Database Info

BigStorage explained & the fastest way to get it

I finally figured out how the BigStorage ROM works.
At locations 7E32h & 211E32Eh (in the sd-card dump) the size of the Storage folder is defined. (atleast in the 1.11wwe I'm using. In other rom's the locations might differ a bit)
In the original rom those locations both contain 80 00 (notation is least significant byte first),
which means the size of the storage is 00800000h (= 8 MB)
The Storage is followed by the Ext_ROM of 01300000h (= 19 MB)
Finaly there's a piece of 00080000h (0.5 MB) which is unused.
So if you want to use all that space for your Storage-folder, the size of that folder would be 800000h+1300000h+80000h = 01B80000h
This means the value at locations 7E32h & 211E32Eh should be B8 01. (which is exactly the same value as you'll find in the Anansky-roms)
The only thing you have to do to get BigStorage, is to change those 2 values.
Because after you have flashed such a patched rom back, upon booting it for the first time, it notices that the Storage folder is wrong, so it starts to format it.
During this time the phone seems to hang at the splashscreen, but after 5 minutes or so, it continues and displays the screen alignment wizard.
So the easiest way to get big storage is:
1. dump current rom to SD-card
2. put the SD-card in a Cardreader
2a. optionally copy the rom to your pc, for backup purposes
3. use a DiskEditor straight on the SD-card to change 80 00 into B8 01 at locations 7E32h & 211E32Eh
4. put the SD-card back in your phone and flash it back.
5. hard-reset and wait a couple of minutes

Thank you This solves the ntrw problem on writing image to card. What I can say more errors in ntrw during writing are made because of partial block at the end, if image is a multiply of 256kB blocks than there are no error message in this case flash image shoud have exactly 64MB

Good work DrChain!!!
But it's important to mention that the indicated locations to make the changes (7E32h & 211E32Eh) are not the same ones in all the versions of ROM.
Greetings :wink:

So, the key point is how to locate where the 2 location should be modified to "b8 01". Could you please show me some hints?
I just have my O2 mini upgraded to 1.12.00WWE and would like to modify it to bigstorage, thanks a lot!!

palmVer said:
So, the key point is how to locate where the 2 location should be modified to "b8 01". Could you please show me some hints?
I just have my O2 mini upgraded to 1.12.00WWE and would like to modify it to bigstorage, thanks a lot!!
Click to expand...
Click to collapse
You need to do a search for "00 00 80 00", unfortunalty you'll find it a lot.
The first place should be a couple of pages above "KERN.pdb" (= a couple lines beneath "Update_TAD_From_Kernel_Charging"
The second place should be a couple of lines above "PSMFSD.pdb"
Hope it helps

Success in Creating BigStorage ROM for Chinese 1.11 version
I used a simple method
- search for 02 00 00 80 00 20 20 00 00 and there are only two locations.
Thanks to the insights from Anansky, MKS, DrChair, ... and I managed to create the BigStorage ROM for Dopod 818 in Chinese.
I changed 80 00 to b8 01 at locations 00007e4a and 01fc232e.
The above search method applies to other ROM versions as well. I have tried it successfully with English versions of O2 mini, i-mate JAM and T-mobile.

nice work guys .....

I like the idea of hacking for BigStorage, but I don't like other stuff being forced on me at the same time (boot pic). So for me this is rather cool. Thanks!
What to hack next?

which DiskEditor you have used?
Tnks,
Ale

DrChair said:
palmVer said:
So, the key point is how to locate where the 2 location should be modified to "b8 01". Could you please show me some hints?
I just have my O2 mini upgraded to 1.12.00WWE and would like to modify it to bigstorage, thanks a lot!!
Click to expand...
Click to collapse
You need to do a search for "00 00 80 00", unfortunalty you'll find it a lot.
The first place should be a couple of pages above "KERN.pdb" (= a couple lines beneath "Update_TAD_From_Kernel_Charging"
The second place should be a couple of lines above "PSMFSD.pdb"
Hope it helps
Click to expand...
Click to collapse
Here was what I did:
1/ Flash my O2 to 1.12 using the official released ROM
2/ Dump the OS to my SD card (256MB), ntrw to my PC
3/ Use HEX editor to locate the "80 00" at 7e32 and 211e32e and modified them to "b8 01", ntrw back to my SD (256MB)
4/ start PPC in bootloader mode with SD card inserted.... after a few seconds, screen showed "ROM size isn't enough"....
Any idea where went wrong?
Thanks.

Re: Success in Creating BigStorage ROM for Chinese 1.11 vers
Just recognize it's a bit difference between DrChair's and Talents' quoted method:
DrChair: looking for 80 00 and change it to b8 01
Talent: looking for 08 00 and change it to b8 01
Clarification from 2 gentlemen please
DrChair said:
You need to do a search for "00 00 80 00", unfortunalty you'll find it a lot.
The first place should be a couple of pages above "KERN.pdb" (= a couple lines beneath "Update_TAD_From_Kernel_Charging"
The second place should be a couple of lines above "PSMFSD.pdb"
Hope it helps
Click to expand...
Click to collapse
Talents said:
I used a simple method
- search for 02 00 00 08 00 20 20 00 00 and there are only two locations.
Thanks to the insights from Anansky, MKS, DrChair, ... and I managed to create the BigStorage ROM for Dopod 818 in Chinese.
I changed 08 00 to b8 01 at locations 00007e4a and 01fc232e.
The above search method applies to other ROM versions as well. I have tried it successfully with English versions of O2 mini, i-mate JAM and T-mobile.
Click to expand...
Click to collapse

My apologies - it should have been changing 80 00 to b8 01.

Talents said:
My apologies - it should have been changing 80 00 to b8 01.
Click to expand...
Click to collapse
Finally, I got it. I tried the same image using different PC and card reader, it works!!
Thanks a lot.

Nice...
Is it possible to create a small ext_rom (~5MB) and the other space to storage? This would be nice to create our own ext_rom without loosing any space.
How to make your own ext_rom from DrChair (thaks!)
I recently managed to make my own ExtROM for my Magician.
A short howto:
1. First dump your rom to a SD-card, using the well know method.
2. Next get the rom to your pc, using ntrw
3. Using a Hex-editor, copy 2BC019C (HEX) till 3EC019C (HEX) to a file.
4. Mount that file as a virtual Harddisk (I use the virtualdisk-plugin for total commander)
5. Modify your ExtROM on that Virtualdisk.
6. Umount the Virtualdisk.
7. paste the contents of the (modified) file back into the rom-file, at precicly the same position and save it under a different name.
8. put the modified rom back onto your SD-card, using ntrw.
9. Flash your Magician, with the new rom.
Have fun with your modified ExtRom
Click to expand...
Click to collapse
What do you think?
Pam

Sorry!
i have found the right post.
http://forum.xda-developers.com/viewtopic.php?p=127612#127612

Sorry, but can someone explain to me how I am supposed to search for these 2 locations?
I have Hex Editor, but I can't seem to locate them.
I have no idea on what I'm doing.
Thanks.

Could the reason why I'm having difficulty with locating the 2 locations is because I am trying to locate them on the file which is stored on my PC as opposed to the file on the SD card?
I can't actually access the file on the SD as each time I do so, it keeps asking me if I want to format it.

jian said:
Could the reason why I'm having difficulty with locating the 2 locations is because I am trying to locate them on the file which is stored on my PC as opposed to the file on the SD card?
I can't actually access the file on the SD as each time I do so, it keeps asking me if I want to format it.
Click to expand...
Click to collapse
1/ use romupdate.exe to dump the ROM to the SD card
2/ place the SD in a external card reader, and use ntrw.exe to dump the ROM image in the SD to your PC (ie. execute the "ntrw read filename.nb1 x:" command in your PC, where filename.nb1 would be the ROM image file, and x is your SD card reader drive)
3/ use Hex Editor to open the filename.nb1 in your PC
4/ use the FIND function to locate "02 00 00 80 00 20 20 00 00" and change it to "02 00 00 b8 01 20 20 00 00"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
5/ save the file as "filename_new.nb1" and execute "ntrw write filename_new.nb1 x:"
6/ put the SD card back to your PPC, start bootloader mode... wait... press Power button.... wait... 100% flashed with checksum error .... soft reset .... wait for several minute at splashscreen.... done!

Thanks!
This is actually what I'm doing but I am still unable to locate the two locations.
Can you reload the image? I can;t see it.
Thanks again

OK, think I've done it.
Was searching in the ASCII field!
Thanks for your help!

[WIP] Mod the splash screen

This is a work in progress and I think I'll need some help...
I was trying to figure out how to mod the splash screen, but have a few questions.
I found the splash screen in the 8.2.3.9 firmware, but haven't found it yet elsewhere. And it has changed with the 8.4.4.11 firmware and I can't track where the changes are coming from.
In the 8239 firmware, I unpacked the blob, split the LNX and SOS partitions, and gunziped the ramdisks. There is an .rle file in there, which turns out to be some version of a headerless run length encoded file. Or maybe all rle files are headerless? Whichever it is, they sure talk funny.
I converted it to a .bmp and it appears to be the splash screen. It's upside-down and in the 556 format, which is how I would expect the splash screen to be.
There are also some battery indicators that I never saw on my TF, so I wonder if the splash screen is a red herring?
I converted the files to jpg, but left the peculiar orientation.
So the questions at large:
1) was there a different splash screen before the 8.2.3.9 firmware?
2) where is the splash screen stored?
3) how did the splash screen get updated in the 8.4.4.11 version?
4) Is the nvidia tag just superimposed? If it's just a 'patch' then it will be a needle in a haystack to find the right pattern- where should we look?
5) or maybe forget looking and just figure out how/where the splash screen gets loaded. In full format, it should be 2.1 MB
6) does the TF leave the splash screen "compressed" and just inflate it at boot time? It seems to load up too quickly.
Here's the run down on what I did.
blobby booty tools
https://github.com/AndroidRoot
I used a different split_boot tool, but I assume it should be the same result.
The file format of the rle file is as follows: Data are ordered in 4 byte sets. 2 bytes for the count and 2 bytes for the data. Read the count and data, and write the data x times, based on the count. The count is little endian, so the first byte of the count is the least significant. For example, 02 00 AA BB would represent AABB AABB, and 02 01 AB AB would be ABAB repeated 258 times. If you do it correctly, the resulting file should be 2,048,000 bytes long. Toss on a header for a 1280x800 556 BMP file and it will pop up.
I'm not a programmer, so this script might be rough. I wrote it by google'ing stuff on the internet.
Code:
#!/usr/bin/env python
import os
bytes = os.path.getsize('EeePad_bootup_first_page.rle')
print(bytes)
in_file = open('EeePad_bootup_first_page.rle', mode='rb')
out_file = open('eeepad.bmp', mode='ab')
while bytes > 0:
loop1 = int(in_file.read(1).encode('hex'),16)
loop2 = int(in_file.read(1).encode('hex'),16)
data = in_file.read(2)
loop = loop2 * 256 + loop1
print(bytes,loop,loop1,loop2,data)
while loop > 0:
out_file.write(data)
loop -= 1
bytes -= 4
in_file.close()
out_file.close()
70 byte header for the BMP file- paste it at the head of the bmp file
Code:
42 4D 46 40 1F 00 00 00 00 00 46 00 00 00 38 00 00 00 00 05 00 00 20 03 00 00 01 00 10 00 03 00 00 00 00 40 1F 00 13 0B 00 00 13 0B 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 E0 07 00 00 1F 00 00 00 00 00 00 00
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Lastly, maybe someone has already figured out how to mod the splash screen, but I've only seen boot animations, not the actual splash image. Then again, I haven't flashed too many roms on the TF yet.

I've combed most of this forum and i havent seen this yet,this would be an awesome mod.

Interesting about the battery meter, since the Transformer doesn't seem to like charging while it's powered off. Perhaps they were planning on not adding the annoying 'turns on as soon as you plug it in" feature and they changed their minds?
Either way, to be honest I'm fine just modding the bootanimation.zip since the first splash screen only last about a second under normal circumstances.

Shawn_230 said:
Interesting about the battery meter, since the Transformer doesn't seem to like charging while it's powered off. Perhaps they were planning on not adding the annoying 'turns on as soon as you plug it in" feature and they changed their minds?
Either way, to be honest I'm fine just modding the bootanimation.zip since the first splash screen only last about a second under normal circumstances.
Click to expand...
Click to collapse
Yes i'd like to see more boot animations,s6261 is pumping them out here hes taking requests also.

On the Viewsonic Gtablet, another TegraII device, the splashscreen was in its own partition, typically 6 or 7. The only thing on that partition was a raw bmp, and taking a dump of the partition with nvflash and opening the resulting file in paint revealed the splashscreen. No idea what it would be like on the TF, but I wouldn't be suprised if it was a lot more complicated.

I've read somewhere that the rle file is a raw image file. Try open it via Photoshop or Gimp

2) where is the splash screen stored?
Click to expand...
Click to collapse
I'm no expert, but I think the splash image reside in the bootloader(EBT/partition4). EBT in 8.4.4.11 updates is larger than previous version.
Q: Anybody know how to extract the EBT.img file. I've succesfully the extract the blob via blobtools.

whirleyes said:
I've read somewhere that the rle file is a raw image file. Try open it via Photoshop or Gimp
Click to expand...
Click to collapse
Gimp 2.6 doesn't recognize the format, but I would guess that it needs a header. Besides, I already read the file.
whirleyes said:
I'm no expert, but I think the splash image reside in the bootloader(EBT/partition4). EBT in 8.4.4.11 updates is larger than previous version.
Q: Anybody know how to extract the EBT.img file. I've succesfully the extract the blob via blobtools.
Click to expand...
Click to collapse
The EBT blob in the 8.4.4.11 is 1.5M, which is too small to be a whole bmp, but maybe it just patches the existing boot screen. It is bigger than the previous updates, which are both around 920K.
I thought that partition 4 was encrypted? I think there might be a second key, but nvflash is a new one for me.
I can see, based on the MD5 hash that the EBT partition pulled via nvflash is unchanged between 8.2.3.9 and 8.4.4.5, but it changes in 8.4.4.11. Not sure what the changes are?
The BCT, EBT, LNX, pulled via nvflash, all change between 8.2.3.9/8.4.4.5 and 8.4.4.11. and are all big enough to hold a boot screen. LNX is unpackable with Android! magic and doesn't have anything interesting. EBT seems to be largely empty space. Would any of these partitions be compressed or compressed by nvflash?

I'm sure the splash is inside the bootloader(EBT)
8.2.3.9 bootloader.bin is around 920k, while 8.4.4.12 bootloader.bin is around 955k.These files is extracted from the blob.
flashing them via nvflash confirm it. LNX partition has nothing to do with it.

whirleyes said:
I'm sure the splash is inside the bootloader(EBT)
8.2.3.9 bootloader.bin is around 920k, while 8.4.4.12 bootloader.bin is around 955k.These files is extracted from the blob.
flashing them via nvflash confirm it. LNX partition has nothing to do with it.
Click to expand...
Click to collapse
It is stored in the bootloader.bin file - blob.EBT

Roach2010 said:
It is stored in the bootloader.bin file - blob.EBT
Click to expand...
Click to collapse
So how is it stored? The bootloader files are too small to hold the whole image and I don't see anything that looks like the .rle file.
I'm guessing it's encoded some other way. In theory, if we can figure out how it's stored, we can mod the bootloader and then reload it to change the boot screen. Do you think that will work?

gee one said:
So how is it stored? The bootloader files are too small to hold the whole image and I don't see anything that looks like the .rle file.
I'm guessing it's encoded some other way. In theory, if we can figure out how it's stored, we can mod the bootloader and then reload it to change the boot screen. Do you think that will work?
Click to expand...
Click to collapse
I was thinking it must be compressed. I have compared the hex of the two bootloaders from 8.4.4.5 and 8.4.4.11 and tbh I couldn't make much sense of them but by flashing each of these as blobs I was able to switch back and forth between the splash images.

Yup, I did that too, although I had a brick in between
The rle file is already compressed and seems to make a lot of sense for a boot time image- it will load faster than reading the raw data and doesn't take much to decompress.
I think the image is in some form of rle format, but it's either cyphered or obscured in some way. Do you know if the bootloader signed or hashed?

The ends of the files are fairly similar- start there and work backwards about 43,000 bytes, give or take.
That area looks about right to me for cyphered rle data.

Awesome, I was just thinking about this some time ago. Tried to emulate a splashscreen here, but a "legit" mod would be great.

[i9003] SIM Unlock for free!!!

I found an easy method to unlock the i9003.
To do this you will need an Hexadecimal editor and have root access to your phone.
Steps:
1. Make a full backup of the /efs folder
2. Get the nv_data.bin file located in /efs
3. Open it with an hexa editor (I used WinHex)
4. Go to line 181460 and modify from 01 00 00 00 00 to 00 00 00 00 00
5. Copy the modified nv_data.bin file into /efs
6. Set the appropiate owner user and group doing chown 1001.1001 nv_data.bin
7. Remove the nv_data.bin.md5 file
8. Reboot your phone
9. Enjoy!!
Locked
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Unlocked
ADB commands:
# su
# cd /efs
# cp /sdcard/nv_data.bin /efs/nv_data.bin
# rm nv_data.bin.md5
# chown 1001.1001 nv_data.bin
# reboot
To check it you can do *#7465625# and verify that Network Lock is [OFF]
I hope it can be useful for you.

after installing a new ROM and unlocking like this could the phone read my SIM card normally ?? (i'm in north africa - Tunisia)

Depends if your phone is region locked. Normally it shouldn't be locked, but some carriers with plans lock the phone

Thanks!! It works fine on my phone.

nice job man.. it works fine

Thanks!
It worked perfectly!

It works. Fantastic solution

Nice Work Man!!
Sent from my GT-I9003 using Tapatalk 2

It works! You are a good man

Man my file has only got 2 lines written.... what can be the problem? Im copying the efs folder in my SDcard, then i choose the called file and it has 32 bytes. only 2 lines written.. Any helps?

i cant ...
the file nv_data.bin.md5 reappears after a reboot
aaaaand nothing happens, a password is required for unlock again
can you help?

Can you upload or give to me your file nv_data.bin??
I try to generate to you a pin unlock code.
This is an experiment, unlock code may be not working.
We try to do, it is only a number PIN to insert.

i made it, thanks
but in 68 stroke

Well! How did you do?

Worked like a charm!! Thanks tons!

Hey fyter, can u help me to unlock the region on i9003.
I bought an i9003 from Africa/Tanzania, but the problem is i cant use it in any other country.
I can use any network in Tanzania, but outside of Tanzania its not showing the network.
Also its not even asking any unlock code.
It seems that the region is locked.....

[TUTORIAL] How to change the /system, /cache and /data partitions for Karbonn A5

To begin with, you need a hex editor, HxD - Freeware Hex Editor is a great editor and it is very small(less than an MB). Then you need a baseband to edit, you need to locate the file named ' appsboot.mbn '.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
That file contains the partition tables, remember this tutorial is about editing the partition tables not extending your physical memory.
So, lets get cracking. Open HxD from programs and open the appsboot.mbn file, now press F3 and search for ' cache ' and press F3 until you see something like this
.
As you can see the highlighted section of the picture
,
there are a few repetitions of ' F0 F0 F0 F0 xx ' multiple times, you are concerned with only the first two /system and /cache partitions respectively.
Remember, you don't need to specify the partition size for /data as it is done automatically when you flash the baseband.
Now back to the hex editing part, once you've decided how much space(in MBs only) you wanna allocate to /system and /cache use this link to Convert hex/dec and select the two digits after the F0 F0 F0 F0 like in this pic
and type the hex number for example in the screenshot B4 in hex equals 180 in decimal, which means /system is allocated 180 MB of space and do the same with Cache, I would recommend allocating 10 MB to it as you hardly ever use it. Then flash the baseband like you normally do through Fastboot.
If you have any doubts ask me and I will do my best to clear things to you. Click Thanks if I helped you, doesn't cost anything

Anil_Sharma said:
To begin with, you need a hex editor, HxD - Freeware Hex Editor is a great editor and it is very small(less than an MB). Then you need a baseband to edit, you need to locate the file named ' appsboot.mbn '.
That file contains the partition tables, remember this tutorial is about editing the partition tables not extending your physical memory.
So, lets get cracking. Open HxD from programs and open the appsboot.mbn file, now press F3 and search for ' cache ' and press F3 until you see something like this
.
As you can see the highlighted section of the picture
,
there are a few repetitions of ' F0 F0 F0 F0 xx ' multiple times, you are concerned with only the first two /system and /cache partitions respectively.
Remember, you don't need to specify the partition size for /data as it is done automatically when you flash the baseband.
Now back to the hex editing part, once you've decided how much space(in MBs only) you wanna allocate to /system and /cache use this link to Convert hex/dec and select the two digits after the F0 F0 F0 F0 like in this pic
and type the hex number for example in the screenshot B4 in hex equals 180 in decimal, which means /system is allocated 180 MB of space and do the same with Cache, I would recommend allocating 10 MB to it as you hardly ever use it. Then flash the baseband like you normally do through Fastboot.
If you have any doubts ask me and I will do my best to clear things to you. Click Thanks if I helped you, doesn't cost anything
Click to expand...
Click to collapse
Thanks ws waiting fr this frm a long tym

Great Guide keep going on...........

@everyone instead of quoting whole OP ..
you can just type @op

The Droid Master said:
Great Guide keep going on...........
Click to expand...
Click to collapse
Usb diagnostics port change next Too many people fall for that

AMAZING GUIDE.... BLOWN MY MIND OFF !!!! :laugh:

good

[RECOVERY][ROOT][ZTE Blade A521][P809F10][TWRP 3.2.X Unofficial Port]

TWRP 3.2.2 Unofficial Port
ZTE Blade A521
(Qualcomm MSM8909)
​
Greetings everyone at XDA. I'm very happy to tell you that I managed to make my first working port of TWRP for the ZTE Blade A521 (a.k.a P809F10), with a Qualcomm MSM8909 chipset. This device had been forgotten in the developers' scene due to the fact that there was no possible way to unlock its bootloader, leaving this phone with no rooting or development possibilities. However, thanks to the developer alexenferman's post:​Bootloader Unlocking on older Qualcomm ZTE Devices, /Devinfo partition modification​It is now possible to permanently unlock its bootloader and therefore,flash unsigned images. Thus, i'm glad to now show you this unofficial port of mine to this old and forgotten device. As this device's sources are still not released by ZTE, it is not possible to compile TWRP or ROMS from source, only ports available. Still watiing for them thougt.
Download:
UniTouch/ZTE-Blade-A521-P809F10-TWRP-3.2.2-Unofficial-
First release of the unofficial port of TWRP fo this device - UniTouch/ZTE-Blade-A521-P809F10-TWRP-3.2.2-Unofficial-
github.com
Installacion Requisites:​
Unlocked Bootloader (Check alexenferman's post: https://forum.xda-developers.com/t/...vices-devinfo-partition-modification.4100897/)
PC with ADB Installed (and Drivers)
Qualcomm QDLoader 9008 Drivers installed
MSM8909 Firehose Programmer Collection (https://github.com/programmer-collection/zte)
QPST Tool (Latest Version) (Not portable)
HxD-Hex Editor
Magisk Patched Boot Image (Attached to this post)
TWRP Recovery file
Brain and WIll
IMPORTANT: Prior to this procedure, you must make sure your device is the one listed here, as there are two available versions of it. There's a Mediatek ZTE Blade A521, and there's a Qualcomm version, to which this post refers. (You can check this on Settings>About Phone). Also, make sure your device's Android version is 7.1.1. and that it matchs this fingerprint: ATT_MX_BA521_V1.0
Otherwise, I'm not sure it will work. If you dont match the fingerprint, but you match the device, you might be able to unlock bootloader and flash the recovery, but you wont be able to use the attached patched Boot Image, and thus, maybe the recovery wont work, as this device has dm_verity on boot, and it has to be patched for the recovery to fully boot. If you dont want to use my atttached boot image, you can patch your stock boot image yourself and flash it with QFIL.
DISCLAIMER: I´m not responsible for whatever you may do to your phone. Everything you do with these instruccions is under your own responsibility.
Procedure:
First of all, you need to unlock this device's bootloader. You can follow the posted method above, but for more detailed instruccions (and considering there's no development for this device at all) ,I decided to show you how myself. If you already did this, you can jump straight to step
Unlocking ZTE Blade A521's Bootloader​
On the phone, get to the Developer Options and enable OEM Unlock. ( Tick 5 times on Build number on Settings>About phone. Now go to Settings>Advanced Settings>Developer Options>OEM Unlock). Also enable USB Debugging. Done this, connect the device to PC.
Now you have to open QFIL tool and ADB Terminal to continue. (by this time, you should have installed all required tools and drivers for this to work. QFIL Portable tool wont work, as it wont recognize the device. It has to be the installable Software of QPST.) On QFIL, tick Flat Build , and select the Firehose programmer you downloaded before (zte-master\BLADEA521\prog_emmc_firehose_8909.mbn). With this tool opened and the device plugged in on the pc, send these commands on ADB:
adb devices
adb reboot edl
The phone will turn off and a red LED will turn on in the device. Now, quickly check if QFIL Tool detected the phone, and click on Tools>Partition Manager, then click OK. ( This last procedure has to be done fast, as the phone will turn EDL Mode off after 30 seconds) After some seconds. if you did it all right, it should show something like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now do right click on the devinfo partition and only select Manage Partition Data. It will show this:
Now click on Read Data and wait for it to finish. Do not unplug the device, and DO NOT click on Close yet. Now get to the file created in the directory stated on the log (Mostly %appdata%/Roaming/Qualcomm/QFIL/) and right click on such file, then open it with HxD Editor. It has to show this:
As stated in alexenferman's post, you must edit some numbers in this file. If you want more info about what you are doing, check the original post. (https://forum.xda-developers.com/t/...vices-devinfo-partition-modification.4100897/)
Edit this (At the first line):
41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
to this:
41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00
01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
After that, save the file, go back to QFIL and click on Load Image. Select the file you just edited. then click on Close, Close again, then OK. The device will boot normally now. Do not unplug the device yet. When the phone has fully booted, send "adb reboot edl" command again, and follow the stated procedure until you get to the partition manager. There, right click on the Recovery partition, (Make sure you are actually clicking on the Recovery partition, as it could happen that you are managing another partition). Click on Load Image, and select the TWRP Recovery image. After flash finished, Click on Close, DO NOT CLOSE PARTITION MANAGER YET. Now, do right click on the Boot partition, Load Image and flash the patched boot image attached (or you can also flash your own patched boot image). Done this, click on Close, Close again and then click on OK.
Now you have to remove the phone's battery and press Volume Up + Power until phone turns on. If TWRP shows up, you are done . If it didnt show up, check if you followed every direction stated above. If you have problems please let me now in the comments.
This Recovery is unofficial, and thus, it might have bugs and issues. If you find one, please state it below.
Special Thanks to TwrpBuilder for his port of TWRP to the ZTE Maven 3, from wich this port was made.
Enjoy
​

Thanks for your contribution