[Android General] StratOS_HTC:
Android Scatter files.

The Thread has been updated at the END !

Scatter File is the most important thing while Flashing and creating Backups.

Scatter files are located in fastboot roms.

In \images\download_agent\ there is a file named flash.xml

There is an example for zircon devices.

DAAgent bin file is also located in this folder

The needed xml scatter files is located in upper directory MT6886_Android_scatter.xml

View attachment 6111406

Data is stored in EMMC or UFS set by MTK_STORAGE_CFG.

In MMC there are regions marked as EMMC_BOOT1 and EMMC_BOOT2 (Preloader and backup preloader) and EMMC_USER.

In UFS there are regions marked as UFS_LU0 and UFS_LU1 (Preloader and backup preloader) and rest are stored in UFS_LU2.

The file contains the xml Flags :

Boundary check flag = False have just partitions as flashinfo and sgpt (Partition based), those two partitions have also the is_reserved flag set to True.

Flag is_upgradable have partitions like different partitions like vbmeta,metadata,spmfw,mcf_ota

Flag empty_boot_needed = True have partitions like lk,tee,logo

Flag boundary_check = False have partitions like flashinfo,sgpt

Since zircon (Redmi Note 13 Pro + 5G) is a devices with Vendor Boot as Recovery (A/B):

This device don't have a dedicated partition for recovery.

The recovery ramdisk resides in the "vendor_boot_a" and "vendor_boot_b" partitions. Depends on current active slot.

The recovery ramdisk includes kernel modules compiled for the specific kernel that resides in the "boot_a" and "boot_b" partitions.

Due to that, you should never flash a custom recovery image that was built for a different kernel version. If you do that, the recovery will fail to boot or malfunction.

Coincidentally, these devices don't support the "fastboot boot" command, so the custom recovery images are built to be flashed to "vendor_boot_a" and "vendor_boot_b" partitions directly.

Flashing to "vendor_boot_ab" will flash to both "vendor_boot_a" and "vendor_boot_b" with a single command, if the device supports it.

A lot of partitions if support for multislot or A/B slot can be flashed/backuped on both partitions.

There are 97 partitions index names stored in the global scatter xml file for zircon (HyperOS).

There are 3 common type of partitions : SV5_BL_BIN (Preloader type), NORMAL_ROM (Dev block type partiitions) and EXT4_IMG (Android image).

Downloadable partitions can be downloaded if the is_download attribute in xml is set to True.

There are also some different opperation types of partitions :

BOOTLOADERS (Preloader), INVISIBLE (Not shown like backup partitions,seccfg,otp,pstore),PROTECTED (Like NVCFG,protect partiitions), UPDATE (vbmeta partitions,md1img,spmfw,mcf_ota,audio_dsp,pi_img,dpm), BINREGION (nvram !), NEEDRESIZE (userdata).

The following partitions are required to be backed up so that we can restore the IMEI/phone specific partitions of the device later.

Those partitions are device and region based also.

Partitions important for backup :

preloader

pgpt

nvcfg

nvdata

protect1

protect2

seccfg

sec1

proinfo

nvram

boot_para

Currently there is no exploit to avoid SBC,SLA or DAA available for zircon.

You can use only no auth preloader (Root cert required @mtkclient - False) to backup/write with sptools without auth/without paying for this service !

Mtkclient initial support is enabled by our device now (MT6886), thanks to @bkerler.

You can download it :

GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool

MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.

github.com

Spoiler content hidden.

You can make backup/flash with spflash application.

Current DA Agent is included as attachement (DA_BR.bin).

ADDED :

The truth about the phone is that it contains 2 bootloader COMMON flash option :

Fastboot (reboot bootloader)

Fastbootd (reboot fastboot)

Access, configuration to partitions are written in the sgpt partition on the phone.

Fastboot can only acess for some partition on phone as in getvar all

It's the same for the Fastbootd (More enhanced) version.

Spoiler content hidden.

Spoiler content hidden.

After flashing the partition via miflash or Spflash (altered xml) it could sequentialy alter also the sgpt data.

This hasn't been tested by me yet.

Some protected partition cannot been flashed via spflash/miflash/fastboot/fastbootd even if you are using engineering preloader and/ or DA loader or any kind of commercial auth way.

This is to do part ...

For all devices with DAA, SLA and Remote-Auth activated no public solution currently exists to flash/unlock BL via cable.

You can OFFICIALLY unlock the bootloader only if you meet the requirements (READ : IMEI & SN verify) :

Product Authentication

Verify your phone purchase

www.mi.com

The Bootloader Unlock story it's not related regarding xiaomi server problems, acoount & phone binding problems ...

It's all in the head ....