[Android Software Development] yuweng:
Factory ROM BackUp

Sharing my findings on how to manually make a SP Flash Tool Factory ROM backup on this new MediaTek MT6595 SoC . . . :cool:

For vendors that doesn't offer it or for users that couldn't find it for their new unknown brand MT6595 . . . :cowboy:

Based on the discussion here, MTK Droid Tools doesn't work & there are only two known MT6595, the Zopo999 & Lenovo X2 that offers SP Flash Tool format.

Below are ways to manually backup the Factory ROM on MT6595.

Method 1

Using adb shell dd command

It is now even easier to make backup on the new MT6595 b'cos it is using direct device path instead of the old format dumchar_info. Require root access !

Based on ghost45 feedback here, you can directly use dd command to make a backup.

adb shell
[COLOR="blue"]ls -al /dev/block/platform/mtk-msdc.0/by-name[/COLOR]

lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]boot[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p7[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]cache[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p14[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 expdb -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2014-12-16 18:25 flashinfo -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]lk[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p6[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]logo[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p11[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2014-12-16 18:25 para -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2014-12-16 18:25 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2014-12-16 18:25 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2014-12-16 18:25 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]recovery[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p8[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 seccfg -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]secro[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p9[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]system[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p13[/COLOR]
lrwxrwxrwx root root 2014-12-16 18:25 [COLOR="blue"]userdata[/COLOR] -> [COLOR="blue"]/dev/block/mmcblk0p15[/COLOR]

Based on Factory ROM from Zopo, you'll only need to make backup of 8 partition as highlighted above.

adb shell su -c "dd if=[COLOR="Blue"]/dev/block/mmcblk0p7[/COLOR] of=/sdcard/boot.img"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p14[/COLOR] of=/sdcard/cache.img"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p6[/COLOR] of=/sdcard/lk.bin"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p11[/COLOR] of=/sdcard/logo.bin"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p8 [/COLOR]of=/sdcard/recovery.img"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p9[/COLOR] of=/sdcard/secro.img"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p13[/COLOR] of=/sdcard/system.img"
adb shell su -c "dd if=[COLOR="blue"]/dev/block/mmcblk0p15[/COLOR] of=/sdcard/userdata.img"

Updates

Found out you can also use below command to backup too.

adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="Blue"]boot[/COLOR] of=/sdcard/boot.img"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]cache[/COLOR] of=/sdcard/cache.img"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]lk[/COLOR] of=/sdcard/lk.bin"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]logo[/COLOR] of=/sdcard/logo.bin"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]recovery[/COLOR] of=/sdcard/recovery.img"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]secro[/COLOR] of=/sdcard/secro.img"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]system[/COLOR] of=/sdcard/system.img"
adb shell su -c "dd if=/dev/block/platform/mtk-msdc.0/by-name/[COLOR="blue"]userdata[/COLOR] of=/sdcard/userdata.img"

View attachment 3093328

You don't actually need userdata as a Factory Reset will format it & you'll have your MT6595 in working condition again, in case of a brick. As you notice above, cache.img, secro.img & usedata.img from Zopo SP Flash Tools is only 6.1Mb, 135.2Kb & 21.9Mb respectively.

Thanks to Master Shifu mrjavum for sharing his findings, you can also make backup of the preloader partition too.

dd if=/dev/block/mmcblk0boot0 of=/sdcard/preloader.bin bs=512c count=512 skip=4

However, you'll need to manually delete the trailing FF & 00 at the end of file of preloader.bin that you backup via dd command. You can use any HexEditor to do that. WARNING : Be careful, the new SP Flash Tool v5 will load this file while older version will pop-up error message when you use incompatible preloader.bin.

View attachment 3093329View attachment 3093330View attachment 3093331View attachment 3093332View attachment 3093333View attachment 3093334View attachment 3093335

Here is the tricky part, you'll need to use either Zopo999 or Lenovo X2 scatter.txt & manually make necessary adjustment to suit to your MT6595. WARNING : Might brick your MT6595 on any mistake made ! Lenovo X2 has the extra preload partition too.

Below is Zopo999 partinfo. Make comparison to your MT6595 & update it accordingly.

adb shell
[COLOR="blue"]cat /proc/partinfo[/COLOR]

Name Start Size
pgpt 0x0000000000000000 0x00000000000[COLOR="blue"]80000[/COLOR]
proinfo 0x0000000000080000 0x0000000000[COLOR="blue"]300000[/COLOR]
nvram 0x0000000000380000 0x0000000000[COLOR="blue"]500000[/COLOR]
protect1 0x0000000000880000 0x0000000000[COLOR="blue"]a00000[/COLOR]
protect2 0x0000000001280000 0x0000000000[COLOR="blue"]a00000[/COLOR]
seccfg 0x0000000001c80000 0x00000000000[COLOR="blue"]40000[/COLOR]
lk 0x0000000001cc0000 0x00000000000[COLOR="blue"]60000[/COLOR]
boot 0x0000000001d20000 0x000000000[COLOR="blue"]1000000[/COLOR]
recovery 0x0000000002d20000 0x000000000[COLOR="blue"]1000000[/COLOR]
secro 0x0000000003d20000 0x0000000000[COLOR="blue"]600000[/COLOR]
para 0x0000000004320000 0x00000000000[COLOR="blue"]80000[/COLOR]
logo 0x00000000043a0000 0x0000000000[COLOR="Blue"]800000[/COLOR]
expdb 0x0000000004ba0000 0x0000000000[COLOR="blue"]c60000[/COLOR]
preload 0x00000000055a0000 0x00000000[COLOR="blue"]20260000[/COLOR] [COLOR="Red"]<- Only [COLOR="Blue"]Lenovo X2[/COLOR] has this preload partition[/COLOR]
system 0x0000000005800000 0x00000000[COLOR="Blue"]52000000[/COLOR]
cache 0x0000000057800000 0x000000000[COLOR="blue"]7000000[/COLOR]
userdata 0x000000005e800000 0x0000000[COLOR="blue"]344580000[/COLOR]
flashinfo 0x00000003a2d80000 0x000000000[COLOR="blue"]1000000[/COLOR]
sgpt 0x00000003a3d80000 0x00000000000[COLOR="blue"]80000[/COLOR]

Zopo999 MT6595_Android_scatter.txt

############################################################################################################
#
# General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
info:
- config_version: V1.1.2
platform: MT6595
project: vanzo95_lwt_ds_kk
storage: EMMC
boot_channel: MSDC_0
block_size: 0x20000
############################################################################################################
#
# Layout Setting
#
############################################################################################################
- partition_index: SYS0
partition_name: preloader
file_name: preloader_vanzo95_lwt_ds_kk.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x[COLOR="blue"]40000[/COLOR]
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADERS
reserve: 0x00

- partition_index: SYS1
partition_name: pgpt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x[COLOR="blue"]80000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00

- partition_index: SYS2
partition_name: proinfo
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x80000
physical_start_addr: 0x80000
partition_size: 0x[COLOR="blue"]300000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00

- partition_index: SYS3
partition_name: nvram
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x380000
physical_start_addr: 0x380000
partition_size: 0x[COLOR="blue"]500000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BINREGION
reserve: 0x00

- partition_index: SYS4
partition_name: protect1
file_name: NONE
is_download: false
type: EXT4_IMG
linear_start_addr: 0x880000
physical_start_addr: 0x880000
partition_size: 0x[COLOR="blue"]a00000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00

- partition_index: SYS5
partition_name: protect2
file_name: NONE
is_download: false
type: EXT4_IMG
linear_start_addr: 0x1280000
physical_start_addr: 0x1280000
partition_size: 0x[COLOR="blue"]a00000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
reserve: 0x00

- partition_index: SYS6
partition_name: seccfg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1c80000
physical_start_addr: 0x1c80000
partition_size: 0x[COLOR="blue"]40000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00

- partition_index: SYS7
partition_name: lk
file_name: lk.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1cc0000
physical_start_addr: 0x1cc0000
partition_size: 0x[COLOR="blue"]60000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS8
partition_name: boot
file_name: boot.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1d20000
physical_start_addr: 0x1d20000
partition_size: 0x[COLOR="blue"]1000000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2d20000
physical_start_addr: 0x2d20000
partition_size: 0x[COLOR="blue"]1000000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS10
partition_name: secro
file_name: secro.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x3d20000
physical_start_addr: 0x3d20000
partition_size: 0x[COLOR="blue"]600000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS11
partition_name: para
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x4320000
physical_start_addr: 0x4320000
partition_size: 0x[COLOR="blue"]80000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00

- partition_index: SYS12
partition_name: logo
file_name: logo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x43a0000
physical_start_addr: 0x43a0000
partition_size: 0x[COLOR="blue"]800000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS13
partition_name: expdb
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x4ba0000
physical_start_addr: 0x4ba0000
partition_size: 0x[COLOR="blue"]c60000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
reserve: 0x00

- partition_index: SYS14
partition_name: system
file_name: system.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x5800000
physical_start_addr: 0x5800000
partition_size: 0x[COLOR="blue"]52000000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS15
partition_name: cache
file_name: cache.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x57800000
physical_start_addr: 0x57800000
partition_size: 0x[COLOR="blue"]7000000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS16
partition_name: userdata
file_name: userdata.img
is_download: true
type: EXT4_IMG
linear_start_addr: 0x5e800000
physical_start_addr: 0x5e800000
partition_size: 0x[COLOR="blue"]49c00000[/COLOR] [COLOR="Blue"]<- i have absolutely no idea how this figure comes about, as i know Zopo999 comes with 16GB or 32GB variant[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

- partition_index: SYS17
partition_name: flashinfo
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xFFFF0084
physical_start_addr: 0xFFFF0084
partition_size: 0x[COLOR="blue"]1000000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
reserve: 0x00

- partition_index: SYS18
partition_name: sgpt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xFFFF0004
physical_start_addr: 0xFFFF0004
partition_size: 0x[COLOR="blue"]80000[/COLOR]
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
reserve: 0x00

Method 2

Using ROM_0 upload from SP Flash Tool

There are already tons of guides doing this so i won't touch on this . . . :cowboy:

What is interesting about this is syserr actually made the discovery & shared his findings since last year ! :good: But i guess nobody discover his thread including myself until i hunt for ways to make backups on the new MT6595 since we have been spoilt by the awesomeness of MTK Droid Tools doing these automatically for us but now it doesn't work on the new MT6595 . . . :cowboy:

As syserr has mentioned on his thread, MTK Droid Tools is actually also using dd command to split the ROM_0 uploaded from SP Flash Tool too.

i have tried it on my old MT6577 & it worked perfectly splitting up all the partitions & generate a perfectly working scatter.txt from dumchar_info too . . . :good: Having said that, however, its not compatible for use with the MT6595 scatter V1.1.2 format.

Complete full output.

./dice.sh MT6577_Android_scatter_emmc.txt ROM_0 > log.txt

i have modded his script to show as below so we know how it works . . . :cowboy:

scatter file name = MT6577_Android_scatter_emmc.txt
SP Flash Tool ROM file name = ROM_0

Processing: PRELOADER
start: 0x0
size: 0x40000
(0x0) Size in DEC = [COLOR="Blue"]0[/COLOR]
(0x40) Size in DEC = [COLOR="blue"]64[/COLOR]
dd if=ROM_0 of=raw.partitions/PRELOADER bs=4096 skip=[COLOR="blue"]0[/COLOR] count=[COLOR="blue"]64[/COLOR]

Processing: DSP_BL
start: 0x40000
size: 0x5C0000
(0x40) Size in DEC = 64
(0x5C0) Size in DEC = 1472
dd if=ROM_0 of=raw.partitions/DSP_BL bs=4096 skip=64 count=1472

Processing: MBR
start: 0x600000
size: 0x4000
(0x600) Size in DEC = 1536
(0x4) Size in DEC = 4
dd if=ROM_0 of=raw.partitions/MBR bs=4096 skip=1536 count=4

Processing: EBR1
start: 0x604000
size: 0x4000
(0x604) Size in DEC = 1540
(0x4) Size in DEC = 4
dd if=ROM_0 of=raw.partitions/EBR1 bs=4096 skip=1540 count=4

Processing: PMT
start: 0x608000
size: 0x400000
(0x608) Size in DEC = 1544
(0x400) Size in DEC = 1024
dd if=ROM_0 of=raw.partitions/PMT bs=4096 skip=1544 count=1024

Processing: NVRAM
start: 0xa08000
size: 0x500000
(0xa08) Size in DEC = 2568
(0x500) Size in DEC = 1280
dd if=ROM_0 of=raw.partitions/NVRAM bs=4096 skip=2568 count=1280

Processing: SECCFG
start: 0xf08000
size: 0x20000
(0xf08) Size in DEC = 3848
(0x20) Size in DEC = 32
dd if=ROM_0 of=raw.partitions/SECCFG bs=4096 skip=3848 count=32

Processing: UBOOT
start: 0xf28000
size: 0x60000
(0xf28) Size in DEC = 3880
(0x60) Size in DEC = 96
dd if=ROM_0 of=raw.partitions/UBOOT bs=4096 skip=3880 count=96

Processing: BOOTIMG
start: 0xf88000
size: 0x600000
(0xf88) Size in DEC = [COLOR="blue"]3976[/COLOR]
(0x600) Size in DEC = [COLOR="blue"]1536[/COLOR]
dd if=ROM_0 of=raw.partitions/BOOTIMG bs=4096 skip=[COLOR="blue"]3976[/COLOR] count=[COLOR="blue"]1536[/COLOR]

Processing: RECOVERY
start: 0x1588000
size: 0x800000
(0x1588) Size in DEC = [COLOR="blue"]5512[/COLOR]
(0x800) Size in DEC = [COLOR="blue"]2048[/COLOR]
dd if=ROM_0 of=raw.partitions/RECOVERY bs=4096 skip=[COLOR="blue"]5512[/COLOR] count=[COLOR="blue"]2048[/COLOR]

Processing: SEC_RO
start: 0x1d88000
size: 0x400000
(0x1d88) Size in DEC = 7560
(0x400) Size in DEC = 1024
dd if=ROM_0 of=raw.partitions/SEC_RO bs=4096 skip=7560 count=1024

Processing: MISC
start: 0x2188000
size: 0x60000
(0x2188) Size in DEC = 8584
(0x60) Size in DEC = 96
dd if=ROM_0 of=raw.partitions/MISC bs=4096 skip=8584 count=96

Processing: LOGO
start: 0x21e8000
size: 0x300000
(0x21e8) Size in DEC = 8680
(0x300) Size in DEC = 768
dd if=ROM_0 of=raw.partitions/LOGO bs=4096 skip=8680 count=768

Processing: EXPDB
start: 0x24e8000
size: 0x200000
(0x24e8) Size in DEC = 9448
(0x200) Size in DEC = 512
dd if=ROM_0 of=raw.partitions/EXPDB bs=4096 skip=9448 count=512

Processing: ANDROID
start: 0x26e8000
size: 0x19000000
(0x26e8) Size in DEC = 9960
(0x19000) Size in DEC = 102400
dd if=ROM_0 of=raw.partitions/ANDROID bs=4096 skip=9960 count=102400

Processing: CACHE
start: 0x1b6e8000
size: 0x19000000
(0x1b6e8) Size in DEC = 112360
(0x19000) Size in DEC = 102400
dd if=ROM_0 of=raw.partitions/CACHE bs=4096 skip=112360 count=102400

Processing: USRDATA
start: 0x346e8000
size: 0x34300000
(0x346e8) Size in DEC = 214760
(0x34300) Size in DEC = 213760
dd if=ROM_0 of=raw.partitions/USRDATA bs=4096 skip=214760 count=213760

Processing: FAT
start: 0x689e8000
size: 0x976080A8
(0x689e8) Size in DEC = 428520
(0x976080A8) Size in DEC = 2539684008
dd if=ROM_0 of=raw.partitions/FAT bs=4096 skip=428520 count=2539684008

Based on his script output above, below should work on the new MT6595.

Name Start Size
boot 0x0000000001d20000 0x000000000[COLOR="blue"]1000000[/COLOR]

start: 0x1d20000
size: 0x1000000

0x1d20 - Convert to decimal = [COLOR="Blue"]7456[/COLOR]
0x1000 - Convert to decimal = [COLOR="blue"]4096[/COLOR]
dd if=ROM_0 of=boot.img bs=4096 skip=[COLOR="blue"]7456[/COLOR] count=[COLOR="blue"]4096[/COLOR]

You can also use his trim.sh & trimFF.sh to automatically remove all the unused FF & 00 at preloader.bin too . . . :good:

i don't have a MT6595 to confirm all this so owners of the new MT6595 should Trial & Error, more info then study syserr's thread . . . :good: