This is a summary of my own repair work. I am NO expert of Android. I do NOT know anything about MTK platform. It is to document my findings in the hope that it may help someone else. Sorry in advance if there is anything inaccurate/wrong. I bear no responsibility if you somehow brick your phone - in my opinion it is pretty hard to completely brick an MTK. All hyperlinks are accurate at the time of writing.
Phone
Elephone S2 Plus
MTK6735 / 5.5" 1280x720 / 2GB+16GB / Android 5.1 / Touch Panel controller: Goodix GT9157-1040
What happened?
Elephone's support to its phones is quite limited. The stock ROM shipped with this phone is dated 20150916. There's been a lot of freezes, malfunctioning - sometimes your just can't turn it off. Battery is not removable. When you managed to turn it off, restart takes forever - getting stuck on the EIB boot logo. So I decided to reflash it. Only available ROM's for this are published on Elephone's forum. Unfortunately I did not realize that ROM's for the smaller version of this phone (i.e. Elephone S2) are not compatible with this S2 Plus.
What could've happened to your phone?
Even if you haven't flashed a wrong ROM, you could face this issue if you flashed a wrong TP firmware (I hate to call it "firmware" - should be "configuration" instead).
How it is fixed
I started playing with the GtpAdbTool and found some pretty powerful features - General Config
When you come to General Config interface, click the 'Read Config' button as shown below. It prints your current TP configuration (186 bytes) from 0x8407. This is my current configuration after the fix. Note that the first byte is the version number. Second last byte is the 8-bit checksum of the first 184 bytes. I figured out that the checksum is a simple 8-bit hex checksum by trial and error. Last byte always show 0x00 but in your config file (aka TP firmware) it is always 0x01 - after the writing process last byte decrease by 1 to indicate successful writing.
The 'Read Config from /proc' button is what actually helped. Your touch panel configuration that is stored in /proc never gets changed and you can just use this to construct a config file and write it back in the main interface. But there's a big problem here - GtpAdbTool won't allow you to write any configuration with the version number lower than its current configuration. In my case, the correct configuration from /proc is 0x5C(i.e. V92) but the wrong config file from that elephone.hk forum post I flashed has a version number of 0x66(i.e. V98). As I mentioned above, you can see from the last screenshot of that elephone.hk forum post[/B] the correct TP Firmware to be flashed has the name - HF5521-GT9157-Config-20150601-1040-V92.cfg and the downloaded firmware name is S550-TWS200296-HD-GT970-v98-20150730.cfg
Now it's really simple. You just need to copy the "GT9XX config init value" (first 186 bytes only - end with 0x01) after you click "Read Config from /proc" to a text editor and update the first byte (version#) to be the same as your current config's version number (1st byte). After this, you take the first 184 bytes (i.e. without the last 2 bytes) and calculate 8-bit checksum. You can use http://www.planetimming.com/checksum8.html . You may need to copy the first 184 bytes to a text editor and remove all '0x' and replace ',' with a space - this is the required format in that checksum calculator. Use the calculated checksum to replace the second last byte and make sure last byte is 0x01. In my case, I changed the 1st byte to 0x62 and recalculated checksum to be 0x75. Construct the new config file and flash it back in the main interface. Restart your phone - ALL GOOD! I am also attaching my config file here if you don't mind a config with a version number 0x62 (while it's really 0x5C actually). If your current config version number is lower than or equal to this, you can use it directly.
Phew~~~~~~~~~~!!! Hope this helps.
Phone
Elephone S2 Plus
MTK6735 / 5.5" 1280x720 / 2GB+16GB / Android 5.1 / Touch Panel controller: Goodix GT9157-1040
What happened?
Elephone's support to its phones is quite limited. The stock ROM shipped with this phone is dated 20150916. There's been a lot of freezes, malfunctioning - sometimes your just can't turn it off. Battery is not removable. When you managed to turn it off, restart takes forever - getting stuck on the EIB boot logo. So I decided to reflash it. Only available ROM's for this are published on Elephone's forum. Unfortunately I did not realize that ROM's for the smaller version of this phone (i.e. Elephone S2) are not compatible with this S2 Plus.
- I flashed latest ROM for S2 (this is wrong like I mentioned above - not compatible with S2 Plus) with SP Flash Tool but unknowningly selected the "Format All+Download" option in SP Flash Tool - DON'T DO THIS! It wipes out IMEI/Wifi MAC/BT MAC.... Phone reboot with blank screen. :crying:
- So I flashed Elephone S2 plus_stock ROM_Android 5.1_20150619 again with "Download" only option in SP Flash Tool - it actually doesn't matter anymore as the damages have been done. By "damages" I mean - a) IMEI/Wifi MAC/BT MAC wiped out; b) Touch Panel configuration was replaced with that for S2 (my mistake in Step 1).
- Now phone restarts fine BUT touch panel coordinates are completely wrong - you hit somewhere it thinks you touched somewhere else. it feels like top half and bottom half are shifted including the 3 soft buttons. Even though the problems with NO IMEI/Wifi MAC/BT MAC are easy to fix, you can only fix them when you can actually operate the phone with its touch screen.
- So I keep the phone charging for a while and then connect my wireless mouse/keyboard via OTG cable to operate the phone. (I used a USB Doctor to test if the "dead" phone is actually charging - it is!)
- To fix missing IMEI - http://bbs.elephone.hk/thread-887-1-1.html - note if you use *#*#3646633#*#* Engineering mode to fix IMEI, the Tutorial had SIM1 and SIM2 command code reversed - in my case, it's 10 for SIM1 and 7 for SIM2.
- To fix Wifi MAC/BT MAC - http://bbs.elephone.hk/forum.php?mod=viewthread&tid=4664 - Use the SN Writer there in the post, I find other SN Writer I downloaded doesn't work with this phone - it gets stuck on META Mode.
- *I have my phone package for finding original IMEI's and my home router has a cached WIFI MAC. I don't really care about BT MAC - it may be impossible to find the original anyway but it works.
- Now I have everything back to normal except for the inoperable Touch Panel. I referred to this post on Elephone's forum guessing that such Touch Panel firmware (which stands for TouchPanel firmware - it really is just a configuration file of 186 bytes that tells the TouchPanel controller the panel's information and how to relate touches to screen coordinates) should be the cause of this problem as I may have flashed with the wrong configuration from the S2 ROM. So I went ahead and flashed that TP firmware (S550-TWS200296-HD-GT970-v98-20150730.cfg) using the GtpAdbTool link in that post. GtpAdbTool is provided by the manufacturer - Goodix provided the touch panel solutions.
- The TP firmware flash went successful BUT it didn't work. Then I looked carefully on the screenshots of that post and found that the detected chipset is GT9157-1040 which is the same as mine but the downloaded firmware's file name suggests the firmware is for a GT970 chipset (filename - S550-TWS200296-HD-GT970-v98-20150730.cfg). At the beginning I thought they might be compatible but after checking Goodix's website I found they are very different - GT970 supports 10-point multitouch whereas GT9157 supports 5-point only - they are DIFFERENT! This is how Elephone is treating their support work - making obvious mistakes and this could've caused such touch panel malfunctioning to innocent users! On a side-topic, I also found that their CWM recovery for S2 Plus is actually adopted from their P8000's CWM, it can only be used to install a zip won't work with MTK Droid Tool etc. Interestingly the last screenshot of that post did show it flashed the correct firmware with the name HF5521-GT9157-Config-20150601-1040-V92.cfg but it is nowhere to be found. Now I am quite sure what was the problem but I couldn't find the correct configuration. I was going to ask Elephone to provide that file but couldn't get in touch with them at all. I even asked in that post if they've made a mistake - no response.
What could've happened to your phone?
Even if you haven't flashed a wrong ROM, you could face this issue if you flashed a wrong TP firmware (I hate to call it "firmware" - should be "configuration" instead).
How it is fixed
I started playing with the GtpAdbTool and found some pretty powerful features - General Config
When you come to General Config interface, click the 'Read Config' button as shown below. It prints your current TP configuration (186 bytes) from 0x8407. This is my current configuration after the fix. Note that the first byte is the version number. Second last byte is the 8-bit checksum of the first 184 bytes. I figured out that the checksum is a simple 8-bit hex checksum by trial and error. Last byte always show 0x00 but in your config file (aka TP firmware) it is always 0x01 - after the writing process last byte decrease by 1 to indicate successful writing.
The 'Read Config from /proc' button is what actually helped. Your touch panel configuration that is stored in /proc never gets changed and you can just use this to construct a config file and write it back in the main interface. But there's a big problem here - GtpAdbTool won't allow you to write any configuration with the version number lower than its current configuration. In my case, the correct configuration from /proc is 0x5C(i.e. V92) but the wrong config file from that elephone.hk forum post I flashed has a version number of 0x66(i.e. V98). As I mentioned above, you can see from the last screenshot of that elephone.hk forum post[/B] the correct TP Firmware to be flashed has the name - HF5521-GT9157-Config-20150601-1040-V92.cfg and the downloaded firmware name is S550-TWS200296-HD-GT970-v98-20150730.cfg
Now it's really simple. You just need to copy the "GT9XX config init value" (first 186 bytes only - end with 0x01) after you click "Read Config from /proc" to a text editor and update the first byte (version#) to be the same as your current config's version number (1st byte). After this, you take the first 184 bytes (i.e. without the last 2 bytes) and calculate 8-bit checksum. You can use http://www.planetimming.com/checksum8.html . You may need to copy the first 184 bytes to a text editor and remove all '0x' and replace ',' with a space - this is the required format in that checksum calculator. Use the calculated checksum to replace the second last byte and make sure last byte is 0x01. In my case, I changed the 1st byte to 0x62 and recalculated checksum to be 0x75. Construct the new config file and flash it back in the main interface. Restart your phone - ALL GOOD! I am also attaching my config file here if you don't mind a config with a version number 0x62 (while it's really 0x5C actually). If your current config version number is lower than or equal to this, you can use it directly.
Phew~~~~~~~~~~!!! Hope this helps.
Last edited:
