Related
Greeting to all owners of MTK SmartPhones!
As this devices are technically documented mainly on Chinese, I will teach you today something about low-level device flashing using SP Flash Tool. For those who may have some experiences, SP Flash Tool is MediaTek's equivalent tool for low level flashing like Odin on Samsung devices or RK Batch Tool on RockChip SoC.
Introduction 1 - What is low level flash tool
Let's just say: it's deeper than android flashing. This way you can backup and restore all parts of your NAND chip, and all partitions, not just android and kernel specific ones such as boot, system, data, cache but also nvram, uboot and so on, important for GSM radio. There are two main parts: preloader.bin, which is installed in very first block of your device's eMMC chip - it's first program which phone run after cold stard, and windows driver which is host-side part needed for DL/DA protocol utilized by SP Flash Tools. Both are essential. If you don't have preloader.bin in your phone, you may have very hard brick which is unable to revive unless jtagged or board remains dead. So, whatever you are doing, keep in mind that you must always have preloader.bin in your phone. If you are using format tools, don't ever format preloader area. This SP Flash Tool is must have backup option as this is only way for You to make complete backup of all partitions and block devices in your phone. You must note that some files like NVRAM are unit specific, they contains IMEI and GSM callibration data and You can't use that from another phone, even if it's from same manufacturer and model. That is exactly why everyone should have their own full backup made with SP Flash Tool. And why should You use SP Flash tools for restore? If you asking me, I'm happiest when i don't need to, but there are cases when it's only solution, because no matter how hard you brick your phone, as long as preloader sits inside, you will be able to restore it to fully working state this way as opposite for custom recoveries which requires some working partitions (recovery, boot, ...) SP Flash Tool is so powerful that you may install custom recovery even without rooting ie. Let's go see how it works:
For this occasion, I will use my Alcatel one touch idol MINI (OT-6012X) as test device, but this may work also for all MTK smartphone devices with EMMC, but I don't know abot their new UBIFS.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Tools needed:
MTK Preloader Drivers - Collection of drivers for MTK Phones
SP Flash Tool - Latest Smart Phone Flash Tool v3 5.1408.00 (20/03/2014)
MTK Droid Root & Tools - Version 2.5.3 needed for splitting dump IMG file into separate partition images and retrieving SCATTER file
Chapter 1 - BACKUP
I'm starting this with assumption You already have drivers installed. If you did not installed drivers, see how to install drivers in Appendix.
1. Shut down your phone with cold start (disable Quick Start/Fast Boot options in shutdown menu or settings)
2. Extract SP Flash Tool you downloaded form URL above and run flash_tool.exe as administrator.
3. Go to Download page and pusth scatter-loading button, than load scatter.txt for You device. You can find this file sometimes in OTA update.zip, or you can create it with MTKDroid Tools but they can be faulty. I provided scatter.txt for Alcatel one touch idol MINI (OT-6012X) as MTKDroid Tools can't generate working scatter for this Alcatel phone.
4. Now navigate to Readback tab and push Add to add new set for read. Save file as ROM_0.img, and for OT-6012X fill other fields just as show on this picture below.
ROM_ALL.img - start address: 0x0000000000000000 and for lenght open scatter.txt and find where /cache partition starts. In my case it's 0x534C0000. This way You will dump all data of your eMMC chip up to cache partition.
Last two eMMC partitions are /cache and /data and we need to add them as well, but separately, beacuse we need all partitions to flash after formatting eMMC. In my case, for OT-6012X it's:
cache.img - start address: 0x00000000534c0000 lenght: 0x09200000
userdata.img - start address: 0x000000005c6c0000 lenght: 0x60000000
Note that I took only first 1.5 GB of data because SP Flash Tool won't let me take more for some reason. But content of /data is not relevant for me, not just because last 0.7 GB was empty space, and I wiped it in recovery right after flashing anyway.
5. Now push Read Back button and connect your phone which is still OFF to PC with USB cable. Soon readback process will start. Depending on your USB speed and configuration it will take up to 45 min or 1h for 3GB im not sure but it's plenty of time to take full dump
6. Once readback is complete you will see green circle as sign all pass well. Congratulations now you have partial dump of your phone memory, you may now disconnect USB, exit SP Flash Tool, and turn on your phone.
Chapter 2 - PREPARING FILES FOR RESTORE
1. Turn on your phone with USB Debugging enabled and installed ADB drivers.
2. Extract MTKDroid Tools and run MTKdroidTools.exe as administrator. Once your phone is detected by MTKDroid Tools you can push Blocks Map button and than you can push Create scatter file button in new window which will popup. This way you can creat scatter file for some devices. With my phone, file which has been generated this way didn't work for an unknown reason, that is why i included this file for download.
3. Navigate to root, backup, recovery tab and push button To process file ROM_ from Flash Tool, and select image dump file you created in previous chapter (ROM_ALL.img). Now MTKDroid Tool will split IMG file into many separate files for each part of eMMC which you will flash later in Chapter 3. If you are asked to create CWM just say No and push Cancel when prompted to input recovery file.
4. Few minuts later you will see "---Task Completed---" in log, and prepared files are located in subdirectory backups of MTKDroid Tool folder. Afterwards you may close MTKDroid Tool. All files are prepared for flashing back into phone as they may bee needed sooner or later.
Chapter 3 - RESTORE
Finally we come to restore but you don't need to take a breath now as this easily could be an easiest step to do
1. Shut down your phone with cold start (disable Quick Start/Fast Boot options in shutdown menu or settings)
2. Run SP Flash Tool again and navigate to tab Download, load scatter.txt for your phone (if you using OT-6012X its included in SP Flash Folder by pressing on Scatter-loading and selecting scatter.txt
3. Double click on each partition and select respectable file from backups folder in MTKDroid Tools you created in Chapter 2. Note that last two partitions (/cache and /data) are located wherever you saved them with SP Flash Tool. See picture for more details:
4. Select Format All + Download from drop-down menu like on picture below. This is essential becasue if you broke partition table, whole eMMC be formatted and all partitions must be rewritten. That is why we need both /cache and /data partitions, all checkboxes must be checked. If you try to unselect single partition you wont be able to do format before flashing.
5. Push Download button and connect your phone (which is off) with PC via USB cable. Process should start, with formating eMMC, and downloading all data respectable. It can take up to 30 mins or so, depending on partition image sizes. After process is finished you will see green circle on screen again. Unplug USB from phone and turn it on.
That would be all.
Appendix - INSTALLING DRIVERS
This going into appendix section as this is needed to be done only once - when You use SP Flash Tool for the very first time. Theoretical background behind this is: we use memory testing routine as it is safe to do and it will initiate preloader to be detected into Windows OS device manager. Once we get new hardware found, we install drivers.
Install adequate drivers from MTK Preloader Drivers via automated setup.
1. Shut down your phone or prepare for cold start if you are in bootloop
2. Run SP Flash Tool and navigate to Memory Test tab
3. Check RAM Test and Data Bus Test ONLY, all other checkboxex must remain clear, than push Start button. DO NOT CHECK EMMC Test!
4. Connect your phone (which is still OFF) and PC with USB cable, afterwards new hardware found wizard should popup. If you installed drivers it should be automatically found, if not, you still may install drivers manually, respectably to device type and OS you are using.
5. Once driver setup is finished, SP Flash Tool will show green circle as signal that RAM is tested and it's ok. If you see red circle RAM is nok.
Addendum - COLD START from BOOTLOOP
If your OT-6012X is in bootloop, try this solution. It it discovered on OT-6012X but may also works for other MTK devices with embedded battery. (devices without detachable battery)
1. Press and hold power button and vol - button together and keep pressed. After 8 sec (when phone turns off) release power button but keep pressed volume - for few seconds more, than release it. Now your phone should stay off.
2. Connect to USB and wait for charging battery few seconds than unplug USB. Now your device is in COLD START state.
3. Now (from cold start state) press volume + and power button at same time, and after phone turns on release power but keep volume + pressed untill recovery loads than restore NAND backup if you have TWRP installed.
If I didn't referred some methods used in this guide it means that they are discovered by myself. If this guide helped you, please don't forget to push thanks button. Have fun.
Hi CyberianIce and thanks for this tutorial, but BitDefender detected a Trojan in MTKDroid_Tools...
With Virustotal (scan of rar archive) : 17 / 51
EDIT : After verification, the same problem is in MTKDroid_Tools official link too but I'm not sure it's a false positive...
paradiselost28 said:
Hi CyberianIce and thanks for this tutorial, but BitDefender detected a Trojan in MTKDroid_Tools...
With Virustotal (scan of rar archive) : 17 / 51
EDIT : After verification, the same problem is in MTKDroid_Tools official link too but I'm not sure it's a false positive...
Click to expand...
Click to collapse
One must turn A/V off when using MTK Droid Root & Tool and SP Flash Tool because they recognize common android exploits (faramir, boromir, etc) as potentially threat. However, that is false alarm, because it is harmless when used for this purpose and absolutely needed for rooting.
CyberianIce said:
One must turn A/V off when using MTK Droid Root & Tool and SP Flash Tool because they recognize common android exploits (faramir, boromir, etc) as potentially threat. However, that is false alarm, because it is harmless when used for this purpose and absolutely needed for rooting.
Click to expand...
Click to collapse
Can you upload somewhere a full backup with all partitions for sp flash tool ?
I have Alcatel 6012x and I bricked it with Sp Flash tool , I used format ALL + download without preloader and others,only cache,userdata and Android ( system ) ,I got an error and now only what can I see it is a blue LED .
Preloader is still alive, you have chance to get things back working if you have Your backup, my files wont help much:
http://forum.xda-developers.com/showthread.php?p=49902338
ok now it is alive,but I do not understand ,it had a very bad signal or what?
Because with Vodafone Romania I do not have signal no where inside of my home,outsite I have signal,and with Cosmote Romania 2G GSM I have 1-2 signal lines and with Cosmote Romania 3G WCDMA everywhere is on roming and I have with it 3-4 signal lines insite of my house .
dfani511 said:
ok now it is alive,but I do not understand ,it had a very bad signal or what?
Because with Vodafone Romania I do not have signal no where inside of my home,outsite I have signal,and with Cosmote Romania 2G GSM I have 1-2 signal lines and with Cosmote Romania 3G WCDMA everywhere is on roming and I have with it 3-4 signal lines insite of my house .
Click to expand...
Click to collapse
It is possible you ruined your GSM calibration data which are located in NAND chip NVRAM. They contains unit-specific GSM radio calibration data and IMEI? How could you format all without preloader? Such operation is hardly possible because if you uncheck any part of emmc, format become regular update of selected partitions.
No that isn't from the last write without preloader , because that problem I had it in the past and for that I tried to re-write the fw
Can I do something ?
Applies to all other phone?
dfani511 said:
No that isn't from the last write without preloader , because that problem I had it in the past and for that I tried to re-write the fw
Can I do something ?
Click to expand...
Click to collapse
Just restore previous backup as described in first post.
EvangelineX said:
Applies to all other phone?
Click to expand...
Click to collapse
Yes but you must obtain scatter.txt for your specific phone.
I think it will work for others phone but not with the scatter from here,if you reed this tutorial he say there it work for others ....
and CyberianIce thank you for this tutorial was helpful
CyberianIce said:
Just restore previous backup as described in first post.
Yes but you must obtain scatter.txt for your specific phone.
Click to expand...
Click to collapse
this phone are not mine it belongs to a friend,today he say me the phone had this problem after when it come from service,they repair the touchscreen , and he doesn't want to sent it back because it stay on service too much (1 mounth)
Can I re-write these files which are responsable with GSM Calibration from NAND?
You don't know that partitions are flashed, which are affected and which are not, and what is for what. How you expect from me to help? You don't know what is problem, and what they did in service. Sorry, this thread is for backup/restore OT-6012 with SP Flash Tool, not for general phone help. If you had NVRAM, protect_f and protect_s backup from your previous backup you could restore that, otherwise don't touch anything.
Is it safe to flash an updated preloader on the same device but different firmware version? E.g. On is running v01 rev and the other device is v02? This is on stock rom and newer bought device has newer firmware
It's never safe to flash preloader, specially if it is from another phone.
Help
Please help. I am new to Android. I bought Alcatel one touch idol mini 6012D with two sim and no sd card. I have installed Twrp and cant update my smart. Please tell how to remove twrp? How to install stock firmware? Please help.
There is no TWRP for dual SIM mode. You tried to flash TWRP from 6012X into 6012D, what for Christ sake you thinked? You need SP Flash Tools backup which is different from this described in this tipic. You have to find stock recovery elsewhere and flash with mobileuncle if your phone can boot at all
guide is best
i think this TUT work on my OT d5 Kitkat 4.4.2 but for some reason SP flash tool did not detect my alacatel D5,,
can you help me,,
im making CWM ,,but when i click read back nothing happens?
and yes i have scatter file generated from MTK driod tool,
driver installed,
what about this error,, "PMT change for the room,it must be downlaoded"
We are trying to get hold a custom recovery for Lenovo Tab3-710F. We are using hundreds of Lenovo tablets in our projects and have up until now used Tab2 A7-10 which has a custom recovery build for it (found here att XDA).
The reason we need the custom recovery is for cloning the unit which works good in CWM or TWRP.
The problem now is that Lenovo have stopped selling Tab2 so we are now stuck with a unit we cant clone.
Have somebody successfully created a custom recovery for the unit? If not or if you have we are offering payments/devices to get this working asap. Are you interested please PM us? When we have it we can share it to the world here no problems for us.
If you need to root the device KingoRoot latest APK works.
So hope somebody can help us.
Perhaps useful for you: I've managed to extract the stock rom of a brand new TB3-710F
http://forum.xda-developers.com/android/help/lenovo-tab-3-7-essential-tb3-710f-mt8127-t3416397
This also includes the "recovery.img" so you could try to change this image and simply flashing it. If it does not work you'll have a stock rom to restore it.
gogetrd said:
We are trying to get hold a custom recovery for Lenovo Tab3-710F. We are using hundreds of Lenovo tablets in our projects and have up until now used Tab2 A7-10 which has a custom recovery build for it (found here att XDA).
The reason we need the custom recovery is for cloning the unit which works good in CWM or TWRP.
The problem now is that Lenovo have stopped selling Tab2 so we are now stuck with a unit we cant clone.
Have somebody successfully created a custom recovery for the unit? If not or if you have we are offering payments/devices to get this working asap. Are you interested please PM us? When we have it we can share it to the world here no problems for us.
If you need to root the device KingoRoot latest APK works.
So hope somebody can help us.
Click to expand...
Click to collapse
Did u manage to get TWRP or CWM for TB3-710F ?
zwirc said:
Did u manage to get TWRP or CWM for TB3-710F ?
Click to expand...
Click to collapse
Yes, I built it for them. Download here
@Tzul @gogetrd We are trying to achieve something similar, configure about 700 tablets of this model. I have played with custom ROMs in the past, but mostly as a consumer (e.g. Cyanogen on personal devices).
It is my understanding that installation using the files provided by @Tzul would require to;
0. create a custom ROM.
Then for each device
1. root device (e.g. Developper mode, allow "Unknown source"s, adb install one rooting apk, run it, etc).
2. install custom recovery on device
3. flash custom ROM
Am I right?
If so do we agree that the time spent doing these operations might be about similar than the time spent e.g. manually installing / configuring the device? Or is there a way to automate the steps above?
You can configure 1 tablet, then extract the ROM and flash it with the "download mode". You don't even need to boot the tablet!
If you want more info let me know, back from holiday in a few days
@lacostej You can certainly automate some steps, and you do not always need root. (And the best way to root is to install the latest SuperSU via TWRP; no need for questionable apps that are doing who knows what...)
There are three ways to install another firmware:
The MediaTek SmartPhone Flash Tool (SPFT). This is a PC program (Windows and Linux) that allows reading and writing of the entire internal storage (on a partition granularity). Via USB, while the device is powered down. Only for devices based on MediaTek chips, of course (this tablet is MediaTek-based).
Fastboot. This is a little USB protocol implemented by the bootloader. A Fastboot client on PC can communicate with the bootloader via USB and execute certain commands, e.g. "fastboot flash" for flashing partitions. However, there are a few drawbacks with this:
First, you need to boot the device into fastboot mode. Some devices have a boot menu that allows you to do this, but this device doesn't. Starting the tablet via power+volumeUP takes you directly to the recovery instead of a boot menu. But in the recovery, whether stock or TWRP, there's a reboot to bootloader option. Using ADB (adb reboot bootloader) should also take you there.
Second, the "fastboot flash" command is restricted on this tablet. If you were to use "fastboot flash recovery <recoveryfilename_here>", for example, it would abort with an error message. I have patched the bootloader to allow the flash command, but you'd first need to install this patched version on your tablet(s), of course, via SPFT or other means.
Third, the "fastboot flash" command has a size limit - the bootloader needs to buffer the USB data in RAM before it can be written, and since the tablet has only 1 GB of RAM, you obviously can't flash a 1 GB system image this way. The buffer is actually a lot smaller: just 128 MiB. Meaning whatever file you send to the tablet via "fastboot flash", it cannot be larger than 128 MiB. So, how do you flash the system or userdata partition then, which are much, much larger? By splitting their image file into many smaller "sparse" image files, each of which is below the size limit. There's probably a tool for doing this, but I don't know any details.
TWRP, or another custom recovery. They allow you to create and restore backups. TWRP has some automation support via OpenRecoveryScript.
So, if you have 700 tablets to configure, you can configure just one, then save its state via SPFT or TWRP, then restore that on each other tablet.
What is its "state"? Well, the system, cache, and data partitions. The system partition is normally read-only and won't change, therefore you do not need to clone it. Unless you install root and modify stuff on the system partition, of course. The cache partition is quite irrelevant. It is the data partition that has all the app settings.
However, if you clone the data partition from one tablet to others, then you're causing each tablet to use the same Android ID (a long number identifying an Android device, usually randomly generated when Android is first booted after a factory reset), the same Bluetooth and WiFi MAC addresses, and some other IDs that should be unique on each device (the tablet's Lenovo serial number might be in some cloned files as well, e.g. the WiFi settings).
You can at least avoid cloning the MAC addresses by deleting the entire directory /data/nvram/ before you create your backup. MediaTek devices have a dedicated NVRAM partition that contains the MAC addresses and some other stuff, and this data gets unpacked to /data/nvram/ when Android boots. Unless the files there already exist. So, by deleting /data/nvram/ before you clone, you force each tablet to extract its unique MAC addresses again at the next boot...
Thanks a lot for the feedback. Really appreciated.
Tzul said:
@lacostej And the best way to root is to install the latest SuperSU via TWRP; no need for questionable apps that are doing who knows what...
Click to expand...
Click to collapse
Doesn't SuperSU already requires root? (http://forum.xda-developers.com/showthread.php?t=1538053)
How did you get root on your Lenovo device? (I assume you had one to dump the image)
However, if you clone the data partition from one tablet to others, then you're causing each tablet to use the same Android ID (a long number identifying an Android device, usually randomly generated when Android is first booted after a factory reset), the same Bluetooth and WiFi MAC addresses, and some other IDs that should be unique on each device (the tablet's Lenovo serial number might be in some cloned files as well, e.g. the WiFi settings).
.
Click to expand...
Click to collapse
That's exactly the thing I was worried about when it comes to cloning. Those problems might arise later during QA, and I probably don't have the time required to do it properly this time.
lacostej said:
Doesn't SuperSU already requires root? (http://forum.xda-developers.com/showthread.php?t=1538053)
How did you get root on your Lenovo device? (I assume you had one to dump the image)
Click to expand...
Click to collapse
SuperSU is just like any other root manager. It provides the actual "su" (superuser) binary that other programs rely on to obtain root privileges, plus an Android app for managing permissions and settings. The su binary needs to be installed on the system partition (at least traditionally), but in order to get write access there, you need root privileges. Therefore, this is a chicken and egg problem: SuperSU provides root, but it also needs root in order to be installed. Other root manager are no different - except that some try to exploit security flaws in Android in order to temporarily obtain root and install their su binary.
Anyway, the classic solution to this conundrum is the (custom) recovery: it basically has root built-in. It can write to the system partition by default, after all one of its jobs is to install firmware updates.
TWRP includes a SuperSU stub. If you leave TWRP via the Reboot menu, it checks whether or not the su binary is installed (at least in Android 4 and 5), and if it isn't, it asks if you'd like to install the SuperSU stub. Which you can then use in Android to update to the latest SuperSU via Play Store. But you can also install SuperSU's latest "update zip" in TWRP to immediately install the full version.
lacostej said:
That's exactly the thing I was worried about when it comes to cloning. Those problems might arise later during QA, and I probably don't have the time required to do it properly this time.
Click to expand...
Click to collapse
Yeah, it is annoying. MediaTek apparently wisened up a bit. Newer platforms they produce do not unpack the NVRAM partition to the data partition anymore. Instead, they use a dedicated "nvdata" partition for that purpose. That way, if you clone the data partition, you at least won't include the unpacked NVRAM data (MAC addresses and IMEI). But still, some other IDs such as the Android ID, references to the serial number, etc. will very likely be referenced by some other files on the data partition.
I created a little "update zip" that can be "installed" via TWRP, which is just a shell script that tries to delete all the files on the data partition that contain unique or sensitive info. I use it to "clean" a data partition before publishing it. But it's not perfect yet...
@Tzul Your modified rom is great. But I have one problem with it.
When you connect your turned off device to the power supply there is a clock and charging animation. The clock is several hours ahead of the system clock. System clock and clock during the charging are connected (when I change the system time the 2nd clock also changes the hour).
I was trying to use hwclock but without success.
Is there some kind of file where I can set the correct time zone for the 2nd clock?
Sorry for my English.
@Yozen I didn't modify the ROM. I extracted and packaged it.
When the tablet is turned off and then connected to a power supply, it will usually start "off-mode charging" (can be disabled, so that Android will boot up instead). This is handled by the bootloader (LK, lk.bin), which also displays the battery animation and the clock that you see. Apparently the bootloader on this device doesn't handle time zones, because the clock shown uses China Standard Time (CST, UTC+08:00). This is the first MediaTek-based device I've seen which shows a clock in the off-mode charging screen at all. I guess they normally don't because they have no simple way to figure out the user's correct time zone at that stage.
Will this method and these files work for TB3-730F?
Sir, is there a custom ROM available for Lenovo tab3-710f ?
lacostej said:
@Tzul @gogetrd We are trying to achieve something similar, configure about 700 tablets of this model. I have played with custom ROMs in the past, but mostly as a consumer (e.g. Cyanogen on personal devices).
It is my understanding that installation using the files provided by @Tzul would require to;
0. create a custom ROM.
Then for each device
1. root device (e.g. Developper mode, allow "Unknown source"s, adb install one rooting apk, run it, etc).
2. install custom recovery on device
3. flash custom ROM
Am I right?
If so do we agree that the time spent doing these operations might be about similar than the time spent e.g. manually installing / configuring the device? Or is there a way to automate the steps above?
Click to expand...
Click to collapse
How did you do it in the end? I'm trying to do something similar here and am very curious!
.acy said:
How did you do it in the end? I'm trying to do something similar here and am very curious!
Click to expand...
Click to collapse
For us it is this "simple".
1. Manually configure a single device
2. Readback the ROM (get the ROM from the device and store it on your PC) using SP Flash Tool
3. Parse the ROM from a single file to multiple files using Mtk Droid Tool
4. (clear cache partition & remove stuff like serial number)
5. Load your ROM in SP Flash Tool
6. Click start
7. DO NOT START your new tablet
8. Connect it to USB
9. Wait (assuming you already have the preloader drivers installed)
10. Done, new ROM is flashed to your tab!
edit:
Oh and with 700 tablets it might be nice to look into compressing the file as the full 8gb dump we flash (and we don't do a lot these days) will take ~30-40 minutes
mattiemvs said:
3. Parse the ROM from a single file to multiple files using Mtk Droid Tool
Click to expand...
Click to collapse
That's unnecessary, because the SP Flash Tool can already read back partitions into separate files.
Also, you don't need to clone some partitions like cache, and you really should not clone nvram and parts of data, otherwise you'll end up with tablets sharing unique IDs such as MAC addresses, which will cause problems.
Tzul, you are absolutely right! I typed the items from my mind as it has been quite some time since I've created the ROM
tb3-710f s000028
Tzul said:
Yes, I built it for them.
Click to expand...
Click to collapse
Hello tzul,
Thanks for your jobs.
I want to install Lenovo_TB3-710F_S000027_TO_S000028_Patched_Tzul.zip
But i don't know how i do this when i try with SPFT i choose teh scatter-file and i have an error :
sp flash toll error : 5417
The load scatter file is invalid !
hint :
please check the scatter file and select again
Can you help me ? please
@siegheart73 That is a patched OTA update. It needs to be installed by the recovery (stock or TWRP). If a zip file contains a "META-INF" folder, then it's most likely intended for the recovery, and not for the SPFT.
Tzul said:
@siegheart73 That is a patched OTA update. It needs to be installed by the recovery (stock or TWRP). If a zip file contains a "META-INF" folder, then it's most likely intended for the recovery, and not for the SPFT.
Click to expand...
Click to collapse
Thanks for your answer.
I go to test it.
I want to root this kernel 000028 and i have difficult to do it ?
Do you have a easy solution ?
Thanks a lot for your help.
Coolpad Rogue 3320A - Stock 5.1.1 Build No. 5.1.157.00.T2.150810.LMY47V
Fastboot Flashable Recovery, Kernel, Modem & Misc. Firmware Images
Disclaimer You flash these images at your own risk. I am not responsible for bricked or otherwise inoperable devices as a result of flashing any of the files provided herein.
These partition images will help you recover a soft bricked device in the event you have missing or corrupt partitions. Additionally, in the event you are having signal or connectivity issues, flashing the modem/radio firmware could resolve those problems. I have provided all partition images for the 3320A with the exception of /system and /userdata. The stock /boot and /recovery images are always good to have in case you ever need them. At a minimum, save these images to external storage in case of future need. I will provide a full /system image in future at request.
WARNING Flashing bootloader or bootloader dependent partitions can result in a hard bricked device. Please do not flash bootloader type partitions unless you are well versed in this area. Tampering with these particular partitions is best left for developers and experts. I will clearly label any bootloader type partitions, in hopes that it will alleviate any confusion.
INSTRUCTIONS:
Install Minimal ADB and Fastboot on your PC or Laptop. The installation files can be found here on XDA Forums. Install the USB Drivers for your Coolpad Rogue 3320A. (The drivers are pre-installed on the device itself. If you are able to boot up, connect your 3320A to your PC and look in your PC's directory for an installation option.) Place the .img files you need on an external SD card or in internal storage. With your device powered off, boot into Recovery Mode by holding power and +volume simultaneously until the Coolpad logo appears -- then let off of power but continue to hold +volume until the stock recovery screen appears. Use your volume button to scroll down to Bootloader and press power to select. When the Fastboot screen appears, connect your device to your PC with a suitable micro USB syncing cable and press +Volume. In your Minimal ADB and Fastboot directory open a command window (Shift and Right Click).Type: fastboot devices If you are properly connected, your device serial number will be displayed in your command window under connected devices. If your serial number doesn't appear, repeat the above steps, ensure your USB drivers are installed correctly, and try changing USB ports on your PC or trying a different cable. Once you are connected properly, the rest is simple: I have named each partition image synonymous to its corresponding partition. In other words, the name of the file is also the name of your device's partition to be flashed.
EXAMPLE If you are flashing the "carrier" partition, you simply type fastboot flash carrier carrier.img Again, I will label each partition as to the type (e.g. recovery, bootloader, modem firmware, etc.)
DOWNLOAD LINK:
https://drive.google.com/folderview?id=0B7-zQU1VihD3eXE1SjBIby02Rmc
PARTITION NAME / TYPE
tz - "Trust Zone" Bootloader Dependent Partition
tzbak - Allotted Partition Backup of tz
ssd - Firmware Partition
sec - Firmware Partition
sbl1 - Secondary Bootloader
sbl1bak - Allotted Partition Backup of sbl1
rpm - Primary Bootloader
recovery - Stock Recovery Image
persist - Firmware Partition
params - Firmware Partition
panic - Firmware Partition
pad - Firmware Partition
oem - Manufacturer/Device ID Partition
modem - Radio Firmware
modemst1 - Radio Firmware
modemst2 - Radio Firmware
misc - Carrier/Region ID Partition
keystore - Firmware Partition
fsg - Radio Firmware
fsc - Firmware Partition
devinfo - Manufacturer/Device Info Partition
ddr - Radio Firmware
config - Carrier Specific Info Partition
boot - Stock Kernel/Ramdisk
aboot - Application Bootloader Partition
Hopefully this guide will help you restore your device from an inoperable state or restore connectivity from problems originating from damaged/corrupt partitions.
Relaying A Message from MotoJunkie01
Relaying A Message from MotoJunkie01
I apologize for not being in closer contact. I have some pressing issues going on and, coupled with work, man I've been tied up something awful. I'm going to need to drop off XDA for a month or better to get my personal issues attended to. I need a huge favor from you.
My little threads I have started, if you could go on and explain I'll be gone for a month or so. I'd appreciate it.
I've Not enough time to even do that.
So if anyone needs a reply I'd figure sometime in July, and I hope you all will understand and allow this time for MotoJunkie01 to attend to his personal matters. Signed: ResistanceIsFutile
Link not working
Your above link does not work. Also I have no idea why you are trying to share images. Fast boot only pushes zip files
Gamesmedic said:
Your above link does not work. Also I have no idea why you are trying to share images. Fast boot only pushes zip files
Click to expand...
Click to collapse
Sorry about the broken link. I just added a new working link with all listed firmware images.
You are obviously extremely confused about the purpose & function of fastboot commands. Allow me to educate you a bit. First, contrary to your statement, fastboot does not "push" files. And it most certainly does not push "zip files." In fact fastboot cannot be used to manipulate zip archives at all. . If you go back and read the thread, fastboot is used primarily, and as a preferred method by many, to flash firmware images to your device. (.img, .bin, mbn, etc) The firmware images in my link can be flashed to the Coolpad Rogue, via fastboot, to restore the partitions to pure stock/factory condition, in the event of a soft brick, bootloop, corrupt OS, etc.
I hope this clears your confusion some, before you hard brick a device trying to "push zip files" with fastboot.
Sim unlock
would this help to do a sim unlock
rachinda said:
would this help to do a sim unlock
Click to expand...
Click to collapse
No. SIM unlocking involves an entirely separate procedure. I am not even sure a SIM unlocking procedure is available apart from using a remote unlocking service or requesting an unlock code through the carrier directly. This thread is merely a source for stock firmware partitions for devices which are stuck in boot loop, soft bricked, poor or lost cellular service, connectivity issues, etc.
Hi,
Does anyone have any idea or suggestion, on how to unlock the bootloader for the Chuwi HiPad Pro?
Or anyone that has unlock for another similar device, could please share how you were able to do it? maybe can help.
Thank you for your attention.
Which hipad pro? Mtk or Qualcomm?
I have MTK .
Contact Chuwi at [email protected] requesting the key to unlock your bootloader.
They will reply with your 16 bit encryption key and then proceed to unlock bootloader as usual via abd fastboot commands.
There are several different commands to try.
I was successful with
fastboot flashing critical unlock
Then entered the encryption key
Fastboot will then ask the tablet in fastboot mode if you would like to unlock the bootloader. Vol - to selected Y/N and Vol + to enter selection.
Try this at least worked on my CHUWI SurPad, Android 10 CPU: MT6771 (MediaTek) and should work on most MediaTek (mt2601, mt6261, mt6572,... check https://github.com/bkerler/mtkclient/tree/main/mtkclient/payloads )
This will work only on MediaTek and you can achieve this:
- Unlock bootloader (it allows you to modify boot partition) without factory wipe (this would happen using fastboot method)
- Modify boot partition via Magick app
1) Unlock bootloader + backup flash partitions
Get familiar with mtkclient (https://github.com/bkerler/mtkclient)
It is tool that can read/write content of flash. Compile it on your linux or windows. FYI Im describing steps in GUI mode but if you have only working ./mtk binary you can do the same but need to read documentation.
Shutdown your tablet, disconenct USB cable from PC to tablet.
Run ./mtk_gui tool and follow its instruction in console you need to get into BROM mode (it is not fastboot mode nor recovery mode, it is special mode that works only MediaTek chips and usually cannot be used. Anyway this program mtkclient using some exploit to get there due to some bugs). It also means most likely that even bricked devices could be "restored" if someone tried modify recovery partition and bricked by replacing it with original one due to dm_verity protection [you can ask me I dumped my device])
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
at this stage you should be in this MTK GUI connected and navigate to read tab and save all yourflash partitions. or at least boot.bin, vbmeta.bin, recovery.bin - you can restore them later if any failure.
Also navigate last tab and click unlock bootloader (this wont erase your data at all)
reboot your device (either with ./mtk reset) or holding 10 sec power button and boot back to android 10. In boot screen you will see some warning that device has bootloader unlocked and 5 sec delay before boot.
2) Modify extracted boot.bin with latest Magisk
Download apk here https://themagisk.com/magisk-app/ and install to your andriod (you can use adb push from laptop via connecetd usb cable [need enabled developer mode), or simply copy to sd card and install from there) also copy boot.bin you dumped from previous step 1)
Run Magisk click to install in Magisk section (and select your boot.img file on sdcard or anywhere where you stored it inside your tabled device) and click "Let's go" - this will do some magic inside boot image which enables Magisk to be your root provider for the apps (something like sudo or su). So patched image is stored my location was /storage/emulated/0/Download/magisk_patched-25205.img
Copy this file back to your laptop somewhere
Shutdown your tablet again and unplug usb cable
3) Disable dm_verity + rewrite boot partition using mtk
Boot your laptop to BROM mode again as described in step 1)
to install patched boot.img (now magisk_patched-25205.img) you can use that mtk_gui and same for overwriting vbmeta partition
for disabling dm_verity you need use vbmeta_empty.bin (it is inside mtkclient directory)
No you can reboot your device and should boot.
Run magisk again and you should see now that choices "Superuser" and "modules" are available.
DONE..
you can also patch recovery.bin with your favority TWRP or another (i havent done this)
you can get root access by installing any sshd client and accesing to it, or simply in adb shell type su and magisk will ask you to grant it
MTK UNIVERSAL V5 can unlock.
HELLO I HAVE THE SAME PROBLEM BUT IS QUALCOMM .ITS EXIST SAME PROG FOR QUALCOMM ?
artaos said:
HELLO I HAVE THE SAME PROBLEM BUT IS QUALCOMM .ITS EXIST SAME PROG FOR QUALCOMM ?
Click to expand...
Click to collapse
[Tool] Ultimate Read write flash mtk, Spd, Qualcomm unlock, Lock network, sim, Frp
******************Miracle Box ******************* This Is only for Personal use, I am Not a Developer of This Box, this is Developed By a miracle Team Hit Thanks:good: For This Crack- Features- Features for MTk[all Devices]- Read info...
forum.xda-developers.com
Pre Story
I have a couple of Unihertz Atom Mini (Android 9) as Pet Tracker, its the best option for my usage.
The application setup for each device is very complicated so i decided doing one stockrom for all.
After successful rooting the device and permanent de-encrypting the data partition, i stuck with some problems.
first i used a pin in the stockrom, a restore on a second device did result with not beeing able to unlock the device - pin is correct but can not unlock.
So i did a new stockrom image without a pin, the restore worked, system runs fine, but now it seems the system cannot set a pin code.
for the backup restore operations i use sp tools / readback / download and for the userdata partition TWRP over OTG. The atom mini has no sd_card slot
If i restore all partitions, i get also these Chinese letters in the middle of the screen, by restoring only the default partitions not.
(Yes i did a backup before of each device to be sure not losing the device depending nvram
any suggestion how to fix this?