Hovatek Forum MOBILE Android [Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


[Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735

[Please help] How to get the scatter file for a Moto C (namath) XT1758 with MediaTek MT6735

Pages (2): Previous 1 2
tya
tya
tya
Junior Member
16
28-06-2018, 07:45 PM
#11



(27-06-2018, 08:02 PM)X3non you can try dumping firmware in scatter file using miracle box at https://www.hovatek.com/forum/thread-13347.html
lets know the outcome of all of these

(28-06-2018, 01:01 PM)hovatek The easiest tools for pulling this off are Windows only tools: Miracle box @ https://www.hovatek.com/forum/thread-13347.html and Wwr @ https://www.hovatek.com/forum/thread-21970.html

I tried Miracle Box Ver 2.27A as you said. The start button appears to be greyed out and nothing much happens.

[Image: ivHvwOW.png]
.png
MiracleBox.png
Size: 184.04 KB / Downloads: 2


I started with the phone off, and battery installed. I then powered the phone on with one press of the power button. I didn't hold it down. The start button was still greyed out.


(28-06-2018, 01:01 PM)hovatek Now, I want to correct two impressions quickly because they could trigger certain errors
1. You don't need to remove the battery to use Sp flash tool
2. Avoid holding volume down button (or any button at all) when connecting to PC for Sp flash tool as this mostly triggers a mismatch error (Yes)

Right, I had only tried those suggested things I had read elsewhere. What I found when I didn't do those things is nothing happened.

(28-06-2018, 01:01 PM)hovatek Now, it seems the wwr + sp flash tool approach is what you've chosen so lets stick with that.

The main reason I chose that method is because all other methods required me to already have a scatter or a known rom that works on the phone. As none are supplied by the vendor this is really all I can think will work.

(28-06-2018, 01:01 PM)hovatek First is the temp scatter file in Wwr. I use Windows so I have generated that for you (find attached).  MT6735 & MT6737M for you to test both
Your first region to dump is the raw preloader

Code:

physical_start_addr: 0x0 (Start Address)
partition_size: 0x80000 (Length)
region: EMMC_BOOT_1 (Very important you set this)

Try dumping this partition and let me know what error(s) you get (full screenshots + logs). This will tell what we're dealing with
Try using Sp flash tool  V5.1532.00 & V5.1516.00

So I had used WwR_MTK_v2 to produce those skeleton scatters. They look the same as the ones I produced yesterday.

I am doing this on a Windows 8.1 x64 machine as Administrator.

MT6735
  1. VCOM drivers installed
    [Image: 5la3aM0.png]
    .png
    Device Manager.png
    Size: 8.45 KB / Downloads: 0

  2. Scatter Loaded
    [Image: mQfTb6q.png]
    .png
    MT6735.s1.png
    Size: 35.04 KB / Downloads: 0

  3. Readback Added
    [Image: 1Lhy76J.png]
    .png
    MT6735.s2.png
    Size: 29.36 KB / Downloads: 0

  4. Readback started
    [Image: tuccXBF.png]
    .png
    MT6735.s3.png
    Size: 29.25 KB / Downloads: 1
  5. Phone off, with battery in plugged in.
  6. Nothing found, Tried all 3 versions: V5.1532.00, V5.1516.00 and V5.1820.
The logs at the end have:
Code:

BROM_DLL[3508][628]: WARNING: EnumerateDevice(): Get friendly name failed! Err(13) (FlashToolLib/host/windows/com_enum.cpp:618)

So it's fairly obvious what is the issue; the device is not being found. I checked the whole log and it was the same.

MT6737M

I found that SP Flash Tool v5.1532 and v5.1516 would not accept the MT6737M scatter file and just said that it was invalid, however the latest version v5.1820 was fine with it - so I guess I'll use that.

I noticed a lot of this in the log files and nothing really happened.

Code:

06/29/18 01:49:40.845 BROM_DLL[3424][388]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(9600) = 9600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/29/18 01:49:40.845 BROM_DLL[3424][388]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(9600), SEND(0xA0)->RECV(0xA0), fail_retry(30). (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:268)
06/29/18 01:49:40.892 BROM_DLL[3424][388]: DEBUG: BRom_Base::SetBRomCommState(): OK!, BaudRate(57600) = 57600 x EXT_CLOCK(2) x Multiple(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:360)
06/29/18 01:49:40.892 BROM_DLL[3424][388]: BRom_AutoBoot::BRom_StartCmd(0): m_ext_clock(EXT_26M), m_baud_rate(57600), SEND(0xA0)->RECV(0xA0), fail_retry(31). (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:268)

The only way I was able to actually get anything happening was to:

  1. Plugged the device, battery removed
  2. Scatter Loaded
    [Image: O7XrfKe.png]
    .png
    MT6737M.s1.png
    Size: 37.53 KB / Downloads: 1

  3. Readback Added
    [Image: kHW8Kyw.png]
    .png
    MT6737M.s2.png
    Size: 29.75 KB / Downloads: 0

  4. Hit Readback
  5. Insert battery (causes power to go to the device)
  6. Then you see S_BROM_DOWNLOAD_DA_FAIL (2004)
    [Image: bVPcci7.png]
    .png
    MT6737M.s3.png
    Size: 43.01 KB / Downloads: 0

  7. Hit Readback again this time we see S_AUTH_HANDLE_IS_NOT_READY (5000)
    [Image: HKDKqPS.png]
    .png
    MT6737M.s4.png
    Size: 34.87 KB / Downloads: 0

(28-06-2018, 01:01 PM)hovatek Side note (while waiting for feedback from above steps):
About the ERROR : S_BROM_DOWNLOAD_DA_FAIL (2004), that could be due to an interruption (device powering up) or a secure bootloader in which case you might need a custom Download Agent) to force detection

I think this may be the issue as it is complaining about a secure bootloader. I was able to reproduce the above about 10 times in a row.

I was able to reproduce this numerous times in Windows and in Linux, exactly the same behavior.

I have also attached the logs produced when those two errors occurred.
This post was last modified: 29-06-2018, 06:10 PM by tya.
Attached Files
.zip
SP_FT_Dump_06-29-2018-02-17-48.zip
Size: 25.46 KB / Downloads: 14
hovatek
hovatek
hovatek
Administrator
49,570
29-06-2018, 11:45 AM
#12
(28-06-2018, 07:45 PM)tya I tried Miracle Box Ver 2.27A as you said. The start button appears to be greyed out and nothing much happens.

The Miracle Box guide mentions a fix for the inactive start button issue. You could refer to https://www.hovatek.com/forum/thread-14815.html


(28-06-2018, 07:45 PM)tya I found that SP Flash Tool v5.1532 and v5.1516 would not accept the MT6737M scatter file and just said that it was invalid, however the latest version v5.1820 was fine with it - so I guess I'll use that

Try the MT6735 scatter file on v5.1532 & v5.1516 using your battery removal technique that triggers detection.
These lower versions often bypass the Auth file errors which the more recent versions trigger.
If this fails then that narrows the way forward down to an Auth file or custom Download Agent

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
tya
tya
tya
Junior Member
16
29-06-2018, 05:52 PM
#13
(29-06-2018, 11:45 AM)hovatek
(28-06-2018, 07:45 PM)tya I tried Miracle Box Ver 2.27A as you said. The start button appears to be greyed out and nothing much happens.

The Miracle Box guide mentions a fix for the inactive start button issue. You could refer to https://www.hovatek.com/forum/thread-14815.html

I appear to have MiracleBox working but after a while it just says however it says:

Code:

>> none usbport, maybe driver not installed

[Image: xes1N1I.png]
.png
Miracle 2.27A Can't find USB port.png
Size: 192.62 KB / Downloads: 0



(29-06-2018, 11:45 AM)hovatek
(28-06-2018, 07:45 PM)tya I found that SP Flash Tool v5.1532 and v5.1516 would not accept the MT6737M scatter file and just said that it was invalid, however the latest version v5.1820 was fine with it - so I guess I'll use that

Try the MT6735 scatter file on v5.1532 & v5.1516 using your battery removal technique that triggers detection.
These lower versions often bypass the Auth file errors which the more recent versions trigger.
If this fails then that narrows the way forward down to an Auth file or custom Download Agent

So I tried v5.1532 and v5.1516 with the MT6735 scatter files. The error was the same - mostly. It thinks I have a MT6735M not a MT6735

Steps to reproduce:

  1. Click Readback
  2. Insert Cable
  3. Insert Battery

Error using version SP Flash Tool v5.1516 MT6735

[Image: x9SDS72.png]


Code:

06/30/18 00:16:03.981 BROM_DLL[2364][6032]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BB chip name(MT6735M_S00): DigitalDie={ hw_ver(0xCA00), sw_ver(0x0000), hw_code(0x0335), hw_subcode(0x8A00) }, AnalogDie={ hw_ver(0x0000), hw_code(0x0000) } (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1554)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: BRom_AutoBoot::BRom_StartCmd(0): Pass! (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:333)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: DEBUG: BRom_Base::CreateObject(): MT6735M(149), EXT_26M(2), p_bootstop(0x03DA0C60), ms_boot_timeout(268435455), max_start_cmd_retry_count(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1385)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: DEBUG: IsChipTypeMatch(): IsChipTypeMatch() (FlashToolLib/sv5/common/generic/src/StorageSizeCheck.cpp:224)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: ERROR: IsChipTypeMatch(): Chip type not match, Target chip type is MT6735M, but the load scatter chip type is MT6735. (FlashToolLib/sv5/common/generic/src/StorageSizeCheck.cpp:240)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: ERROR: FlashTool_Connect_BROM_Ex(): FlashTool_Connect_BROM_Ex() fail, error S_CHIP_TYPE_NOT_MATCH(3179) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1750)
06/30/18 00:16:03.981 BROM_DLL[2364][6032]: ERROR: FlashTool_Disconnect_BROM(): invalid arguments! *p_ft_handleis NULL (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2031)


Error using version SP Flash Tool v5.1532 MT6735

[Image: 0EerKCi.png]


Code:

06/30/18 00:32:43.979 BROM_DLL[2624][2148]: DEBUG: BRom_Base::GetBBChipIDFromTarget(): BB chip name(MT6735M_S00): DigitalDie={ hw_ver(0xCA00), sw_ver(0x0000), hw_code(0x0335), hw_subcode(0x8A00) }, AnalogDie={ hw_ver(0x0000), hw_code(0x0000) } (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1572)
06/30/18 00:32:43.979 BROM_DLL[2624][2148]: BRom_AutoBoot::BRom_StartCmd(0): Pass! (FlashToolLib/sv5/common/interface/src/brom_autoboot.cpp:336)
06/30/18 00:32:43.979 BROM_DLL[2624][2148]: DEBUG: BRom_Base::CreateObject(): MT6735M(149), EXT_26M(2), p_bootstop(0x03E487D0), ms_boot_timeout(268435455), max_start_cmd_retry_count(1). (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1399)
06/30/18 00:32:43.979 BROM_DLL[2624][2148]: DEBUG: IsChipTypeMatch(): IsChipTypeMatch() (FlashToolLib/sv5/common/generic/src/StorageSizeCheck.cpp:224)
06/30/18 00:32:43.979 BROM_DLL[2624][2148]: ERROR: IsChipTypeMatch(): Chip type not match, Target chip type is MT6735M, but the load scatter chip type is MT6735. (FlashToolLib/sv5/common/generic/src/StorageSizeCheck.cpp:243)
06/30/18 00:32:43.979 BROM_DLL[2624][2148]: ERROR: FlashTool_Connect_BROM_Ex(): FlashTool_Connect_BROM_Ex() fail, error S_CHIP_TYPE_NOT_MATCH(3184) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1751)


So I decided to use the MT6735M_Android_scatter generated with WwR_MTK as the errors said MT6735M, but the load scatter chip type is MT6735 :
.txt
MT6735M_Android_scatter.txt
Size: 1.01 KB / Downloads: 5


Error using version SP Flash Tool v5.1516 MT6735M

[Image: MgkoVkR.png]


Code:

06/30/18 01:27:03.448 BROM_DLL[368][4184]: DEBUG: BRom_MT6276::Boot_FlashTool(): Cable Type - UART (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1290)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: DEBUG: BRom_MT6276::Boot_FlashTool(): SV5 starts... (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1293)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: DEBUG: BRom_MT6276::Boot_FlashTool(): CALLBACK_COM_INIT_STAGE(0x00446410)....  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1304)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1705)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): ver(0x01).  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1728)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: BRom_PowerKeyLockSentry(): execute m_base.SetReg_LockPowerKey().  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2051)
06/30/18 01:27:03.448 BROM_DLL[368][4184]: BRom_Base::BromCmd_GetSecConf(): enter ...  (SLA/src/CSLA_SV5.cpp:412)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD8) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1284)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: BRom_Base::BromCmd_GetSecConf(): OK.  (SLA/src/CSLA_SV5.cpp:436)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: SECURE_HANDLE_BROM::onDAWillBeDownloaded(): sec_config = 0x00000005 (boot loader) (FlashToolLib/source/security/src/secure_handle_brom.cpp:148)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: BRom_Base::BRom_GetVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1586)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: WARN: BRom_Base::BRom_GetVer(): BROM_SCMD_GET_BROM_VER(0xFF) is not support! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1603)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1705)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): ver(0x01).  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1728)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [0] [6735 2601] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [1] [6735 6571] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [2] [6735 6572] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [3] [6735 6573] [CA00 CA10 1] [0000 CA01 0] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [4] [6735 6575] [CA00 CA00 1] [0000 E100 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [5] [6735 6575] [CA00 CB00 0] [0000 E201 0] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [6] [6735 6577] [CA00 CA00 1] [0000 E100 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [7] [6735 6580] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [8] [6735 6582] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [9] [6735 6583] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [10] [6735 6592] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [11] [6735 6595] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [12] [6735 6735] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5074)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DA_HANDLE::SearchDA(): DA_HANDLE(0x03193350):SearchDA(): DA[12] is selected!  (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5096)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: DAEntrySet::CompareSingleKey(): DA entry key(67350). (FlashToolLib/source/common/generic/src/da_entry_base.cpp:377)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: DEBUG: BRom_MT6276::Boot_FlashTool(): (00000C08): BRom_WriteBuf() ... (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1455)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: BRom_MT6276::BRom_WriteBuf(): p_data_blocks(0x087EFBB0).  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:957)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: BRom_MT6276::BRom_WriteBuf(): block_count(1), total_length(84392).  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1003)
06/30/18 01:27:03.464 BROM_DLL[368][4184]:     com_util::GetCommPreference(00000C08): dcb.BaudRate(921600), packet_len(1024), accuracy(2).  (FlashToolLib/host/windows/com_util.cpp:540)
06/30/18 01:27:03.464 BROM_DLL[368][4184]: BRom_MT6276::BRom_WriteBuf(): sending m_blocks[0]={ m_baseaddr(0x00200000), m_data(0x04880578), m_data_len(84392), m_data_sig_len(256) }. (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1033)
06/30/18 01:27:03.479 BROM_DLL[368][4184]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD7) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1284)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: ERROR: BRom_MT6276::BRom_WriteBuf(): Read16Data(): Status returns error (0x2001)! (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1153)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: ~BRom_PowerKeyLockSentry(): execute m_base.SetReg_ReleasePowerKey().  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2062)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: Boot_FlashTool(): DA_HANDLE->rwlock: READ_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:423)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: ERROR: pre_download_da(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x031A0A08): Boot_FlashTool(): fail!  (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1487)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: pre_download_da(031A0A08): DA_HANDLE->rwlock: READ_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:423)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: ERROR: FlashTool_Connect_Download_InitDA(): FlashTool_Connect_Download_InitDA() fail, error S_BROM_DOWNLOAD_DA_FAIL(2004) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1537)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: ERROR: FlashTool_Connect_Download_DA(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x031A0A08): FlashTool_Connect_Download_InitDA(): fail!  (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1400)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: FlashTool_Disconnect(0x031A0A08): mutex: LOCK ... (FlashToolLib/host/windows/mutex.cpp:143)
06/30/18 01:27:03.651 BROM_DLL[368][4184]: DEBUG: DA_cmd::CMD_Finish(): Send DA_FINISH_CMD(0xD9), device_status(DISCONNECT_USB_AND_RELEASE_POWERKEY). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1048)
06/30/18 01:27:03.704 BROM_DLL[368][4184]: ERROR:     com_util::ReadComm(00000C08): return FALSE!, Err(995). (FlashToolLib/host/windows/com_util.cpp:409)
06/30/18 01:27:03.704 BROM_DLL[368][4184]: ERROR: DA_cmd::ReadData(): Retry(0): ReadComm(0/1): Err(995), total=(0/1). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:231)
06/30/18 01:27:03.704 BROM_DLL[368][4184]: ERROR: DA_cmd::CMD_Finish(): Error return(2). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1082)
06/30/18 01:27:03.704 BROM_DLL[368][5056]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:27:03.704 BROM_DLL[368][5056]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:27:03.704 BROM_DLL[368][5056]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:27:03.720 BROM_DLL[368][4184]: DEBUG: DA_cmd::CMD_Finish(): OK! (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1088)
06/30/18 01:27:03.720 BROM_DLL[368][4184]: ERROR: FlashTool_Disconnect(): (0x031A0A08): da_cmd.CMD_Finish(): fail! (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2001)
06/30/18 01:27:03.720 BROM_DLL[368][4184]: FlashTool_Disconnect(0x031A0A08): mutex: UNLOCK. (FlashToolLib/host/windows/mutex.cpp:158)


Error using version SP Flash Tool v5.1532 MT6735M

[Image: 4zSj7Ek.png]


Code:

06/30/18 01:31:05.184 BROM_DLL[2728][3524]: DEBUG: BRom_MT6276::Boot_FlashTool(): Cable Type - UART (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1290)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: DEBUG: BRom_MT6276::Boot_FlashTool(): SV5 starts... (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1293)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: DEBUG: BRom_MT6276::Boot_FlashTool(): CALLBACK_COM_INIT_STAGE(0x004490D0)....  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1304)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1723)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): ver(0x01).  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1746)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: BRom_PowerKeyLockSentry(): execute m_base.SetReg_LockPowerKey().  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2069)
06/30/18 01:31:05.184 BROM_DLL[2728][3524]: BRom_Base::BromCmd_GetSecConf(): enter ...  (SLA/src/CSLA_SV5.cpp:412)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD8) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1289)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: BRom_Base::BromCmd_GetSecConf(): OK.  (SLA/src/CSLA_SV5.cpp:436)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: SECURE_HANDLE_BROM::onDAWillBeDownloaded(): sec_config = 0x00000005 (boot loader) (FlashToolLib/source/security/src/secure_handle_brom.cpp:148)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: BRom_Base::BRom_GetVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1604)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: WARN: BRom_Base::BRom_GetVer(): BROM_SCMD_GET_BROM_VER(0xFF) is not support! (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1621)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): enter ...  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1723)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: BRom_Base::BRom_GetBootLoaderVer(): ver(0x01).  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1746)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [0] [6735 2601] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [1] [6735 6571] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [2] [6735 6572] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [3] [6735 6573] [CA00 CA10 1] [0000 CA01 0] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [4] [6735 6575] [CA00 CB00 0] [0000 E201 0] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [5] [6735 6577] [CA00 CA00 1] [0000 E100 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [6] [6735 6580] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [7] [6735 6582] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [8] [6735 6583] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [9] [6735 6592] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [10] [6735 6595] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): SearchDA [11] [6735 6735] [CA00 CA00 1] [0000 0000 1] (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5081)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DA_HANDLE::SearchDA(): DA_HANDLE(0x018A65E0):SearchDA(): DA[11] is selected!  (FlashToolLib/source/common/handle/src/flashtool_handle_internal.cpp:5103)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: DAEntrySet::CompareSingleKey(): DA entry key(67350). (FlashToolLib/source/common/generic/src/da_entry_base.cpp:381)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: DEBUG: BRom_MT6276::Boot_FlashTool(): (00000AA8): BRom_WriteBuf() ... (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1455)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: BRom_MT6276::BRom_WriteBuf(): p_data_blocks(0x0674FAC0).  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:957)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: BRom_MT6276::BRom_WriteBuf(): block_count(1), total_length(88016).  (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1003)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]:     com_util::GetCommPreference(00000AA8): dcb.BaudRate(921600), packet_len(1024), accuracy(2).  (FlashToolLib/host/windows/com_util.cpp:542)
06/30/18 01:31:05.200 BROM_DLL[2728][3524]: BRom_MT6276::BRom_WriteBuf(): sending m_blocks[0]={ m_baseaddr(0x00200000), m_data(0x051F0DE8), m_data_len(88016), m_data_sig_len(256) }. (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1033)
06/30/18 01:31:05.215 BROM_DLL[2728][3524]: DEBUG: BRom_Base::Write8DataWithEcho(): =0, cmd(0xD7) (FlashToolLib/sv5/common/interface/src/brom_base.cpp:1289)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: ERROR: BRom_MT6276::BRom_WriteBuf(): Read16Data(): Status returns error (0x2001)! (FlashToolLib/sv5/common/generic/src/brom_mt6276.cpp:1153)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: ~BRom_PowerKeyLockSentry(): execute m_base.SetReg_ReleasePowerKey().  (FlashToolLib/sv5/common/interface/src/brom_base.cpp:2080)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: Boot_FlashTool(): DA_HANDLE->rwlock: READ_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:423)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: ERROR: pre_download_da(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x018B1C18): Boot_FlashTool(): fail!  (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1487)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: pre_download_da(018B1C18): DA_HANDLE->rwlock: READ_UNLOCK. (FlashToolLib/host/windows/rwlock.cpp:423)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: ERROR: FlashTool_Connect_Download_InitDA(): FlashTool_Connect_Download_InitDA() fail, error S_BROM_DOWNLOAD_DA_FAIL(2004) (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1537)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: ERROR: FlashTool_Connect_Download_DA(): S_BROM_DOWNLOAD_DA_FAIL(2004),ft_handle(0x018B1C18): FlashTool_Connect_Download_InitDA(): fail!  (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:1400)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: FlashTool_Disconnect(0x018B1C18): mutex: LOCK ... (FlashToolLib/host/windows/mutex.cpp:143)
06/30/18 01:31:05.387 BROM_DLL[2728][3524]: DEBUG: DA_cmd::CMD_Finish(): Send DA_FINISH_CMD(0xD9), device_status(DISCONNECT_USB_AND_RELEASE_POWERKEY). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1048)
06/30/18 01:31:05.452 BROM_DLL[2728][3524]: ERROR:     com_util::ReadComm(00000AA8): return FALSE!, Err(995). (FlashToolLib/host/windows/com_util.cpp:411)
06/30/18 01:31:05.452 BROM_DLL[2728][3524]: ERROR: DA_cmd::ReadData(): Retry(1): ReadComm(0/1): Err(995), total=(0/1). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:231)
06/30/18 01:31:05.452 BROM_DLL[2728][3524]: ERROR: DA_cmd::CMD_Finish(): Error return(2). (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1082)
06/30/18 01:31:05.453 BROM_DLL[2728][5524]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:31:05.453 BROM_DLL[2728][5524]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:31:05.453 BROM_DLL[2728][5524]: ComPortEnumerateByArg: NOT FOUND!! (FlashToolLib/host/windows/com_enum.cpp:514)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]: DEBUG: DA_cmd::CMD_Finish(): OK! (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:1088)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]: ERROR: FlashTool_Disconnect(): (0x018B1C18): da_cmd.CMD_Finish(): fail! (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2010)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]: FlashTool_Disconnect(0x018B1C18): mutex: UNLOCK. (FlashToolLib/host/windows/mutex.cpp:158)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]:     com_sentry::Close(\\?\usb#vid_0e8d&pid_2000#5&1eaa782a&0&3#{a5dcbf10-6530-11d2-901f-00c04fb951ed}, 00000AA8): OK! (FlashToolLib/host/windows/com_sentry.cpp:663)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]:     com_base::~com_base() m_hCOM(FFFFFFFF) (FlashToolLib/host/windows/com_sentry.cpp:122)
06/30/18 01:31:05.468 BROM_DLL[2728][3524]: DEBUG: FlashTool_Disconnect(): successfully done. (FlashToolLib/sv5/common/generic/src/flashtool_api.cpp:2022)


So what is interesting about these is that it does get a lot further.

But seems to fail here:

Code:

ERROR: BRom_MT6276::BRom_WriteBuf(): Read16Data(): Status returns error (0x2001)!

Incidentally another thing I noticed earlier up:

Code:

06/30/18 01:31:05.075 BROM_DLL[2728][3524]: DEBUG: IsChipTypeMatch(): IsChipTypeMatch() (FlashToolLib/sv5/common/generic/src/StorageSizeCheck.cpp:224)
06/30/18 01:31:05.075 BROM_DLL[2728][3524]: DEBUG: BRom_Base::ForceCharge(): USB download without battery is not supported. (FlashToolLib/sv5/common/interface/src/brom_base.cpp:331)

Maybe I should insert battery then cable rather than the other way around. I don't think that's causing this issue though that might just be early on in the attempt.
This post was last modified: 29-06-2018, 06:00 PM by tya.
hovatek
hovatek
hovatek
Administrator
49,570
30-06-2018, 12:27 PM
#14
(29-06-2018, 05:52 PM)tya Maybe I should insert battery then cable rather than the other way around. I don't think that's causing this issue though that might just be early on in the attempt.

The error 2004 seems to be triggered by the battery removal technique which happens to be the only way to force detection.
I think you might be looking at an Authentication file / custom Download Agent

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
tya
tya
tya
Junior Member
16
30-06-2018, 01:19 PM
#15



(30-06-2018, 12:27 PM)hovatek
(29-06-2018, 05:52 PM)tya Maybe I should insert battery then cable rather than the other way around. I don't think that's causing this issue though that might just be early on in the attempt.

The error 2004 seems to be triggered by the battery removal technique which happens to be the only way to force detection.
I think you might be looking at an Authentication file / custom Download Agent

I think you might be right:

kriztekblog Download MTK Secure Boot DA Loader Files For MTK Devices
KriztekBlog April 28, 2018

If you are reading this post, you might have faced FRP related issues on a Mediatek device even with professional tools like CM2, NCK, Miracle Box etc.

Most new Mediatek powered smartphones come with a secured boot/boot ROM that can’t be controlled with the normal MTK DA(Download Agent) which is always in the official SP flash tool and other Chinese smartphones fixing tools.

With the normal MTK_AllInOne_DA.bin file, you can perform operations on like FRP reset, firmware backup, flashing, read security codes etc on MTK devices.

But this isn’t possible on devices with a secured boot device.

Trying this will give you errors all through unless you find a way of getting through it directly on the phone.

Most CM2 users would have seen this error :

Operation : Format FileSystem [ v1.58 ]

1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey

Wait for phone…
Phone found! [ 9 ]
Sync…
Inital Boot Ok!
BB_CPU_PID : 6582
BB_CPU_NME : [MediaTek] MT6582_S00
BB_CPU_EXT : 0xCA01 , 0x8A00 , 0x0000
Processing BROM stage
Settings for BROM configured!
SecCfgVal : 0x00000000
BromVer : 0x00FF
BLVersion : 0x0001
PreLoader : Active [ Boot with PL ]
BootLdrSS : NORMAL with PRELOADER
Processing DA stage
DA Select done, will use MTK_AllInOne_DA_v5.1624.16.07
Sending and initialize DA …

[DA_ERROR] : SECURITYBOOT_BOOT_NOT_ACCEPTED
Boot Error!

Operation Failed
Elapsed: 00:00:05
Reconnect Power/Cable

This shows that the device can’t be communicated with the normal DA file since it has a secured boot. The simple solution is to use a custom secured DA file for the device and it can then accept any command from the tool/DA. Some other devices might also need an AUTH(Authentication file) to get things done.

kriztekblog Motorola DA Files

   XT1760
   XT1721_Boot DA
   XT1755_Boot DA
   Moto-XT1724_XT1726
   DA_SWSEC_WAT.Moto-XT1750.bin
   –
   Moto-xt1721_xt1723_xt1724_xt1725_x1726
   Moto-xt1750
   Moto-xt1754_xt1755_xt1756_xt1757_xt1758
   Moto-xt1760_61_62_63_66_70_71_72_73

XT1758 is mine!

kriztekblog Files are without password. To get download link for any file, simply make a donation to KrizTekBlog and then use the comments box below to request for any of the files.

I don't really want to be transferring money, especially if it doesn't work Tongue. He doesn't say how much either. Apart from the fact it isn't his property appears to be selling.

He then has two instructions:

kriztekblog How To Use A Custom MTK DA File With CM2 MTK Module
  • After downloading the file, make sure you rename it to MTK_AllInOne_DA_SP
  • Go to your CM2MTK boot folder on your PC. It’s at C:\InfinityBox\CM2MTK\Boot
[Image: How-To-Use-A-Custom-MTK-DA-File-With-CM2-nck-2.png]

  • Copy/move the MTK_AllInOne_DA_SP.bin to your desktop
  • Copy the custom DA file into the MTK boot folder.
  • Make sure it’s renamed properly MTK_AllInOne_DA_SP
  • Once done, open CM2 MTK Module
  • Select the MT65xx as usual
  • Click on Service Tab
  • Click FULL FACTORY(WIPE + FRP) and select FRP(Factory Reset Protection)
  • Once done, click on Reset Settings / Format FS
[Image: 2018-04-28_08-49-44.png]
.png
2018-04-28_08-49-44.png
Size: 67.22 KB / Downloads: 0

  • If everything went well, the FRP partition will be wiped safely.

If you use the InfinityBox_install_CM2MT2_v2.00-r2.7z, it’s now as easy as NCK MTK software. All you have to do,
  • Open the software
  • Under custom settings (DA Auth Cert), select DA and select the custom DA file you have or previously downloaded.
  • Click on the Service Tab
  • You can now proceed to reset ONLY FRP and it will work flawlessly.

Download InfinityBox_CM2MT2_v2.00-r2.7z

It appears he's removed the InfinityBox_install_CM2MT2_v2.00-r2.7z software but there is:

http://dl1.infinity-box.com/download/ind...2.00-r4.7z

and a bunch of others:

http://dl1.infinity-box.com/download/ind...=software/

I'm not sure which one I should use. The latest?

Have you done this before?

Do you have the download agents?

kriztekblog How To Use A Custom MTK DA File With MTK SP Flashtool

[Image: 2018-04-28_08-55-31.png]
.png
2018-04-28_08-55-31.png
Size: 111.41 KB / Downloads: 0

  • Download the latest version of SP Flashtool v5.1744
  • Unpack the archived file and paste it on your desktop
  • Open the SP Flashtool v5.1744 folder and launch flash_tool.exe
  • Once open, click on Choose in front of Download-Agent, locate and select the custom MTK_AllInOne_DA_SP for your phone.
  • If there’s an Auth file too, you should add it via the Authentication file tab.
  • You will then need to load the scatter file of your device.
  • Then follow Method 3 on FRP Bypass
  • You should be very careful to avoid issues.

I looked at that Method 3 on FRP Bypass but he doesn't have the XT1758 there.

kriztekblog How To Use A Custom MTK DA File With NCK Box

To use a custom DA file on NCK box MTK module, it is very easy. NCK MTK Module has an easy to use interface. You must have the box to use the software unless you are using a cracked version.
So let’s quickly see how to use custom DA file with NCK box
  • Launch NCKBox Android MTK software
  • Click on FRP-Pattern-Privacy tab
  • Click on Select custom loader
  • Locate and select the custom DA file for your device.
  • You can now reset FRP or perform other operations with the custom DA file.
  • It’s so simple.
If you have any questions or contribution, you can use the comments box below.
A big thanks to CM2 and NCK Box team for an awesome MTK servicing tool plus steady updates. Go get one of these tools if you really want to step up your phone fixing game.

I don't have one of these so this isn't an option by the looks of it. I also don't have a cracked copy. I think the SP Flashtool might be the way to go.
This post was last modified: 30-06-2018, 03:07 PM by hovatek.
hovatek
hovatek
hovatek
Administrator
49,570
30-06-2018, 01:50 PM
#16
(30-06-2018, 01:19 PM)tya ..
XT1758 is mine!
..
I don't have one of these so this isn't an option by the looks of it. I also don't have a cracked copy. I think the SP Flashtool might be the way to go.

Forget about using CM2. It requires a hardware dongle which you don't have.
Here's the custom Download Agent for your model (attached below). Just extract and name it MTK_AllInOne_DA.bin then replace the one in SP flash tool with it before you launch.
Attached Files
.7z
Moto-xt1754_xt1755_xt1756_xt1757_xt1758.7z
Size: 1,004.18 KB / Downloads: 20

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
tya
tya
tya
Junior Member
16
30-06-2018, 02:47 PM
#17
https://www.kriztekblog.com/2017/06/rese...vices.html 3 Ways To Reset/Remove FRP On MTK-Mediatek Devices
KriztekBlog June 14, 2017

The term FRP is so popular nowadays since a large number of Android users are on the latest Android operating system. FRP-Factory Reset Protection is a security feature on Android 5 Lollipop and above devices that is triggered when a device with a synchronized Google account is reset via the recovery menu/fastboot.

The device automatically flags it as a theft or an insecure action. So, after the reset, the device will prompt for the most recent synchronized Google account to be verified. It protects your device from unauthorized access but unfortunately, it can be bypassed.

How To Bypass FRP On MTK Devices Method 1
  1. Install MediaTek USB VCOM Drivers if you haven’t done that. Without the drivers properly installed, you won’t be able to use any of the methods or steps below. – Download
  2. Download Miracle Box 2.27A Cracked without box (rar password – bdjakriztek) and save it on your desktop. – Download
  3. Set your PC date to 2014.
  4. Open the Miracle box 2.27A cracked folder and run the Loader.exe as an admin.
  5. Miracle box should now load.

    [Image: bypass-frp-on-mediatek-android-devices-v...le-box.png]


  6. Click on MTK tab.

    [Image: bypass-frp-on-mediatek-android-devices-v...-box-2.png]


  7. Click on Unlock/Fix tab. Select Clear setting/FRP and then click on the Start Button at the bottom.

    [Image: 2017-06-14_10-48-46.png]
    .png
    2017-06-14_10-48-46.png
    Size: 107.04 KB / Downloads: 1


  8. You can select No/Yes in the prompt to make a backup or Skip it before resetting the FRP on your MTK device.
  9. Make sure you have a charged battery and your device is completely turned off.
  10. Connect your device via a good USB cable to your PC and the FRP will be removed/reset in a short while.

    [Image: 2017-06-14_10-57-32.png]
    .png
    2017-06-14_10-57-32.png
    Size: 108.76 KB / Downloads: 1


  11. You can now disconnect your device and power it on. You will be able to skip the forbidden step now that FRP has been successfully bypassed on your device.
How To Bypass FRP On MTK Devices Method 2
The method here involves SP Flashtool. You don’t need Miracle box or any Chinese Flashing box or whatever. You will need to download the FRP reset file for your specific device.
With this method, you can just reset the FRP on your device like a pro and all you previously had on the device will be saved.
The size of the files are mostly in kilobytes, very safe and easy to use.
To use the FRP reset files below,
  1. Install MTK VCOM Drivers too.
  2. Download SP Flashtool and unpack it to your desktop. – Download
  3. Download the FRP Reset file for your MTK device and unpack it.
  4. Open SP Flashtool and load the scatter file in the FRP Reset folder you previously unpacked.
  5. You will now see FRP partition, Preloader and userdata loaded in SP Flashtool.
  6. You can unmark the rest and leave only FRP.
  7. Make sure the download mode is set to Download Only!
  8. Click on Download in SP Flashtool and connect your MTK device while it’s completely turned off.
  9. When you see download completed, voila! You just bypassed/removed/reset FRP on your MTK device.
How To Bypass FRP On MTK Devices Method 3
I had to work this method out and it’s been used on about 5 MTK phones to be sure all is working properly. If you get PMT has changed error in SP Flashtool after trying to use the direct FRP unlock file, this one is for you.

Please make sure you follow the tutorial properly or ask questions if necessary to avoid issues. Don’t hold me responsible for your mishap.

Download the FRP reset file for your exact device model which should contain the scatter file. If you already have your device original scatter file from the firmware backup, you are good to go.

  1. Download SP Flashtool and Notepad++
  2. Install Notepad++
  3. Launch SP Flashtool and locate the scatter file inside the firmware/frp reset file folder.

    [Image: Remove-frp-on-mtk-Android-devices-via-sc...file-2.png]



  4. Click on the Format Tab
  5. Select Manual Format
  6. Locate the firmware folder, right click on the MT65xx Android scatter.txt and select Edit with Notepad++
  7. When it opens, press CTRL + F key and search for frp.
  8. Carefully note the values under linear_start_addr: and partition_size:

    [Image: 2017-09-18_10-19-19.png]
    .png
    2017-09-18_10-19-19.png
    Size: 47.71 KB / Downloads: 1


  9. Copy the value under linear_start_addr: and paste it in SP Flashtool format tab, inside Begin Address[HEX]: e.g 0x4fa0000
  10. Copy the value under partition_size: and paste it in SP Flashtool format tab, inside End Address[HEX]: e.g 0x100000
  11. Cross check properly before hitting the Start button.

    [Image: 2017-09-18_10-21-29.png]
    .png
    2017-09-18_10-21-29.png
    Size: 59.11 KB / Downloads: 3


  12. Connect your device while it’s off and allow SP Flashtool to do it’s job. You should get a Format Ok when it’s done.

    [Image: 2017-09-18_10-24-15.png]
    .png
    2017-09-18_10-24-15.png
    Size: 73.83 KB / Downloads: 5


  13. Disconnect your device and then turn it on. FRP has been removed successfully without any loss.

    https://www.youtube.com/watch?v=QEzX8m7zbc4

FRP BYPASS BONUS
 
This is a bonus tutorial on how to bypass FRP on Tecno, Infinix and other MediaTek devices . This method of fixing FRP lock doesn’t need any flashing but just installation of some APKs.

This method of bypassing FRP on MTK devices is very efficient on devices with new security patch where other FRP bypass methods doesn’t work.
  1. Turn on your MTK device, e.g Tecno W4 and connect it to a nearby Hotspot.
  2. Click on Add network
  3. In the space to enter the network SSID, type some letters, press and hold it to highlight and then tap on 3 dots that would appear at the top.
  4. Select Assist.
  5. Google App should now launch to assist you in bypassing the FRP. Now tap on the search box and enter file manager, then select file manager from the search results.
  6. Download and copy Quick Shortcut Maker to your device via a PC.
  7. Download and copy Google Account Manager for Android 5 or Google Account Manager for Android 6 base on the Android version on your MTK device to the device memory.
  8. Open the File Manager and then install Google Account Manager before the QSM-Quick Shortcut Maker APK.
  9. Open the QSM app.
  10. Scroll down to Google Account Manager and select the Google Account Manager (Type Email and Password)
  11. Click on Try
  12. A window will open with an option to enter your password. Click on the 3 dots at the top right, select Browser sign-in and click OK
  13. In the next window, enter a working Google Account Email and password, then tap on Sign-in
  14. If the email and password you entered is valid, it will sign in and then return you back to the QSM app.
  15. Restart your device and you have successfully bypassed FRP on your MTK Android device.
Note I have not tried any of these methods. I just cleaned it up and posted here because he has heaps of JavaScript tracking and url shortening that pays money. Do what you will with it, move it to another section etc.
This post was last modified: 30-06-2018, 03:25 PM by tya.
hovatek
hovatek
hovatek
Administrator
49,570
30-06-2018, 03:09 PM
#18
(30-06-2018, 02:47 PM)tya Note I have not tried any of these methods. I just cleaned it up and posted here because he has heaps of JavaScript tracking and url shortening that pays money. Do what you will with it, move it to another section etc.

Try the custom DA I attached in my previous comment with SP flash tool and let me know how it goes

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
tya
tya
tya
Junior Member
16
30-06-2018, 06:40 PM
#19
(30-06-2018, 03:09 PM)hovatek
(30-06-2018, 02:47 PM)tya Note I have not tried any of these methods. I just cleaned it up and posted here because he has heaps of JavaScript tracking and url shortening that pays money. Do what you will with it, move it to another section etc.

Try the custom DA I attached in my previous comment with SP flash tool and let me know how it goes

I think this picture describes how it went!

[Image: r8RqYqu.png]
.png
emmc_boot_1.png
Size: 43.53 KB / Downloads: 0


I was able to then backup my whole rom using this guide [Tutorial] How to use Wwr_MTK + SP Flash tool to backup Mediatek rom I did have to use WwR_MTK_2.40_Eng during the preloader stage though because WwR_MTK_v2.30 didn't show anything after preloader analysis.
EricChandler
EricChandler
EricChandler
Newbie
1
19-09-2023, 04:11 AM
#20



I also had difficulty, but in the past I was also instructed by a friend to use yowhatsapp última versión and I was able to do it.
Pages (2): Previous 1 2
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram