[Guide] Dumping boot.img & recovery.img using dd (for complicated partitions)

sparksthedev

Member
Mar 18, 2016
15
15
0
Hi there! i am new to forums as well as in developing. i have recently taken interest in making cyanogenmod for my device. So, i have been searching web for hours to dump boot.img and recovery.img for my device. As my device is a mediatek device, its partitions are complicated (atleast for me :p) there are alot of guides on web dumping by dump_image, romdump, simple dd, mtk droid tool, etc. unfortunately none of them worked for me. After hours of searching on xda forums itself i found all the pieces of this puzzle.
So lets get started, as every guide says "I take no responsibility whatever happens to your device", same applies here too.
Requirements:
-My device is rooted, i am not sure whether you need rooted device or not for this procedure.
-adb with its drivers installed
-basic knowledge of linux

Procedure:
1. use "adb shell" to enter terminal mode.
2. type "cat /proc/dumchar_info". It will give some result note down for bootimg and recovery. Example for my device:

Part_Name Size StartAddr Type MapTo

bootimg 0x0000000001000000 0x0000000001d80000 2 /dev/block/mmcblk0

recovery 0x0000000001000000 0x0000000002d80000 2 /dev/block/mmcblk0

3. Convert the hexadecimal code of Size and StartAddr into decimal (you can do it online on any website as well).
Size StartAddr
16777216 30932992

16777216 47710208

4. Divide that decimal code by bs (i took 4096).
Size StartAddr
16777216/4096=4096 30932992/4096=7552

16777216/4096=4096 47710208/4096=11648

5. finally we obtained count and skip for dd (i.e. values of size is count and values of StartAddr is skip). Run dd now.

dd if=/dev/block/mmcblk0 of=/storage/sdcard1/boot.img bs=4096 count=4096 skip=7552

dd if=/dev/block/mmcblk0 of=/storage/sdcard1/recovery.img bs=4096 count=4096 skip=11648

Click Thanks! If it helped you.
 

ID10T_Error

Member
Jan 6, 2018
16
1
0
Thanks will try this guide on my MTK device after reading it again, installing android terminal on my device and staring at my lcd expecting somthing to change.

So I looked in proc but don't have dumchar_info, I do have the file partitions in proc which has the following
1|[email protected]:/proc $ cat partitions
cat partitions
major minor #blocks name

7 0 9274 loop0
254 0 469348 zram0
179 0 7634944 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 14336 mmcblk0p4
179 5 8192 mmcblk0p5
179 6 8192 mmcblk0p6
179 7 8192 mmcblk0p7
179 8 8192 mmcblk0p8
179 9 16384 mmcblk0p9
179 10 16384 mmcblk0p10
179 11 8192 mmcblk0p11
179 12 16384 mmcblk0p12
179 13 8192 mmcblk0p13
179 14 2048 mmcblk0p14
179 15 6144 mmcblk0p15
179 16 8192 mmcblk0p16
179 17 5120 mmcblk0p17
179 18 11264 mmcblk0p18
179 19 49152 mmcblk0p19
179 20 8192 mmcblk0p20
179 21 8192 mmcblk0p21
179 22 32768 mmcblk0p22
179 23 32768 mmcblk0p23
179 24 2424832 mmcblk0p24
179 25 409600 mmcblk0p25
179 26 4435968 mmcblk0p26
179 27 44032 mmcblk0p27
179 28 16384 mmcblk0p28
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
179 128 15558144 mmcblk1
179 129 16384 mmcblk1p1
179 130 15540719 mmcblk1p2
253 0 2405704 dm-0
253 1 4435968 dm-1
253 2 15540719 dm-2
[email protected]:/proc $

But i think the real file might be [email protected]:/proc $ cat wp_info
cat wp_info
Name Start Size WP_Type

pgpt 0x0000000000000000 0x0000000000800000 None

proinfo 0x0000000000800000 0x0000000000300000 None

nvram 0x0000000000b00000 0x0000000000500000 None

protect1 0x0000000001000000 0x0000000000a00000 None

protect2 0x0000000001a00000 0x0000000000e00000 None

tctpersist 0x0000000002800000 0x0000000000800000 None

simlock 0x0000000003000000 0x0000000000800000 None

para 0x0000000003800000 0x0000000000800000 None

lk 0x0000000004000000 0x0000000000800000 Power_On

boot 0x0000000004800000 0x0000000001000000 Power_On

recovery 0x0000000005800000 0x0000000001000000 None

logo 0x0000000006800000 0x0000000000800000 Power_On

expdb 0x0000000007000000 0x0000000001000000 None

seccfg 0x0000000008000000 0x0000000000800000 None

oemkeystore 0x0000000008800000 0x0000000000200000 Power_On

secro 0x0000000008a00000 0x0000000000600000 Power_On

keystore 0x0000000009000000 0x0000000000800000 Power_On

tee1 0x0000000009800000 0x0000000000500000 Power_On

tee2 0x0000000009d00000 0x0000000000b00000 Power_On

persist 0x000000000a800000 0x0000000003000000 None

efuse 0x000000000d800000 0x0000000000800000 None

frp 0x000000000e000000 0x0000000000800000 None

nvdata 0x000000000e800000 0x0000000002000000 None

metadata 0x0000000010800000 0x0000000002000000 None

system 0x0000000012800000 0x0000000094000000 Power_On

cache 0x00000000a6800000 0x0000000019000000 None

userdata 0x00000000bf800000 0x000000010ec00000 None

otp 0x00000001ce400000 0x0000000002b00000 None

flashinfo 0x00000001d0f00000 0x0000000001000000 None

sgpt 0x00000001d1f00000 0x0000000000080000 None


start End WP_Type
0x0000000004000000->0x00000000057fffff : Power_On
0x0000000006800000->0x0000000006ffffff : Power_On
0x0000000008800000->0x000000000a7fffff : Power_On
0x0000000012800000->0x00000000a67fffff : Power_On
[email protected]:/proc $ ˹ff亮鷀5豐5


Name Start Size
boot 0x0000000004800000 0x0000000001000000 Power_On
recovery 0x0000000005800000 0x0000000001000000 None

decimals start size
boot 75497472 16777216
recovery 92274688 16777216

75497472/4096 =18432 16777216/4096=4096
92274688/4096 =22528 16777216/4096=4096

So i'll try dd if=/dev/block/mmcblk0 of=/sdcard/boot.img bs=4096 count=4096 skip=18432
which results in:
dd: /dev/block/mmcblk0: Permission denied

and dd if=/dev/block/mmcblk0 of=/sdcard/boot.img bs=4096 count=4096 skip=22528
which I didn't bother trying. ok couldn't help myself, same difference.

Now looking into /dev and searching mtk dump recovery
 
Last edited:

mpoushdeh

New member
Dec 26, 2020
1
0
11
Thanks will try this guide on my MTK device after reading it again, installing android terminal on my device and staring at my lcd expecting somthing to change.

So I looked in proc but don't have dumchar_info, I do have the file partitions in proc which has the following
1|[email protected]:/proc $ cat partitions
cat partitions
major minor #blocks name

7 0 9274 loop0
254 0 469348 zram0
179 0 7634944 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 14336 mmcblk0p4
179 5 8192 mmcblk0p5
179 6 8192 mmcblk0p6
179 7 8192 mmcblk0p7
179 8 8192 mmcblk0p8
179 9 16384 mmcblk0p9
179 10 16384 mmcblk0p10
179 11 8192 mmcblk0p11
179 12 16384 mmcblk0p12
179 13 8192 mmcblk0p13
179 14 2048 mmcblk0p14
179 15 6144 mmcblk0p15
179 16 8192 mmcblk0p16
179 17 5120 mmcblk0p17
179 18 11264 mmcblk0p18
179 19 49152 mmcblk0p19
179 20 8192 mmcblk0p20
179 21 8192 mmcblk0p21
179 22 32768 mmcblk0p22
179 23 32768 mmcblk0p23
179 24 2424832 mmcblk0p24
179 25 409600 mmcblk0p25
179 26 4435968 mmcblk0p26
179 27 44032 mmcblk0p27
179 28 16384 mmcblk0p28
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
179 128 15558144 mmcblk1
179 129 16384 mmcblk1p1
179 130 15540719 mmcblk1p2
253 0 2405704 dm-0
253 1 4435968 dm-1
253 2 15540719 dm-2
[email protected]:/proc $

But i think the real file might be [email protected]:/proc $ cat wp_info
cat wp_info
Name Start Size WP_Type

pgpt 0x0000000000000000 0x0000000000800000 None

proinfo 0x0000000000800000 0x0000000000300000 None

nvram 0x0000000000b00000 0x0000000000500000 None

protect1 0x0000000001000000 0x0000000000a00000 None

protect2 0x0000000001a00000 0x0000000000e00000 None

tctpersist 0x0000000002800000 0x0000000000800000 None

simlock 0x0000000003000000 0x0000000000800000 None

para 0x0000000003800000 0x0000000000800000 None

lk 0x0000000004000000 0x0000000000800000 Power_On

boot 0x0000000004800000 0x0000000001000000 Power_On

recovery 0x0000000005800000 0x0000000001000000 None

logo 0x0000000006800000 0x0000000000800000 Power_On

expdb 0x0000000007000000 0x0000000001000000 None

seccfg 0x0000000008000000 0x0000000000800000 None

oemkeystore 0x0000000008800000 0x0000000000200000 Power_On

secro 0x0000000008a00000 0x0000000000600000 Power_On

keystore 0x0000000009000000 0x0000000000800000 Power_On

tee1 0x0000000009800000 0x0000000000500000 Power_On

tee2 0x0000000009d00000 0x0000000000b00000 Power_On

persist 0x000000000a800000 0x0000000003000000 None

efuse 0x000000000d800000 0x0000000000800000 None

frp 0x000000000e000000 0x0000000000800000 None

nvdata 0x000000000e800000 0x0000000002000000 None

metadata 0x0000000010800000 0x0000000002000000 None

system 0x0000000012800000 0x0000000094000000 Power_On

cache 0x00000000a6800000 0x0000000019000000 None

userdata 0x00000000bf800000 0x000000010ec00000 None

otp 0x00000001ce400000 0x0000000002b00000 None

flashinfo 0x00000001d0f00000 0x0000000001000000 None

sgpt 0x00000001d1f00000 0x0000000000080000 None


start End WP_Type
0x0000000004000000->0x00000000057fffff : Power_On
0x0000000006800000->0x0000000006ffffff : Power_On
0x0000000008800000->0x000000000a7fffff : Power_On
0x0000000012800000->0x00000000a67fffff : Power_On
[email protected]:/proc $ ˹ff亮鷀5豐5


Name Start Size
boot 0x0000000004800000 0x0000000001000000 Power_On
recovery 0x0000000005800000 0x0000000001000000 None

decimals start size
boot 75497472 16777216
recovery 92274688 16777216

75497472/4096 =18432 16777216/4096=4096
92274688/4096 =22528 16777216/4096=4096

So i'll try dd if=/dev/block/mmcblk0 of=/sdcard/boot.img bs=4096 count=4096 skip=18432
which results in:
dd: /dev/block/mmcblk0: Permission denied

and dd if=/dev/block/mmcblk0 of=/sdcard/boot.img bs=4096 count=4096 skip=22528
which I didn't bother trying. ok couldn't help myself, same difference.

Now looking into /dev and searching mtk dump recovery
mount -o remount rw /