yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Alex1948:
WHOLE_ROM

4. Run SP Flash Tool, Open Scatter File :

- What scatter file upload ? images 1(that obtained with MTKDroid) or scatter.txt (renamed) and otained with dumchar , script pyton....see images 2. ???

- Start adress is 0x00000000 , but Lenght can pass 0xE7F20000 (start adress FAT=0xC81C0000+FAT lenght=0x1FD60000) END adress FAT ???

With this file, probably higher, than 1GB ,WHOLE_ROM - without extension , What do I do next ?

- to get all the MTKDroid A5_Duo_130806_ForFlashtoolFromReadBack_131007-212823 - see image 3(for this we used start adress 0x00000000 and Lenght 0x3c9c0000 - my CACHE start adress) and My ROM_0 has - 969 MB

And another CWM recovery, more personalized for this phone with can be done?Android-Kitchen-0.224 ? Need 2 files(system.img and boot.img)

I installed and cygwin but does not work, crashes
[Android Software/Hacking General [Developers Only]] syserr:
#3 and #4 go hand in hand. You just need to make SPFT happy. In all my testing, the scatter and img files can be WRONG... *IF* all you are doing is using "Read back" and "Write memory". It makes sense that to do raw reads and writes, you wouldn't need to know the structure. But this tool forces you to have a scatter and images so it will perform the read/write tasks.

On your second issue, the "FAT" block is not very important and at least on ICS 4.0.4 on my device, if it is all zeros, then on first boot Android will ask to format it. On 4.0.3, I think I had to create a FAT image, which is pretty easy on Linux.
[Android Software/Hacking General [Developers Only]] gls9:
I used this "tool".

But with clean.sh I get a error about DSP_BL. In my scatterfile (MT6589) it is not there. I attached scatterfile.

Is there another "replacement" which i need to clean ?
[Android Software/Hacking General [Developers Only]] iZLeeP:
Thanks for the guide!
[Android Software/Hacking General [Developers Only]] JoeSip:
Lost calibration data - Unresponsive screen

Hey guys, I have Star N9800 phone. During the last week I've been trying hard to fix my touchscreen driver since I flashed a stock ROM. The problems I was facing were checking and comparing lk.bin (lcm driver) with other people who also have same phone, downloading different ROMs and boot images, tried almost everything. I even opened my phone and disconnected the digitizer to check if it's the problem. When it's connected it says: touchscreen: ili2113a when I check version in factory mode (VOL- + HOME + POWER). When it's disconnected it says: touchscreen: (null), so obviously digitizer is working fine.

Today I think i've found the problem. While using SP Flash Tool I've used manual format from 0x00000000 to whatever it said. It deleted calibration data. And apparently calibration data is stored in nvram.bin which can be backed up using MTK Droid Tools while running a working ROM.

I have flashed original stock ROM now, I'm rooted and I can control my phone from the PC but can't use the screen. It's fully unresponsive. I've checked some answers here on XDA and some guy said I should make a nvram backup of stock ROM and then flash userdata_nvram_only.tar as USERDATA in SP Flash Tool. When I tried unzipping that .tar it clearly has /data/nvram/ folder which also contains some calibration and other files. But when I flashed that .tar as USERDATA my phone isn't booting anymore. I've tried flashing different boot.img but the problem is still here.

Does anybody know how to fix my touchscreen?

I contacted few people on www.NeedRom.com to upload userdata_nvram_only.tar for me, but I don't know whether they are going to do it or not.

I appreciate all help I can get, and I'd seriously hate if I had to send the phone back to china. I wouldn't really do it.
[Android Software/Hacking General [Developers Only]] syserr:
Posted my reply to his PM:

I think you are totally on track. The NVRAM block/partition is special and it really bugs me that I didn't know this up front when I killed my first MTK device, and people I trusted (ahead of me) didn't talk about it. (FYI, I bought an identical device to repair my device's NVRAM block)

The trick here is... most MTK SP Flash ROMs available don't have the NVRAM block. This is because, they are unique to the device (IMEI and MAC) and if you don't Format with SP Flash, then you don't need them.

What you need... someone with an identical device that is willing to run SP Flash and do a "Read Memory" on the address range of NVRAM block. You would get the address range from the scatter file.
[Android Software/Hacking General [Developers Only]] syserr:
I'll say a couple more things:

Yes, right now your NVRAM block is probably all zeros. And yes, you can use MTK Droid Tools to back up a good NVRAM... I like using SP Flash Tool to read the memory range of the NVRAM block, then I know it's in a shutdown state etc. All MKDRT is doing is running an adb command and doing something like "dd if=/dev/mc***** of=nvram.bin bs=1M count=1"... You could do that too with adb.

You don't need the USERDATA block at all. I would correct your request, to just ask for NVRAM. As USERDATA/USRDATA/DATA (all aliases of the same thing) is a block for your installed apps and data. It is what gets wiped when you do a Factory Reset with typical ROMs or with CWM etc.
[Android Software/Hacking General [Developers Only]] JoeSip:
Thank you very much man!

So now I'm supposed to just get backup of NVRAM that someone has done in MTK Droid Tools and not the whole ROM?

What if I flash full backup of someone's whole ROM? Will that save me too?
[Android Software/Hacking General [Developers Only]] syserr:
That works too. That's how I learned what I was doing -- there is less to go wrong when writing a whole ROM with Write Memory. They are big though.

You can stop short of read/writing the USRDATA and FAT block/partitions -- because they are really big. They are not necessary, USRDATA is created fresh with a Factory Reset which does a Data Wipe. FAT can usually be recreated in the Settings menu for Storage... as it is the "internal SDCARD".
[Android Software/Hacking General [Developers Only]] JoeSip:
Fine. I have asked some people to do NVRAM backup and whole ROM backup if they have the time. I'll pay $10 to the guy who helps me get my phone fixed :P
[Android Software/Hacking General [Developers Only]] syserr:
Kind of a side note...

I've had the same feelings in the past about $$ for help -- as I've been in some bad situations. But, I also make quite a bit of money especially compared to other countries. I've had poor luck motivating people to help me with $. I decided I was going to dive into how MTK stuff worked for myself and to give to the community. Hopefully, when I need help, folks will look at my reputation as a "giver" and give back to me.

So I humbly ask for people to hit the Thanks button. Your bounty on a WHOLE ROM may work, I hope it does. There very well could be technical people that need the money.

I purchased 2 additional Tablets (one from over-seas) that I did not need, so I could dump their ROMs to further my understanding and give to the community (those ROMs).
[Android Software/Hacking General [Developers Only]] JoeSip:
I've already clicked thanks :P

I'd actually do it 3 times if i could because you really cleared some things for me. And you should start using MTK phones. They are the best because they can't actually get bricked. Even if you flash wrong preloader, by downloading correct one in meta-mode you can fix phone.

The problem for me was just that i didn't know that calibration data can be deleted so easily by SP Flash Tool.

On a side note, MTK has released a MT6595, scoring 47000+ in AnTuTu... So yeah, long live MediaTek!
[Android Software/Hacking General [Developers Only]] syserr:
I've actually been thinking about an MTK phone. In my region though I really must have a CDMA phone that can at least roam onto Verizon. I use a small MVNO that rides on Verizon's towers. Verizon has taken over rural USA as far as I can tell. :(

Maybe I'll find a cheap MTK CDMA phone. (they have to be out there like the Moto Droid D1)
[Android Software/Hacking General [Developers Only]] JoeSip:
oh! :D

good luck finding such phone, MTK have surely made such phones and the MT6595 CPU has got 4G unlike all older MTK chipsets. But it'll cost you a bit more.

Try searching for 'Teca N3B' (snapdragon) or 'Teca N9B' (mediatek) on eBay. That's pretty cheap phone and offers all signal ranges.
[Android Software/Hacking General [Developers Only]] ghost45:
Very interesting thread for my study!

Thanks Syserr!

Actually the new Soc Mtk6595m There is sweeping!

:p
[Android Software/Hacking General [Developers Only]] AlexZap:
Hey, Syserr,

this thread is great and it has given me great inspiration. as you may or may not know, the new mediatek SoC's do not have an easy way of extracting a scatter file. there is no dumchar_info file. i am sure your other methods would work to do it (via sp flash tool), but this is a pain if you want to do a simple backup. so i took your dice.sh script and re-wrote it work with a different file: /proc/partinfo. all phones should have this, as it is really a base part of linux. i cant see anyone disabling this in a kernel build. i think too much relies on it. anyway, if you want to check it out, it is attached. this is my method:

pull the partinfo file:

adb shell cat /proc/partinfo>partinfo.txt

dump the rom (without sp flash tool)

adb forward tcp:5555 tcp:5555
adb shell su -c "nc -l -p $netcat_port -e dd if=/dev/block/mmcblk0" &
nc 5555 127.0.0.1 |pv -i 0.5 >rom.img

run the script

dice.sh partinfo.txt rom.img

should run on both old and new mtk SoC's. more work to be done because it is dumping everything. and there is no scatter file... but i am working on all of that. just thought you might find it interesting.
[Android Software/Hacking General [Developers Only]] kenny108:
Script for newer MTK chipsets

With the newer MTK chipsets the format of the scatter file is very different and I've made a shell script to work with those. Find it in the Alcatel Pixi thread.

:)

Edit: Be very careful with flashing back the extracted preloader...people have reported bricked phones by flashing the wrong preloader. The extracted preloader must be edited first. There are 0x800 bytes at the start that must be removed, and extra bytes at the end (either 0x00 or 0xFF) that should also be removed. See post#1 for ideas and scripts (clean, trim, and trimFF) on how to do this.
[Android Software/Hacking General [Developers Only]] Miss Montage:
New versions of the SP Flash (from 5.1548) also allow to dice the ROM directly during the Readback. You need to modify the line "ShowByScatter=false" in file option.ini to "ShowByScatter=true".

The files will be dumped as ROM_0, ROM_1, ROM_2 etc.

Also it might occur that "userdata" is not listed, in case you want to save an image you need to add it manually.
[Android Software/Hacking General [Developers Only]] AlexZap:
This is great info!! Still no automatic way to generate a scatter file tho, other then parsing the /proc/part_info file tho, unfortunately...
[Android Software/Hacking General [Developers Only]] Tr4sHCr4fT:
what partitions are you renaming to cause it fail 100%?

i renamed userdata and had only it active for Download, but it kept going.
[Android Software/Hacking General [Developers Only]] jhedzkie:
will this work with MT67XX devices as well?
[Android Software/Hacking General [Developers Only]] AlexZap:
I don't know about his log method, but there is no dumchar file in the 64 bit ROMs. You can pull /proc/partinfo and use that to create a scatter file.
[Android Software/Hacking General [Developers Only]] jhedzkie:
alright it seemed to work thus far. the only thing left to do is to readback. hopefully it works.
[Android Software/Hacking General [Developers Only]] jhedzkie:
I extracted only recovery from readback. how to convert it to .img file?
[Android Software/Hacking General [Developers Only]] Miss Montage:
Have you tried to simply rename it to recovery.img ?
[Android Software/Hacking General [Developers Only]] jhedzkie:
i did. i also tried booting it with adb, but it says

C:\adb>fastboot boot recovery.img
downloading 'boot.img'...
OKAY [ 1.322s]
booting...
FAILED (remote: invalid kernel address: not lie in memory)
finished. total time: 1.342s

and it's also on a fixed size of 16mb. i thought it'd be not an exact size.
[Android Software/Hacking General [Developers Only]] Miss Montage:
Probably the device does not support testing the recovery by

fastboot boot recovery.img

Nonetheless I just readback and flashed the same twrp.img, and it is still there...
[Android Software/Hacking General [Developers Only]] jhedzkie:
what I have with me is the partitions from spft named ROM_* respectively. and they do come in fixed file sizes based on the size indicated in the scatter that i've managed to come up with. what i haven't had success in doing is executing those *.sh from the first page. i tried running them with cygwin but it fails everytime.
[Android Software/Hacking General [Developers Only]] AlexZap:
the preloader is the first few k in that first partition. look at a m67xx scatter file and you will see. if you need the preloader you need to extract is it from that partition
[Android Software/Hacking General [Developers Only]] PAPalinskie:
i've already view the scatter file that i'm using. i want to dump full partition info of my phone first. since it is also 8Gb ROM(from its scatter, same ROM size but different partition info such as system that is 2Gb compared to my system partition that is 2.5Gb) i need the whole ROM, not just the preloader.
[Android Software/Hacking General [Developers Only]] AlexZap:
does your phone have the file /proc/partinfo? if so, your phone is using the new partition layout format. you could use ADB to dump the entire rom, or if you have a scatter file for your phone, you can use sp flash tool to backup your phone.
[Android Software/Hacking General [Developers Only]] PAPalinskie:
the kernel doesn't have /proc/partinfo and also no luck of dumping scatter file in mtkdroidtools(because it has no partinfo in the current ROM and it didn't support 6580). also, i tried to dump scatter via miracle box(crack, without box) in preloader mode but it didn't do the job. i just want to do is to root the device by modifying boot and the recovery image and make a backup of the phone but no luck of of obtaining good scatter file for my phone.
[Android Software/Hacking General [Developers Only]] AlexZap:
does it have /proc/dumchar_info? if it does, you can probably get away with a patched mtkdrt... https://mega.nz/#!iQRA1QRJ!YyrHd49V7WCE9sNe95L5nwyECwJuhLEnRhbcRsJFaj4
[Android Software/Hacking General [Developers Only]] PAPalinskie:
no dumpchar too.
[Android Software/Hacking General [Developers Only]] AlexZap:
what phone do you have?
[Android Software/Hacking General [Developers Only]] PAPalinskie:
this is only proc have and maybe this will find me a hint from adb at least.

1
10
100
101
102
103
107
108
109
11
110
111
1113
112
1120
113
1131
114
115
116
117
12
120
121
122
123
124
125
126
1263
127
129
130
131
13168
13181
13186
132
133
134
135
136
137
13780
138
13801
139
14
140
141
142
14291
144
145
1458
146
147
1484
1490
15
1501
1509
156
157
16
161
162
166
167
16765
17025
171
17180
172
1742
176
17690
177
17733
179
17916
18
180
18085
181
18263
18569
18582
18587
186
18839
19
19010
19134
193
19312
19313
19355
194
19406
19428
19435
19438
19441
19447
19464
195
196
19618
197
19735
19769
19774
19778
19906
2
20
200
202
20291
20308
20314
20332
20359
20375
20382
20398
204
20403
20441
20494
20565
20583
20641
20683
20695
20703
20762
20769
208
209
210
211
212
213
214
216
217
218
219
22
221
222
223
224
225
227
228
229
23
230
232
233
235
236
237
238
239
24
240
241
242
246
248
25
250
251
26
27
28
29
3
30
31
32
3295
33
34
35
36
37
371
372
374
38
39
40
41
410
411
42
43
44
45
46
47
48
49
5
51
52
53
54
543
6482
6686
6688
68
69
6981
7
7245
7431
8
86
87
88
89
9
90
900
92
93
94
95
96
97
98
99
aed
asound
batdrv_log
boot_mode
bootprof
buddyinfo
bus
cgroups
chip
class
clkmgr
cmdline
cmdq_test
consoles
cpu
cpufreq
cpuinfo
crypto
device-tree
devices
diskstats
driver
execdomains
fb
fgadc_log
filesystems
fm
freqhopping
fs
ged
gpufreq
hps
interrupts
iomem
ioports
irq
kallsyms
kmsg
kpagecount
kpageflags
kpageswapn
last_kmsg
lk_env
loadavg
locks
m4u
meminfo
misc
mlog
mlog_fmt
mounts
mrdump_rst
msdc_FT
msdc_debug
msdc_help
msdc_tune
msdc_tune_flag
mt-auxadc
mt_pmic
mt_power_gs
mt_xgpt
mtd
mtk_battery_cmd
mtk_cmdq
mtk_cmdq_debug
mtk_mira
mtk_sched
mtkcooler
mtktz
mtprintk
mtprof
net
pagetypeinfo
partitions
perfmgr
pm_init
pm_init
ptp
rid
sched_debug
schedstat
scsi
self
softirqs
stat
swaps
sys
sysram
sysram_flag
sysrq-trigger
tasks_all
tasks_rq
thermlmt
thread-self
timer_list
tty
uid_cputime
uid_stat
uptime
version
vmallocinfo
vmstat
wdk
wmt_tm
xlog
zoneinfo
zraminfo

numbers at the top are suspected to be a folder so maybe a bin name below is the partinfo. mtk marshmallow roms are more difficult to root. also, cant enter dev or debug folder because of permission.
[Android Software/Hacking General [Developers Only]] AlexZap:
all the number folders are for individual processes... so they are a nonstarter. check out "partitions".
[Android Software/Hacking General [Developers Only]] PAPalinskie:
these are only in the partition table(i excluded mmcblk1)

major minor #blocks name

7 0 1254 loop0
7 1 32768 loop1
254 0 491456 zram0
179 0 7634944 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 10240 mmcblk0p4
179 5 256 mmcblk0p5
179 6 384 mmcblk0p6
179 7 16384 mmcblk0p7
179 8 16384 mmcblk0p8
179 9 512 mmcblk0p9
179 10 8192 mmcblk0p10
179 11 10240 mmcblk0p11
179 12 1024 mmcblk0p12
179 13 32768 mmcblk0p13
179 14 40320 mmcblk0p14
179 15 2048 mmcblk0p15
179 16 6144 mmcblk0p16
179 17 8192 mmcblk0p17
179 18 2662400 mmcblk0p18
179 19 62144 mmcblk0p19
179 20 4521472 mmcblk0p20
179 21 16384 mmcblk0p21
179 96 512 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0

The largest partition seems to be my userdata and the second to the highest will be my system partition. if the part map is converted to hex easily, this will show a scatter map instead. but due to new partition map implemented on marshmallow, it is difficult to know what partition i am dumping.
[Android Software/Hacking General [Developers Only]] AlexZap:
you can correlate partitions to names by looking in /dev/block/ and the subdirectories there. tho you cant access therm without root. but with this, you have sizes (# blocks * 512), and you can figure out names. now you can probably create a scatter file and dump the rom with sp flash tool. just find a scatter file for another 6580 device and modify it to have your sizes.
[Android Software/Hacking General [Developers Only]] PAPalinskie:
so, i should start at mmcblk0p3 instead? there is a chances that this preloader is larger than 10Mb(based on my previous dumps of MTK 64bit ROMS and didn't try to dump 32bit mt6580 yet). and the 512 will be my ebr and mbr as is? i already have a 6580 scatter file(doogee x5) so guessing where is the right partition will be the biggest guessing game here because this is the newest partition map created to freak ROM dumpers.
[Android Software/Hacking General [Developers Only]] vinokirk:
Have you tried to get a scatter file from a MTK6580 device? I am trying to root a Lenovo A1010a20 (Lenovo A Plus), and in the process tryoing to create a scxatter file with MTK Droid Tools 2.5.3, but the 'Create scatter file' button is greyed out
[Android Software/Hacking General [Developers Only]] PAPalinskie:
actually, i found a better solution to dump scatter file and the whole ROM. you should try cracked miracle box software. well, it didn't require the dongle itself to run the software.
[Android Software/Hacking General [Developers Only]] vinokirk:
Thanks for the reply :)

So you just ran the software without the box?

Did you connect via a regular USB cable to the phone?

Do you have any experience in rooting Android 5.1 on an MTK 6580?
[Android Software/Hacking General [Developers Only]] PAPalinskie:
sure it is. well, i only have here is 6.0 device on a mt6580 chip. regular cables are able to use without the box.
[Android Software/Hacking General [Developers Only]] billyx1:
I have a similar partitions file like [MENTION=5321477]PAPalinskie[/MENTION]. How is the process to convert it to a scatter-file?

[MENTION=5321477]PAPalinskie[/MENTION] Could you please provide your scatter-file?

https://play.google.com/store/apps/details?id=me.kuder.diskinfo&rdid=me.kuder.diskinfo can show the mapping between the names
[Android Software/Hacking General [Developers Only]] PAPalinskie:
[MENTION=1844155]bilyx1[/MENTION] do you use a similar device like walton or intex? I think the problem here is... I am not sure if we have a same partition blocks. Creating scatter file is an easy task but too risky. As of i said earlier, you should try a cracked miracle box software in making scatter files and it does not require the box to operate.
[Android Software/Hacking General [Developers Only]] AbdulMajid11:
Building a scatter file from scratch using Wwr_MTK tool (For both old and new MTK )

Requirements

Download Wwr_MTK

Download SP Flash tool

Download a scatter file for the Mediatek phone's chipset (e.g MT****_Android_scatter)

Notepad++ (Download @ https://notepad-plus-plus.org/ )

Procedure

Wwr_MTK is a tool for backing up Mediatek Android phones (in scatter format) without root. The tool (in hand with SP Flash Tool) is able to read the phone's partition table then use that information to create a scatter file. To get a scatter file:

Follow this guide to do a full rom dump which will then contain the scatter file

Another alternative is to follow this guide to get the start and end addresses for each partition which you can then input into a scatter file for your phone model
[Android Software/Hacking General [Developers Only]] Donphillipe:
How to extract ROM when you have the scatter file

I always seem to have an inverse problem from everyone else. I have a factory restore scatter file exammple for this phone and I need to somehow use it (or anything that works) to pull at minimum the userdata.img file and hopefully everything else to the point where I can write a cloned image back to another phone.

Objective: Pull about 500 contacts off a severely 'dropped' phone suffering total screen loss and partial mother board loss, a phone that has by some miracle still has a functioning powered-off USB interface which communicates with SPFflast.

Limitations: Only Windows skills and can't begin to figure how to run these scripts.

The chipset is MT6582 so the MTK Tools PC Tool doesn't work to backup the phone (which is probably what drove this originally). So with access to the factory ROM restore scatter file, is it possible to somehow use that scatter file as a reference to determine what data extents are valid to create the various restore files under ADD in the SPFlash tool? When I attempted an extraction by entering the values of linear_start_address for the top and partition_size for the bottom, the image I extracted could not be opened by EXT4 unpacker but it said the file was invalid. Not sure if this Ext4unpacker is still working.

My effort to extract contacts may be in vane with Android 5 because the contacts will possibly be encrypted anyway and in that case my only option will then be, once I get the image extracted, I'll have to load the image, including userdata.img to an exact duplicate phone.

If it's possible to copy address locations from the factory restore scatter file and use the Data Read function of SPFlash, do the values get copied verbatim or do I have to manipulate the data in some way?
[Android Software/Hacking General [Developers Only]] c11android:
wwr_mtk cant create scater file from ROM_USER

Can I create a scatter file from this info:

wwr_mtk cant create a scatter file to cut my ROM file, to create firmware.

I cant create another ROM because the phone is formated.

Any idea how to create the scatter file?
[Android Software/Hacking General [Developers Only]] shevart:
Hello,

I have the same problem of gray button.

Did you solve the problem?

Thank you for sharing!