[Android General] Tzul:
Hehe, classic beginner mistake. I've seen it happen to people before, but usually they figure it out a bit sooner.

It absolutely didn't cross my mind that this could be your problem, because I wrote that long post for you, explaining the boot process...

Connecting USB wakes up the tablet and starts the boot process (I mentioned it in the post as a boot reason). It'll execute boot ROM, preloader, bootloader. Usually stops there, if the bootloader can do "off-mode charging", otherwise it might even start Android.

From that alone it should be clear that you can't connect the USB cable first, then leisurely click the download/readback button, because by that time, the bootloader might have taken over already. As described, the preloader is responsible for the SPFT connection, and it only waits for two seconds or so.

Actually, you can connect the USB cable first, and click the SPFT button second. You just need to be quick enough! Or, you can connect the USB cable way in advance, i.e. while running Android, or the recovery; then click the button in SPFT (nothing will happen); then shut down / reboot the tablet. That'll cause the boot process to begin anew, therefore running the preloader, which will then establish a connection with the SPFT.

That should also explain why there is no "mechanism for toggling the SPFT USB connection". It would be dangerous to do it any other way - while Android, or even just the bootloader (think Fastboot) is running, there's too much other stuff in progress which could interfere with the flashing process, or lead to data corruption if the device were forcibly shut down.

Yes, it is a bit counterintuitive, but all the information you needed was there. I posted this small guide a few pages back, it does have dedicated readback instructions, and it also says to click the button first, then connect USB.

That's exactly how you do it. You don't need to read back the partitions individually, one per "session". Just tick the checkboxes of all the partitions you want, then have them all transfered in a single session.

The preloader and pgpt partitions do not overlap. They are stored in separate EMMC regions (region is what MediaTek calls them... some call them partitions, but we already use that term for something else). Each region has its own linear address space that starts at 0.

The preloader is stored in the region EMMC_BOOT_1. There's also EMMC_BOOT_2 (unused as far as I know), EMMC_RPMB (replay protected memory block, for security stuff, unused as far as I know), and finally EMMC_USER, where pgpt and all other partitions are stored.

When the SPFT makes a connection, it'll show you some chip info in the bottom left corner. Something like this:

Chipinfo:
Chip Name:	MT6752_S01
Chip Version:	0x0000ca01
Ext Clock:	EXT_26M
Ext RAM Type:	DRAM
Ext RAM Size:	0x80000000	(2 GiB)
SRAM Size:	0x00020000	(128 KiB)
EMMC Flash:
Boot1 Size:	0x400000	(4 MiB)
Boot2 Size:	0x400000	(4 MiB)
RPMB Size:	0x400000	(4 MiB)
GP1 Size:	0x0
GP2 Size:	0x0
GP3 Size:	0x0
GP4 Size:	0x0
UA Size:	0x3a3e00000	(14910 MiB)

I added the values in parentheses, for convenience. As you can see, the user area (UA), i.e. EMMC_USER, has a size of 0x3a3e00000.

Therefore, you could simply create a new readback section, with EMMC_USER as region, start address 0, length 0x3a3e00000, and that would dump the entire user area to a single file. That dump wouldn't contain the preloader, of course, because it does not reside in this region.

If you want to do a readback for the preloader, you have to use the EMMC_BOOT_1 region, and be aware of a little quirk: although the preloader starts at linear address 0, according to the scatter file, it actually starts at address 0x800. The Boot1 region starts with a 2 KiB header of sorts, and only after that the actual preloader data begins.