[GUIDE][UTIL][MT65xx] Create Scatter File and Dump Full ROM

Search This thread
By:
Advanced…
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
i have dumped 6580 partition info but there is no preloader. instead the partinfo started at proinfo(i'll guess they change it since it is a marshmallow build and new bootloader). the partition dump is in below.
Code: 
01/06/17 11:00:59.670 BROM_DLL[9420][8328]: FlashTool_ReadPartitionCount(034DEA50): mutex: LOCK ... (FlashToolLib/host/windows/mutex.cpp:143)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(proinfo), begin_add(0x0000000000080000), len(0x0000000000300000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(nvram), begin_add(0x0000000000380000), len(0x0000000000500000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(protect1), begin_add(0x0000000000880000), len(0x0000000000A00000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(protect2), begin_add(0x0000000001280000), len(0x0000000000A00000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(seccfg), begin_add(0x0000000001C80000), len(0x0000000000040000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(lk), begin_add(0x0000000001CC0000), len(0x0000000000060000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(boot), begin_add(0x0000000001D20000), len(0x0000000001000000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(recovery), begin_add(0x0000000002D20000), len(0x0000000001000000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(para), begin_add(0x0000000003D20000), len(0x0000000000080000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(logo), begin_add(0x0000000003DA0000), len(0x0000000000800000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(expdb), begin_add(0x00000000045A0000), len(0x0000000000A00000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(frp), begin_add(0x0000000004FA0000), len(0x0000000000100000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(nvdata), begin_add(0x00000000050A0000), len(0x0000000002000000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(metadata), begin_add(0x00000000070A0000), len(0x0000000002760000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(oemkeystore), begin_add(0x0000000009800000), len(0x0000000000200000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(secro), begin_add(0x0000000009A00000), len(0x0000000000600000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(keystore), begin_add(0x000000000A000000), len(0x0000000000800000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(system), begin_add(0x000000000A800000), len(0x00000000A2800000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(cache), begin_add(0x00000000AD000000), len(0x0000000010000000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(userdata), begin_add(0x00000000BD000000), len(0x0000000113F80000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
01/06/17 11:00:59.686 BROM_DLL[9420][8328]: DEBUG: GPTReadCmd::ReadData(): Part(flashinfo), begin_add(0x00000001D0F80000), len(0x0000000001000000), part_id(8). (FlashToolLib/sv5/common/generic/src/partition_table_cmd.cpp:1130)
 
A

AlexZap

Senior Member
Feb 15, 2014
454
303
Waterbury
PAPalinskie said:
i have dumped 6580 partition info but there is no preloader. instead the partinfo started at proinfo(i'll guess they change it since it is a marshmallow build and new bootloader). the partition dump is in below.
Click to expand...
Click to collapse

the preloader is the first few k in that first partition. look at a m67xx scatter file and you will see. if you need the preloader you need to extract is it from that partition

Sent from my KFGIWI using XDA Premium 4 mobile app
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
AlexZap said:
the preloader is the first few k in that first partition. look at a m67xx scatter file and you will see. if you need the preloader you need to extract is it from that partition

Sent from my KFGIWI using XDA Premium 4 mobile app
Click to expand...
Click to collapse
i've already view the scatter file that i'm using. i want to dump full partition info of my phone first. since it is also 8Gb ROM(from its scatter, same ROM size but different partition info such as system that is 2Gb compared to my system partition that is 2.5Gb) i need the whole ROM, not just the preloader.
 
Last edited:
A

AlexZap

Senior Member
Feb 15, 2014
454
303
Waterbury
PAPalinskie said:
i've already view the scatter file that i'm using. i want to dump full partition info of my phone first. since it is also 8Gb ROM(from its scatter, same ROM size but different partition info such as system that is 2Gb compared to my system partition that is 2.5Gb) i need the whole ROM, not just the preloader.
Click to expand...
Click to collapse

does your phone have the file /proc/partinfo? if so, your phone is using the new partition layout format. you could use ADB to dump the entire rom, or if you have a scatter file for your phone, you can use sp flash tool to backup your phone.
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
AlexZap said:
does your phone have the file /proc/partinfo? if so, your phone is using the new partition layout format. you could use ADB to dump the entire rom, or if you have a scatter file for your phone, you can use sp flash tool to backup your phone.
Click to expand...
Click to collapse

the kernel doesn't have /proc/partinfo and also no luck of dumping scatter file in mtkdroidtools(because it has no partinfo in the current ROM and it didn't support 6580). also, i tried to dump scatter via miracle box(crack, without box) in preloader mode but it didn't do the job. i just want to do is to root the device by modifying boot and the recovery image and make a backup of the phone but no luck of of obtaining good scatter file for my phone.
 
A

AlexZap

Senior Member
Feb 15, 2014
454
303
Waterbury
PAPalinskie said:
the kernel doesn't have /proc/partinfo and also no luck of dumping scatter file in mtkdroidtools(because it has no partinfo in the current ROM and it didn't support 6580). also, i tried to dump scatter via miracle box(crack, without box) in preloader mode but it didn't do the job. i just want to do is to root the device by modifying boot and the recovery image and make a backup of the phone but no luck of of obtaining good scatter file for my phone.
Click to expand...
Click to collapse

does it have /proc/dumchar_info? if it does, you can probably get away with a patched mtkdrt... https://mega.nz/#!iQRA1QRJ!YyrHd49V7WCE9sNe95L5nwyECwJuhLEnRhbcRsJFaj4



Sent from my KFGIWI using XDA Premium 4 mobile app
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
AlexZap said:
what phone do you have?
Click to expand...
Click to collapse

this is only proc have and maybe this will find me a hint from adb at least.
Code: 
1
10
100
101
102
103
107
108
109
11
110
111
1113
112
1120
113
1131
114
115
116
117
12
120
121
122
123
124
125
126
1263
127
129
130
131
13168
13181
13186
132
133
134
135
136
137
13780
138
13801
139
14
140
141
142
14291
144
145
1458
146
147
1484
1490
15
1501
1509
156
157
16
161
162
166
167
16765
17025
171
17180
172
1742
176
17690
177
17733
179
17916
18
180
18085
181
18263
18569
18582
18587
186
18839
19
19010
19134
193
19312
19313
19355
194
19406
19428
19435
19438
19441
19447
19464
195
196
19618
197
19735
19769
19774
19778
19906
2
20
200
202
20291
20308
20314
20332
20359
20375
20382
20398
204
20403
20441
20494
20565
20583
20641
20683
20695
20703
20762
20769
208
209
210
211
212
213
214
216
217
218
219
22
221
222
223
224
225
227
228
229
23
230
232
233
235
236
237
238
239
24
240
241
242
246
248
25
250
251
26
27
28
29
3
30
31
32
3295
33
34
35
36
37
371
372
374
38
39
40
41
410
411
42
43
44
45
46
47
48
49
5
51
52
53
54
543
6482
6686
6688
68
69
6981
7
7245
7431
8
86
87
88
89
9
90
900
92
93
94
95
96
97
98
99
aed
asound
batdrv_log
boot_mode
bootprof
buddyinfo
bus
cgroups
chip
class
clkmgr
cmdline
cmdq_test
consoles
cpu
cpufreq
cpuinfo
crypto
device-tree
devices
diskstats
driver
execdomains
fb
fgadc_log
filesystems
fm
freqhopping
fs
ged
gpufreq
hps
interrupts
iomem
ioports
irq
kallsyms
kmsg
kpagecount
kpageflags
kpageswapn
last_kmsg
lk_env
loadavg
locks
m4u
meminfo
misc
mlog
mlog_fmt
mounts
mrdump_rst
msdc_FT
msdc_debug
msdc_help
msdc_tune
msdc_tune_flag
mt-auxadc
mt_pmic
mt_power_gs
mt_xgpt
mtd
mtk_battery_cmd
mtk_cmdq
mtk_cmdq_debug
mtk_mira
mtk_sched
mtkcooler
mtktz
mtprintk
mtprof
net
pagetypeinfo
partitions
perfmgr
pm_init
pm_init
ptp
rid
sched_debug
schedstat
scsi
self
softirqs
stat
swaps
sys
sysram
sysram_flag
sysrq-trigger
tasks_all
tasks_rq
thermlmt
thread-self
timer_list
tty
uid_cputime
uid_stat
uptime
version
vmallocinfo
vmstat
wdk
wmt_tm
xlog
zoneinfo
zraminfo
numbers at the top are suspected to be a folder so maybe a bin name below is the partinfo. mtk marshmallow roms are more difficult to root. also, cant enter dev or debug folder because of permission.
 
Last edited:
A

AlexZap

Senior Member
Feb 15, 2014
454
303
Waterbury
PAPalinskie said:
this is only proc have and maybe this will find me a hint from adb at least.

numbers at the top are suspected to be a folder so maybe a bin name below is the partinfo. mtk marshmallow roms are more difficult to root. also, cant enter dev or debug folder because of permission.
Click to expand...
Click to collapse

all the number folders are for individual processes... so they are a nonstarter. check out "partitions".
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
AlexZap said:
all the number folders are for individual processes... so they are a nonstarter. check out "partitions".
Click to expand...
Click to collapse

these are only in the partition table(i excluded mmcblk1)
Code: 
major minor  #blocks  name

 7          0            1254 loop0
 7          1          32768 loop1
 254      0        491456 zram0
 179      0      7634944 mmcblk0
 179      1            3072 mmcblk0p1
 179      2            5120 mmcblk0p2
 179      3          10240 mmcblk0p3
 179      4          10240 mmcblk0p4
 179      5              256 mmcblk0p5
 179      6              384 mmcblk0p6
 179      7          16384 mmcblk0p7
 179      8          16384 mmcblk0p8
 179      9              512 mmcblk0p9
 179     10           8192 mmcblk0p10
 179     11         10240 mmcblk0p11
 179     12           1024 mmcblk0p12
 179     13         32768 mmcblk0p13
 179     14         40320 mmcblk0p14
 179     15           2048 mmcblk0p15
 179     16           6144 mmcblk0p16
 179     17           8192 mmcblk0p17
 179     18     2662400 mmcblk0p18
 179     19         62144 mmcblk0p19
 179     20     4521472 mmcblk0p20
 179     21         16384 mmcblk0p21
 179     96             512 mmcblk0rpmb
 179     64           4096 mmcblk0boot1
 179     32           4096 mmcblk0boot0
The largest partition seems to be my userdata and the second to the highest will be my system partition. if the part map is converted to hex easily, this will show a scatter map instead. but due to new partition map implemented on marshmallow, it is difficult to know what partition i am dumping.
 
A

AlexZap

Senior Member
Feb 15, 2014
454
303
Waterbury
PAPalinskie said:
these are only in the partition table(i excluded mmcblk1)

The largest partition seems to be my userdata and the second to the highest will be my system partition. if the part map is converted to hex easily, this will show a scatter map instead. but due to new partition map implemented on marshmallow, it is difficult to know what partition i am dumping.
Click to expand...
Click to collapse

you can correlate partitions to names by looking in /dev/block/ and the subdirectories there. tho you cant access therm without root. but with this, you have sizes (# blocks * 512), and you can figure out names. now you can probably create a scatter file and dump the rom with sp flash tool. just find a scatter file for another 6580 device and modify it to have your sizes.
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
AlexZap said:
you can correlate partitions to names by looking in /dev/block/ and the subdirectories there. tho you cant access therm without root. but with this, you have sizes (# blocks * 512), and you can figure out names. now you can probably create a scatter file and dump the rom with sp flash tool. just find a scatter file for another 6580 device and modify it to have your sizes.
Click to expand...
Click to collapse

so, i should start at mmcblk0p3 instead? there is a chances that this preloader is larger than 10Mb(based on my previous dumps of MTK 64bit ROMS and didn't try to dump 32bit mt6580 yet). and the 512 will be my ebr and mbr as is? i already have a 6580 scatter file(doogee x5) so guessing where is the right partition will be the biggest guessing game here because this is the newest partition map created to freak ROM dumpers.
 
vinokirk

vinokirk

Senior Member
Mar 30, 2008
2,249
247
England
PAPalinskie said:
this is only proc have and maybe this will find me a hint from adb at least.
numbers at the top are suspected to be a folder so maybe a bin name below is the partinfo. mtk marshmallow roms are more difficult to root. also, cant enter dev or debug folder because of permission.
Click to expand...
Click to collapse

Have you tried to get a scatter file from a MTK6580 device? I am trying to root a Lenovo A1010a20 (Lenovo A Plus), and in the process tryoing to create a scxatter file with MTK Droid Tools 2.5.3, but the 'Create scatter file' button is greyed out
 
Last edited:
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
vinokirk said:
Have you tried to get a scatter file from a MTK6580 device? I am trying to root a Lenovo A1010a20 (Lenovo A Plus), and in the process tryoing to create a scxatter file with MTK Droid Tools 2.5.3, but the 'Create scatter file' button is greyed out
Click to expand...
Click to collapse

actually, i found a better solution to dump scatter file and the whole ROM. you should try cracked miracle box software. well, it didn't require the dongle itself to run the software.
 
vinokirk

vinokirk

Senior Member
Mar 30, 2008
2,249
247
England
PAPalinskie said:
actually, i found a better solution to dump scatter file and the whole ROM. you should try cracked miracle box software. well, it didn't require the dongle itself to run the software.
Click to expand...
Click to collapse
Thanks for the reply :)
So you just ran the software without the box?
Did you connect via a regular USB cable to the phone?
Do you have any experience in rooting Android 5.1 on an MTK 6580?
 
PAPalinskie

PAPalinskie

Senior Member
Jun 23, 2013
204
22
Cavite
Xiaomi Poco X3 NFC
@bilyx1 do you use a similar device like walton or intex? I think the problem here is... I am not sure if we have a same partition blocks. Creating scatter file is an easy task but too risky. As of i said earlier, you should try a cracked miracle box software in making scatter files and it does not require the box to operate.
 
A

AbdulMajid11

Member
Sep 13, 2018
24
1
techin.review
Building a scatter file from scratch using Wwr_MTK tool (For both old and new MTK )

Requirements
Download Wwr_MTK
Download SP Flash tool
Download a scatter file for the Mediatek phone's chipset (e.g MT****_Android_scatter)
Notepad++ (Download @ https://notepad-plus-plus.org/ )
Procedure

Wwr_MTK is a tool for backing up Mediatek Android phones (in scatter format) without root. The tool (in hand with SP Flash Tool) is able to read the phone's partition table then use that information to create a scatter file. To get a scatter file:
Follow this guide to do a full rom dump which will then contain the scatter file
Another alternative is to follow this guide to get the start and end addresses for each partition which you can then input into a scatter file for your phone model
 
  • Like
Reactions: nl12439
You must log in or register to reply here.

Similar threads

B
[UTIL][WIN][MT65xx] MTK Droid Root & Tools | MediaTek Android Smartphone
Replies
2K
Views
3M
A
allyalla
Snoop05
[OFFICIAL][TOOL][WINDOWS] ADB, Fastboot and Drivers - 15 seconds ADB Installer v1.4.3
Replies
2K
Views
7M
abdulkareem786
abdulkareem786
frigid
[UTIL][WIN][01/04] ACS HTC Super Tool v3
Replies
1K
Views
1M
mrrocketdog
mrrocketdog
shimp208
[TOOL]Minimal ADB and Fastboot [2-9-18]
Replies
982
Views
5M
sinommo
sinommo
fonehacker
[Tool][AIO]Universal Android Flasher v1.40 b (ROM-dump,adb,Fastboot,build.prop,etc.)
Replies
258
Views
702K
ChaoticCapriquarius
ChaoticCapriquarius

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 34
    syserr
    syserr
    [GUIDE][UTIL][MT65xx] Create Scatter File / Dump Full ROM
    For any MT65xx device, no matter how obscure.


    I will discuss a method for:
    * making your own SPFT scatter file
    * dumping your entire ROM (without root)
    * dicing up your entire ROM into partition blocks

    This is somewhat of a manual process. rua1's MTK Droid Root & Tools circumvents the need for doing most of this. I applaude his work, it's a big undertaking and he supports it well.

    Here are a few reasons to use the method I discuss here:
    * you want a ROM dump without rooting
    * you want a ROM dump without your OS booted (clone cold system is safe)
    * you want a guaranteed way to restore exactly current state (safety and return to store)
    * you are just plain worried something will go wrong

    -------------------------------------

    I have two methods for creating a scatter file.

    Method #1
    Find your scatter information in SP Flash Tool's Logs

    Well first, you have to make SP Flash Tool happy enough to give you some information about your device.

    * Obtain a SPFT ROM that is known good for any phone/tablet, preferrably with the same chip as yours. Make sure that scatter file loads into SPFT without error, SPFT checks the PRELOADER and DSP_BL and if they aren't in the scatter directory, it will fail and maybe crash.

    * Close SPFT, now modify the MT*scatter.txt file and introduce a few errors in the partition names, but don't change PRELOADER or DSP_BL. An example, instead of "ANDROID" replace it with "DEADBEEF". You ask why? Well you want to make SURE that the "Download" feature fails. You DON'T want the "Download" to actually work and write your random SPFT ROM to your new device. After loading the freshly broken scatter file, click "Download" and hook up your MTK device in preloader / META Mode. It will say your PMT block does not match the scatter file. ERROR:

    * Go to SPFT's menu "Help / Open logs folder" and find the latest date. Open the BROM_DLL*.log in your text editor. Search for text that looks like this, I'd first search for "CMD_ReadPartitionInfo():

    Code: 
    11/14/13 09:01:27.382 BROM_DLL[3836][2208]: DA_cmd::CMD_ReadPartitionInfo(): command is allowed. (FlashToolLib/sv5/common/generic/src/da_c
md.cpp:5242)
11/14/13 09:01:27.382 BROM_DLL[3836][2208]: DA_cmd::CMD_ReadPartitionInfo(): getting 20 partitions .. (FlashToolLib/sv5/common/generic/src
/da_cmd.cpp:5269)
11/14/13 09:01:27.397 BROM_DLL[3836][2208]: DA_cmd::CMD_ReadPartitionInfo(): dump 20 partitions (FlashToolLib/sv5/common/generic/src/da_cm
d.cpp:5279)
11/14/13 09:01:27.397 BROM_DLL[3836][2208]: PART[0 ](PRELOADER     ) - offset (0x0000000000000000) - size (0x0000000000040000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.397 BROM_DLL[3836][2208]: PART[1 ](DSP_BL        ) - offset (0x0000000000040000) - size (0x00000000005C0000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.397 BROM_DLL[3836][2208]: PART[2 ](MBR           ) - offset (0x0000000000600000) - size (0x0000000000004000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[3 ](EBR1          ) - offset (0x0000000000604000) - size (0x000000000005C000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[4 ](__NODL_PMT    ) - offset (0x0000000000660000) - size (0x0000000000400000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[5 ](__NODL_NVRAM  ) - offset (0x0000000000A60000) - size (0x0000000000300000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[6 ](__NODL_SECCFG ) - offset (0x0000000000D60000) - size (0x0000000000020000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[7 ](UBOOT         ) - offset (0x0000000000D80000) - size (0x0000000000060000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[8 ](BOOTIMG       ) - offset (0x0000000000DE0000) - size (0x0000000000600000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[9 ](RECOVERY      ) - offset (0x00000000013E0000) - size (0x0000000000600000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[10](SEC_RO        ) - offset (0x00000000019E0000) - size (0x0000000000600000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[11](__NODL_MISC   ) - offset (0x0000000001FE0000) - size (0x0000000000060000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[12](LOGO          ) - offset (0x0000000002040000) - size (0x0000000000300000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[13](__NODL_EXPDB  ) - offset (0x0000000002340000) - size (0x00000000000A0000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[14](EBR2          ) - offset (0x00000000023E0000) - size (0x0000000000004000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[15](FAC           ) - offset (0x00000000023E4000) - size (0x0000000010000000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[16](ANDROID       ) - offset (0x00000000123E4000) - size (0x0000000020100000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[17](CACHE         ) - offset (0x00000000324E4000) - size (0x0000000020100000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[18](USRDATA       ) - offset (0x00000000525E4000) - size (0x0000000020100000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
11/14/13 09:01:27.413 BROM_DLL[3836][2208]: PART[19](FAT           ) - offset (0x00000000726E4000) - size (0x0000000000000000) - mask (0x0
000000000000000) (FlashToolLib/sv5/common/generic/src/da_cmd.cpp:5283)
    Make sure you aren't looking at a dump of your scatter, but looking at the partition dump from your device. (If it contains DEADBEEF flag from above, you are looking at the wrong part of the log.) You can manually create a scatter file from that, or you can paste the lines with partition info into a text file and run this shell script:

    Code: 
    cat pastedlog.txt | sed -n 's/.*](\([^ ]*\)[^(]*(\([^)]*\).*)/\1 \2\n{\n}/p' | sed 's/x00000000/x/g' > mynewscatter.txt

    This will get you really close, but the last entry you see in a typical scatter file is BMTPOOL. I don't know much about BMTPOOL or __NODL_BMPPOOL other than it's not a real partition. It might not even be required? (You might be able to fake that entry if you look at similar scatter files. If not, read on)

    Method #2
    An alternate and supplemental way of getting scatter info is to use ADB on a running device. I'm sure this is similar to MTK Droid Root & Tools method.

    Code: 
    adb pull /proc/dumchar_info

    Now that you have that file local on your PC, you can run this python script:

    Code: 
    import sys
import string
import re

ins = open( "dumchar.txt", "rb" )
outs = open( "scatter.txt", "wb" )
for line in ins:
    linesp = re.split('\W+', line)
    name = linesp[0].upper()
    start = int(linesp[2],16)
    block = linesp[5]
    if block != 'misc':
        start = start + 0x600000
    outs.write(name + " " + string.replace(hex(start), "L", "") + "\n{\n}\n")
ins.close()
outs.close()

    This method gives you the BMTPOOL entry that the other method does not, but it lacks the __NODL_ designator for all partitions. If you aren't familiar with that prefix, SPFT uses that to know if it should typically allow you to DownLoad over the top of the paritition.

    With both scatter files, throw them side-by-side in a text editor (or diff tool) and with a brain, it's easy enough to merge one with the __NODL_ prefix and the one with the BMTPOOL entry.

    Scatter file complete!

    PS - Possibly another way, is to use SPFT to do a "Read back" (read memory) at 0x660000 of size 0x400000. Save this as the PMT block and analyse it with a hex editor. I believe the PMT block is always at address 0x66000 judging from a dozen different scatter files.

    Dump Full ROM
    Perfect Total Backup of your Firmware

    The safe way to do this with or without a proper scatter file is the "Read back" feature of SP Flash Tool. There are MANY reasons to dislike MediaTek, but this feature is so nice that I can forgive them for most of their wrong doing.

    Most of this section I will generalize from my Lenovo A2107A Guide.

    Here is a cookbook for doing a total backup of your MTK device with MediaTek's SP Flash Tool. No rooting, you might even do this before you ever boot! I have basically done this with both of my devices before I fiddled too much. I recommend doing it before you do anything really.

    1. Install VCOM Drivers.
    2. Install SP Flash Tool.
    3. Grab an SPFT ROM, really anything should work, you just have to make SP Flash Tool happy. SPFT validates the scatter file against some of the image files, so you have to calm SPFT down by giving it something it can make sense of. We won't use the scatter file or image files while we do the "Read back" operation.
    4. Run SP Flash Tool, Open Scatter File
    5. Don't play with anything, go into the "Read back" tab (This will read your flash to a file on your PC)
    6. Click on any items in the list, then click the "Remove" button
    7. Now click the "Add" button
    8. Double click on the "N/A" under Read Flag
    9. Type a file name to write to, like "WHOLE_ROM"
    10. Now it will popup a window "Readback block start address"
    11. Leave "Hex" selected, Start Address" 0x0000, Length: 0x40000000, Click OK (NOTE: this will get the first GIG of flash)
    12. Click the "Read back" button
    13. SPFT now waits for you to connect your device and put it in Meta Mode
    14. Without plugging your phone/tablet in, tap the Reset Button or make sure it's fully off
    15. Hold VolUp, plug in USB, Release VolUp (putting it in Meta Mode) <--- Important
    16. You will see the progress bar moving. Total backup takes forever, because in this mode SPFT seems to not do USB HIGHSPEED
    That's IT! It'll take a few hours, so go to bed.

    If you ever restore, just go into Recovery and Wipe Data and Cache. (as these are large and we probably didn't back them up above)

    Note: "Length" in Step 11 is probably long enough for most devices. You can reference the scatter file you made above to make sure get everything, but you don't need USRDATA or CACHE, as those get wiped anyway.


    Dicing up Full ROM image into partition images


    I've made a little bash shell script to dice up a whole ROM according to a scatter file. This creates files exactly the size of the partitions. Some post processing needs done below the script:

    dice.sh
    Code: 
    #!/bin/bash

scatterfile=$1
rom=$2
pdir=raw.partitions

rm -rf $pdir
mkdir $pdir

cat $scatterfile | grep "x" | while read line; do
    name=$(echo $line | sed 's/ .*//g')
    name=$(echo $name | sed 's/^__NODL_//g')
    start=$(echo $line | sed 's/.* //g')
#    echo $name

    if [[ -n $last_name ]]; then
	echo "Processing: $last_name"
	echo "     start: $last_start"
	size=$(( $start - $last_start ))
	if [[ $size -lt 0 ]]; then
	    size=0xFFFFF000
	else
	    size=0x$(echo "obase=16; $size" | bc)
	fi
	echo "      size: $size"
	short_start=$(echo $last_start | sed 's/000$//g')
	short_size=$(echo $size | sed 's/000$//g')
	echo dd if=$rom of=$pdir/$last_name bs=$(( 0x1000 )) \
	    skip=$(( $short_start )) count=$(( $short_size ))
	dd if=$rom of=$pdir/$last_name bs=$(( 0x1000 )) \
	    skip=$(( $short_start )) count=$(( $short_size ))
    fi

    last_name=$name
    last_start=$start
done

    Now there is some post processing done. Truncate MBR, EBR1, EBR2 to 512 bytes. And remove trailing bytes of 0000 or FFFF on the end of PRELOADER and DSP_BL.

    Here is a one off script for example use:

    clean.sh
    Code: 
    #!/bin/bash

pdir=raw.partitions
odir=out

rm -rf $odir
mkdir $odir

dd if=$pdir/PRELOADER of=$odir/preloader.bin bs=$(( 0x800 )) skip=1
./trim.sh $odir/preloader.bin
./trimFF.sh $odir/preloader.bin

dd if=$pdir/DSP_BL of=$odir/DSP_BL bs=$(( 0x8000 )) count=1
./trimFF.sh $odir/DSP_BL

dd if=$pdir/MBR of=$odir/MBR bs=512 count=1
dd if=$pdir/EBR1 of=$odir/EBR1 bs=512 count=1
dd if=$pdir/EBR2 of=$odir/EBR2 bs=512 count=1

cp $pdir/UBOOT $odir/uboot.bin

cp $pdir/LOGO $odir/logo.bin
./trim.sh $odir/logo.bin

cp $pdir/SEC_RO $odir/secro.img

cp $pdir/RECOVERY $odir/recovery.img

cp $pdir/BOOTIMG $odir/boot.img

cp $pdir/FAC $odir/fac.img

cp $pdir/ANDROID $odir/system.img

cp MT*.txt $odir/

    And quickly, Here is my hack to remove 0000 and FFFF from the end of files:

    trim.sh
    Code: 
    #!/bin/bash
truncate -s $(( 4 + $(cat $1 | hexdump -v -e '/4 "%_ad: " ' -e '4/1 "%02X" "\n"' \
 | grep -v ": 00000000" | tail -n 1 | sed 's/:.*//') )) $1
    trimFF.sh
    Code: 
    #!/bin/bash
truncate -s $(( 4 + $(cat $1 | hexdump -v -e '/4 "%_ad: " ' -e '4/1 "%02X" "\n"' \
 | grep -v ": FFFFFFFF" | tail -n 1 | sed 's/:.*//') )) $1

    You should be able to read the clean.sh script and figure out only in just those few cases, is special post processing needed. If you don't post process, SPFT will give errors.

    I hope this helps. If you have any questions, ask... I'll try to clarify this first post.
    View
    6
    A
    AlexZap
    Hey, Syserr,
    this thread is great and it has given me great inspiration. as you may or may not know, the new mediatek SoC's do not have an easy way of extracting a scatter file. there is no dumchar_info file. i am sure your other methods would work to do it (via sp flash tool), but this is a pain if you want to do a simple backup. so i took your dice.sh script and re-wrote it work with a different file: /proc/partinfo. all phones should have this, as it is really a base part of linux. i cant see anyone disabling this in a kernel build. i think too much relies on it. anyway, if you want to check it out, it is attached. this is my method:

    pull the partinfo file:
    Code: 
    adb shell cat /proc/partinfo>partinfo.txt
    dump the rom (without sp flash tool)
    Code: 
    adb forward tcp:5555 tcp:5555
adb shell su -c "nc -l -p $netcat_port -e dd if=/dev/block/mmcblk0" &
nc 5555 127.0.0.1 |pv -i 0.5 >rom.img
    run the script
    Code: 
    dice.sh partinfo.txt rom.img

    should run on both old and new mtk SoC's. more work to be done because it is dumping everything. and there is no scatter file... but i am working on all of that. just thought you might find it interesting.
    View
    5
    M
    Miss Montage
    New versions of the SP Flash (from 5.1548) also allow to dice the ROM directly during the Readback. You need to modify the line "ShowByScatter=false" in file option.ini to "ShowByScatter=true".
    The files will be dumped as ROM_0, ROM_1, ROM_2 etc.
    Also it might occur that "userdata" is not listed, in case you want to save an image you need to add it manually.
    View
    4
    K
    kenny108
    Script for newer MTK chipsets

    With the newer MTK chipsets the format of the scatter file is very different and I've made a shell script to work with those. Find it in the Alcatel Pixi thread.
    :)

    Edit: Be very careful with flashing back the extracted preloader...people have reported bricked phones by flashing the wrong preloader. The extracted preloader must be edited first. There are 0x800 bytes at the start that must be removed, and extra bytes at the end (either 0x00 or 0xFF) that should also be removed. See post#1 for ideas and scripts (clean, trim, and trimFF) on how to do this.
    View
    2
    syserr
    syserr
    fragargon said:
    hi syserr,

    i m tryin to run the script dice.sh and this is the trace i get

    Code: 
    kiko@maconzalez ~/TESTbcup $ sh -x ./dice.sh
+ 
: not found2: ./dice.sh: 
+ scatterfile=
+ rom=
+ pdir=raw.partitions
+ 
: not found6: ./dice.sh: 
+ rm -rf raw.partitions
+ mkdir raw.partitions
+ 
: not found9: ./dice.sh: 
./dice.sh: 37: ./dice.sh: Syntax error: end of file unexpected (expecting "then")
kiko@maconzalez ~/TESTbcup $

    any advice would be welcome. I dumb a complete rom and try to dice it.

    thank you syserr
    Click to expand...
    Click to collapse

    Sorry Sorry Sorry. It takes 2 arguments, I should do some error checking and make sure the user supplies them.

    Code: 
    ./dice.sh scatterfile.txt FULLROM.img
    It might have some syntax that is specific to bash, so "sh" might throw errors too.
    View

New posts