Hovatek Forum MOBILE Android [Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


[Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735

[Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735

Pages (2): 1 2 Next
tya
tya
tya
Junior Member
16
27-06-2018, 06:58 PM
#1



Hi,

Just a few questions. I have had a bit of experience with flashing roms (CyanogenMod, LineageOS etc) on the (Nexus S, Galaxy Nexus, Nexus 5 etc) but I haven't done it with a Motorola phone before. I am having some difficulty. It was a lot easier with those phones Smile I bought a Motorola Moto C XT1758 (2018-04-17 date on box) it was bought not from any carrier or on a plan and therefore is unlocked from any carrier.

I have had trouble getting the scatter file. I set up my environment [TUTORIAL]How to setup SP_Flash_Tool_Linux (MTK/MediaTek Soc) with this guide. I am using Ubuntu 18.04.

I looked at [GUIDE][UTIL][MT65xx] Create Scatter File / Dump Full ROM For any MT65xx device, no matter how obscure

Method #1
syserr;47778785 * Obtain a SPFT ROM that is known good for any phone/tablet
I think that requires me to have a recovery ROM. I found that Motorola's Recovery Images are only for the Droid Maxx, Moto G, Moto X and XOOM. They also say you need a "Moto Pure Edition or a Developer Edition device."

Method #2
Code:

$ adb pull /proc/dumchar_info
adb: error: remote object '/proc/dumchar_info' does not exist

I have also read one can do:

Code:

namath:/ $ cat /proc/mtd                                                                                                                                                                                        
dev:    size   erasesize  name

But that didn't work for me either.

I am running out of ideas.


On a side note I have tried to unlock my bootloader but have only gotten the below error. I also tried using mfastboot-v2.zip but that didn't help either.

Code:

$ sudo fastboot oem get_unlock_data
[sudo] password for me:
...
FAILED (remote: unknown command)
finished. total time: 0.002s

I made sure to go into Developer Options and toggle the "OEM unlocking", which asked for  my PIN but that didn't help. I did look at Mark_Emeritus's Bootloader Unlock Problems? thread but it seems mine is in the table of unlockable CIDs, being 0x0032.


Any tips on that would be appreciated.

Code:

sudo fastboot getvar all

Code:

(bootloader)     max-download-size: 0x8000000
(bootloader)     partition-size:flashinfo: 1000000
(bootloader)     partition-type:flashinfo: raw data
(bootloader)     partition-size:userdata: 32000000
(bootloader)     partition-type:userdata: ext4
(bootloader)     partition-size:cache: 19000000
(bootloader)     partition-type:cache: ext4
(bootloader)     partition-size:system: c0000000
(bootloader)     partition-type:system: ext4
(bootloader)     partition-size:metadata: 2480000
(bootloader)     partition-type:metadata: raw data
(bootloader)     partition-size:nvdata: 2000000
(bootloader)     partition-type:nvdata: ext4
(bootloader)     partition-size:frp: 100000
(bootloader)     partition-type:frp: raw data
(bootloader)     partition-size:efuse: 80000
(bootloader)     partition-type:efuse: raw data
(bootloader)     partition-size:tee2: 500000
(bootloader)     partition-type:tee2: raw data
(bootloader)     partition-size:tee1: 500000
(bootloader)     partition-type:tee1: raw data
(bootloader)     partition-size:keystore: 800000
(bootloader)     partition-type:keystore: raw data
(bootloader)     partition-size:secro: 600000
(bootloader)     partition-type:secro: raw data
(bootloader)     partition-size:oemkeystore: 200000
(bootloader)     partition-type:oemkeystore: raw data
(bootloader)     partition-size:seccfg: 80000
(bootloader)     partition-type:seccfg: raw data
(bootloader)     partition-size:expdb: a00000
(bootloader)     partition-type:expdb: raw data
(bootloader)     partition-size:logo: 800000
(bootloader)     partition-type:logo: raw data
(bootloader)     partition-size:recovery: 1000000
(bootloader)     partition-type:recovery: raw data
(bootloader)     partition-size:boot: 1000000
(bootloader)     partition-type:boot: raw data
(bootloader)     partition-size:para: 80000
(bootloader)     partition-type:para: raw data
(bootloader)     partition-size:lk: 80000
(bootloader)     partition-type:lk: raw data
(bootloader)     partition-size:protect2: a00000
(bootloader)     partition-type:protect2: ext4
(bootloader)     partition-size:protect1: a00000
(bootloader)     partition-type:protect1: ext4
(bootloader)     partition-size:nvram: 500000
(bootloader)     partition-type:nvram: raw data
(bootloader)     partition-size:proinfo: 300000
(bootloader)     partition-type:proinfo: raw data
(bootloader)     partition-size:preloader: 40000
(bootloader)     partition-type:preloader: raw data
(bootloader)     ro.carrier: retapac
(bootloader)     radio: 5
(bootloader)     kernel.version[0]: Linux version 3.18.35+
(bootloader)     kernel.version[1]: (cibuild@dell-PowerEdge-R730)
(bootloader)     kernel.version[2]: gcc version 4.8 (GCC)
(bootloader)     kernel.version[3]: 1 SMP PREEMPT
(bootloader)     kernel.version[4]: 2018-01-24:15:35:20
(bootloader)     ro.build.fingerprint[1]: motorola/namath_58/namath:7.0/NRD
(bootloader)     ro.build.fingerprint[2]: D90M.014/1516778722:user/release-
(bootloader)     ro.build.fingerprint[3]: -keys
(bootloader)     ro.build.version.mtk[1]: alps-mp-n0.mp1-V1.0.2_wt6737m.65.
(bootloader)     ro.build.version.mtk[2]: .n_P109
(bootloader)     ro.build.version.full[1]: Blur_Version.25.21.14.namath_58.
(bootloader)     ro.build.version.full[2]: retail.en.US
(bootloader)     imei1: <CENSORED>
(bootloader)     imei2: <CENSORED>
(bootloader)     boot reason: wdt_by_pass_pwk
(bootloader)     hwrev: M11
(bootloader)     CID: 0x0032
(bootloader)     SKU: XT1758
(bootloader)     CPU: "MT6735"
(bootloader)     serialno: <CENSORED>
(bootloader)     off-mode-charge: 1
(bootloader)     warranty: yes
(bootloader)     securestate: no
(bootloader)     hwsecure: yes
(bootloader)     kernel: lk
(bootloader)     board: WT98736B32_DA1
(bootloader)     product: WT98736B32_DA1
(bootloader)     Ram size: 1GB
(bootloader)     emmc: KMFE60012M_B214
(bootloader)     storage-type: emmc
(bootloader)     version-preloader: 0.1.00
(bootloader)     version: 0.5
all: Done!!
finished. total time: 0.005s

I haven't yet tried this [Tutorial] How to create scatter file for Mediatek devices but it looks fairly recent. I am guessing as my phone is fairly recent and has MT6735 the old method using MTK Android Devices won't work. The guide for doing this with [Tutorial] How to use Wwr_MTK + SP Flash tool to backup Mediatek rom is there. Apparently there is an alternative way [Tutorial] How to get length addresses for full ROM dump using PGPT, Wwr_MTK & SP Flash Tool.

It would be nice if there was a way to do this without Windows. Any tips or insight you can provide would be welcome.
This post was last modified: 29-06-2018, 06:18 PM by tya.
tya
tya
tya
Junior Member
16
27-06-2018, 07:03 PM
#2
So I tried with MTK Droid Root & Tools and obviously my phone is too new to work with it.

For some reason it thought I had a MT6737M which seems to contradicts what I got from "sudo fastboot getvar all", that said I had a MT6735 in my Moto C (XT1758).

Code:

Hardware : MT6737M
Model : Moto C
Build number : NRD90M.014
Build date UTC : 20180124-072506
Android  v : 7.0
Baseband v: MOLY.LR9.W1444.MD.LWTG.MP.V110.5.P49, 2018/01/08 19:57
Kernel v : 3.18.35+ (cibuild@dell-PowerEdge-R730) (gcc version 4.8 (GCC) ) #1 SMP  Wed Jan 24 15:56:40 CST 2018

Code:

--->>> Connect to device <<<---
 --- ERROR  :  --- TotalBytesPerChunk Not Found. Set default Page/Spare=2048/64 !!!
 --- Unknown ROM structure, backup NOT possible!
ATTENTION!  File /system/recovery-from-boot.p which restore factory recovery in case of phone switching on in a normal mode Is Found!

When I clicked block maps it only showed :

Code:

N         1
Name      bmtpool
Scatter   0000000000
Size      0000000000
Byte Size 0

Which doesn't look right.

So I tried [Tutorial] How to use Wwr_MTK + SP Flash tool to backup Mediatek rom from my previous post.

So my next step was to try with the WwR_MTK_v2.30 tools. I exported a MT6735_Android_scatter.

I read this process requires you to remove the battery from the phone and power it off.

I went to the "Readback" tab in Smart Phone Flash Tool v5.1820.000 after putting the scatter-loading file in. I clicked Add, double clicked on the entry and saved ROM_0 to my desktop.

I then set:

Code:

Region:        EMMC_BOOT_1
Start Address: 0x0000000000000000
Length:        0x0000000000080000

I got the error: CHIP TYPE NOT match!! target efusse value: 0x94010000

Looking at the logs I see

Code:

06/27/18 23:57:54.494 BROM_DLL[4276][4468]: DEBUG: GetCOMPortWithFilter(): New COM port: Filter index(1), Number(COM3), Friendly(MediaTek PreLoader USB VCOM (Android) (COM3)), Instance(USB\VID_0E8D&PID_2000\5&1EAA782A&0&2), Symbolic(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}) (FlashToolLib/host/windows/com_enum.cpp:1183)
06/27/18 23:57:54.494 BROM_DLL[4276][4468]:     com_base::com_base()  m_hCOM(FFFFFFFF) (FlashToolLib/host/windows/com_sentry.cpp:117)
06/27/18 23:57:54.494 BROM_DLL[4276][4468]:     com_sentry::eek:pen(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, FFFFFFFF, 115200) (FlashToolLib/host/windows/com_sentry.cpp:597)
06/27/18 23:57:54.494 BROM_DLL[4276][4468]:     hCOM = 0xcbc, retry [0] times (FlashToolLib/host/windows/com_sentry.cpp:611)
06/27/18 23:57:54.510 BROM_DLL[4276][5112]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]:     com_sentry::SetRTS(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000CBC): successfully pull high RTS and DTR! (FlashToolLib/host/windows/com_sentry.cpp:713)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]:     com_sentry::Reset(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000CBC): OK!, baudrate(115200). (FlashToolLib/host/windows/com_sentry.cpp:496)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: WARNING: debugconf::load(C:\Users\Administrator\Desktop\SP_Flash_Tool_v5.1820_Win\libdebug.conf): file doesn't exist (FlashToolLib/source/common/generic/src/debugconf.cpp:117)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]:     com_sentry::eek:pen(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000CBC): CreateFile("\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}") OK!, baudrate(115200). (FlashToolLib/host/windows/com_sentry.cpp:631)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: DA_cmd::DA_cmd(): m_p_stopflag(0x03F40CB0)=0. (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:82)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: Setup_Connect_Param(): ###  debug 111 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1214)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: Setup_Connect_Param(): ###  debug 222 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1225)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: Setup_Connect_Param(): ###  debug 333 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1230)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: Setup_Connect_Param(): ###  debug 444 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1234)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: DEBUG: Setup_Connect_Param(): ###  debug 666 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1244)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: FlashTool_Connect_BROM_Ex(03477188)(): AUTO_DETECT_BBCHIP(254), AUTO_DETECT_EXT_CLOCK(254).  (FlashToolLib/sv5/common/interface/src/brom.cpp:1050)
06/27/18 23:57:54.760 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): ... (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:209)
06/27/18 23:57:55.010 BROM_DLL[4276][4468]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(57600) = 57600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(57600), SEND(0xA0)->RECV(0x52), fail_retry(1). (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:268)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(9600) = 9600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0xA0)->RECV(0x5F), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x0A)->RECV(0xF5), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x50)->RECV(0xAF), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x05)->RECV(0xFA), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): [0] 0xA0 -> 0x5F     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): [1] 0x0A -> 0xF5     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): [2] 0x50 -> 0xAF     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): [3] 0x05 -> 0xFA     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWCode() ... (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1571)
06/27/18 23:57:55.025 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWCode(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1999)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xFD) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWCode(): HW Code (0x335) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2022)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWCode(): OK! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2024)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWCode() Pass! Get HW code(0x335) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1579)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Try to detect chips with GET_HW_SW_VER .. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1644)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BBChipIDMap::Find(): Find bbchip (0x335) (FlashToolLib/source/common/generic/src/bbchip_id.cpp:536)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWSWVer() ... (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1662)
06/27/18 23:57:55.041 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWSWVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1944)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xFC) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWSWVer(): HW_VER(0xca00), SW_VER(0x0), HW_SUBCODE(0x8a00) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1979)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::BRom_GetHWSWVer(): OK! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1981)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Get HW SW version is done. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1668)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]:     ChipRemap.lookup(0x0335, 0x8A00, 0xCA00, 0x0000) .. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:205)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Find the BBChip ID as (157) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1684)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BB chip name(MT6735M_S00): DigitalDie={ hw_ver(0xCA00), sw_ver(0x0000), hw_code(0x0335), hw_subcode(0x8A00) }, AnalogDie={ hw_ver(0x0000), hw_code(0x0000) } (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1724)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: BRom_AutoBoot::BRom_StartCmd(0): Pass! (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:336)
06/27/18 23:57:55.057 BROM_DLL[4276][4468]: DEBUG: BRom_Base::CreateObject(): MT6735M(157), EXT_26M(2), p_bootstop(0x03F40CB0), ms_boot_timeout(268435455), max_start_cmd_retry_count(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1495)
06/27/18 23:57:55.072 BROM_DLL[4276][4468]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD1) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/27/18 23:57:55.103 BROM_DLL[4276][4468]: BRom_MT6276::BRom_ReadCmd32(): 0x102061B0[1]={ 0x94010000 }.     (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:675)
06/27/18 23:57:55.119 BROM_DLL[4276][4468]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD1) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: BRom_MT6276::BRom_ReadCmd32(): 0x102061B0[1]={ 0x94010000 }.     (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:675)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: ERROR: BRom_MT6735::IsChipTypeMatch(): CHIP TYPE NOT match!!  target efuse value: 0x94010000 (FlashToolLib/sv5/common/generic/src/brom_mt6735.cpp:207)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: ERROR: FlashTool_Connect_BROM_Ex(): FlashTool_Connect_BROM_Ex() fail, error S_CHIP_TYPE_NOT_MATCH(3184) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1962)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: ERROR: FlashTool_Connect_BROM_Ex(): <ERR_CHECKPOINT>[146][error][3184]</ERR_CHECKPOINT> [S_CHIP_TYPE_NOT_MATCH] (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1963)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: ERROR: FlashTool_Disconnect_BROM(): invalid arguments! *p_ft_handleis NULL (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2370)
06/27/18 23:57:55.150 BROM_DLL[4276][4468]: ERROR: FlashTool_Disconnect_BROM(): <ERR_CHECKPOINT>[109][error][1002]</ERR_CHECKPOINT> [S_INVALID_ARGUMENTS] (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2371)
06/27/18 23:57:55.150 BROM_DLL[4276][5112]: RB_ClearAll(): RB_HANDLE->rwlock: WRITE_LOCK ... (FlashToolLib/host/windows/rwlock.cpp:460)
06/27/18 23:57:55.150 BROM_DLL[4276][5112]: RB_ClearAll(): RB_HANDLE->rwlock: WRITE_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:476)

It thinks I should have a BRom_Base::GetBBChipIDFromTarget(): BB chip name(MT6735M_S00) but according to my get vars I should have a "MT6735".

I tried with the MT6735M to see if that would work but I got the same error.

Code:

06/28/18 00:09:31.105 BROM_DLL[3728][4116]: DEBUG: GetCOMPortWithFilter(): New COM port: Filter index(1), Number(COM3), Friendly(MediaTek PreLoader USB VCOM (Android) (COM3)), Instance(USB\VID_0E8D&PID_2000\5&1EAA782A&0&2), Symbolic(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}) (FlashToolLib/host/windows/com_enum.cpp:1183)
06/28/18 00:09:31.105 BROM_DLL[3728][4116]:     com_base::com_base()  m_hCOM(FFFFFFFF) (FlashToolLib/host/windows/com_sentry.cpp:117)
06/28/18 00:09:31.105 BROM_DLL[3728][4116]:     com_sentry::eek:pen(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, FFFFFFFF, 115200) (FlashToolLib/host/windows/com_sentry.cpp:597)
06/28/18 00:09:31.105 BROM_DLL[3728][4116]:     hCOM = 0xae0, retry [0] times (FlashToolLib/host/windows/com_sentry.cpp:611)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]:     com_sentry::SetRTS(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000AE0): successfully pull high RTS and DTR! (FlashToolLib/host/windows/com_sentry.cpp:713)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]:     com_sentry::Reset(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000AE0): OK!, baudrate(115200). (FlashToolLib/host/windows/com_sentry.cpp:496)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: WARNING: debugconf::load(C:\Users\Administrator\Desktop\SP_Flash_Tool_v5.1820_Win\libdebug.conf): file doesn't exist (FlashToolLib/source/common/generic/src/debugconf.cpp:117)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]:     com_sentry::eek:pen(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000AE0): CreateFile("\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed}") OK!, baudrate(115200). (FlashToolLib/host/windows/com_sentry.cpp:631)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: DA_cmd::DA_cmd(): m_p_stopflag(0x0404C1B0)=0. (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:82)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: Setup_Connect_Param(): ###  debug 111 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1214)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: Setup_Connect_Param(): ###  debug 222 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1225)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: Setup_Connect_Param(): ###  debug 333 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1230)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: Setup_Connect_Param(): ###  debug 444 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1234)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: DEBUG: Setup_Connect_Param(): ###  debug 666 ### (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1244)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: FlashTool_Connect_BROM_Ex(033C30A0)(): AUTO_DETECT_BBCHIP(254), AUTO_DETECT_EXT_CLOCK(254).  (FlashToolLib/sv5/common/interface/src/brom.cpp:1050)
06/28/18 00:09:31.371 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): ... (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:209)
06/28/18 00:09:31.621 BROM_DLL[3728][4116]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(57600) = 57600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(57600), SEND(0xA0)->RECV(0x52), fail_retry(1). (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:268)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(9600) = 9600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0xA0)->RECV(0x5F), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x0A)->RECV(0xF5), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x50)->RECV(0xAF), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0x05)->RECV(0xFA), OK. (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:261)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): [0] 0xA0 -> 0x5F     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): [1] 0x0A -> 0xF5     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): [2] 0x50 -> 0xAF     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): [3] 0x05 -> 0xFA     (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:305)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWCode() ... (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1571)
06/28/18 00:09:31.636 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWCode(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1999)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xFD) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWCode(): HW Code (0x335) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2022)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWCode(): OK! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2024)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWCode() Pass! Get HW code(0x335) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1579)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Try to detect chips with GET_HW_SW_VER .. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1644)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BBChipIDMap::Find(): Find bbchip (0x335) (FlashToolLib/source/common/generic/src/bbchip_id.cpp:536)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BRom_GetHWSWVer() ... (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1662)
06/28/18 00:09:31.652 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWSWVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1944)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xFC) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWSWVer(): HW_VER(0xca00), SW_VER(0x0), HW_SUBCODE(0x8a00) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1979)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::BRom_GetHWSWVer(): OK! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1981)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Get HW SW version is done. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1668)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]:     ChipRemap.lookup(0x0335, 0x8A00, 0xCA00, 0x0000) .. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:205)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): Find the BBChip ID as (157) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1684)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BB chip name(MT6735M_S00): DigitalDie={ hw_ver(0xCA00), sw_ver(0x0000), hw_code(0x0335), hw_subcode(0x8A00) }, AnalogDie={ hw_ver(0x0000), hw_code(0x0000) } (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1724)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: BRom_AutoBoot::BRom_StartCmd(0): Pass! (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:336)
06/28/18 00:09:31.668 BROM_DLL[3728][4116]: DEBUG: BRom_Base::CreateObject(): MT6735M(157), EXT_26M(2), p_bootstop(0x0404C1B0), ms_boot_timeout(268435455), max_start_cmd_retry_count(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1495)
06/28/18 00:09:31.683 BROM_DLL[3728][4116]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD1) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/28/18 00:09:31.714 BROM_DLL[3728][4116]: BRom_MT6276::BRom_ReadCmd32(): 0x102061B0[1]={ 0x94010000 }.     (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:675)
06/28/18 00:09:31.730 BROM_DLL[3728][4116]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD1) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1325)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: BRom_MT6276::BRom_ReadCmd32(): 0x102061B0[1]={ 0x94010000 }.     (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:675)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: ERROR: BRom_MT6735::IsChipTypeMatch(): CHIP TYPE NOT match!!  target efuse value: 0x94010000 (FlashToolLib/sv5/common/generic/src/brom_mt6735.cpp:207)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: ERROR: FlashTool_Connect_BROM_Ex(): FlashTool_Connect_BROM_Ex() fail, error S_CHIP_TYPE_NOT_MATCH(3184) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1962)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: ERROR: FlashTool_Connect_BROM_Ex(): <ERR_CHECKPOINT>[146][error][3184]</ERR_CHECKPOINT> [S_CHIP_TYPE_NOT_MATCH] (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1963)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: ERROR: FlashTool_Disconnect_BROM(): invalid arguments! *p_ft_handleis NULL (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2370)
06/28/18 00:09:31.761 BROM_DLL[3728][4116]: ERROR: FlashTool_Disconnect_BROM(): <ERR_CHECKPOINT>[109][error][1002]</ERR_CHECKPOINT> [S_INVALID_ARGUMENTS] (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2371)
06/28/18 00:09:31.761 BROM_DLL[3728][4956]: RB_ClearAll(): RB_HANDLE->rwlock: WRITE_LOCK ... (FlashToolLib/host/windows/rwlock.cpp:460)
06/28/18 00:09:31.761 BROM_DLL[3728][4956]: RB_ClearAll(): RB_HANDLE->rwlock: WRITE_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:476)

So finally I decided to try with the version MT6737M that MTK Droid Root & Tools suggested was my chip. I did get a different error with that, not surprising it didn't work.


Code:

06/28/18 00:38:47.882 BROM_DLL[7403][7559]: ERROR: FlashTool_Connect_Download_InitDA(): FlashTool_Connect_Download_InitDA() fail, error S_BROM_DOWNLOAD_DA_FAIL(2004) (flashtool_api.cpp:1622)
06/28/18 00:38:47.882 BROM_DLL[7403][7559]: ERROR: FlashTool_Connect_Download_InitDA(): <ERR_CHECKPOINT>[150][error][2004]</ERR_CHECKPOINT> [S_BROM_DOWNLOAD_DA_FAIL] (flashtool_api.cpp:1624)
06/28/18 00:38:47.882 BROM_DLL[7403][7559]: ERROR: FlashTool_Connect_Download_DA(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x44012630): FlashTool_Connect_Download_InitDA(): fail!  (flashtool_api.cpp:1476)
06/28/18 00:38:47.882 BROM_DLL[7403][7559]: ERROR: FlashTool_Connect_Download_DA(): <ERR_CHECKPOINT>[149][error][2004]</ERR_CHECKPOINT> [S_BROM_DOWNLOAD_DA_FAIL] (flashtool_api.cpp:1478)
06/28/18 00:38:47.883 BROM_DLL[7403][7559]: FlashTool_Disconnect(0x44012630): mutex: LOCK ... (mutex.cpp:151)
06/28/18 00:38:47.883 BROM_DLL[7403][7559]: DEBUG: CMD_Finish(): Send DA_FINISH_CMD(0xD9), device_status(DISCONNECT_USB_AND_RELEASE_POWERKEY). (da_cmd.cpp:1050)
06/28/18 00:38:57.882 BROM_DLL[7403][7559]: ERROR: ReadData(): Retry(200): ReadComm(0/1): exceed timeout 10000 ms, retry 200 times fail!, total=(140561394696192/1). (da_cmd.cpp:272)
06/28/18 00:38:57.882 BROM_DLL[7403][7559]: ERROR: CMD_Finish(): Error return(2). (da_cmd.cpp:1084)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]: DEBUG: CMD_Finish(): OK! (da_cmd.cpp:1090)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]: ERROR: FlashTool_Disconnect(): (0x44012630): da_cmd.CMD_Finish(): fail! (flashtool_api.cpp:2338)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]: FlashTool_Disconnect(0x44012630): mutex: UNLOCK. (mutex.cpp:166)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]:     com_base::close(/dev/ttyACM3): tty(15) OK! (com_base.cpp:455)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]:     com_sentry::Close(0x7fd744006260): OK!! (com_sentry.cpp:409)
06/28/18 00:38:57.892 BROM_DLL[7403][7559]: DEBUG: FlashTool_Disconnect(): successfully done. (flashtool_api.cpp:2350)

Same results on Linux using SPFlash there.

Any tips or insight you can provide would be welcome.
X3non
X3non
X3non
Recognized Contributor
22,062
27-06-2018, 08:02 PM
#3
(27-06-2018, 07:03 PM)tya So I tried with MTK Droid Root & Tools and obviously my phone is too new to work with it.
...
Any tips or insight you can provide would be welcome.

mtk droid tool won't work properly on newer mtk chipsets
attach a screenshot of the error you got while using MT6737M scatter for readback

try booting your device into factory mode [vol down + power button]. if successfully then in factory mode, scroll down and select "Version"
it should also indicate chipset type OR you can also use the app at https://www.hovatek.com/forum/thread-13054.html to verify chipset

you can try dumping firmware in scatter file using miracle box at https://www.hovatek.com/forum/thread-13347.html
lets know the outcome of all of these
tya
tya
tya
Junior Member
16
28-06-2018, 07:30 AM
#4
X3non mtk droid tool won't work properly on newer mtk chipsets
Yeah I didn't expect that to work especially as it wasn't able to find my block map. But I tried to do a readback with the suggested chipset anyway ie MT6737M

I guess that's why I got as:

Code:

ERROR: FlashTool_Connect_Download_DA(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x44012630): FlashTool_Connect_Download_InitDA(): fail!  (flashtool_api.cpp:1476)

The dialog that came up was just that generic, with the red progress bar at 100%. (This will be indexed by search engines whereas a screenshot won't be). I was getting the same error in Windows as I got in Linux.

Code:

Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
add@/devices/pci0000:00/0000:00:14.0/usb1/1-1

add@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.0

add@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.1

bind@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.0

add@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.1/tty/ttyACM1

vid is 0e8d

device vid = 0e8d

pid is 2000

device pid = 2000

com portName is: /dev/ttyACM1

Total wait time = -1530164186.000000
USB port is obtained. path name(/dev/ttyACM1), port name(/dev/ttyACM1)
USB port detected: /dev/ttyACM1
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
COM port is open. Trying to sync with the target...
Failed to Connect DA: S_BROM_DOWNLOAD_DA_FAIL
Disconnect!
BROM Exception! ( ERROR : S_BROM_DOWNLOAD_DA_FAIL (2004)

[H/W] Fail to download DA to baseband chip's internal SRAM!
[HINT]:
1. There's an cable communication problem between FlashTool and BootROM.
2. Target might be shutdown unexpectedly or target lost power supply.
[ACTION]
1. Try again.
2. Proceed H/W checking in download cable and target side com port.
3. Monitor if power-drop occured in target side.)((ConnectDA,../../../flashtool/Conn/Connection.cpp,146))

X3non try booting your device into factory mode [vol down + power button]. if successfully then in factory mode, scroll down and select "Version"

It doesn't as it happens it just comes up with a text menu and no board or model information. My Nexus phones used to come up with that info.

Code:

adb reboot bootloader
will automatically reboot into fastboot mode.

Code:

Select Boot Mode:
[VOLUME_DOWN is select. VOLUME_UP to OK.]

[Recovery     Mode]
[Fastboot     Mode]        <<==
[Normal       Mode]

Recovery just comes up with the robot with the red warning sign and "No Command".

Code:

Fastboot just shows => FASTBOOT mode...

Code:

fastboot reboot
will send you back into the normal Android OS.

X3non it should also indicate chipset type OR you can also use the app at https://www.hovatek.com/forum/thread-13054.html to verify chipset

I don't have a Google Play account added on the phone so I just looked at getprop (that app would do that too).

Code:

$ adb shell getprop |grep MT
[mediatek.wlan.chip]: [CONSYS_MT6735]
[persist.log.tag.RILC-MTK]: [I]
[ro.mediatek.platform]: [MT6737M]

Code:

fastboot getvar CPU
Code:

CPU: "MT6735"
finished. total time: 0.002s

So it turns out the actual platform is a MT6737M like MTK Droid said. The CPU (which would include WLAN) was a MT6735. No wonder it said S_CHIP_TYPE_NOT_MATCH(3184) when I tried to use a MT6735 on readback in SPFlash Tool.

I went over to your thread Mediatek (MTK) Scatter Files and used your scatter file for the MT6737M.

I also took the tip of holding down the volume key mentioned here: [Please help] SP Flash Tools error 2004

Battery was removed, I got a new error:

Code:

Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
add@/devices/pci0000:00/0000:00:14.0/usb1/1-1

add@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.0

add@/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.0/tty/ttyACM1

vid is 0e8d

device vid = 0e8d

pid is 0003

device pid = 0003

com portName is: /dev/ttyACM1

Total wait time = -1530164831.000000
USB port is obtained. path name(/dev/ttyACM1), port name(/dev/ttyACM1)
USB port detected: /dev/ttyACM1
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
COM port is open. Trying to sync with the target...
Failed to Connect DA: S_AUTH_HANDLE_IS_NOT_READY
Disconnect!
BROM Exception! ( ERROR : S_AUTH_HANDLE_IS_NOT_READY (5000)

[User] This is a secure Base-band Chip! Please select the authentication file first.
[HINT]:
)((ConnectDA,../../../flashtool/Conn/Connection.cpp,146))

So that is progress. Over here BROM Exception! ( ERROR : S_AUTH_HANDLE_IS_NOT_READY (5000) they suggest it is because of a locked bootloader. For Motorola devices they suggest: (quoting because it's behind a password).

https://motorola-global-portal.custhelp....r-device-b UNLOCK YOUR BOOTLOADER
STEP 2 - GET YOUR DEVICE ID & UNLOCK CODE


First ensure your device has the latest tools.
  1. Install the Android SDK. Download here.
  2. Install the latest Motorola USB Drivers on your desktop. Download here

Next get your Device ID


  1. Put your device in fastboot mode (power off, then press the power and volume down buttons simultaneously).
  2. On your desktop, open a command prompt or terminal, and go to the directory where you installed the Android SDK tools (or make sure fastboot is in your $PATH)
  3. At the prompt, type
    $ fastboot oem get_unlock_data
  4. The returned string will be used to retrieve your unlock key.

    Example: On a Windows Desktop, the returned string format would be
    $ fastboot oem get_unlock_data(bootloader) 0A40040192024205#4C4D3556313230(bootloader) 30373731363031303332323239#BD00(bootloader) 8A672BA4746C2CE02328A2AC0C39F95(bootloader) 1A3E5#1F53280002000000000000000(bootloader) 0000000
  5. On a Mac OS Desktop, the returned string format would be
    INFO0A40040192024205#4C4D3556313230INFO30373731363031303332323239#BD00INFO8A672BA4746C2CE02328A2AC0C39F95INFO1A3E5#1F53280002000000000000000INFO0000000
  6. Paste together the 5 lines of output into one continuous string without (bootloader) or ‘INFO’ or white spaces. Your string needs to look like this:
    0A40040192024205#4C4D355631323030373731363031303332323239#BD008A672BA4746C2CE02328A2AC0C39F951A3E5#1F532800020000000000000000000000
  7. Check if your device can be unlocked by pasting this string in the field below, and clicking “Can my device be unlocked?”
NOTE: If your device is unlockable, a "REQUEST UNLOCK KEY" button will now appear at the bottom of this page.

Then get your Unlock Key

NOTE: If your device is unlockable, a blue "REQUEST UNLOCK KEY" button will appear.

*You will receive an email with your Unlock Key at the email address you used to log in here. If you don't see the email, check your spam folder to make sure it wasn't sent there by mistake.


Code:

fastboot oem get_unlock_data    
...
FAILED (remote: unknown command)
finished. total time: 0.002s

However that didn't work for me, even though I checked the OEM unlock in the Developer Options menu. I have searched around and nobody else seems to have a solution or updated their posts.

It looks as if get_unlock_data is specific to my phone, maybe it is already unlocked and I don't need to actually do that? In my first post I mentioned the CID is one that can apparently have the bootloader unlocked.

Mysteryagr just says to go to the motorola website, but that's no help https://forum.xda-developers.com/showpost.php?p=74825601&postcount=16 I sent an email to Motorola, will update on result.
This post was last modified: 29-06-2018, 06:17 PM by tya.
hovatek
hovatek
hovatek
Administrator
49,570
28-06-2018, 01:01 PM
#5



(28-06-2018, 07:30 AM)tya ..I sent an email to Motorola, will update on result.

Lets simplify this. Your device is MediaTek MT6735 and you want to create the scatter file and eventually dump the firmware.
The easiest tools for pulling this off are Windows only tools: Miracle box @ https://www.hovatek.com/forum/thread-13347.html and Wwr @ https://www.hovatek.com/forum/thread-21970.html
Now, I want to correct two impressions quickly because they could trigger certain errors
1. You don't need to remove the battery to use Sp flash tool
2. Avoid holding volume down button (or any button at all) when connecting to PC for Sp flash tool as this mostly triggers a mismatch error (Yes)

Now, it seems the wwr + sp flash tool approach is what you've chosen so lets stick with that.
First is the temp scatter file in Wwr. I use Windows so I have generated that for you (find attached).  MT6735 & MT6737M for you to test both
Your first region to dump is the raw preloader

Code:

physical_start_addr: 0x0 (Start Address)
partition_size: 0x80000 (Length)
region: EMMC_BOOT_1 (Very important you set this)

Try dumping this partition and let me know what error(s) you get (full screenshots + logs). This will tell what we're dealing with
Try using Sp flash tool  V5.1532.00 & V5.1516.00

Side note (while waiting for feedback from above steps):
About the ERROR : S_BROM_DOWNLOAD_DA_FAIL (2004), that could be due to an interruption (device powering up) or a secure bootloader in which case you might need a custom Download Agent) to force detection
This post was last modified: 28-06-2018, 01:18 PM by hovatek.
Attached Files
.zip
2 Scatter files.zip
Size: 1.02 KB / Downloads: 13

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
tya
tya
tya
Junior Member
16
28-06-2018, 07:24 PM
#6
Just going to post a couple of posts to get around that 10 post thing as I want to post screenshots.
tya
tya
tya
Junior Member
16
28-06-2018, 07:25 PM
#7
Four more to go.
tya
tya
tya
Junior Member
16
28-06-2018, 07:26 PM
#8
Three more
tya
tya
tya
Junior Member
16
28-06-2018, 07:27 PM
#9
Second to last one.
tya
tya
tya
Junior Member
16
28-06-2018, 07:28 PM
#10



Please don't delete until I have 10 posts. Last one.
Pages (2): 1 2 Next
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram