[Android General] giuaig:
Hello!

i bought an OT-985 (not dual sim) just a week ago and i'm trying in any ways to root it because it's a branded one and I don't like boot logo and some apps but without luck, so I think it's better to share some info on it...

This phone have 3 "secret" menu: ((!!Be Carefully, you can damage your phone!!))

#1. Factory Mode --> Power off phone, then start it keeping pressed Home&VolDown buttons and Power On button

#2. Android system recovery utility --> Power off phone, then start it keeping pressed VolUp and Power On buttons, at the logo press Home again to show menu

#3. Engineer Mode --> it's a code to compose directly in the phone "*#*#3646633#*#*" (without quotes)

Some important info found (see attachment for more):

[Version]
BB Chip: [B]MT6573[/B]
MS Board: one_touch_985_gsm
IMEI: xxxxx80111xxxxx
Modem Ver.: MAUI.11AMD.W11.37.SP.V27.P27 , 2012/08/15 14:10
Bar Code: MT012345678901234567
Build Time: Thu Sep 27 18:04:02 CST 2012
UBoot Ver.: 2010.06
Kernel Ver.: [B]2.6.35.7[/B] (android-bld@aclgcl-ubnt157) (gcc version 4.4.3 (GCC) ) #1 PREEMPT Fri Sep 14 18:20:03 CST 2012
Android Ver.: 2.3.6
SW Ver.: ALPS.GB.JRD2.SP.V2
Custom Build Verno.: v53W-0

[Partition Info]:
dev size erasesize name
mtd0: 00040000 00020000 "preloader"
mtd1: 000c0000 00020000 "dsp_bl"
mtd2: 00080000 00020000 "pro_info"
mtd3: 00300000 00020000 "nvram"
mtd4: 00020000 00020000 "seccnfg"
mtd5: 00060000 00020000 "uboot"
mtd6: 00600000 00020000 "boot"
mtd7: 00600000 00020000 "recovery"
mtd8: 00120000 00020000 "secstatic"
mtd9: 00060000 00020000 "misc"
mtd10: 00300000 00020000 "logo"
mtd11: 000a0000 00020000 "expdb"
mtd12: 07300000 00020000 "system"
mtd13: 09100000 00020000 "custpack"
mtd14: 03c00000 00020000 "cache"
mtd15: 09fa0000 00020000 "userdata"

[File System Info]:
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
/dev/block/mtdblock12 /system yaffs2 ro,relatime 0 0
/dev/block/mtdblock13 /custpack yaffs2 rw,relatime 0 0
/dev/block/mtdblock15 /data yaffs2 rw,nosuid,nodev,relatime 0 0
/dev/block/mtdblock14 /cache yaffs2 rw,nosuid,nodev,relatime 0 0
tmpfs /data/local/sqlite_stmt_journals tmpfs rw,relatime,size=4096k 0 0
/dev/block/mtdblock8 /data/nvram/md/s yaffs2 ro,relatime 0 0

I tested almost any exploit or tool like Gingerbreak, alcapwn, zergRush, SuperOneClick, MTK Droid Tools.....it seems 2.6.35.7 is a very solid kernel!

After that i found mt6573 from mediatek it's a common chip used in china clone phone too (OT985 = TCLA966) and "MT6573" seems a very good keyword to search for, in fact I discovered some good tool like "SP Flash Tool" and "MT65xx ROM Studio"

Tutorial on how create a rom dump without root privileges:

"Creating a ROM dump of your MT65x3 device" (sorry I can't post links yet)

bm-smartphone-reviews.blogspot.com.es/2012/04/creating-rom-dump-of-your-mt65x3-device.html

This serbian guy on youtube says it's possibile to gain root by first flashing boot.img:

"Kako Root-ovati Alcatel OT 985" (instruction to root 985 plus a .bin file image)

youtube.com/watch?v=Ni6P94A-PcY

so...

I hope this info can help some real Dev to point me in the right direction! I'm not a programmer, I just use Linux everyday at home, actually i'm trying to understand a pdf from Dan Rosenberg who seems to had done an exploit for my kernel version on a Motorola but obviously files are different...

Last thing, if I do a "Factory reset" can I wipe the branded logo animation at boot or because it's written in the NAND i can't? Thank you

Hi!