scatter : the FAT size is 0!
If I merge the 2 logs, I can add the fat size from the previous log, to the scatter you give me, and the result is OK :
Code:
Partitions: {ANDROID={0=EBR1}, USRDATA={2=EBR1}, CACHE={1=EBR1}, FAT={0=EBR2}}
totalSize=15528361984 byte (100%)
Before:
sysSize=947912704 byte (6%)
cacheSize=134217728 byte (1%)
dataSize=4294967296 byte (28%)
fatSize=10151264256 byte (65%)
So, just open you scatter you give me in text editor, and replace the line "partition_size: 0x0" with this "partition_size: 0x25D100000" in the FAT section (partition_index: SYS19) and you will be able to resize your partitions.
do not forgot, the scatter and boot records (MBR, EBR1 and EBR2) must be in the same folder!
I am waiting your feedback.
Click to expand...
Click to collapse
I am so sorry but please can you do it for me I am a total noob in this please can u help
Tech N You said:
I am so sorry but please can you do it for me I am a total noob in this please can u help
Click to expand...
Click to collapse
here the correct scatter.
copy it in the same folder as MBR, EBR1 and EBR2, open it with JMTKResizer and you can resize your partitions
Code:
############################################################################################################
#
# General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
info:
- config_version: V1.1.2
platform: MT6592
project: j608_xolo
storage: EMMC
boot_channel: MSDC_0
block_size: 0x20000
############################################################################################################
#
# Layout Setting
#
############################################################################################################
- partition_index: SYS0
partition_name: PRELOADER
file_name: preloader_j608_xolo.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x40000
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADERS
reserve: 0x00
- partition_index: SYS1
partition_name: MBR
file_name: MBR
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS2
partition_name: EBR1
file_name: EBR1
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x80000
physical_start_addr: 0x80000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS3
partition_name: PRO_INFO
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x100000
physical_start_addr: 0x100000
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS4
partition_name: NVRAM
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x400000
physical_start_addr: 0x400000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BINREGION
reserve: 0x00
- partition_index: SYS5
partition_name: PROTECT_F
file_name: NONE
is_download: false
type: EXT4_IMG
linear_start_addr: 0x900000
physical_start_addr: 0x900000
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS6
partition_name: PROTECT_S
file_name: NONE
is_download: false
type: EXT4_IMG
linear_start_addr: 0x1300000
physical_start_addr: 0x1300000
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS7
partition_name: SECCFG
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1d00000
physical_start_addr: 0x1d00000
partition_size: 0x40000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS8
partition_name: UBOOT
file_name: lk.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1d40000
physical_start_addr: 0x1d40000
partition_size: 0x60000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS9
partition_name: BOOTIMG
file_name: boot.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1da0000
physical_start_addr: 0x1da0000
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS10
partition_name: RECOVERY
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x27a0000
physical_start_addr: 0x27a0000
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS11
partition_name: SEC_RO
file_name: secro.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x31a0000
physical_start_addr: 0x31a0000
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS12
partition_name: MISC
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x37a0000
physical_start_addr: 0x37a0000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS13
partition_name: LOGO
file_name: logo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3820000
physical_start_addr: 0x3820000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS14
partition_name: EBR2
file_name: EBR2
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x4020000
physical_start_addr: 0x4020000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS15
partition_name: EXPDB
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x40a0000
physical_start_addr: 0x40a0000
partition_size: 0xf60000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS16
partition_name: ANDROID
file_name: system.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x5000000
physical_start_addr: 0x5000000
partition_size: 0x38800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS17
partition_name: CACHE
file_name: cache.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x3d800000
physical_start_addr: 0x3d800000
partition_size: 0x8000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS18
partition_name: USRDATA
file_name: userdata.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x45800000
physical_start_addr: 0x45800000
partition_size: 0x100000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS19
partition_name: FAT
file_name: NONE
is_download: false
type: EXT4_IMG
linear_start_addr: 0x145800000
physical_start_addr: 0x145800000
partition_size: 0x25D100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS20
partition_name: BMTPOOL
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xFFFF00a8
physical_start_addr: 0xFFFF00a8
partition_size: 0x1500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
reserve: 0x00
@dreambo See this error! Device not turning on now! :crying:
Tech N You said:
@dreambo See this error! Device not turning on now! :crying:
Click to expand...
Click to collapse
Sorry for that
First, you have always the original scatter (never touched by the program) you can reflash it and revive the phone.
Second, some rules that we must know before using this program :
1- We must know what we are doing, if we resize a partition we must be sure that the image file designed for this partition can fit in the new partition
2- With SPFlashTool, we have to do (as mentinned in the help) a "firmware upgrade" or "format and download all", because we have touched the scatter structure
3- All files must to be provided to SPFlashTool, not only the modded ones.
I have used this program to resize the DATA/FAT partitions for my phone, and it is working as I expect now, it is a STAR N9800, an MT6592 like yours

[ROM] Fake Lenovo S900 5.5'' Unbrick [4.2.2]

I have a fake Lenovo S900 with a lot of apps that fake the real specs of this phone, so I made this rom base in the oficial ROM for Cubot GT88 since it is idential in the real hardware specs.
If you want a clean rom for your fake phone, then install this ROM check the real specs and dont have any other problems, so enjoy it.
1. Make a backup of your nvram with the MTKdroid Tools (IMEI backup)
2. Do a factory restore (dont do this part without previously backup your nvram o imei backup)
3. Use the Flash Tool to install this ROM.
4. Restore the nvram or imei.
Link:
Mega Folder
thanks! i have one but, i have a problem too
thanks! i have one but, i have a problem too
my fake s900 is not entering the menu apps anymore, im not able to navigate in apps or menus. i downloaded your rom, but how i can enter in recover mode in this phone? can you help me?
getting error to get root mode in mtkdroidtools to make a backup
---------- Post added at 08:21 PM ---------- Previous post was at 07:23 PM ----------
miottoss said:
thanks! i have one but, i have a problem too
my fake s900 is not entering the menu apps anymore, im not able to navigate in apps or menus. i downloaded your rom, but how i can enter in recover mode in this phone? can you help me?
getting error to get root mode in mtkdroidtools to make a backup
Click to expand...
Click to collapse
--->>> Connect to device <<<---
ATTENTION! Fake Hardware in kernel or firmware doesn't correspond to phone!
--- scatter is write to the file:
G:\New folder\MtkDroidTools\MT6572_Android_scatter.txt
--->>> Connect to device <<<---
ATTENTION! Fake Hardware in kernel or firmware doesn't correspond to phone!
--- ERROR ttycmd1 device NOT found!
--- Reboot in recovery ...
--->>> Connect to device <<<---
--- ERROR : --- TotalBytesPerChunk Not Found. Set default Page/Spare=2048/64 !!!
--- Unknown ROM structure, backup NOT possible!
--- ATTENTION! Recovery doesn't suit this phone!
--- Unknown ROM structure, backup NOT possible!
--- The preservation folder on the computer: G:\New folder\MtkDroidTools\backups\_700101_ForFlashtoolFromReadBack_150414-161914\
thank you very much!
still appears as lenovo?
model is really known? to seek alternative ROMS ...
I think it is a V5 Jiake, but not sure ... The V6 ROMs work fine, but do not work the cameras
in this ROM I keep getting 4GB of RAM .. some way to modify it to come out the real thing?
and no work the home button
i made this detailed post to try get some help.
hi a i have a fake lenovo s900, and after remove some bloatware, i have a loop in the start screen from android. im not able to enter system, he already back to lockscreen when i pass finger in the screen.
i tried a lot of tutorials, but im not able to make sp_tools recognize the phone.
but droid tools is working. here some photos when i conect in droid tools.
the button to root in droid tools, not work. droid tools freeze
the images are attached
i have a rom to test, but not able to make the sp_tools use the phone.
the rom in this thread: http://forum.xda-developers.com/gen...-5-unbrick-t3080479/post60112257#post60112257
folder with vid e images for details.
https://www.dropbox.com/sh/9g6sdft0pqh96lv/AADFCD-o9kk1XC6OvJZU3Gtia?dl=0
any idea how i can fix this? thanks!
miottoss said:
i made this detailed post to try get some help.
hi a i have a fake lenovo s900, and after remove some bloatware, i have a loop in the start screen from android. im not able to enter system, he already back to lockscreen when i pass finger in the screen.
i tried a lot of tutorials, but im not able to make sp_tools recognize the phone.
but droid tools is working. here some photos when i conect in droid tools.
the button to root in droid tools, not work. droid tools freeze
the images are attached
i have a rom to test, but not able to make the sp_tools use the phone.
the rom in this thread: http://forum.xda-developers.com/gen...-5-unbrick-t3080479/post60112257#post60112257
folder with vid e images for details.
https://www.dropbox.com/sh/9g6sdft0pqh96lv/AADFCD-o9kk1XC6OvJZU3Gtia?dl=0
any idea how i can fix this? thanks!
Click to expand...
Click to collapse
I was the same
the problem is the launcher, which is corrupt
I solved it like this:
down the notification bar and enter settings
click on settings (sometimes not work the first time, try more times)
once in settings, go to Applications
locate the store play
install any launcher to your liking
once installed, should have finished your problem, try and comment
im a noob here so i cant post links or files :/
I'm back to say that my fake S900 is ok again. i useD the romfrom heldigard friend. with this rom several software problems have been resolved, as the HDR CAM which no longer turns off the camera after taking a photo HDR. im testing more apps.
I do not know if it was that, but I did several extra steps.
installed the android SDK following these steps.
used drivers: ADB_usb_driver_120827_v3 and A25_USB_VCOM_Drivers
1- GOOGLE SEARCH: [TUTORIAL] Como instalar o SDK TOOLS e habilitar o ADB
2- YOUTUBE SEARCH: How To Flash ROM for Every China Phone with the SP Flash Tool ! [HD]
i just flashed "system.img" in ANDROID section of sp_tools.
after all installed mtkdroid_tools use to extract and save your android_scatter.txt-it
sp_tools open, choose your android_scatter, select ANDROID in the list below, and choose system.img.
click download
OFF with the device connect it to the USB
wait a few seconds and the sp_tools begin the the update
then just restart your phone
NOW YOU HAVE A CUBOT START SCREEN. NO MORE LENOVO.
wohooooooooooooooooooo!
miottoss said:
i made this detailed post to try get some help.
hi a i have a fake lenovo s900, and after remove some bloatware, i have a loop in the start screen from android. im not able to enter system, he already back to lockscreen when i pass finger in the screen.
i tried a lot of tutorials, but im not able to make sp_tools recognize the phone.
but droid tools is working. here some photos when i conect in droid tools.
the button to root in droid tools, not work. droid tools freeze
the images are attached
i have a rom to test, but not able to make the sp_tools use the phone.
the rom in this thread: http://forum.xda-developers.com/gen...-5-unbrick-t3080479/post60112257#post60112257
folder with vid e images for details.
https://www.dropbox.com/sh/9g6sdft0pqh96lv/AADFCD-o9kk1XC6OvJZU3Gtia?dl=0
any idea how i can fix this? thanks!
Click to expand...
Click to collapse
miottoss said:
im a noob here so i cant post links or files :/
I'm back to say that my fake S900 is ok again. i useD the romfrom heldigard friend. with this rom several software problems have been resolved, as the HDR CAM which no longer turns off the camera after taking a photo HDR. im testing more apps.
I do not know if it was that, but I did several extra steps.
installed the android SDK following these steps.
used drivers: ADB_usb_driver_120827_v3 and A25_USB_VCOM_Drivers
1- GOOGLE SEARCH: [TUTORIAL] Como instalar o SDK TOOLS e habilitar o ADB
2- YOUTUBE SEARCH: How To Flash ROM for Every China Phone with the SP Flash Tool ! [HD]
i just flashed "system.img" in ANDROID section of sp_tools.
after all installed mtkdroid_tools use to extract and save your android_scatter.txt-it
sp_tools open, choose your android_scatter, select ANDROID in the list below, and choose system.img.
click download
OFF with the device connect it to the USB
wait a few seconds and the sp_tools begin the the update
then just restart your phone
NOW YOU HAVE A CUBOT START SCREEN. NO MORE LENOVO.
wohooooooooooooooooooo!
Click to expand...
Click to collapse
tou're spanish?
vicent76 said:
tou're spanish?
Click to expand...
Click to collapse
br
miottoss said:
br
Click to expand...
Click to collapse
nah, curiosity...
in your previous post put a google search in Spanish, caught my attention.
a greeting
Hola! llevo con el telefono brickeado mas de un mes, he probado lo imposible y con todo tipo de FW y no hay manera de conseguir hacerlo volver a la vida.
Llevaba bastante esperando que alguien subiera una ROM cualquiera para probar si por fin conseguia la barra verde en el flashtool pero me sigue dando el error de siempre:
http: // i57.tinypic.com / 16a9rhe.png (quitar los espacios del link)
El telefono esta totalmente brickeado y ni enciende, ya lo habia dejado por imposible.
Muchas gracias!
--------------------------------------------------------------------
Hi! I have the phone briked since one month or more. I tried all and nothing makes alive the phone again
I've been waiting for somebody could upload the original rom, so i would can try if I get a green bar on flashtool app, but I still having the same error:
http: // i57.tinypic.com / 16a9rhe.png (put out the spaces on the link)
The phone are completly bricked, it no powers on, I left it for imposible
Sorry for my english and lots of thanks
s900 lenovo
i found this rom and tested in my lenovo s900 fake. is a lenovo 5.5 fake mtk 6592
Hardware : MT6572 (MTK6592 is Fake!)
Model : S900
Build number : S5_JB3_3G_EMMC_32_4_XLD_QHD_Z7_LZ_S900_20141211.10 4037
Build date UTC : 20141209-024037
Android v : 4.4.3
Baseband v: MOLY.WR8.W1315.MD.WG.MP.V15, 2014/08/04 16:18
download:
yadi.sk/d/8TSef8IZewx3y
try this video to see how flash.
youtube.com/watch?v=ztI8sc8MUNo
good luck.
anbs said:
i found this rom and tested in my lenovo s900 fake. is a lenovo 5.5 fake mtk 6592
Hardware : MT6572 (MTK6592 is Fake!)
Model : S900
Build number : S5_JB3_3G_EMMC_32_4_XLD_QHD_Z7_LZ_S900_20141211.10 4037
Build date UTC : 20141209-024037
Android v : 4.4.3
Baseband v: MOLY.WR8.W1315.MD.WG.MP.V15, 2014/08/04 16:18
download:
yadi.sk/d/8TSef8IZewx3y
try this video to see how flash.
youtube.com/watch?v=ztI8sc8MUNo
good luck.
Click to expand...
Click to collapse
Hello
Do You can send my scatter file for S900 fake ?
bartsoft said:
Hello
Do You can send my scatter file for S900 fake ?
Click to expand...
Click to collapse
save all below as a "MT6592_Android_scatter.txt"
############################################################################################################
#
# General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
info:
- config_version: V1.1.1
platform: MT6572
project: yuanda72_wet_a_jb3
storage: EMMC
boot_channel: MSDC_0
block_size: 0x20000
############################################################################################################
#
# Layout Setting
#
############################################################################################################
- partition_index: SYS0
partition_name: PRELOADER
file_name: preloader_yuanda72_wet_a_jb3.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0xc00000
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADERS
reserve: 0x00
- partition_index: SYS1
partition_name: MBR
file_name: MBR
is_download: true
type: NORMAL_ROM
linear_start_addr: 0xc00000
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS2
partition_name: EBR1
file_name: EBR1
is_download: true
type: NORMAL_ROM
linear_start_addr: 0xc80000
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS3
partition_name: PRO_INFO
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0xd00000
physical_start_addr: 0x0
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS4
partition_name: NVRAM
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x1000000
physical_start_addr: 0x0
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BINREGION
reserve: 0x00
- partition_index: SYS5
partition_name: PROTECT_F
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x1500000
physical_start_addr: 0x0
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS6
partition_name: PROTECT_S
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x1f00000
physical_start_addr: 0x0
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00
- partition_index: SYS7
partition_name: SECCFG
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x2900000
physical_start_addr: 0x0
partition_size: 0x20000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS8
partition_name: UBOOT
file_name: lk.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2920000
physical_start_addr: 0x0
partition_size: 0x60000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS9
partition_name: BOOTIMG
file_name: boot.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2980000
physical_start_addr: 0x0
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS10
partition_name: RECOVERY
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2f80000
physical_start_addr: 0x0
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS11
partition_name: SEC_RO
file_name: secro.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3580000
physical_start_addr: 0x0
partition_size: 0x40000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS12
partition_name: MISC
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x35c0000
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS13
partition_name: LOGO
file_name: logo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3640000
physical_start_addr: 0x0
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS14
partition_name: EXPDB
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x3940000
physical_start_addr: 0x0
partition_size: 0xa00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS15
partition_name: ANDROID
file_name: system.img
is_download: true
type: YAFFS_IMG
linear_start_addr: 0x4340000
physical_start_addr: 0x0
partition_size: 0x28a00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS16
partition_name: CACHE
file_name: cache.img
is_download: true
type: YAFFS_IMG
linear_start_addr: 0x2cd40000
physical_start_addr: 0x0
partition_size: 0x17800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS17
partition_name: USRDATA
file_name: userdata.img
is_download: true
type: YAFFS_IMG
linear_start_addr: 0x44540000
physical_start_addr: 0x0
partition_size: 0x52c00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS18
partition_name: FAT
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0x97140000
physical_start_addr: 0x0
partition_size: 0x0
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00
- partition_index: SYS19
partition_name: BMTPOOL
file_name: NONE
is_download: false
type: NONE
linear_start_addr: 0xFFFF00a8
physical_start_addr: 0x0
partition_size: 0x1500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
reserve: 0x00
Need S900 mtk6580 firmware
I have also a fake lenove s900. i need mtk6580 firmware
yadi.sk/d/8TSef8IZewx3y - your link is dead. please upload it again. Thanks in advance.

[Completed] MTK6572 M8 SP Flash Tools Scatter file question

Hi there,
I have an MTK6572 M8 4.2.2 HTC clone that I picked up 2nd hand. The previous owner had somehow installed KingRoot as an embedded system app and all attempts to remove it completely have failed. My only option appears to be to apply a new system.img file.
I created an SP Flash Tool scatter file and have found a ROM whose scatter file indicates that the contents of this ROM are identical (almost) to that of the phone I am trying to fix. When I compare the 2 scatter files one line differs, see following text. I've tried Root Browser (with root) to get rid of the KingRoot.apk from the system/apps dir but it refuses to 'go away'.
SCATTER FILES
MINE DOWNLOADED ROM
partition_index: SYS18 partition_index: SYS18
partition_name: FAT partition_name: FAT
file_name: NONE file_name: NONE
is_download: false is_download: false
type: NONE type: NONE
linear_start_addr: 0x36740000 linear_start_addr: 0x36740000
physical_start_addr: 0x35B40000 physical_start_addr: 0x35B40000
partition_size: 0x387E0000 XXXXX partition_size: 0xB49C0000
region: EMMC_USER region: EMMC_USER
storage: HW_STORAGE_EMMC storage: HW_STORAGE_EMMC
boundary_check: true boundary_check: true
is_reserved: false is_reserved: false
operation_type: INVISIBLE operation_type: INVISIBLE
reserve: 0x00 reserve: 0x00
The contents of each scatter file is identical apart from the line marked XXXXX partition_size: 0xB49C0000
My questions are.
1. Do I need to make modifications during the SP Flash Tool flashing process to make sure that I don't damage anything?
2. Is it enough to just flash the system.img file on it's own? Which would mean that I don't have to worry about the variation in partition sizes, just select the system.img file and download to phone, which I believe will replace my system dir with the original.
Sorry if I have asked any dumb questions, but when you are on the brink of doing something that might trash your phone you should at least seek a 2nd opinion from someone more who has more experience (less fear).
Thanks in advance for your advice.
Barney
barniclebill said:
Hi there,
I have an MTK6572 M8 4.2.2 HTC clone that I picked up 2nd hand. The previous owner had somehow installed KingRoot as an embedded system app and all attempts to remove it completely have failed. My only option appears to be to apply a new system.img file.
I created an SP Flash Tool scatter file and have found a ROM whose scatter file indicates that the contents of this ROM are identical (almost) to that of the phone I am trying to fix. When I compare the 2 scatter files one line differs, see following text. I've tried Root Browser (with root) to get rid of the KingRoot.apk from the system/apps dir but it refuses to 'go away'.
SCATTER FILES
MINE DOWNLOADED ROM
partition_index: SYS18 partition_index: SYS18
partition_name: FAT partition_name: FAT
file_name: NONE file_name: NONE
is_download: false is_download: false
type: NONE type: NONE
linear_start_addr: 0x36740000 linear_start_addr: 0x36740000
physical_start_addr: 0x35B40000 physical_start_addr: 0x35B40000
partition_size: 0x387E0000 XXXXX partition_size: 0xB49C0000
region: EMMC_USER region: EMMC_USER
storage: HW_STORAGE_EMMC storage: HW_STORAGE_EMMC
boundary_check: true boundary_check: true
is_reserved: false is_reserved: false
operation_type: INVISIBLE operation_type: INVISIBLE
reserve: 0x00 reserve: 0x00
The contents of each scatter file is identical apart from the line marked XXXXX partition_size: 0xB49C0000
My questions are.
1. Do I need to make modifications during the SP Flash Tool flashing process to make sure that I don't damage anything?
2. Is it enough to just flash the system.img file on it's own? Which would mean that I don't have to worry about the variation in partition sizes, just select the system.img file and download to phone, which I believe will replace my system dir with the original.
Sorry if I have asked any dumb questions, but when you are on the brink of doing something that might trash your phone you should at least seek a 2nd opinion from someone more who has more experience (less fear).
Thanks in advance for your advice.
Barney
Click to expand...
Click to collapse
Greetings,
Thank you for using XDA Assist.
Please consider asking your questions here:
Android Q&A
The experts there may be able to help you.
Good luck!

[Completed] Mtk6572 recovery size !

hello everyone :laugh:
i want to extend my recovery size to 7mb
i read an article that convert 1mb from bootimg patition to the recovery partition :
http://forum.xda-developers.com/showpost.php?p=55160827&postcount=100
but i had a problem with applying it
i have a problem with editing the values ( numbers)
i changed the partion size but linear_start_addr its not like the same in the article :silly:
i dont have numbers i have numbers and letters
this is how its look like in my scartter file
partition_index: SYS10
partition_name: RECOVERY
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2f80000
physical_start_addr: 0x0
partition_size: 0x700000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
so please any one if you know the answer tell me :good::good:
good by :highfive:
OP reposted in the correct section:
http://forum.xda-developers.com/and...overy-size-t3435185/post68093408#post68093408
Thread closed.

Categories

Resources