[Android Q&A, Help & Troubleshooting] superusr:
Further information on recovery + boot

This is my first Android phone, and so far I've managed to get out of a few scrapes with it not booting, but this isn't for the faint-hearted....

Anyway, I've been trying to install some recovery software on it, to make life easier. As xzyk has noticed, there are some interesting partition names when doing 'cat /proc/mtd' . When turning on the phone, I think that:

Pressing volume up when powering on enters some sort of recovery mode, where the only option is to wipe the data (recovery partition)

Pressing volume down when powering on enters fastboot mode where I can connect the phone via the USB cable to a linux computer and type fastboot flashing commands (bootloader partition).

I've found out that the Alcatel OT 983 is very similar to the Vodafone smart II aka Alcatel v860 aka Alcatel MTC-962 (if you have used ALCATEL ONE TOUCH Upgrade NB V1.0.2 you can see you either select the MTC-962 or One Touch 983 model). There's a lot of information on this phone in this thread:

Vodafone smart II/Alcatel v860 Reocovery !ROOT!. Look out for posts by phenomenalxp, aka roeddie, the author of roeddie rom. His web site contains an 'extended recovery' image which I think comes from the MTC-962 (a Russian version of the v860). This extended recovery has an option to 'backup and restore'. I can't post URLs but google for 'Vodafone Smart II Recovery roeddie' to see this. Interestingly there's a screenshot of the "All data will be lost,continue?" screen which the OT 983 recovery provides.

I tried installing this image to the recovery partition and it started up by pressing volume up + power on, however it did not recognise the OT 983

keyboard layout, and only the volume up key worked. But it was interesting that it started up at all.

I took a closer look at the image (google "HOWTO: Unpack, Edit, and Re-Pack Boot Images" for info on this). I downloaded split_bootimg.zip, used this command to strip away the header in it

dd if=recovery.img of=nh_recovery.img bs=2048 skip=1

and then ran

$./split_bootimg.pl nh_header_recovery.img
Page size: 2048 (0x00000800)
Kernel size: 3141432 (0x002fef38)
Ramdisk size: 1363027 (0x0014cc53)
Second size: 0 (0x00000000)
Board name: RF42W0W0
Command line:
Writing nh_recovery.img-kernel ... complete.
Writing nh_recovery.img-ramdisk.gz ... complete.

$mkdir ramdisk
$ cd ramdisk/
$ gunzip -c ../nh_recovery.img-ramdisk.gz |cpio -i

which extracted the ramdisk, and I found the recovery binary in sbin/recovery.

I ran this binary from a terminal on my phone, and it started up. The text was hidden by Android, but I could see that pressing volume up and down highlighted the different options.

Next I unpacked the original recovery image, replaced the recovery binary with this one, and rebuilt the image using the header from the original image. This time recovery mode didn't boot at all. phenomenalxp thinks that the bootloader is locked, and I think he is right. Using a hex editor on the original recovery and boot images, I noticed that the header is mostly zeros, but interestingly contains these hex codes at offset 0x20:

BA BE FA CE 28 XX XX 00

BABEFACE looks suspiciously like a marker of some sort. Let's search for this string in the first partition, modem.img (I used 'dd if=/dev/mtd/mtd0 of=modem.img' on my phone to generate this image).

strings modem.img > modem_strings.txt

If you search for babeface in this file you will see

ERROR: Couldn't find 0xbabeface in comms image!!!

So there is some sort of checking going on here that the image file is 'valid'. Next I downloaded an ARM disassembler for Windows called disarm (google "Binary file ARM code disassembler for PC") and searched for babeface in the disassembled code.

000002ec: ldr r4,#0x664 ; = #0x28003000
000002f0: ldr r0,[r4,#0x20]
000002f4: ldr r4,#0x66c ; = #0xbabeface
000002f8: cmp r0,r4

Look, it's checking for babeface at offset 0x20 ;)

000002fc: beq #0x304
00000300: b #0x31c

So let's see what happens if it fails this check

0000031c: ldr r4,#0x574 ; = #0x8880018
...
00000334: b #0x334

So if the check doesn't work it goes into an infinite loop and never boots.

The word after 'babeface' is some sort of checksum which is checked using some iterative code. So I think if we want to know how to generate this checksum, we need to analyse this code further. This I believe is what we need to do if we want to install CWM recovery or other recovery software on the OT 983.