[Android Software/Hacking General [Developers Only]] flatmax:
Hi there,

I want to port CWM to the Charmpin gin g7 (MTK6589 quad core $140 chinese phone).

I managed to find a way to get root in recovery, however I can't seem to pull the boot.img.

It is possible that the bootloader is locked, however there doesn't seem to be a way to get this phone into fastboot mode. No combination of hardware boot keys NOR adb reboot bootloader seems to work !

Any pointers on what to do ?

Here is some information :

In recovery :
[MENTION=1901967]androi[/MENTION]d:/ # cat /proc/cmdline

console=ttyMT3,921600n1 vmalloc=530M slub_max_order=0 lcm=0-nt35517_qhd_dsi_vedio_lcm_drv fps=6260 lcm_type=1 pl_t=2035 lk_t=2637 printk.disable_uart=1 boot_reason=2

[MENTION=1901967]androi[/MENTION]d:/ # cat /proc/mounts

rootfs / rootfs rw 0 0

tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0

devpts /dev/pts devpts rw,relatime,mode=600 0 0

proc /proc proc rw,relatime 0 0

sysfs /sys sysfs rw,relatime 0 0

/dev/block/mmcblk0p6 /cache ext4 rw,nodev,noatime,nodiratime,data=ordered 0 0

/dev/block/mmcblk0p5 /system ext4 rw,nodev,noatime,nodiratime,data=ordered 0 0

[MENTION=1901967]androi[/MENTION]d:/ # ls /dev/block/

loop0 loop4 mmcblk0 mmcblk0p2 mmcblk0p6 mmcblk1p1

loop1 loop5 mmcblk0boot0 mmcblk0p3 mmcblk0p7 platform/

loop2 loop6 mmcblk0boot1 mmcblk0p4 mmcblk0p8

loop3 loop7 mmcblk0p1 mmcblk0p5 mmcblk1

Partition Information:

preloader 0x0000000000600000 0x0000000000000000 2 /dev/misc-sd

mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0

ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1

pmt 0x0000000000400000 0x0000000000100000 2 /dev/block/mmcblk0

pro_info 0x0000000000300000 0x0000000000500000 2 /dev/block/mmcblk0

nvram 0x0000000000500000 0x0000000000800000 2 /dev/block/mmcblk0

protect_f 0x0000000000a00000 0x0000000000d00000 2 /dev/block/mmcblk0p2

protect_s 0x0000000000a00000 0x0000000001700000 2 /dev/block/mmcblk0p3

seccfg 0x0000000000020000 0x0000000002100000 2 /dev/block/mmcblk0

uboot 0x0000000000060000 0x0000000002120000 2 /dev/block/mmcblk0

bootimg 0x0000000000600000 0x0000000002180000 2 /dev/block/mmcblk0

recovery 0x0000000000600000 0x0000000002780000 2 /dev/block/mmcblk0

sec_ro 0x0000000000600000 0x0000000002d80000 2 /dev/block/mmcblk0p4

misc 0x0000000000080000 0x0000000003380000 2 /dev/block/mmcblk0

logo 0x0000000000300000 0x0000000003400000 2 /dev/block/mmcblk0

ebr2 0x0000000000080000 0x0000000003700000 2 /dev/block/mmcblk0

expdb 0x0000000000a00000 0x0000000003780000 2 /dev/block/mmcblk0

android 0x0000000028a00000 0x0000000004180000 2 /dev/block/mmcblk0p5

cache 0x0000000007e00000 0x000000002cb80000 2 /dev/block/mmcblk0p6

usrdata 0x00000000b2500000 0x0000000034980000 2 /dev/block/mmcblk0p7

fat 0x0000000003b00000 0x00000000e6e80000 2 /dev/block/mmcblk0p8

bmtpool 0x0000000001500000 0x00000000ff9f00a8 2 /dev/block/mmcblk0

recovery filesystem table

=========================

0 /tmp ramdisk (null) (null) 0

1 /boot emmc boot (null) 0

2 /cache ext4 /dev/block/mmcblk0p6 (null) 0

3 /data ext4 /dev/block/mmcblk0p7 (null) 0

4 /misc emmc misc (null) 0

5 /recovery emmc recovery (null) 0

6 /sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0

7 /system ext4 /dev/block/mmcblk0p5 (null) 0

I:no boot messages

locale is [en_US]

can't open /dev/tty0: No such file or directory

framebuffer: fd 3 (540 x 960)

ioctl(): blank: Invalid argument

ioctl(): blank: Invalid argument

installing_text: en (324 x 38 @ 411)

erasing_text: en (109 x 38 @ 312)

no_command_text: en (172 x 38 @ 312)

error_text: en (64 x 38 @ 312)

Command: "/sbin/recovery"

==============================

[ASP] SECURE BOOT INIT 'Thu Nov 1 17:35:20 CST 2012(ASF.JB.6589)'

==============================

[SEC] no check. ret 0x9007

ro.boot.serialno=0123456789ABCDEF

ro.serialno=0123456789ABCDEF

ro.bootmode=unknown

ro.baseband=unknown

ro.bootloader=unknown

ro.hardware=mt6589

ro.revision=0

ro.factorytest=0

ro.secure=1

ro.allow.mock.location=0

persist.mtk.aee.aed=on

ro.debuggable=1

persist.sys.usb.config=mass_storage,adb

persist.service.acm.enable=0

ro.mount.fs=EXT4

ro.build.id=JOP40D

ro.build.display.id=CJCP.JB2.MPV1.5.1

ro.build.version.incremental=eng.leo.1374046989

ro.custom.build.version=V1.5.1

ro.build.version.sdk=17

ro.build.version.codename=REL

ro.build.version.release=4.2.1

ro.build.date=2013年 07月 17日 星期三 15:45:56 CST

ro.build.date.utc=1374047156

ro.build.type=user

ro.build.user=leo

ro.build.host=leo-desktop

ro.build.tags=release-keys

ro.product.model=Charmpin-G7

ro.product.brand=Charmpin

ro.product.name=Charmpin

ro.product.device=Charmpin

ro.product.board=Charmpin

ro.product.cpu.abi=armeabi-v7a

ro.product.cpu.abi2=armeabi

ro.product.manufacturer=CJCP

ro.product.locale.language=zh

ro.product.locale.region=CN

ro.wifi.channels=

ro.board.platform=

ro.build.hardware.version=

ro.build.customer=

ro.build.innner.version=

ro.build.product=Charmpin

ro.build.description=wt95045-user 4.2.1 JOP40D 1374046989 release-keys

ro.build.fingerprint=Charmpin/wt95045/wt95045:4.2.1/JOP40D/1374046989:user/release-keys

ro.build.flavor=

ro.build.characteristics=default

ro.mediatek.version.release=ALPS.JB2.MP.V1.2

ro.mediatek.platform=MT6589

ro.mediatek.chip_ver=S01

ro.mediatek.version.branch=ALPS.JB2.MP

ro.mediatek.version.sdk=1

rild.libpath=/system/lib/mtk-ril.so

rild.libargs=-d /dev/ttyC0

wifi.interface=wlan0

ro.mediatek.wlan.wsc=1

ro.mediatek.wlan.p2p=1

mediatek.wlan.ctia=0

ro.operator.optr=CUST

wifi.tethering.interface=ap0

ro.opengles.version=131072

wifi.direct.interface=p2p0

dalvik.vm.heapgrowthlimit=128m

dalvik.vm.heapsize=256m

ro.sys.usb.mtp.whql.enable=0

sys.ipo.pwrdncap=2

ro.sys.usb.storage.type=mtp,mass_storage

ro.sys.usb.bicr=yes

ro.sys.usb.charging.only=yes

ro.camera.sound.forced=0

ro.audio.silent=0

ro.zygote.preload.enable=0

persist.sys.timezone=Asia/Shanghai

persist.mtklog.log2sd.path=/mnt/sdcard2

ril.specific.sm_cause=0

gps.solution.combo.chip=1

ro.build.display.wtid=SW_GIN_V1.5.1

ril.external.md=0

fmradio.driver.chip=3

ro.sf.hwrotation=0

ril.current.share_modem=2

launcherplus.allappsgrid=2d

launcher2.allappsgrid=3d_20

curlockscreen=1

ro.mediatek.gemini_support=true

persist.radio.fd.counter=15

persist.radio.fd.off.counter=5

persist.radio.fd.r8.counter=15

persist.radio.fd.off.r8.counter=5

persist.mtk.wcn.combo.chipid=-1

drm.service.enabled=true

fmradio.driver.enable=1

ril.first.md=1

ril.flightmode.poweroffMD=1

ril.telephony.mode=1

ril.radiooff.poweroffMD=0

dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt

mediatek.wlan.chip=MT6628

mediatek.wlan.module.postfix=_mt6628

ro.config.notification_sound=Proxima.ogg

ro.config.alarm_alert=Alarm_Classic.ogg

ro.config.ringtone=Backroad.ogg

net.bt.name=Android

net.change=net.bt.name

dalvik.vm.stack-trace-file=/data/anr/traces.txt

ro.mtprof.disable=1

init.svc.ueventd=running

ro.sf.lcd_density=240

init.svc.recovery=running

init.svc.adbd=running

Matt