you have soft bricked or hard your Phone its easy
Now just follow the Steps and do it properly
And one more essential step is to crack.lg flash tool by changing the system date and entering the serial key the key is present somewhere in the above post search it and enter it u will crack lg flash too
Tools and files needed :-
1-bootv21e.rar from here http://d-h.st/RC5 and after downloading this file unrar it by any unzip or unrar software
2- lg usb drivers and usb cable of LG from here http://csmg.lgmobile.com:9002/data/L...in7_LGEAll.zip
3-http://csmg.lgmobile.com:9002/data/S...shTool_1.1.zip is the LG FLASH tool
4-download the .dll file from here http://www.mediafire.com/?mc6ia9o8iqwqndw
5- Optional Smart flashtool if you get get through the KEy of LG flash tool but this would be hactic and you would also need lg support tool for imei fix download links
-https://docs.google.com/file/d/0B8IkQjiPjX_DS2s1NC1zVGtLWDQ/edit?pli=1 smartflash tool
-Google LG suppot tool
Before you start READ THE GUIDE once so you can understand it and then proceed with repair.
http://d-h.st/U08 omap4420 wkparks
and google omap flashinstaller
Step1.
Install LGflashtool (also copy/paste crack)
P920 users should run LG FlashTool and load BOOTV21E_AP.bin (ONLY THE AP.BIN FILE) and keep it open but NOT ready for flashing.
SU760 users should run LG FlashTool and load SU760V10GROM (ONLY THE AP.BIN FILE) and keep it open but NOT ready for flashing.
Step 2.
Extract WKPARKS omap4boot and follow installation steps:
Install OMAP4430 USB driver
Quote:
If you plug your Phone on PC without battery, OMAP4430 device appeared for seconds and then disappeared in your Windows Device Manager
(check arsen4oo photo guide in post #3)
On windows 7 sometimes OMAP4430 flashes too fast so you cant install driver.
There is a a windows feature that will help you install the driver easier.
To view devices that were once installed but are no longer attached to the computer, open a Command Prompt window using the Run As Administrator option and enter the command:
SET DEVMGR_SHOW_NONPRESENT_DEVICES=1
Then, from the same command prompt, type devmgmt.msc to open Device Manager. Choose View, Show Hidden Devices. The new instance of Device Manager will show “ghosted” entries for devices that were once present. This technique is especially useful for fixing problems caused by leftover drivers after replacing a network card or video card—you can easily delete the ghosted device or update the OMAP4430 driver.
After driver installation ends remove usb cable BUT keep windows device manager open.
Step 3. Run start_fastboot.bat and select option 2
Step 4. Pull out battery
Step 5. Hold Vol+
Step 6. Connect USB cable, the usbboot will start
Step 7. Insert battery while the usbboot is waiting
Step 8. Script tells you to remove cable but i dont think it's necessary in this version
Step 9. Release Vol+ and look in your Windows Device manager
If everything worked ok your phone got recognised and now you are in downoad mode.
Step 10. Change LG USB Serial Port according to LG FlashTool Guide to port 41.
Step 11. Remove cable and battery from P920/SU760
Step 12. Set LG FlashTool ready for flashing.
Step 13. Run Steps 3-9 again and you will see your phone being flashed from LG FlashTool.
It will be stopped at 26-30% because phone will turn off on its own BUT the next time you try to enter NORMAL DOWNLOAD MODE it will be available again.
Step 14. Set LG FlashTool ready to flash your P920 with BOOTV21E_AP.bin again.
SU760 users should use SU760V10GROM bin .
Step 15. Put your phone in DOWNLOAD MODE without using omap4boot this time.
Step 16. LG FlashTool will recognise the phone and flash it completely this time.
P920 after reboot will go to CWM. You can flash your personal backup or reboot to STOCK V21E.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
5-Restoring IMEI
a.Connect phone by USB
b.Activate USB debug mode
c.Enter 3845#*920# in dialer if that doesn’t work try 3845#*925# or 3845#*720# if device is SU760
d.Select Port Settings -> Select CP Image Download
e.A new device should appear at let it install
f.Open Tutty (or hyperterminal) and select serial protocol. Click on open
g.Type AT if response is not OK, change port number (it is possible that when typing you don’t see any letters)
h.Type at%imei, it should display a dummy IMEI
i.Type at%imei=x,x,x,x,x,x,x,x,x,x,x,x,x,x,x where x,x,x... is your orginal IMEI number (found under the battery of your phone). It should response IMEI WRITE OK
j.Reboot phone
if u dont understand it LG support tool will so
6-now open lg suppot tool and remove battery follow step 4 till u get the download mode with S/w and something written in chinese and wait till phone is detected now click customer Support and then recovery Phone then you will be asked for imei insert the imei and it will recognise ur pphone press ok depending on the speed of ur internet connection it will take the time to download the files and update ur phone let the whole procedure complete with me it took around one hour
7- after the process is completed disconnected the phone insert battery and boot ur phoen again it will boot and now again u will find the same issue but this time the trick is simple and easy ur internal memory curropted so format it u will get around 5.57gb and then .Enter 3845#*920# in dialer and do a factory reset or a normal factory reset after reset ur phone wll boot and display android and a package and the loading bar this means the phone is fixed with imei and u will get what you need have a look at the attachment and the vidoe on youtube i have posted [YOUTUBE]http://www.youtube.com/watch?v=BR1_jrsAibk[YOUTUBE]
the last step of factory reset is essential or you wont fix the imei
all the best
download reebooter utility from here http://d-h.st/24C
and do this
Info:
This utility will not work if you don't have Omap Drivers installed
Select task:
1. Flash ICS FastbootLoaders+Recovery
2. Flash V21E Loaders+Recovery
x. Exit
----------------------------------------
Please select 1,2 or exit(x): 2
Ready to Flash V21E+recovery
waiting for OMAP44xx device...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
reading ASIC ID
usb_write 4
usb_read 81
[*] read 0 bytes
NumOfSubblocks: 0x5
Subblock ID: 0x1
Subblock Size: 0x5
CH enabled: 0x7
ROM revision: 0x3
Checksum Subblock: 0x15
CHIP: 4430
IDEN: 40a11fbe08c36fb34f6a113fc2516c63395c7947
MPKH: 5f4092eccddf90fa43f546adf89508b31b9c74795e9516194c0ea6412fdcb7f6
CRC0: 0983f41c
CRC1: 139c4f4f
sending 2ndstage to target... f0030002
usb_write 4
usb_write 4
wait 5-seconds...
[*] msg size = 4
usb_write 21504
[*] data size = 21504
usb_close
Reopen usb...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
waiting for 2ndstage response...
usb_read 4
usb read = aabbccdd
accepted 2ndstage response
sending image to target...
size = 232512
usb_write 4
usb_write 232512
** Done **
< waiting for device >
sending 'recovery' (5854 KB)...
OKAY [ 3.012s]
writing 'recovery'...
OKAY [ 1.230s]
finished. total time: 4.252s
sending 'u-boot' (512 KB)...
OKAY [ 0.268s]
writing 'u-boot'...
OKAY [ 0.355s]
finished. total time: 0.627s
sending 'x-loader' (128 KB)...
OKAY [ 0.070s]
writing 'x-loader'...
OKAY [ 0.051s]
finished. total time: 0.127s
Loaders have been flashed.
Your P920 is ready to boot into GB again. Reboot.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
GOOD LUCK and lets get those bricks fixed.
TROUBLESHOOTING
If you get the Silver LG Screen u are on Fastboot mode
if you get a message like usb not recognised then u probably have a faulty cable
all the Best f++k the Brick:good:
If something doesn't work for you make a post describing exactly what you did , your phone model and your operating system.
Before making pointless posts READ THE GUIDE.
If you don't know how to make one of the recovery programs work READ THEIR GUIDE .
You can find links in the end of this post.
http://forum.xda-developers.com/showthread.php?p=18134614
http://forum.xda-developers.com/showthread.php?t=1629307
http://forum.xda-developers.com/showthread.php?t=1244490
http://forum.xda-developers.com/showthread.php?t=1540163
Sent from my LG-P920 using xda premium
I will edit this thread for the atachments so wait for it
And one more essential step is to crack.lg flash tool by changing the system date and entering the serial key the key is present somewhere in the above post search it and enter it u will crack lg flash too
Sent from my LG-P920 using xda premium
This is more or less a duplicate of the thread below
http://forum.xda-developers.com/showthread.php?t=1942836&page=58
Thread Closed
Qualcomm based chipset phones are fixed through QPST tool. One of the software provided QPST is eMMC software download which helps to fix corrupt bootloader and emmc partitions. BUT SOMETIMES THE BOOTLOADER REPAIR IS NOT SUCCESSFUL.
The PURPOSE OF THIS THREAD is to know what is causing the errors and provide solutions.
The eMMC software creates log files like Dload_COMxx.dbg which can be found under C:\ProgramData\Qualcomm\QPST in Windows 7 PC.
I am encoutring "Image Download Failed. Cookie (if present) not received" error in eMMC download. Here is the log file:
2013/07/03 14:15:55.095 Restart timeout set to 10 seconds
2013/07/03 14:15:55.095 StartSB2Download
2013/07/03 14:15:55.095 Begin SB2.0 Software Download
2013/07/03 14:15:55.095 Skip Reset: 1
2013/07/03 14:15:55.095 Lock phone
2013/07/03 14:15:55.095 Examine phone mode
2013/07/03 14:15:55.111 Get partition file name
2013/07/03 14:15:55.111 User specified flash programmer:
2013/07/03 14:15:55.111 Flash Programmer file:
2013/07/03 14:15:55.126 Examine phone mode
2013/07/03 14:15:55.126 Mobile not in download mode!
2013/07/03 14:15:55.126 SynchronizeConnection starting...
2013/07/03 14:15:55.126 Sending Hello to flash programmer...
2013/07/03 14:15:55.126 Disabling automatic polling.
2013/07/03 14:15:55.189 Try Hello with polling disabled...
2013/07/03 14:15:55.189 Try Hello with polling disabled...
2013/07/03 14:15:55.189 Try Hello with polling disabled...
2013/07/03 14:15:55.189 SynchronizeConnection succeeded.
2013/07/03 14:15:55.189 Sending Hello Packet
2013/07/03 14:15:55.204 Version info = 5 2
2013/07/03 14:15:55.204 Block size = 400
2013/07/03 14:15:55.204 Flash base = 0
2013/07/03 14:15:55.204 Device Name=eMMC:
2013/07/03 14:15:55.204 Flash ID size= 4
2013/07/03 14:15:55.204 Sectors = 128
2013/07/03 14:15:55.204 Feature mask = 0x09
2013/07/03 14:15:55.204 Sending Close 0
2013/07/03 14:15:55.204 Log: Cannot close when not previously opened
2013/07/03 14:15:55.204 ARMPRG error: 15, text: Cannot close when not previously opened
2013/07/03 14:15:55.204 CloseDownloader error
2013/07/03 14:15:55.204 Sending Security Mode 1
2013/07/03 14:15:55.204 eMMC user image present - skipping partition table
2013/07/03 14:15:55.220 eMMC user image: C:\flare repair files\8X25_msimage.mbn
2013/07/03 14:15:55.220 Opening eMMC USER file
2013/07/03 14:15:55.220 Opening eMMC USER mode
2013/07/03 14:15:55.220 Sending MI Open mode 33 size 0
2013/07/03 14:15:55.579 Log: Open multi failed, unknown error
2013/07/03 14:15:55.579 ARMPRG error: 7, text: Open multi failed, unknown error
2013/07/03 14:15:55.579 Download end, status 103, error 852
2013/07/03 14:15:55.579 Exit SB 2.0 download with status 0x00000000
a have a htc one m8s where do i get the xml file and the patch please
To load raw images to a device you will likely need a signature. Even low level tools like QFIL, for example, require MBN files which are essentially keys to the device.
Hello all ,
I linked a serial cable to my allwinner a20 based Android Tv box.
It can not pass after the boot logo and next is all what it display in serial console.
Somebody pelase help i need to reisntall linux on it ,if you knwo any u boot keys that i have to press on the uboot serial consoel pelase help.I tryed to press ransom keys but i see nothin.
Here is all i see when it start:
====================================
HELLO! BOOT0 is starting!
boot0 version : 3.0.0
dram size =512
sum=0x9c3bd8cf
src_sum=0x9c3bd8cf
Ready to disable icache.
Jump to secend Boot.
[ 0.133]
U-Boot 2011.09-rc1-dirty (Nov 08 2013 - 11:06:32) Allwinner Technology
[ 0.141]version: 1.1.0
[ 0.144]pmbus: ready
axp read error
probe axp20x failed
axp_probe error
boot_clock = 912
dcdc2_vol = 1400
axp set dcdc2_vol to 1400 failed
dcdc3_vol = 1250
ldo2_vol = 3000
ldo3_vol = 2800
ldo4_vol = 2800
power_start = 0
storage_type = -1
usb_recovery = 0
find power_sply to end
fel key old mode
run key detect
no key found
no key input
dram_para_set start
dram_para_set end
[ 0.293]DRAM: 512 MiB
relocation Offset is: 15b27000
user_gpio config
user_gpio ok
DRV_DISP_Init: opened
[ 0.560]boot_disp.output_type=2
[ 0.563]boot_disp.output_mode=5
[ 0.567]boot_disp.auto_hpd=1
workmode = 0
[ 1.871]NAND: NAND_UbootInit
NB1 : enter NAND_LogicInit
nand : get id_number_ctl from script, 3
not burn nand partition table!
NB1 : nftl num: 3
init nftl: 0
NB1 : NAND_LogicInit ok, result = 0x0
[ 2.381]sunxi flash init ok
In: serial
Out: serial
Err: serial
--------fastboot partitions--------
-total partitions:12-
-name- -start- -size-
bootloader : 1000000 1000000
env : 2000000 1000000
boot : 3000000 1000000
system : 4000000 20000000
recovery : 24000000 2000000
databk : 26000000 2000000
misc : 28000000 1000000
private : 29000000 1000000
sysrecovery : 2a000000 21000000
data : 4b000000 40000000
cache : 8b000000 17000000
UDISK : a2000000 0
-----------------------------------
base bootcmd=run setargs_nand boot_normal
bootcmd set setargs_nand
key 0
recovery key high 6, low 4
cant find fstbt value
Fastboot detected, will boot fastboot
to be run cmd=run setargs_nand boot_fastboot
the user data'magic is bad
WORK_MODE_BOOT
board_status_probe
sunxi_bmp_display
WORK_MODE_BOOT
[ 2.509]Hit any key to stop autoboot: 0
run usb fastboot
sunxi_fastboot_init
recv addr 0x41000000
send addr 0x582580a8
delay time 0
usb init ok
------------------------------------------------------------------
After this nothing .Please help me
After searching all google and reading documantation ,I contacted the box seller and he gied me the files i neeeded.
I used a image file named sun7i_A20v2.0_android_sugar-ref001_2014.09.04_TakenYBSJ.img and a windwos software to flash it via usb named PhoenixPacketV333
To flash teh device you muist hava a serial console to the box (veru easy to do if you have the cable ) ,and keep pushed the key 2
on serial consle (putty) while powering the device ,so it enter in fel mode ( something like recovery mode ,it accept usb connection) .Then oyu need a usb male to male cable to conect the android tv box usb port to the windows usb port ,and start flasing using the PhoenixPacketV333 software.
If somebody needs more help or files just write here I check daily .
have a nice day all!
Hello XDA community !
To be honest I'm a newbie here, and not really experienced on mobile phone technical stuff
My Zenfone suddenly stopped working last week, without any particular reason.
The only thing I can see when I on the device is the "Powered by Android" logo. But nothing else happens after.
Then I wanted to start the recovery menu, but even when I select "recovery mode" or "fastboot" nothing happens, it's still showing "Powered by Android" logo and no more
See this screenshot :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I tried to plug the device with USB to my linux laptop with android studio installed, but adb devices show nothing
I also tried to create a microSD card, bootable, with exFAT partition and put the phone firmware on the root of the card (as described https://www.asus.com/supportonly/zenfone max plus (m1)(zb570tl)/helpdesk_download/). Even with it, recovery or fastboot options give the same screen as above
My idea was to be able to boot from sd card and be able to "revive" somehow the phone, and at least being able to download user data from it with the help of adb
I'm not sure if it's possible of if I should prepare the microsd with another format or partition layout
Any idea to guide me ?
Don't think you can recover any user-data this because probably bootloader completely got corrupted. Re-flash Stock ROM.
Thanks for your answer.
Sorry also because I made a mistake : I think fastboot mode is active
What I did : In the menu above, I selected "Fastboot mode"
then I got an output : "CSC FASTBOOT mode"
Then I plugged the phone on my laptop USB
The "lsusb" command returned an additionnal device :
Code:
Bus 001 Device 004: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo / FP1
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0bb4 HTC (High Tech Computer Corp.)
idProduct 0x0c01 Dream / ADP1 / G1 / Magic / Tattoo / FP1
bcdDevice 1.00
iManufacturer 1 MediaTek
iProduct 2 Android
iSerial 3 J1AXJR04D658EJ6
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 256mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 66
bInterfaceProtocol 3
iInterface 4 fastboot
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Device Status: 0x0001
Self Powered
"adb devices" still returns nothing but "fastboot devices" does :
J1AXJR04D658EJ6 fastboot
"fastboot reboot" does also reboot the phone ...
From there I guess at least I can do something. I don't know if I'll be able to recover some data, but anyway if I can recover my phone that would be fine too.
you can unlock bootloader with mtkclient (do a backup beforehand) and flash TWRP from fastboot, to see if that leads to something.
ok thanks a lot. I'll have a look to mtkclient / TWRP and try to manage !
Will let you know soon.
keep in mind unlocking from fastboot forces factory reset. It will flush keystore in TEE, don't try this even with full backup. TEE can't backed up.
unlocking from mtkclient afaik does not wipe userdata. but do a backup of userdata + metadata + seccfg (or even better full dump) just in case.
you can try to boot into EDL mode with both vol keys + usb, modified fastboot, DIY deep flash cable or test point method.
[GUIDE][TOOL] Reboot to EDL mode from FASTBOOT! No More "Test Point Method"! [kenzo]
[GUIDE][TOOL] Reboot to EDL mode from FASTBOOT! No More "Test Point Method"! [kenzo] Reboot to EDL mode from FASTBOOT! No more Test Point Method needed ;) Technical Details: Redmi Note 3 support rebooting to EDL in Android Bootloader aboot...
forum.xda-developers.com
also please note TWRP is maybe not able to decrypt, because encryption keys are bonded to bootloader lock state.
however some people claim it's possible, maybe due the fact that seccfg is patched in way to circumvent this (untested).
if you can't boot into recovery from bootloader, you can boot into file from fastboot (requires bootable slot)
Code:
fastboot boot twrp.img
thanks Alecxs for all the information. I'll take some time to read carefully everything.
In the meantime, I installed successfully mtkclient on my laptop. I didn't know about this tool before
I used first the read partition tool, which went fine for almost all partitions except userdata :-(
it started but stopped after 9 GB (over 52) with the following message
Failed to dump sector 12517376 with sector count 109592543 as MyZenfone-partition dump/userdata.bin
18.0% Read (Sector 0x12D6C80 of 0x6883FDF, 42m:19s left) 18.67 MB/sDAXFlash
DAXFlash - [LIB]: Error on reading data: MMC error (0xc0040030)
looks like game over ...
well.. if this is game over, then you have nothing to lose I guess? so backup all partitions excluding userdata (--skip=userdata) then only try to unlock seccfg (do not erase any partition ignore instructions) then boot into fastboot and check if TWRP can boot
TRY AT OWN RISK YOU MAY CORRUPT USERDATA ENCRYPTION OR ERASE USERDATA
Code:
python3 mtk da seccfg unlock
python3 mtk payload --metamode FASTBOOT
fastboot boot path/to/twrp.img
might be possible to dump userdata excluding unreadable sectors. but you need to read the instructions. nevertheless the dump (even if healthy) is impossible to decrypt on PC, can only be decrypted on the origin phone itself...
thanks alecxs, I think I'll try to boot into twrp
My concern is to find a suitable twrp for my device. There is no official port for Asus X018D
I tried to find it by googling and found this on "unofficial twrp" site
twrp 3.2.3 For Mediatek MT6750 Phone
which could be ok for mine maybe except they it's for android 8 and 8.1, while I was still on Nougat 7
I don't know if trying this could work or not ?
you need TWRP for the Plus variant. can you share boot.img + recovery.img read off device?
yes I can share the dumped partitions from mtkclient (the extension is .bin)
boot.bin :
boot.bin
drive.google.com
recovery.bin
recovery.bin
drive.google.com
okay let me try to port generic TWRP. you can meanwhile try that Oreo+recovery+tested.img (login required)
edit: X018D_TWRP.img for android 9 (no login required)
So I tried to unlock bootloader from mtkclient, which resulted in :
sej - HACC init
sej - HACC run
sej - HACC terminate
sej - HACC init
sej - HACC run
sej - HACC terminate
Done |--------------------------------------------------| 0.0% Write (Sector 0x0 of 0x1) 0.00 MB/sDAXFlash
DAXFlash - [LIB]: Error on writeflash: MMC error (0xc0040030)
and then after (maybe I shouldn't have ...)
python3 mtk payload --metamode FASTBOOT
I think I did something wrong, because now I cannot list GPT
python mtk printgpt
gives
Code:
Port - Device detected :)
Preloader - CPU: MT6755/MT6750/M/T/S(Helio P10/P15/P18)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x326
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 10A8E97D4708BDEB74D8D7B3C7E0EBFA
PLTools - Loading payload from mt6755_payload.bin, 0x258 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/laurent/Applications/DevOps/Android/mtkclient/mtkclient/payloads/mt6755_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash
DAXFlash - [LIB]: xread error: unpack requires a buffer of 12 bytes
DAXFlash
DAXFlash - [LIB]: Error jumping to DA: -1
actually, the second command was just to exit preloader mode and switch into fastboot... sorry for the confusion. I have also attached the android 7 version of twrp for testing.. (see above)
If I got this right, unlocking was trying to write Sector 0x0 of 0x1 but it deny writing anything because eMMC is not writeable at 0xc0040030. But isn't that in userdata area?
however, on android 7 for some mediatek devices it's possible to boot into TWRP on locked bootloader. but needs flashing. you can try another flash tool, but it requires windows
edit:
@arthur.levene I got it wrong, seems there is also linux version. Anyway, please read golden rules for SP Flash Tool.
I recommend to create your own scatter file based on the current partition table, either with mtkclient or with WwR MTK v2.51 (most likely you can use the one that already comes with that twrp as the recovery start address is at 0x8000 on many devices, but I personally generally don't trust any scatter file just random downloaded).
lol thought 0xc0040030 was the address of the unreadable sector. turns out it is a fault code. so that could mean eMMC error (most likely) or insufficient permissions.
So any flashing attempts will probably fail no matter what tool used. maybe there is a cheat with heating gun or refrigerator (just guesswork, beware of condensating water)
thanks again alecxs for your time and advice.
I will continue my investigations based on your informations. If i understand your comment about eMMC error, this is not good news.
I will try also the flashing solution in case it could work, though not very skilled on that part too
actually I have never used mtkclient myself but according to documention flashing looks quite easy.
Code:
python3 mtk w recovery twrp.img
However, as you stated in OP you can't enter recovery mode from bootloader menu, so this could be bigger challenge.
I tried but currently I have an error
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - DA Extensions successfully added
Done |--------------------------------------------------| 0.0% Write (Sector 0x0Progress: |███████-------------------------------------------| 14.0% Write (SectProgress: |██████████████------------------------------------| 28.0% Write (Sector 0x2000 of 0x7254, 01s left) 6.74 MB/s
DAXFlash
DAXFlash - [LIB]: unpack requires a buffer of 12 bytes
quick search gives hint is might be driver issue. but you're on linux right? you could try again with libusb-1.0-0-dev_1.0.26-1_amd64.deb
https://github.com/bkerler/mtkclient/issues/192