[GUIDE] How to root MediaTek-based AB partition schemed Nokia Android Phones

Search This thread

hikari_calyx

Senior Member
Note: This guide requires polishment, will do that soon.

Unlike the previous root guide written for Nokia 7 Plus, this guide requires to use MTK SP Flash Tool to dump stock boot.

Why I suddenly release this guide? Because I found the method to unlock the bootloader for Nokia X5 / 5.1 Plus, but the unlock guide is unsuitable to disclose here right now. Check my Twitter if you want to confirm. To apply this guide, you must have your phone bootloader unlocked. So in theory this guide will also work on Nokia 3.1, 3.1 Plus and 5.1 once stock firmware released.

Since it's a MediaTek-based device, you can easily dump the stock boot from your device by reading the partition table of scatter file.

Now let's begin.

Step 1: Check which slot is your phone currently using

You have few methods to check, but let me introduce two usually used methods. Pick one of them that you're familiar with.

1. Use USB Debugging method to check

Once you enable the USB debugging, execute following command in either terminal or command prompt. I assume you have installed Android Platform Tools.

Code:
.\adb shell getprop ro.boot.slot_suffix

Expected output would be either
Code:
[ro.boot.slot_suffix]: [_a]
Or:
Code:
[ro.boot.slot_suffix]: [_b]

2. Use Fastboot command to check

Same as above, I assume you have installed Android Platform Tools and you have enabled USB debugging.

Code:
.\adb reboot bootloader
Code:
.\fastboot getvar current-slot

Expected output would be either
Code:
current-slot: a
Or:
Code:
current-slot: b

Step 2: Dump your stock boot with MTK SP Flash Tool

If you already have stock boot extracted from stock firmware, skip this step, just copy the boot.img from stock firmware to the phone.

I assume that you already have MTK Port driver installed properly.

Check the MT6xxx_Android_scatter.txt from the stock firmware, and find either "boot_a" or "boot_b" on the whole text.

In this case, I used Nokia X5 CN PDA-0-102A-MT6771_Android_scatter.txt, and you'll find following info:

Code:
- partition_index: SYS34
  partition_name: boot_a
  file_name: PDA-0-102A-00CN-boot.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x22a00000
  physical_start_addr: 0x22a00000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

Code:
- partition_index: SYS52
  partition_name: boot_b
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0xf4200000
  physical_start_addr: 0xf4200000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

Please write down the linear_start_addr and partition_size of your stock boot in your current active slot.
For example, if your current slot is B, then you need to use the start address and size of boot_b, which is started from 0xf4200000 and the length is 0x2000000.
You know what to use if your current slot is A, right?

Open MTK SP Flash Tool, load the Download Agent file and scatter file from the extracted stock firmware (older than your current firmware is OK).
Then switch to Readback tab.

Add a readback info, double click that, find a suitable location and save it as "PDA-XXXX-stock_boot.img" (depends on your current firmware revision, e.g. PDA-114A-stock_boot.img)

In this case, we need to dump stock boot from boot_b, now type 0xf4200000 in start address text box and 0x2000000 in length box.

After these info are typed, click OK, Readback - now connect your powered off phone with both volume keys pressed.
After readback OK popped up, close SP Flash Tool, disconnect your phone and power it on again.

Part 3: Patch this boot image

Download and install latest Magisk Manager from https://github.com/topjohnwu/Magisk/releases
Copy the stock boot to the Download directory of internal storage, then tap "Install" - "Install" - "Patch Boot Image", choose "PDA-XXXX-stock_boot.img" you just copied to the phone.
Now you need to wait 1-2 minutes for finish patched boot image.

Pull it out from your phone once finished:
Code:
.\adb pull /storage/emulated/0/Download/magisk_patched.img D:\PDA-XXXX-patched_boot.img

Part 4: Flash boot image
Unlike Qualcomm-based models, we can't perform temporarily boot.
Luckily, we have stock boot already, you should know what to do if you want to go back to stock.

Here's how:

Reboot to fastboot mode with your familiar method:
Code:
.\adb reboot bootloader

Flash patched boot with this command:
Code:
.\fastboot flash boot_(currentslot) D:\PDA-XXXX-patched_boot.img

Example:
Code:
.\fastboot flash boot_b D:\PDA-114A-patched_boot.img

Then reboot your phone:
Code:
.\fastboot reboot

Now all done. Enjoy your rooted Nokia X5 / 5.1 Plus.

Part 5: How to make OTA available with only your phone?

When a newer update released, you can follow this guide to install new updates and inherit root permission with OTA updates: https://github.com/topjohnwu/Magisk/blob/master/docs/tutorials.md
 
Last edited:

hoangkyo555

Member
Apr 12, 2018
11
1
Unlike the previous root guide written for Nokia 7 Plus, this guide requires to use MTK SP Flash Tool to dump stock boot.

Why I suddenly release this guide? Because I found the method to unlock the bootloader for Nokia X5 / 5.1 Plus, but the unlock guide is unsuitable to disclose here right now. Check my Twitter if you want to confirm. To apply this guide, you must have your phone bootloader unlocked. So in theory this guide will also work on Nokia 3.1, 3.1 Plus and 5.1 once stock firmware released.

Since it's a MediaTek-based device, you can easily dump the stock boot from your device by reading the partition table of scatter file.

Now let's begin.

Step 1: Check which slot is your phone currently using

You have few methods to check, but let me introduce two usually used methods. Pick one of them that you're familiar with.

1. Use USB Debugging method to check

Once you enable the USB debugging, execute following command in either terminal or command prompt. I assume you have installed Android Platform Tools.

Code:
.\adb shell getprop ro.boot.slot_suffix

Expected output would be either
Code:
[ro.boot.slot_suffix]: [_a]
Or:
Code:
[ro.boot.slot_suffix]: [_b]

2. Use Fastboot command to check

Same as above, I assume you have installed Android Platform Tools and you have enabled USB debugging.

Code:
.\adb reboot bootloader
Code:
.\fastboot getvar current-slot

Expected output would be either
Code:
current-slot: a
Or:
Code:
current-slot: b

Step 2: Dump your stock boot with MTK SP Flash Tool

I assume that you already have MTK Port driver installed properly.

Check the MT6xxx_Android_scatter.txt from the stock firmware, and find either "boot_a" or "boot_b" on the whole text.

In this case, I used Nokia X5 CN PDA-0-102A-MT6771_Android_scatter.txt, and you'll find following info:

Code:
- partition_index: SYS34
  partition_name: boot_a
  file_name: PDA-0-102A-00CN-boot.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x22a00000
  physical_start_addr: 0x22a00000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

Code:
- partition_index: SYS52
  partition_name: boot_b
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0xf4200000
  physical_start_addr: 0xf4200000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

Please write down the linear_start_addr and partition_size of your stock boot in your current active slot.
For example, if your current slot is B, then you need to use the start address and size of boot_b, which is started from 0xf4200000 and the length is 0x2000000.
You know what to use if your current slot is A, right?

Open MTK SP Flash Tool, load the Download Agent file and scatter file from the extracted stock firmware (older than your current firmware is OK).
Then switch to Readback tab.

Add a readback info, double click that, find a suitable location and save it as "PDA-XXXX-stock_boot.img" (depends on your current firmware revision, e.g. PDA-114A-stock_boot.img)

In this case, we need to dump stock boot from boot_b, now type 0xf4200000 in start address text box and 0x2000000 in length box.

After these info are typed, click OK, Readback - now connect your powered off phone with both volume keys pressed.
After readback OK popped up, close SP Flash Tool, disconnect your phone and power it on again.

Part 3: Patch this boot image

Download and install latest Magisk Manager from https://github.com/topjohnwu/Magisk/releases
Copy the stock boot to the Download directory of internal storage, then tap "Install" - "Install" - "Patch Boot Image", choose "PDA-XXXX-stock_boot.img" you just copied to the phone.
Now you need to wait 1-2 minutes for finish patched boot image.

Pull it out from your phone once finished:
Code:
.\adb pull /storage/emulated/0/Download/patched_boot.img D:\PDA-XXXX-patched_boot.img

Part 4: Flash boot image
Unlike Qualcomm-based models, we can't perform temporarily boot.
Luckily, we have stock boot already, you should know what to do if you want to go back to stock.

Here's how:

Reboot to fastboot mode with your familiar method:
Code:
.\adb reboot bootloader

Flash patched boot with this command:
Code:
.\fastboot flash boot_(currentslot) D:\PDA-XXXX-patched_boot.img

Example:
Code:
.\fastboot flash boot_b D:\PDA-114A-patched_boot.img

Then reboot your phone:
Code:
.\fastboot reboot

Now all done. Enjoy your rooted Nokia X5 / 5.1 Plus.

Part 5: How to make OTA available with only your phone?

Execute following command under either ADB shell or terminal emulator:
Code:
$ su
(Confim Root permission on your phone)
# dd if=/storage/emulated/0/Download/PDA-XXXX-stock_boot.img of=/dev/block/bootdevice/by-name/boot_(yourcurrentslot)

e.g.
Code:
# dd if=/storage/emulated/0/Download/PDA-114A-stock_boot.img of=/dev/block/bootdevice/by-name/boot_b

Then open Magisk Manager and reinstall Magisk directly.
Now when a newer update released, you can follow this guide to install new updates and inherit root permission with OTA updates: https://github.com/topjohnwu/Magisk/blob/master/docs/tutorials.md

This is the root way, do not need to unlock the bootloader ???
 

Kenway10

Member
Jul 28, 2016
5
0
Unlock Bootloader

Hey, Bruh how to unlock bootloader

its quite simple on pie (atleast thats where i have tested and worked it out)
just boot into fastboot mode and type in cmd

fastboot flashing unlock

that should do the trick (atleast that did for mr)

---------- Post added at 08:39 PM ---------- Previous post was at 08:37 PM ----------

This is the root way, do not need to unlock the bootloader ???

Then how you gonna flash that patched boot image (if bootloader is locked you can't flash ****)

---------- Post added at 08:59 PM ---------- Previous post was at 08:39 PM ----------

can someone help me with scatterfile for TA-1105??
 

bigrammy

Senior Member
Apr 8, 2011
2,946
2,572
huddersfield
Recovery Partition

Hi @hikari_calyx

I have just received the Nokia 3.1 Plus (mt6765/2) which uses this AB Partition Scheme which is totally new to me. :rolleyes:
Looking at the scatter.txt I can not see "Recovery" anywhere.
Did Nokia remove it or rename it maybe like Sony do (fotakernel = Recovery) ?
I would like to get TWRP on this device if that's possible.
I am still on the stock shipped out of the box 8.1.0 firmware version at moment. :fingers-crossed:

Thanks Again for your Great Work on these Nokia's :highfive:
 

BarrackaN

Member
Feb 20, 2015
16
2
dar es salaam, tanzania
Hi @hikari_calyx

I have just received the Nokia 3.1 Plus (mt6765/2) which uses this AB Partition Scheme which is totally new to me. :rolleyes:
Looking at the scatter.txt I can not see "Recovery" anywhere.
Did Nokia remove it or rename it maybe like Sony do (fotakernel = Recovery) ?
I would like to get TWRP on this device if that's possible.
I am still on the stock shipped out of the box 8.1.0 firmware version at moment. :fingers-crossed:

Thanks Again for your Great Work on these Nokia's :highfive:


A/B devices no longer have a recovery partition. The recovery is embedded into boot partition. To get twrp you'll need to patch the ramdisk for boot_a and boot_b with TWRP files. That's the only way to get twrp. Recovery.img doesn't exist for a/b devices
 
  • Like
Reactions: bigrammy

bigrammy

Senior Member
Apr 8, 2011
2,946
2,572
huddersfield
A/B devices no longer have a recovery partition. The recovery is embedded into boot partition. To get twrp you'll need to patch the ramdisk for boot_a and boot_b with TWRP files. That's the only way to get twrp. Recovery.img doesn't exist for a/b devices
Thanks for the reply BarrackaN :good:
I kinda worked that out now but clearly I will need to do some more reading on this new partitioning scheme :eek:
I actually thought I ordered the nokia 3.1 according to it's specs but was sent this 3.1 plus instead :eek:
I guess I need to keep up with times so this will force me to learn :laugh:

Thanks Again :highfive:
 

momenabdoz

Member
Feb 25, 2017
6
0
ROMs for Nokia 5.1 plus

you must unlock the bootloader
Why this phone doesn't receive a custom ROM yet hmd global released the source kernel and the unlock method for all Nokia phone including Nokia 5.1 plus why developers doesn't make ROM for this phone source code is available means that mediatek processor doesn't a obstacle to make ROM for this phone please developers respond to my request
 

BarrackaN

Member
Feb 20, 2015
16
2
dar es salaam, tanzania
Thanks for the reply BarrackaN :good:
I kinda worked that out now but clearly I will need to do some more reading on this new partitioning scheme :eek:
I actually thought I ordered the nokia 3.1 according to it's specs but was sent this 3.1 plus instead :eek:
I guess I need to keep up with times so this will force me to learn :laugh:

Thanks Again :highfive:


One of my android one phones got updated to android 10. And google has once again changed how recovery works on a/b devices. Now ramdisk in boot.img is shared by both boot and recovery in linked libraries. So there's currently no way of patching the boot.img with twrp on android 10 because twrp uses the whole ramdisk to run but changing the ramdisk will make the device unbootable. It's frustrating, at least the twrp team said they are working on it.

The best place to learn about this is through google's android developer site. When they discuss in detail all the changes from oreo to pie to Q.
 
  • Like
Reactions: bigrammy

BurningGrip3

Member
Sep 12, 2019
7
0
Why this phone doesn't receive a custom ROM yet hmd global released the source kernel and the unlock method for all Nokia phone including Nokia 5.1 plus why developers doesn't make ROM for this phone source code is available means that mediatek processor doesn't a obstacle to make ROM for this phone please developers respond to my request

Can you send a link to the bootloader unlock method?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Note: This guide requires polishment, will do that soon.

    Unlike the previous root guide written for Nokia 7 Plus, this guide requires to use MTK SP Flash Tool to dump stock boot.

    Why I suddenly release this guide? Because I found the method to unlock the bootloader for Nokia X5 / 5.1 Plus, but the unlock guide is unsuitable to disclose here right now. Check my Twitter if you want to confirm. To apply this guide, you must have your phone bootloader unlocked. So in theory this guide will also work on Nokia 3.1, 3.1 Plus and 5.1 once stock firmware released.

    Since it's a MediaTek-based device, you can easily dump the stock boot from your device by reading the partition table of scatter file.

    Now let's begin.

    Step 1: Check which slot is your phone currently using

    You have few methods to check, but let me introduce two usually used methods. Pick one of them that you're familiar with.

    1. Use USB Debugging method to check

    Once you enable the USB debugging, execute following command in either terminal or command prompt. I assume you have installed Android Platform Tools.

    Code:
    .\adb shell getprop ro.boot.slot_suffix

    Expected output would be either
    Code:
    [ro.boot.slot_suffix]: [_a]
    Or:
    Code:
    [ro.boot.slot_suffix]: [_b]

    2. Use Fastboot command to check

    Same as above, I assume you have installed Android Platform Tools and you have enabled USB debugging.

    Code:
    .\adb reboot bootloader
    Code:
    .\fastboot getvar current-slot

    Expected output would be either
    Code:
    current-slot: a
    Or:
    Code:
    current-slot: b

    Step 2: Dump your stock boot with MTK SP Flash Tool

    If you already have stock boot extracted from stock firmware, skip this step, just copy the boot.img from stock firmware to the phone.

    I assume that you already have MTK Port driver installed properly.

    Check the MT6xxx_Android_scatter.txt from the stock firmware, and find either "boot_a" or "boot_b" on the whole text.

    In this case, I used Nokia X5 CN PDA-0-102A-MT6771_Android_scatter.txt, and you'll find following info:

    Code:
    - partition_index: SYS34
      partition_name: boot_a
      file_name: PDA-0-102A-00CN-boot.img
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x22a00000
      physical_start_addr: 0x22a00000
      partition_size: 0x2000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    Code:
    - partition_index: SYS52
      partition_name: boot_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xf4200000
      physical_start_addr: 0xf4200000
      partition_size: 0x2000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    Please write down the linear_start_addr and partition_size of your stock boot in your current active slot.
    For example, if your current slot is B, then you need to use the start address and size of boot_b, which is started from 0xf4200000 and the length is 0x2000000.
    You know what to use if your current slot is A, right?

    Open MTK SP Flash Tool, load the Download Agent file and scatter file from the extracted stock firmware (older than your current firmware is OK).
    Then switch to Readback tab.

    Add a readback info, double click that, find a suitable location and save it as "PDA-XXXX-stock_boot.img" (depends on your current firmware revision, e.g. PDA-114A-stock_boot.img)

    In this case, we need to dump stock boot from boot_b, now type 0xf4200000 in start address text box and 0x2000000 in length box.

    After these info are typed, click OK, Readback - now connect your powered off phone with both volume keys pressed.
    After readback OK popped up, close SP Flash Tool, disconnect your phone and power it on again.

    Part 3: Patch this boot image

    Download and install latest Magisk Manager from https://github.com/topjohnwu/Magisk/releases
    Copy the stock boot to the Download directory of internal storage, then tap "Install" - "Install" - "Patch Boot Image", choose "PDA-XXXX-stock_boot.img" you just copied to the phone.
    Now you need to wait 1-2 minutes for finish patched boot image.

    Pull it out from your phone once finished:
    Code:
    .\adb pull /storage/emulated/0/Download/magisk_patched.img D:\PDA-XXXX-patched_boot.img

    Part 4: Flash boot image
    Unlike Qualcomm-based models, we can't perform temporarily boot.
    Luckily, we have stock boot already, you should know what to do if you want to go back to stock.

    Here's how:

    Reboot to fastboot mode with your familiar method:
    Code:
    .\adb reboot bootloader

    Flash patched boot with this command:
    Code:
    .\fastboot flash boot_(currentslot) D:\PDA-XXXX-patched_boot.img

    Example:
    Code:
    .\fastboot flash boot_b D:\PDA-114A-patched_boot.img

    Then reboot your phone:
    Code:
    .\fastboot reboot

    Now all done. Enjoy your rooted Nokia X5 / 5.1 Plus.

    Part 5: How to make OTA available with only your phone?

    When a newer update released, you can follow this guide to install new updates and inherit root permission with OTA updates: https://github.com/topjohnwu/Magisk/blob/master/docs/tutorials.md
    1
    This is the root way, do not need to unlock the bootloader ???

    you must unlock the bootloader
    1
    Hi can you please make a custom recovery for it.
    1
    Hi @hikari_calyx

    I have just received the Nokia 3.1 Plus (mt6765/2) which uses this AB Partition Scheme which is totally new to me. :rolleyes:
    Looking at the scatter.txt I can not see "Recovery" anywhere.
    Did Nokia remove it or rename it maybe like Sony do (fotakernel = Recovery) ?
    I would like to get TWRP on this device if that's possible.
    I am still on the stock shipped out of the box 8.1.0 firmware version at moment. :fingers-crossed:

    Thanks Again for your Great Work on these Nokia's :highfive:


    A/B devices no longer have a recovery partition. The recovery is embedded into boot partition. To get twrp you'll need to patch the ramdisk for boot_a and boot_b with TWRP files. That's the only way to get twrp. Recovery.img doesn't exist for a/b devices
    1
    Thanks for the reply BarrackaN :good:
    I kinda worked that out now but clearly I will need to do some more reading on this new partitioning scheme :eek:
    I actually thought I ordered the nokia 3.1 according to it's specs but was sent this 3.1 plus instead :eek:
    I guess I need to keep up with times so this will force me to learn :laugh:

    Thanks Again :highfive:


    One of my android one phones got updated to android 10. And google has once again changed how recovery works on a/b devices. Now ramdisk in boot.img is shared by both boot and recovery in linked libraries. So there's currently no way of patching the boot.img with twrp on android 10 because twrp uses the whole ramdisk to run but changing the ramdisk will make the device unbootable. It's frustrating, at least the twrp team said they are working on it.

    The best place to learn about this is through google's android developer site. When they discuss in detail all the changes from oreo to pie to Q.