Database Info

[GUIDE] Root for chinafonino I9300DDKL1

I have this phone:
I9300DDKL1
2.6.35.7-I9300XXKL3-CL793489roo[email protected]#2
GINGERBREAD.XXKL3
android: 4.1.9
this is a very cheap phone... it have a spreadtrum cpu 1ghz, 512mb di ram, 180mb for apps, no internal memory, android 2.3.7
many many chinese app and it don't have a international play store and google account... only chinese store,
but it is fast and have a good display,
i want root... i have tried many famous exploit and programs, but nothing...I have tried all the known ways, but nothing worked.
I flashed a cwm recovery to a similar phone (i9270) but when you get into recovery the screen is illuminated, making it unusable.
But the phone has no problems once powered on.
but i'm be very lucky and now i have root:
Here the luck:
I go into recovery, I connect it to the USB port ... I realize that the computer recognizes it!
I start randomly MTKdroids .... and I realize with amazement that recognizes it and tells me that the "root shell"!!
practically even if the recovery is not usable ... (Matter of display driver I think) this works!! I open directly from mtkdroid prompt for adb and can install the root manually with ADB commands!!
preparation:
A) install the drivers (ok for win8 64bit)
SCI-android-new i9300ddkl1.rar (12.7 MB)
https://mega.co.nz/#!00NUkARJ!EGBrqAcjV3_MHiFhmBzifW3u2yQc7rsbyirbS_LCvNU
B) flash the recovery
1) download this
recovery.img (10.0 MB)
https://mega.co.nz/#!x4sEmSoa!JC1YkjyJ6b2-TC5o1JaXHCws22UqIjWkuF8n5LwnXxA
2) Download fastboot
adb_fastboot_and_other_tools.zip (11.1 MB)
https://mega.co.nz/#!YhsgmBjR!O3_dXhqPVVXR7FPlv_4EARFoDEUnKbTj9ocNXIuicuc
3) You must log in fastboot mode. you must try all combinations of buttons, I worked by holding power, then volume more then home in fast time.
4)copy recovery.img inside directory with fastboot
4) from the cmd prompt, type:
fastboot flash recovery recovery.img
Mtk Dorids:
MTKdroidTools_v230.exe (4.3 MB)
https://mega.co.nz/#!lgFyQQbY!DNNtAwVP24u2RPpl7M_CFjAW_m98PEdwraLiPIWtcWA
install mtkdroids
copy files SU, superuser.apk and busybox in the directory adb in directory of mtkdroids
pull them by this file:
https://mega.co.nz/#!511zRR6J!B9vcRCGuBsQ6iqvrK3piwUxbu75p-kyof3cJsgcr2G0
connect your phone switched on
open mtkdroids
reboot into recovery with "reboot" button
when the phone will reboot into recovery
you will see a green square and the "root shell" in the lower left
open "adb terminal"
then:
1) mount the file system:
adb shell
# mount -o rw -t /dev/block/mtdbblock11 /system
# exit
2) copy the file root:
adb push to / system / xbin / su
adb push Superuser.apk / system / app / Superuser.apk
adb push busybox / system / xbin / busybox
3) set the permission
adb shell
# Chmod 06755 / system / xbin / su
# Chmod 0644 / system / app / Superuser.apk
# Chmod 0755 / system / xbin / busybox
exit
4) Restart

Hi Angelo,
link A and B dont work...mega ask me for encryption key!
could you check it please?
thanks

ok..
i have fixed links... (new driver for fastboot mode) and make some adjustment.
Angelo

hi
i need this driver...
plz help me
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
plz help me

angelobiz said:
I have this phone:
I9300DDKL1
[email protected]#2
GINGERBREAD.XXKL3
android: 4.1.9
this is a very cheap phone... it have a spreadtrum cpu 1ghz, 512mb di ram, 180mb for apps, no internal memory, android 2.3.7
many many chinese app and it don't have a international play store and google account... only chinese store,
but it is fast and have a good display,
i want root... i have tried many famous exploit and programs, but nothing...I have tried all the known ways, but nothing worked.
I flashed a cwm recovery to a similar phone (i9270) but when you get into recovery the screen is illuminated, making it unusable.
But the phone has no problems once powered on.
but i'm be very lucky and now i have root:
Here the luck:
I go into recovery, I connect it to the USB port ... I realize that the computer recognizes it!
I start randomly MTKdroids .... and I realize with amazement that recognizes it and tells me that the "root shell"!!
practically even if the recovery is not usable ... (Matter of display driver I think) this works!! I open directly from mtkdroid prompt for adb and can install the root manually with ADB commands!!
preparation:
A) install the drivers (ok for win8 64bit)
SCI-android-new i9300ddkl1.rar (12.7 MB)
https://mega.co.nz/#!00NUkARJ!EGBrqAcjV3_MHiFhmBzifW3u2yQc7rsbyirbS_LCvNU
B) flash the recovery
1) download this
recovery.img (10.0 MB)
https://mega.co.nz/#!x4sEmSoa!JC1YkjyJ6b2-TC5o1JaXHCws22UqIjWkuF8n5LwnXxA
2) Download fastboot
adb_fastboot_and_other_tools.zip (11.1 MB)
https://mega.co.nz/#!YhsgmBjR!O3_dXhqPVVXR7FPlv_4EARFoDEUnKbTj9ocNXIuicuc
3) You must log in fastboot mode. you must try all combinations of buttons, I worked by holding power, then volume more then home in fast time.
4)copy recovery.img inside directory with fastboot
4) from the cmd prompt, type:
fastboot flash recovery recovery.img
Mtk Dorids:
MTKdroidTools_v230.exe (4.3 MB)
https://mega.co.nz/#!lgFyQQbY!DNNtAwVP24u2RPpl7M_CFjAW_m98PEdwraLiPIWtcWA
install mtkdroids
copy files SU, superuser.apk and busybox in the directory adb in directory of mtkdroids
pull them by this file:
https://mega.co.nz/#!511zRR6J!B9vcRCGuBsQ6iqvrK3piwUxbu75p-kyof3cJsgcr2G0
connect your phone switched on
open mtkdroids
reboot into recovery with "reboot" button
when the phone will reboot into recovery
you will see a green square and the "root shell" in the lower left
open "adb terminal"
then:
1) mount the file system:
adb shell
# mount -o rw -t /dev/block/mtdbblock11 /system
# exit
2) copy the file root:
adb push to / system / xbin / su
adb push Superuser.apk / system / app / Superuser.apk
adb push busybox / system / xbin / busybox
3) set the permission
adb shell
# Chmod 06755 / system / xbin / su
# Chmod 0644 / system / app / Superuser.apk
# Chmod 0755 / system / xbin / busybox
exit
4) Restart
Click to expand...
Click to collapse
Bro is possible you make a full backup from this phone i need too i have one need full rom..thx

[UNBRICK] ZTE V5 Red Bull V9180 2GB RAM, 8GB ROM

Hi there.
All, who want to turn on their phone, this won’t respond to anything and after connecting to PC, many partitions appear and phone is connected in device manager in windows as QHUSB_DLOAD (or similar) are welcome here.
Congratulation, you have an soft brick in your hands.
But it isn’t as hopeless as it seems, your phone can be repaired.
There are two methods how to restore phone. Easy and hard
Easy way:
Not tested. The theory is, that phone won't start because it have damaged MBR sector. So goal is to get a copy of MBR sector from worked phone and flash it to damaged one.
It should work :angel:
It's a pitty, that easy way is still under some developing and here is the hard way.
Edit: Try to flash file from post below from fazerg and give some feedback. If it works, whole hard way is not needed to do. But, still not tested.
Requirement:
- Linux system (for example portable Ubuntu) - http://www.ubuntu.com/download/desktop/create-a-usb-stick-on-windows
Before preparing USB stick, try if it is visible in your BIOS. My 8GB stick won’t, so I have to use some old 4GBs. After this, some BIOSes need not only to make boot priority to removable devices, but you have to prioritize USB in HDD boot priority.
- Some knowledge about disk partitioning
- Patience – lot of patience
Let’s start
- Boot linux.
- Connect phone – the blue LED should blink.
- Wait until new disks is connected (the time is always different, I don’t know why, sometimes it is almost instant, sometimes I have to wait 30 minutes). The phone may constantly mount and unmount, don’t worry, it’s normal behavior for phone in your condition.
- After you have stable connection, press ctrl-alt-t (run terminal window).
- Type
Code:
sudo su
you gain root access in linux.
- Type
Code:
fdisk –l
You’ll see something like this (try to read the whole message, real output is very long).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
/dev/sda – your system disk
/dev/sdb – your data disk (if you have some)
/dev/sdc – USB stick with linux
/dev/sdd – phone
And a warning message:
WARNING: GPT (GUID Partition Table) detected on '/dev/sdd'! The util fdisk doesn't support GPT. Use GNU Parted.
For now you are interested in /dev/sdd
- type:
Code:
parted /dev/sdd
Then inside parted just type
Code:
print
Some error message would appear, just type o or ok
You should see table like this:
That's all in parted, just type
Code:
quit
Then you must save these partitions 13 – modemst1, 14 - modemst2 and 22 – persist. It contains your unique IMEI and MAC addresses of WiFi and Bluetooth.
You can do it this way:
Create folder on your hard drive or probably on your bootable Ubuntu USB if it has enough space to do it. Let say we call it v5backup.
type:
Code:
dd if=/dev/sdd13 of=/<disk_where_created_folder>/v5backup/modemst1
dd if=/dev/sdd14 of=/<disk_where_created_folder>/v5backup/modemst2
dd if=/dev/sdd22 of=/<disk_where_created_folder>/v5backup/persist
Great, you have saved very important information. Do not share them with anyone – It can bring you a problem if you have two mobiles with the same IMEI.
Note: As a backup path do not use /dev/sdb but path, which you see in file explorer like /media/name_of_drive/DATA
Optional, but very recommended step: Make backup of a every single partition by typing:
Code:
dd if=/dev/sdd1 of=/<disk_where_created_folder>/v5backup/modem
dd if=/dev/sdd2 of=/<disk_where_created_folder>/v5backup/sbl1
and so on…
So let’s restore.
1) Find someone with the same phone – in this case ZTE V5 2/8GB.
- Set donors phone do fastbootmode (turn it off, press vol- and power), then go to last line – Dload mode. Then connect it to PC
- Type
Code:
dd if=/dev/sdd of=/<path_to_where_you_want>/v5backup/full.img
This makes full image sector by sector of donors phone.
- Wait until done - beware of choosing destination folder – full backup would have about 8GB, so you have to have enough free space.
- Turn on donors phone (about 20 sec press power button).
2) Connect your phone, wait until it connect, and make reverse step
- Type
Code:
dd if=/<path_to_where_you_want>/v5backup/full.img of=/dev/sdd
- Wait until done.
- Buy donor some beer
After flash complete, don’t disconnect phone, LED begins to blink and after some time (maybe 5 minutes), phone should begin to recharge from PC’s USBport.
If you haven’t donor to give you a phone, I can upload my backup. BUT, it is 5GB file, I don’t have such big storage to upload. And, I made this step in windows by using HDDraw copy tool, so this file will be unusable in linux.
After your phone restart, you can see, that it is the same as donors Didn’t I say, it’s a bit copy? Unfortunately, you can’t make a call or connect to Wifi, because you lost all NV information. Let’s restore them…
Reset your phone into fastbootmode (turn it off, press vol- and power), then go to last line – Dload mode, connect it to PC and type:
Code:
dd if=/<disk_where_created_folder>/v5backup/modemst1 of=/dev/sdd13
dd if=/<disk_where_created_folder>/v5backup/modemst2 of=/dev/sdd14
dd if=/<disk_where_created_folder>/v5backup/persist of=/dev/sdd22
That’s all. Now, you should have fully worked phone with dual sim, WiFi and Bluetooth worked. Congratulations :fingers-crossed:
If you don't undestand something in this guide, feel free to PM me.
This guide is made with big help and technical support from fazerg. Thank you, without your advice, I'm still having a brick.

In case no backup available.
Attached file should help recover the 2/8 version phone and make it bootable at least into fastboot and/or recovery mode.
Just unpack it and do in similar way
Code:
dd if=head.img of=/dev/sdx
where x stands for drive letter of bricked phone as it is visible by Ubuntu and head.img is located in Ubuntu home folder. Otherwise full path to head.img file must be typed e.g. if=/media/ubuntu/<disk_name>/<path_to_file>/head.img if the file is on another mounted disk either hard or flash drive or if=~/Desktop/head.img if the file is on Ubuntu desktop

fazerg said:
In case no backup available.
Attached file should help recover the phone and make it bootable at least into fastboot and/or recovery mode.
Just unpack it and do in similar way
Code:
dd if=head.img of=/dev/sdx
where x stands for drive letter of bricked phone as it is visible by Ubuntu
Click to expand...
Click to collapse
I dont know much but i have the same situation after trying to root ma phone.........someone said if i copy the stock rom v1.15 into sd card and update using the option install update using external sd (nubia recovery).
will that work?

saritkgp143 said:
I dont know much but i have the same situation after trying to root ma phone.........someone said if i copy the stock rom v1.15 into sd card and update using the option install update using external sd (nubia recovery).
will that work?
Click to expand...
Click to collapse
Say exactly please what is the current condition of your phone. Can you get into recovery and/or fastboot mode?

Hi, your guide is very good, my zte during the update 1.12 downloaded by needrom turned off and it' s dead; It doesn't turn on in any mode, including fastboot.
I tried to follow your guide but I'm not able to make the backup of modemst1, so I can't go on. I'm also not able to set the donor phone in dload mode.
Please, Can you please help me to write the correct comand using ubuntu. I don't know when i was wrong.
Thank you.

Did you try to flash file from fazerg's post?
If it succeed, you won't need donor's phone.

Yes, after the flash ubuntu see all the 27 partitions but the phone doesnt' start.

Giuseppe24 said:
I tried to follow your guide but I'm not able to make the backup of modemst1,
Click to expand...
Click to collapse
What error message ubuntu writes?
Giuseppe24 said:
I'm also not able to set the donor phone in dload mode.
Click to expand...
Click to collapse
Not hard, just follow these instructions:
turn it off, press vol- and power, then go to last line – Dload mode

marus2 said:
What error message ubuntu writes?
Not hard, just follow these instructions:
turn it off, press vol- and power, then go to last line – Dload mode
Click to expand...
Click to collapse
I going to try again the fazerg's files but when I type the script "dd if=/dev/sde of=/dev/sdf " (the phone is sde, the USB key is sdf) the USB key is partitioned and it becomes unusable.
When I add to the script " /zte" or "/backup" Ubuntu appears: "no such directory".
What can I do?
Thanks

Giuseppe24 said:
dd if=/dev/sde of=/dev/sdf
Click to expand...
Click to collapse
This command makes a whole copy of source disk. If you want to do an single image file, type:
Code:
dd if=/dev/sde of=/dev/sdf/full.img

marus2 said:
This command makes a whole copy of source disk. If you want to do an single image file, type:
Code:
dd if=/dev/sde of=/dev/sdf/full.img
Click to expand...
Click to collapse
So If I wanna a backup of modemst1 ecc. I must type:
dd if=/dev/sde13 of=/dev/sdf/modemst1.img
dd if=/dev/sde14 of=/dev/sdf/modemst2.img
dd if=/dev/sde22 of=/dev/sdf/nv.img
It is right?

Yes, that's right.

marus2 said:
Yes, that's right.
Click to expand...
Click to collapse
Good thanks, and then I type:
dd if=/dev/sdd/head.img of=/dev/sde
I wait five minutes
dd if=/dev/sdf/modemst1.img of=/dev/sde13
And I go on for modemst2 on sde14 and persist on sde22
Is it right?

Code:
dd if=/dev/sd[B]d[/B]/head.img of=/dev/sde
Only if you have head.img file in sdd drive...otherwise it wont' found that file.
After flashing this file, try to turn on your phone. I is possible, that you won't need to flash modemst1, 2 etc.

marus2 said:
Code:
dd if=/dev/sd[B]d[/B]/head.img of=/dev/sde
Only if you have head.img file in sdd drive...otherwise it wont' found that file.
After flashing this file, try to turn on your phone. I is possible, that you won't need to flash modemst1, 2 etc.
Click to expand...
Click to collapse
I have this file on ubuntu desktop, the ubuntu is installed on sdd usb key.

Giuseppe24 said:
I have this file on ubuntu desktop, the ubuntu is installed on sdd usb key.
Click to expand...
Click to collapse
[email protected]:/home/ubuntu# dd if=/dev/sde13 of=/dev/sdf/modemst1.img
dd: failed to open ‘/dev/sdf/modemst1.img’: Not a directory
I have this error

Hm, it seems, I have an mistake in guide.
The output file path should be like you see it in file manager /media/Giuseppe24/DATA/v5backup for example.

marus2 said:
Hm, it seems, I have an mistake in guide.
The path should be like you see it in file manager /media/Giuseppe24/DATA/v5backup for example.
Click to expand...
Click to collapse
I corrected the script and now it works
[email protected]:/home/ubuntu# dd if=/dev/sde13 of=/media/ubuntu/usb/modemst1.img
3072+0 records in
3072+0 records out
1572864 bytes (1,6 MB) copied, 0,0964907 s, 16,3 MB/s
I made all backup and flashed the fazerg's file but the phone doesn't start; need I a donors phone?

Did you try to charge phone for some time?
Try start fastboot or recovery.

Now the phone is in charge but I think the flash is not successful because the first partition has a unlocated space (see the image)

[MTK] Rooting a device (kind of) manually

This is mainly for newer MTK devices for which there are no "one-click root" solutions available yet. With modifications, it should apply to some non MTK devices as well.
This method is quite risky! If the SP Flash Tool backup comes out corrupt, you could get a brick!
Tools required:
1) MTKDroid tools ( http://forum.xda-developers.com/showthread.php?t=2160490 )
2) SPFlash Tools ( http://forum.xda-developers.com/showthread.php?t=2650125 )
3) Easy Magic TWRP Installer ( http://forum.xda-developers.com/showthread.php?t=2798257 )
4) Cofface's Bootimg tools ( http://en.miui.com/thread-27657-1-1.html )
5) 15s ADB installer ( http://forum.xda-developers.com/showthread.php?t=2588979 )
6) Chainfire's ADBD insecure ( http://forum.xda-developers.com/showthread.php?t=1687590 )
7) SPFT vcom drivers ( http://forum.xda-developers.com/showthread.php?t=2206421 )
If you already have a SP Flash Tools ROM for your phone, you can use the boot.img from that, and go straight to "SU through ADB"
Steps to get boot.img:
1) If you don't already have ADB, Fastboot, and drivers for your phone, download Snoop05's 15s ADB installer, and install ADB, fastboot, and drivers.
2) Connect your phone to your computer, and wait for all the drivers to finish installing. Open a command prompt window and type "ADB devices". If you see your device serial number, then proceed, else see the bottom of this post.
3) Open MTKDroid Tools. Click the "root" button on the bottom right. If it roots successfully, you don't need my guide!
4) Click "blocks map". You will see the partition structure of your phone. Press the "Create scatter file" button on this window. If it creates a scatter, go to step 5.
4a) If the scatter button is grayed out, close MTKDroid. Open the folder where you extracted MTKDroid Tools.
4b) Open MTKdroidTools.ini
4c) There is a line saying, "ScatVer111 =". After that, there are some numbers. Those numbers refer to MTK SoC numbers. Add your SoC number to the end of that line. You can get that number from CPU-Z or similar apps. Save the file.
4d) Open MTKDroid and do step 4 now. Remember, the scatter created in this way might not be particularly reliable. But it will work fine for SPFT readBack. Just don't try to use this to flash your phone without checking it first!
5) Open SP Flash Tool. On the "download" tab, click "scatter loading", and load the scatter file created in step 4.
6) Open the "Readback" tab. Click "add" on the top. Double click the new entry that appears. Choose a location to store your ROM dump in.
7) In the dialog that appears, choose "Hex" under "type".
7a) Open the scatter file created in step 4. Search for "partition_name: BOOTIMG".
7b) Look at the number after "partition_size". Enter that number in SP Flash Tools as end address. Enter the value of "linear_start_addr" in "start address", and "partition size" in end address".
8) Disconnect your phone, and switch it off. Take out the battery, and connect it to your computer. Wait for the drivers to install, then disconnect the phone again. If the drivers don't install, check the end of this post.
9) Click "readback" on SP Flash Tools, and connect the phone (without the battery). Press the power button ONCE.
10) SPFT will start the readback. Go to the folder where you saved the SPFT ROM_ file you read right now, and rename it "boot.img"
To get SU through ADB:
11) Move boot.img and Cofface's bootimg tools to the same folder. Press shift and right-click inside the folder, then choose "open command window here". In the command prompt, type "bootimg --unpack-bootimg". Your boot.img will get extracted.
12) Open the "initrd" folder that just got created. Open the ramdisk folder. Find the folder that has a file called "adbd". Delete adbd. Open Chainfire's ADBD insecure with 7zip, and go to "assets". Copy the adbd.21.png file to the folder from which you just deleted "adbd" from. Rename this file "adbd" (without quotes, of course). Open default.prop, and change ro.secure to 0, ro.debugable to 1
13) In the command window, type bootimg --repack-bootimg. It will create two files, boot-new.img, and boot-old.img. "boot-old.img" is your phone's original (stock) boot. "boot-new" is the newly modified one.
14) Switch on and connect your phone. Type "adb reboot bootloader" in command prompt. Your phone will reboot, and show something like "=fastboot". Type "fastboot boot boot-new.img". If your phone reboots, then it's fine, skip 14 a, and continue to step 15.
14a) Otherwise, now comes the most dangerous part. Type "fastboot flash boot boot-new.img". If your boot.img has been corrupted somehow, this will kill your phone. If that happens, flash your stock ROM with SPFlash, there are many guides on XDA, check them. Type "fastboot reboot".
15) Now you have an insecure bootloader. Type "adb shell" in command prompt to check. If you get a prompt like "[email protected]" or "android#", that means that you now have root access through adb. Now you only need to extend it beyond ADB.
INSTALLING THE SU BINARY
Just pushing SU and giving it the correct permissions is enough for some phones, others are more difficult. If pushing it does not work, see the custom recovery method.
Push SU
1) Download the SU binary, and SuperSU. Open a command prompt in the directory where you kept the SU binary, and type:
Code:
adb remount
adb push su /system/bin/su [case sensitive]
adb shell chmod 6755 /system/bin/su [case sensitive]
adb shell chown root:root /system/bin/su [case sensitive]
adb push SuperSU.apk /system/app/SuperSU.apk [case sensitive]
adb shell chmod 644 /system/app/SuperSU.apk [case sensitive]
adb shell chown root:root /system/app/SuperSU.apk [case sensitive]
adb reboot
Now install Root Checker or some similar application, and check if you have got root access.
Through custom recovery:
1) Type:
Code:
adb remount
adb shell rm /system/bin/su
2) Do all the steps in the "Steps to get boot.img" section again, but this time, use the "linear_start_addr" and "partition_size" values of your recovery partition. Name the result "recovery.img".
3) Open the TWRP auto port utility, with the phone disconnected from the computer. Select the manual port option. Follow all the instructions on-screen. Connect the phone when asked, and install the new recovery when the option comes up.
4) After booting to TWRP, go to "reboot" -> "system". When TWRP askes to root your phone, tap "yes". After booting, install SuperSU from the app store.
DONE!
Some phones have problems with wifi when using the modified boot.img, if so, just:
Code:
fastboot flash boot boot-old.img
If your phone is not recognized when you connect it without the battery:
Connect without the battery.
Open device manager, and find the device with an "!" beside it. Double-click that ->update drivers -> "Let me chose" -> Android device -> Vcom driver. Install that, then it should work.
If "adb devices" do not list your phone, do the steps above, but choose "ADB interface" this time.

Hey, I have tried this for many time but the scatter file looks something different. Im new here. So please do something. This is the scatter file;-
PRELOADER 0x0
{
}
MBR 0x1400000
{
}
EBR1 0x1480000
{
}
__NODL_PRO_INFO 0x1500000
{
}
__NODL_NVRAM 0x1800000
{
}
__NODL_PROTECT_F 0x1d00000
{
}
__NODL_PROTECT_S 0x2700000
{
}
__NODL_SECCFG 0x3100000
{
}
UBOOT 0x3120000
{
}
BOOTIMG 0x31a0000
{
}
RECOVERY 0x37a0000
{
}
SEC_RO 0x3da0000
{
}
__NODL_MISC 0x3de0000
{
}
LOGO 0x3e60000
{
}
__NODL_EXPDB 0x4160000
{
}
ANDROID 0x4b60000
{
}
CACHE 0x36b60000
{
}
USRDATA 0x3eb60000
{
}
__NODL_FAT 0x88160000
{
}
__NODL_BMTPOOL 0xffff00a8
{
}
plz reply.

Nice tutorial bro;
@out386

That's the new scatter format. I don't know anything about it. So install terminal emulator from the Play Store, and type this:
cat /proc/emmc
Look for "boot" on the right
In the same line as boot, you'll see something on the left like "emmc_p7". Write down the number after that "p".
Then type
dd if=/dev/block/mmcblk0p<the number you just wrote> of=/sdcard/boot
Do the same for recovery. Then copy these files to the pc and use them instead of sp flash tools. This might not work for some devices.
But this guide is old, and not written well. You should try the app Kingroot (or similar) before trying this.

[MOD] [root] [CHUWI] [Vi7]

This is a guide on rooting the new Chuwi Vi7 Phablet as a result of spending lots of hours on this proyect with the hope that others find it useful.
This is work in progress, do not attempt it if you are not ready to flash back the original rom in case you soft brick your Chuwi
PREREQUISITES:
A) For LINUX users:generally install the android-tools package so you have the adb command available.
In Manjaro linux and Arch Linux just do
Code:
sudo pacman -Sy android-tools
In Ubuntu probably
Code:
apt-get update && apt-get install android-tools
A) windows users would need to (presumibly; not tested)
For WINDOWS users:
install the intel drivers for android and user the attached adb.exe with dm-verity support
Most ADB.EXE do not have dm-verity. Try installing Java (prerequisite to install Android Studio) and installed Android Studio (download full package, but only install SDK part).
The file reported to work fine is android-studio-bundle-141.2117773-windows.exe
The ADB version is 1,011,200 bytes with date of 02/14/2015 07:12 PM.
1) (Recommended) Apply the over the air update; you know you have it when you can see the Google Playstore installed.
2) Connect your Chuwi Vi7 to your PC with a microusb cable
First we need the ability to write to the system partition so in order to do this, run these commands:
Code:
adb root
adb disable-verity
adb reboot
wait 30 seconds now we are going to do a backup of SYSTEM and DATA just in case
(if you are in Windows remove the ./ before system_068 and data_069)
This will take some minutes
Code:
adb boot recovery
Wait a few seconds until you are in the stock recovery
Code:
adb root
adb pull /dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID068 ./system_068
adb pull /dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 ./data_069
adb reboot
3) unzip the attached file and transfer all the individual files contained to the Chuwi´s /data/local/tmp folder
Code:
adb root
# Now we are going to push the whole folder contained in the archive we just extracted
adb push RootChuwiVi7 /data/local/tmp/
4) Now from a terminal run this command:
Code:
adb shell /system/bin/sh -x /data/local/tmp/vi7root
alternatively run
Code:
./rootnow
and that´s it!
Now open Root Verifier (it´s an app) to check if your Chuwi is rooted...
If you like my work dont forget to press the THANKS button and/or donate
TIPS: If you do not get prompted to allow root access by superSU, do adb root from the command line
If you need to flash the phablet here you can download the rom and flashing tool:
https://mega.nz/#!QVFCGDCa!oz4jXrxdsE6pJ4rVt4AlbUHN-VY9NwTF7SNfeir0mSk
Password: jopasaps
You need to install the intel drivers and the flash drivers and run Flash E2, load all the rom files, click on custom order, tick all the boxes, select generic usb, click on NEXT, turn off the phablet, then click on USB1 and very very quickly plug the phablet to your PC while holding VOLUME- you will see some activity in the screen and within 1 minute it will be ready.
If it is ready within 5 seconds then you did not load all the files. Depending on why your phablet is soft bricked it may be enough to flash only some of the files.
KNOWN ISSUES: Open Source superuser by koush does not work as the su binary needs recompiling. We are therefore using SuperSU by chain, I suggest you don't update SuperSU in the Play Store.
TROUBLESHOOTING: the command adb reboot ptest_clear is reported to work with soft bricked devices (put here as a courtesy, not needed in principle)
UPDATE: Download this file to update your SYSTEM partition to the latest version of the firmware, including some debloating and with English as default language. This update is done from recovery, through an adb push command

Thanks for this! I'm trying but can't get it to work. Running the script generates errors and I've boiled it down to doing the permissions -- I can't mount /system as RW no matter what syntax I've tried. I'm in the ADB shell and running under SU (#). Also tried mounting explicit as /dev/block/dm-0 but it still only comes back as "mount: Read-only file system".

Try again from the beginning, you will be able to mount read/write system now...
ALSO VERY IMPORTANT, download the new attachment and use instead ...

Thanks, I tried to disable verity before and it didn't work. I'll try again this time.
---------- Post added at 11:14 AM ---------- Previous post was at 11:11 AM ----------
Can you by any chance post your ADB.exe which has support for disable-verity command?

My adb is simple to install...
1) Install Manjaro linux
2) Run: pacman -Sy android-tools
and... that´s it! you get adb and fastboot
and no need to install android drivers
the sequence then I use to be able to write to the system partition on the Chuwi Vi7 is:
adb root
adb disable-verity (that needs to be done only once)
adb remount
Let me know whether it works in windows ...
TheAndroidGeek said:
Thanks, I tried to disable verity before and it didn't work. I'll try again this time.
---------- Post added at 11:14 AM ---------- Previous post was at 11:11 AM ----------
Can you by any chance post your ADB.exe which has support for disable-verity command?
Click to expand...
Click to collapse

casacristo said:
My adb is simple to install...
1) Install Manjaro linux
2) Run: pacman -Sy android-tools
and... that´s it! you get adb and fastboot
and no need to install android drivers
the sequence then I use to be able to write to the system partition on the Chuwi Vi7 is:
adb root
adb disable-verity (that needs to be done only once)
adb remount
Let me know whether it works in windows ...
Click to expand...
Click to collapse
For WINDOWS users:
I had various flavors of ADB.EXE and none of them had the dm-verity. Finally installed Java (prerequisite to install Android Studio) and installed Android Studio (download full package, but only install SDK part).
The file I used as android-studio-bundle-141.2117773-windows.exe
The ADB version is 1,011,200 bytes with date of 02/14/2015 07:12 PM.
Now rooted... but not sure what to do with this very low spec tablet I have so many other tablets (Onda, Teclast, Acer, etc).
Thanks casacristo!

Yeoh Master Shifu Arturo, its been awhile, how are you, only today notice your thread here, sorry for a little OT...
i own the first variance of x3(c3130), damn intel for making it so hard to root... :laugh:
Code:
[[email protected] ~]$ adb root
[COLOR="blue"]adbd cannot run as root in production builds[/COLOR]
[[email protected] ~]$ adb disable-verity
[COLOR="blue"]error: closed[/COLOR]
i was trying a different approach, root via recovery & i wonder if you have tried the FlsTool, can't figured out the correct commands to repack back ported custom recoveries...
Code:
[URL="https://github.com/android-ia/vendor_intel_build/blob/master/FlsTool/FlsTool"]FlsTool[/URL]
FlsTool v.1.21
This tool can do several different operations of FLS files.
Use the 'Action' option to select to required operation.
Actions:
-p [ --pack ] Packing multiple FLS files into one
-i [ --inject ] Inject NVM, Certificates or Security into FLS file
-x [ --extract ] Extract all image parts from the FLS file(s)
--extract-fls Extract embedded files from the FLS file(s)
--extract-prg Extract PRG file
-b [ --to-bin ] Convert a single Hex file to binary file
--hex-to-fls Create an Fls from a Prg file
--sign Formerly known as FlsSign
--to-fls2 [ arg ] Force output file format to Fls2
--to-fls3 [ arg ] Force output file format to Fls3
-d [ --dump ] Dump the meta data of an FLS file.
--sec-pack Dump all SecPack data of an FLS file.
HexToFls options:
--prg arg Choose a PRG file to create the Fls from
--psi arg Add a PSI to the Fls file (replaces if '-r' option)
--ebl arg Add an EBL to the Fls file (replaces if '-r' option)
--meta arg Inject any meta file to the Fls file (Equal to --version or -v in HexToFls)
--xml arg Add an XML file to the Fls file (replaces if '-r' option)
--zip arg Add a ZIP file to the Fls file (replaces if '-r' option)
--script arg Add a Script file to the Fls file (replaces if '-r' option)
--tag arg Specifies the memory region tag to insert the input file (replaces if '-r' option)
Inject options:
-n [ --nvm-path ] arg Path to the NVM input files
Generic Options:
-o [ --output ] arg Output path
-r [ --replace ] [ arg ] Defaults to replace when trying to add a section which is already existing
-v [ --verbose ] [ arg ] Set verbosity
--prompt [ arg ] Prompt before quitting
--version Show the version of this tool
-h [ --help ] Show command line help
Please specify an input file

@jasonx3
try this file:
https://mega.co.nz/#!UMVwTQIR!w04Pidyd2TRDLyWnqMfCL_qxXRtJmapD0UFmp0hQnx4
it is a full rom with root and gapps, with a script that flashes it (provided
you have a root shell)
@Vadim Shved
Can you be more specific?
I use link2sd without problems to convert apps to system apps.
do this:
adb root
adb remount
what is the output?

Hello Yuweng, good to see you, yes it has been a while... I don´t change hardware very frequently nowadays and not always I feel I can make a substantial contribution to the community
I have not used FlsTool but I have something to offer you....
Download this file:
https://mega.co.nz/#!UMVwTQIR!w04Pidyd2TRDLyWnqMfCL_qxXRtJmapD0UFmp0hQnx4
It is a complete dd copy of my system partition with a script that will verify the md5sum is correct and flash it.
I think this should work fine if you can be root though a recovery.
This system image has already root, busybox, google updates integrated
yuweng said:
Yeoh Master Shifu Arturo, its been awhile, how are you, only today notice your thread here, sorry for a little OT...
i own the first variance of x3(c3130), damn intel for making it so hard to root... :laugh:
Code:
[[email protected] ~]$ adb root
[COLOR="blue"]adbd cannot run as root in production builds[/COLOR]
[[email protected] ~]$ adb disable-verity
[COLOR="blue"]error: closed[/COLOR]
i was trying a different approach, root via recovery & i wonder if you have tried the FlsTool, can't figured out the correct commands to repack back ported custom recoveries...
Code:
[URL="https://github.com/android-ia/vendor_intel_build/blob/master/FlsTool/FlsTool"]FlsTool[/URL]
FlsTool v.1.21
This tool can do several different operations of FLS files.
Use the 'Action' option to select to required operation.
Actions:
-p [ --pack ] Packing multiple FLS files into one
-i [ --inject ] Inject NVM, Certificates or Security into FLS file
-x [ --extract ] Extract all image parts from the FLS file(s)
--extract-fls Extract embedded files from the FLS file(s)
--extract-prg Extract PRG file
-b [ --to-bin ] Convert a single Hex file to binary file
--hex-to-fls Create an Fls from a Prg file
--sign Formerly known as FlsSign
--to-fls2 [ arg ] Force output file format to Fls2
--to-fls3 [ arg ] Force output file format to Fls3
-d [ --dump ] Dump the meta data of an FLS file.
--sec-pack Dump all SecPack data of an FLS file.
HexToFls options:
--prg arg Choose a PRG file to create the Fls from
--psi arg Add a PSI to the Fls file (replaces if '-r' option)
--ebl arg Add an EBL to the Fls file (replaces if '-r' option)
--meta arg Inject any meta file to the Fls file (Equal to --version or -v in HexToFls)
--xml arg Add an XML file to the Fls file (replaces if '-r' option)
--zip arg Add a ZIP file to the Fls file (replaces if '-r' option)
--script arg Add a Script file to the Fls file (replaces if '-r' option)
--tag arg Specifies the memory region tag to insert the input file (replaces if '-r' option)
Inject options:
-n [ --nvm-path ] arg Path to the NVM input files
Generic Options:
-o [ --output ] arg Output path
-r [ --replace ] [ arg ] Defaults to replace when trying to add a section which is already existing
-v [ --verbose ] [ arg ] Set verbosity
--prompt [ arg ] Prompt before quitting
--version Show the version of this tool
-h [ --help ] Show command line help
Please specify an input file
Click to expand...
Click to collapse

Mine is a dual-sim c3130, ro.secure=1, ro.adb.secure=1, no adb while at stock 3e recovery, fastboot flash recovery twrp-recovery.img doesn't work, non of the existing exploit rooting software works, in fact, nothing works on this piece of sh#t but its so cheap... :laugh:
Got mine for less than a month, its a rebrand of Teclast X70, only last week the oem release the firmware, thats where i found out about FlsTool, its actually also available on Windows, i'll leave the linux copy here for everyone to explore...

Thanks! and by all means let us know if you succeed...
yuweng said:
Mine is a dual-sim c3130, ro.secure=1, ro.adb.secure=1, no adb while at stock 3e recovery, fastboot flash recovery twrp-recovery.img doesn't work, non of the existing exploit rooting software works, in fact, nothing works on this piece of sh#t but its so cheap... :laugh:
Got mine for less than a month, its a rebrand of Teclast X70, only last week the oem release the firmware, thats where i found out about FlsTool, its actually also available on Windows, i'll leave the linux copy here for everyone to explore...
Click to expand...
Click to collapse

casacristo said:
@Vadim Shved
Can you be more specific?
I use link2sd without problems to convert apps to system apps.
do this:
adb root
adb remount
what is the output?
Click to expand...
Click to collapse
I did everything from your tutorial. Root checker says that root is present. BUT! I cant do opearations with system partiotion. I tried to: 1)adb root 2)adb remount. After that in command promt I see that remount succeeded. Root checker say that root is present... But I still cant do anything. System partiotion cant be r/w
Edit: Sorry, but I thing that it is a problem of some apps that are not ready for android 5.1.x

Is there original rom available anywhere with tools to flash it? (got my vi7 in a state where it show only first "chuwi" logo, no "intel" logo - just black screen (but PC for example sees ADB interface; unfortunately "no permission"). I'm hoping that's only software problem.
Edit: CRANE_EVB firmware (seems to be some vi7 compatible device, not vi7 itself) finally worked. Required that I force (in devices manager) "intel usb driver for android devices" to be used for my detected chuwi vi7 "adb interface", then "adb.exe reboot ptest_clear" and it starts, no more black screen, no more "PTEST VER 1.41" problem etc.
Anyway still looking for original vi7 rom (not that crane_evb thing).

Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Updates - 01-Sept-2015
Huge Thanks to best98 for carrying out numerous of tests... :good:
Conclusion : No point to further develop custom recoveries, after unlocking bootloader, vi7 will refuse to boot unless you press Vol+ for 3 seconds then only it will boot up normally, no one would wanna do that...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
best98 said:
Hi
So, I tried to flash stock 3e recovery..
Code:
"Warning: Chip mismatch. HW is [Sofia_3G_R] SW expects [Sofia_3G]
Device synchronized.
Using: Faster CRC, Writing all blocks , Skip data CRC , Skip protocol CRC
Start downloading item 'CUST:recovery.fls'' from file 'C:\Android\Chuwi_V7\stock-3e-recovery.fls''.
Checksum OK (0x0000)
Process time was 656 msec.
Total time was 1359 msec.
Channel 1 is succesfully closed."
Still boots with the green/red/black screen..
Did the fastboot eom lock
Code:
PS C:\> fastboot oem lock
...
(bootloader) Please confirm the device state action using the UI.
(bootloader) got key event 1
(bootloader) EV_DOWN received
(bootloader) got key event 2
(bootloader) EV_POWER received
(bootloader) Userdata erase required, this can take a while...
OKAY [ 11.506s]
finished. total time: 11.511s
Now, got the bootloop.. -> flashing the whole firmware : boots ok.
adb reboot fastboot
fastboot oem unlock
Code:
PS C:\> fastboot oem unlock
...
(bootloader) Please confirm the device state action using the UI.
(bootloader) got key event 1
(bootloader) EV_DOWN received
(bootloader) got key event 2
(bootloader) EV_POWER received
(bootloader) Userdata erase required, this can take a while...
OKAY [ 11.299s]
finished. total time: 11.300s
Black/green/red screen..
fastboot format cache + fastboot format data = same Black/green/red screen..
I hit 'Vol+' it goes forward.. shows Intel logo and boots..
Pierrick
Click to expand...
Click to collapse

fastboot oem unlock confirm
gets
< waiting for device >
and nothing else happens
yuweng said:
Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Click to expand...
Click to collapse

Is it possible to overclock this device? 900mhz.... it sucks.

Hmm.. I could try.. nothing to loose, but can't get the communication to work.
I unlocked the bootloader throug the Developer Option menu. Is it enough ?
yuweng said:
Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Click to expand...
Click to collapse

Thank You so much for participating in Development... :good:
Fyi, OP can't test b'cos he drop & break his vi7 while i'm having a different variance of x3...
First you need to unlock the bootloader & if you didn't then it will brick your vi7 but then again, you guys have the firmware to unbrick it...
Steps
If you're using Windows then download fastboot from here, if you're using linux then follow tips from OP
To reboot to fastboot => adb reboot fastboot -> There is no intel Droidboot, only green distorted screen but fastboot command works
To unlock bootloader -> fastboot oem unlock then follow PC on-screen for instructions & for formatting data & cache partition too. Mine have to issue the command fastboot oem unlock confirm
After this to reboot -> fastboot reboot
At PC, setup intel USB driver -> right click -> Run As Administrator
Start FlsTool -> Switch off your vi7 -> wait awhile -> Click at Next -> Click Start USB1 -> Plugin your vi7 & it'll download
After boot up Android -> adb reboot recovery & if TWRP doesn't boot then unplug USB, press & hold Power for 10 seconds & it power off then follow the same procedure to reinstall back stock 3e recovery
For more info, refer to the FlsTool attach pdf file for details
Additional info
At the Russian forum mentioned you'll need to check the option Manual (no auto start) while on my x3 with default Auto Start works fine...

Hi
Not changing the bootloader butusing a mix of the OP script and Chinese tablet -Intel Root- script worked.
One of the big deal was to have the ADB compatibility with "disable-verity" which is the last release.
Now, I will try to focus on TWRP.. but FLS with COM to USB mapping makes it a little bit complicated !
Pierrick

OK.. just tried this, and now, I have a green screen ..
Rolling back the 3e recovery worked but the result is still showing me, black/green and red lines.
Right now, tablet does not boot anymore, except those lines in green/black and red.. where no text is written - looks like locked inl in fastboot.
Willing to hear from you to get back the control of the tablet
Here are the settings I used - thumbnail !
BTW - attaching adb.exe that handles the disable-verity
yuweng said:
Thank You so much for participating in Development... :good:
Fyi, OP can't test b'cos he drop & break his vi7 while i'm having a different variance of x3...
First you need to unlock the bootloader & if you didn't then it will brick your vi7 but then again, you guys have the firmware to unbrick it...
Steps
If you're using Windows then download fastboot from here, if you're using linux then follow tips from OP
To reboot to fastboot => adb reboot fastboot -> There is no intel Droidboot, only green distorted screen but fastboot command works
To unlock bootloader -> fastboot oem unlock then follow PC on-screen for instructions & for formatting data & cache partition too. Mine have to issue the command fastboot oem unlock confirm
After this to reboot -> fastboot reboot
At PC, setup intel USB driver -> right click -> Run As Administrator
Start FlsTool -> Switch off your vi7 -> wait awhile -> Click at Next -> Click Start USB1 -> Plugin your vi7 & it'll download
After boot up Android -> adb reboot recovery & if TWRP doesn't boot then unplug USB, press & hold Power for 10 seconds & it power off then follow the same procedure to reinstall back stock 3e recovery
For more info, refer to the FlsTool attach pdf file for details
Additional info
At the Russian forum mentioned you'll need to check the option Manual (no auto start) while on my x3 with default Auto Start works fine...
Click to expand...
Click to collapse

[Fix sensors after Update/Custom-Rom] (camera, accelerometer, proximity etc.)

Hi guys,
Some times after a Custom-OS flash or system update my sensors didn't work anymore. I tried a lot but at the end I found out that the persist.img needed to be flashed again cause they get somehow compromised.
I'm not really familiar with all the flashing stuff but that helped me and maybe someone has something to add or enhance just write a comment.
I'n not responsible for any damage so be careful in what you are doing.​
Backup your persist.img
Type this into terminal or ADB shell with root privileges.
Code:
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img
now you should find it in your root folder where all your data is -> put it somewhere save.
Download your corresponding FASTBoot-Image-Zip (like: 10.3.6-OnePlus6Oxygen_22.J.48_OTA_048_all_2010042239_c0c1fee2ee-FASTBOOT.zip) from this thread
Unpack the zip in a folder Update
copy persist.img from Update\images.zip to your Update folder
copy Update\Others_flashall.zip\flash-only-persist.bat to Update
To make the changes happening:
Reboot the OnePlus 6 in fastboot mode (Power and volume-);
Connect the OnePlus 6 to PC
Run Update\flash-only-persist.bat flasher
Wait until the process end
The phone will automatically reboot.