[Android General] coozoo:
Greetings,

Got this device from China and it looks pretty good.

But surprised no TWRP recovery. Tried to prepare it by myself.

EVERYTHING THAT YOU DO. YOU DO AT YOUR OWN RISK.

DOWNLOAD -> View attachment 4591304

What works:

It's booting.

I'm able to flash magisk (so finally rooted).

External sdcard mounted fine.

Still has some problem with encryption and I can't get rid of it (device still shows encrypted).

Problems:

Not able to mount internal sdcard and data (suppose because of encryption)

Not sure about OTG mount.

So actually you can try it.

And so here the steps how to do that for those who want to do the same.

We need to download:

First of all we need to find some TWRP for device that close to ours.

I've got some recovery for DOOGEE Y6 just because it has the same CPU MTK6750 (I've used this one TWRP+3.1.1-0doogeey6.zip suppose google can find it somewhere download and save).

Download original firmware (in case of doogee you need to register on doogee official site)

We need to download CarlivImageKitchen (I've used this one CarlivImageKitchen_Windows_x64_v1.3.zip google for it) it is exists for windows and linux as well and extract it somewhere.

Download SP_Flash_Tool

Script for IDA kallsyms_loader.idc

Open and remove inside:

static trim(str) {
return rtrim( ltrim(str) );
}

rename kallsyms_loader.idc.c to kallsyms_loader.idc

Unpack recoveries:

Go to inside "CarlivImageKitchen" folder and find "recovery-resources" folder.

So this is the folder where we need to place our firmwares to modify them.

Extract DOOGEE S55 original firmware and find inside recovery.img,

copy it to "CarlivImageKitchen/recovery-resources" and

rename recovery.img->recoverystock.img

Now gain donnor recovery from archive (my case TWRP+3.1.1-0doogeey6.zip),

copy it to "CarlivImageKitchen/recovery-resources" too and

rename recovery.img->recoverydoogeey6.img

Go to root of CarlivImageKitchen directory and find inside carliv.bat (or carliv.sh for linux) script and execute it

You will see such screen. Type R and press Enter button:

* *
* Carliv Image Kitchen for Android v1.3 *
* boot+recovery images (c)2016 carliv@xda *
* including support for MTK powered phones images *
* WINDOWS x64 version *
* *
***************************************************

Choose what kind of image you need to work on.

][**********************][
][ B. BOOT ][
][**********************][
][ R. RECOVERY ][
][**********************][
][ C. CLEAR FOLDER ][
][**********************][
][ O. CLEAR OUTPUT ][
][**********************][
][ P. SEE INSTRUCTIONS ][
][**********************][
][ E. EXIT ][
][**********************][

Type your option [B,R,C,O,P,E] then press ENTER:

Then you need select firmaware to work for.

Type the number related to recoverystock.img (in example it is 2) and press Enter

***************************************************
* *
* Carliv Image Kitchen for Android v1.3 *
* boot+recovery images (c)2016 carliv@xda *
* including support for MTK powered phones images *
* WINDOWS x64 version *
* *
***************************************************
* RECOVERY images section *
***************************************************

---------------------------------------------------
- R. - Refresh.
---------------------------------------------------
- E. - Go to Main menu.
---------------------------------------------------
- 1. - recoverydoogeey6.img
---------------------------------------------------
- 2. - recoverystock.img
---------------------------------------------------

Type an image number then press ENTER:

You will get such screen. Type 1 and hit Enter.

Wait few seconds and your stock will be extracted to "recoverystock" folder

* Carliv Image Kitchen for Android v1.3 *
* boot+recovery images (c)2016 carliv@xda *
* including support for MTK powered phones images *
* WINDOWS x64 version *
* *
***************************************************
* IMG scripts section *
***************************************************

Your selected image is recoverystock.img.
The folder for repack will be recoverystock.
Make sure that folder exists and you didn't delete it, because if you did, it wi
ll give you an error.

][*************************][*************************][
][ 1. Unpack image ][ B. Other boot image ][
][*************************][*************************][
][ 2. Repack image ][ R. Other recovery image][
][*************************][*************************][
][ I. Display image info ][
][*************************][*************************][
][ Q. Go to main menu ][
][*************************][*************************][

Type your option [1,2,B,R,I,Q] then press ENTER:

Then you will be returned to the same screen (IMG scripts section). Type R and hit Enter.

Now you will see RECOVERY images section screen again.

Where you need to type number related to recoverydoogeey6.img (in my case it is 1) and hit Enter

On next screen type 1 and hit enter to unpack recoverydoogeey6.img.

As result "recoverydoogeey6" will be created in the root of CarlivImageKitchen directory (you can create some backup of original folder because it's the one what we will change).

You can leave CarlivImageKitchen script opened just minimize it and peform merge of files described below.

Now we have stock and donnor recoveries unpacked. We need to merge them.

Merging:

Copy and replace kernel donor kernel with stock

recoverystock/recovery.img-kernel -> recoverydoogeey6/recovery.img-kernel

Copy some other files in my case (maybe it should be some more but I will investigate later)

recoverystock/ramdisk/fstab.enableswap -> recoverydoogeey6/ramdisk/fstab.enableswap

recoverystock/ramdisk/meta_init.rc -> recoverydoogeey6/ramdisk/meta_init.rc

recoverystock/ramdisk/ueventd.rc -> recoverydoogeey6/ramdisk/ueventd.rc

Now we need to merge build.prop settings (I'm using meld for that)

In stock firmware it is prop.default in donor recovery it is default.prop

Just merge values wisely (I've did it somehow).

And merge mount devices. Again I've used meld.

recoverystock/ramdisk/etc/recovery.fstab

into

recoverydoogeey6/ramdisk/etc/recovery.fstab

In my case they're pretty different and donor lack some items. So not sure about correctness at least it's place where possible fixes needed.

Packing modified recovery:

Create back up of modified folder "recoverydoogeey6" (just in case of fail no need to perform all steps again)

Maximize CarlivImageKitchen (if you closed it then you need unpack kernel again and replace with backup of modded folder from previous step)

Type 2 and hit Enter

* Carliv Image Kitchen for Android v1.3 *
* boot+recovery images (c)2016 carliv@xda *
* including support for MTK powered phones images *
* WINDOWS x64 version *
* *
***************************************************
* IMG scripts section *
***************************************************

Your selected image is recoverydoogeey6.img.
The folder for repack will be recoverydoogeey6.
Make sure that folder exists and you didn't delete it, because if you did, it wi
ll give you an error.

][*************************][*************************][
][ 1. Unpack image ][ B. Other boot image ][
][*************************][*************************][
][ 2. Repack image ][ R. Other recovery image][
][*************************][*************************][
][ I. Display image info ][
][*************************][*************************][
][ Q. Go to main menu ][
][*************************][*************************][

Type your option [1,2,B,R,I,Q] then press ENTER:

Go to CarlivImageKitchen root folder and find "output" directory.

Inside will be file like this.

recoverydoogeey6-20180828-0030.img

Now we can try our new recovery (really we should :) to continue)

First flashing

Create somewhere recovery folder and place generated recoverydoogeey6-20180828-0030.img inside

Rename recoverydoogeey6-20180828-0030.img -> recovery.img

And copy scatter file from original firmware MT6750_Android_scatter.txt to this recovery folder

Content of this directory should look like this:

MT6750_Android_scatter.txt
recovery.img

Now we need to open SP flash tool. Go to directory of tool and run flash_tool.exe (i'm skipping MTK driver installation here)

Select Download tab

Set Scatter-loading file (MT6750_Android_scatter.txt ) by choose button

Now ONLY recovery markbox will be marked (check that)

Press Download button and connect you phone in turned off state. Wait for firmawaring finish

Hold Volume UP+Power buttons

Select recovery by Volume UP and confirm Volume Down

TWRP loaded

But (this bloody but) your touch will not work.

People discovered that problem in kernel, touch simply disabled for MTK in recovery mode.

Good news that now we have loaded our kernel and we can connect through ADB with root access.

So the next step is kernel patching... (thanks to LosTigeros on github who described it well by this link).

Kernel patching

Get kernel memory map

So you phone in TWRP without touch

Connect it via ADB

adb shell

Execute

# echo 0 > /proc/sys/kernel/kptr_restrict
# cat /proc/kallsyms >/tmp/symbols.txt
# exit

And pull out it from phone to PC

adb pull /tmp/symbols.txt symbols.txt

At this point you can reboot phone we got what we want (it will restore stock recovery automatically)

Uncompress kernel

Let's rename our fresh recovery.img -> recoverynotouch.img (now we will work using it as basement)

and place it CarlivImageKitchen/recovery-resources/recoverynotouch.img

Launch CarlivImageKitchen and unpack this image in the same way as we did it before

Go to "recoverynotouch" folder and here our S55 kernel: recovery.img-kernel

It is actually packed kernel with some additional info at the end of file.

So let's unpack it. Open recovery.img-kernel and extract "recovery" file (it is inside archive) to some folder

View attachment 4584557

Prepare Patch

Open Unpacked recovery inside IDA PRO

You will see "Load New File" window

Select ARM little-indian as Processor type and press Set button and then Ok button

View attachment 4584574

Next window "Disassembly memory organization"

Set 0xFFFFFFC000080000 as ROM start adress and Loading adress (because 64 bit)

View attachment 4584575

Answer yes for 64bit load

View attachment 4584576

Click Ok in next window that IDA not able to find entry point

File -> Script file... and select previously downloaded that kallsyms_loader.idc file.

You will see browse window. Select our symbols.txt that we've downloaded from our device

Sit back and relax while script making work for you

Now go to IDA menu Options -> General and change Number of opcode bytes (non-graph) to 6

From some kernel sources (I've downloaded some close to mine) it's not hard to find name of function

get_boot_mode

So let's search through disassembled code for such appearance.

Go to menu Search -> Text

Type here get_boot_mod

and mark Find all occurrences

Wait... New tab with results will be opened

Pay attention to DCB instruction and double click it

View attachment 4584581

For our convenience lets rename function from address to human readable name get_boot_mod

Click on DATA XREF address

View attachment 4584584

You will see function sub_FFFFFFC00050A910 and rename it to get_boot_mod

View attachment 4584585

Close previous search results tab and search for get_boot_mode again.

Now you will see more.

This time pay attention to BL instructions, go over them by double click (mine was almost last what I need)

View attachment 4584592

Here the right code

You can see relations with kernel sources

BL get_boot_mod;
CMP W0, #2; RECOVERY_BOOT = 2,
B.EQ loc_FFFFFFC00112A384;

if (RECOVERY_BOOT == get_boot_mode())
return 0;

View attachment 4584593

/* boot type definitions */
enum boot_mode_t {
NORMAL_BOOT = 0,
META_BOOT = 1,
RECOVERY_BOOT = 2,
SW_REBOOT = 3,
FACTORY_BOOT = 4,
ADVMETA_BOOT = 5,
ATE_FACTORY_BOOT = 6,
ALARM_BOOT = 7,
#if defined(CONFIG_MTK_KERNEL_POWER_OFF_CHARGING)
KERNEL_POWER_OFF_CHARGING_BOOT = 8,
LOW_POWER_OFF_CHARGING_BOOT = 9,
#endif
DONGLE_BOOT = 10,
UNKNOWN_BOOT
};

So lets patch it replace this 3 directives with NOP (1F 20 03 D5)

Go to Edit->Patch Program->Change Byte

and repeat 3 times for each line

View attachment 4584620

Save changes Edit -> Patch program -> Apply patches to input file...

Now we need to compress kernel back. And add tricky data at the end.

Compress kernel

Compress. You can use 7zip. I've used gzip

$ gzip -9 recovery

You will receive recovery.gz

Open compressed file recovery.gz with hex editor

Scroll to the bottom

View attachment 4584625

Open recovery.img-kernel of our uncompressed unpatched kernel (extracted from recoverynotouch.img)

Go to the end and find some data section with lot of different descriptions

And you will find the same endings

View attachment 4584626

Now copy this data after this end, I mean starting from D0 till the end to the end of our recovery.gz

And now rename recovery.gz -> recovery.img-kernel

Prepare Image with working touch

Launch CarlivImageKitchen script

Unpack recoverynotouch.img

Replace recovery.img-kernel inside "recoverynotouch" folder with our patched kernel

Pack recoverynotouch in CarlivImageKitchen by typin 2 and hitting enter

EVERYTHING THAT YOU DO. YOU DO AT YOUR OWN RISK.

DOWNLOAD -> View attachment 4591304

What works:

It's booting.

I'm able to flash magisk (so finally rooted).

External sdcard mounted fine.

Still has some problem with encryption and I can't get rid of it (device still shows encrypted).

Problems:

Not able to mount internal sdcard and data (suppose because of encryption)

Not sure about OTG mount.

So actually you can try it.