Working Bootable recovery for the KFFOWI (Ford)

Search This thread

Vlasp

Senior Member
Mar 18, 2012
842
272
Plano, Texas
As you know, root has been achieved on this device. Now, let's move on to recovery. The recovery.img is a lot like the boot.img, in the way that you can boot from it. In theory, if we make a 3e recovery.bin for this device (TWRP/CWM), and we boot from it, we will be able to install any rom. Let's let the Recovery.bin development start!

THIS DEVICE DOES NOT SUPPORT FLASHING RECOVERIES. YOU HAVE TO BOOT FROM THEM IN FASTBOOT.

This device now has 2 custom recoveries, those 2 being TWRP (Team Win Recovery Project) and CM (CyanogenMod) Recovery. CyanogenMod recovery is much like the stock recovery, with the only difference being that CM Recovery can install files that don't have the Amazon ZIP Signature. TWRP, on the other hand, has a touchscreen display, and is much more user friendly than CM Recovery. The links to both are here:
You can do many things in a Custom Recovery, such as:
  • Install custom ROMs (Found here)
  • Install modifications to your current OS (XPosed Framework, Root, etc.)
  • Install GAPPS (Google Applications, including Play Store and Play Services)
  • Wipe your current ROM
  • Backup your current ROM
  • Restore a backup of a previous ROM
If you have any questions, ask them here.
Now, press the thank button here and thank the developers that made these recoveries and ROMs possible, and you are good to go.
Good Luck!
 
Last edited:

Awesomeslayerg

Senior Member
Jul 5, 2014
792
357
Los Angeles
I have attached the images we can use. I dont know if we need the system image file but if we do just let me know hopefully ill be able to upload it or someone else might cause its 1 GB it may take some time.
 

Attachments

  • Images.zip
    9.1 MB · Views: 502

Vlasp

Senior Member
Mar 18, 2012
842
272
Plano, Texas
I have attached the images we can use. I dont know if we need the system image file but if we do just let me know hopefully ill be able to upload it or someone else might cause its 1 GB it may take some time.

Well, we just need someone to build a recovery for this device. Once that is bootable, we can install roms. Also, since we will most likely not be able to unlock the bootloader, Safestrap might be our best bet.
 

Awesomeslayerg

Senior Member
Jul 5, 2014
792
357
Los Angeles
True.. it's a mediatek soc so there's gotta be a way to unlock the bootloader because most of the mediatek devices have unlocked bootloader I think. And besides it gives us an unlock code so we need to see what that deal is
 

csolanol

Senior Member
Apr 18, 2010
1,753
2,624
Just leaving here partitions structure:

Model: MMC 8GND3R (sd/mmc)
Disk /dev/block/mmcblk0: 7818MB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number Start End Size File system Name Flags
1 1049kB 2097kB 1049kB KB
2 2097kB 3146kB 1049kB DKB
3 3146kB 21.4MB 18.2MB EXPDB
4 21.4MB 22.4MB 1049kB UBOOT
5 22.4MB 39.2MB 16.8MB boot
6 39.2MB 56.0MB 16.8MB recovery
7 56.0MB 56.5MB 524kB MISC
8 56.5MB 60.2MB 3670kB LOGO
9 60.2MB 65.4MB 5243kB TEE1
10 65.4MB 70.6MB 5243kB TEE2
11 70.6MB 1329MB 1258MB ext4 system
12 1329MB 1591MB 262MB ext4 cache
13 1591MB 7818MB 6227MB ext4 userdata
 

Awesomeslayerg

Senior Member
Jul 5, 2014
792
357
Los Angeles
Hmm it looks like the MTK Droid Root and Tools V2.5.3 works now so we can flash images via that as well as recovery AND boot. But someone should get a 2nd fire and try it out because we have no scatter file.

We could possibly install a 2nd bootloader
 

diegocr

Senior Member
Dec 8, 2011
539
812
Hmm it looks like the MTK Droid Root and Tools V2.5.3 works now so we can flash images via that as well as recovery AND boot. But someone should get a 2nd fire and try it out because we have no scatter file.

We could possibly install a 2nd bootloader

I have made this one and test ro readback partitions bug gets error 2004
Partition lists
storage, boot_channel & block_size maybe not good

Model: MMC 8GND3R (sd/mmc)

storage: SDMMC ????

Sometimes tablet wont boot and have to remove battery connector

Last SP Flash TOOL, linux version have much errors and force to remove battery
http://firmware.su/51343-sp-flash-tool.html
DO NO USE TO DOWNLOAD ANYTHING
UNDER CONSTRUCTION

scatter updated, UNTESTED
 

Attachments

  • MT8127_fire_UNTESTED_scatter.txt
    5.4 KB · Views: 542
Last edited:

diegocr

Senior Member
Dec 8, 2011
539
812
idme print as su

unlock_code:

---------- Post added at 12:09 PM ---------- Previous post was at 11:52 AM ----------

There are 2 boads type and 2 preloaders......
Mine have preloader_prod.img board_id: 0025001040000015

Code:
# check if production device
if ("0025001000000015" == read_file_str("/proc/idme/board_id") ||
    "0025001000010015" == read_file_str("/proc/idme/board_id") ||
    "0025001010000015" == read_file_str("/proc/idme/board_id") ||
    "0025001010010015" == read_file_str("/proc/idme/board_id") ||
    "0025001020000015" == read_file_str("/proc/idme/board_id"))
then
    ui_print("Copying preloader.img to boot partition 0 for unsecure device...");
    package_extract_file("images/preloader.img", "/dev/block/platform/mtk-msdc.0/mmcblk0boot0");
else
    ui_print("Copying preloader_prod.img to boot partition 0 for secure device...");
    package_extract_file("images/preloader_prod.img", "/dev/block/platform/mtk-msdc.0/mmcblk0boot0");
endif;
 

Awesomeslayerg

Senior Member
Jul 5, 2014
792
357
Los Angeles
Okay i used the MTK-TWRP thing right now and used it to unpack the recovery image and it looks like we can use this to our advantage to flash unverified files by editing some of the prop settings.
 

ggow

Recognized Developer
Feb 28, 2014
4,094
10,909
How would we flash it?

Use the following commands to flash the recovery

Code:
adb shell
su
dd if=/sdcard/recovery.img of=/dev/block/platform/mtk-msdc.0/by-name/recovery

- I have Cyanogenmod Recovery working except a few minor niggles
- Let you know once it's fully working
- It looks like we can't boot unsigned images that are flashed to the recovery partition
- If I boot the image from fastboot rather than flashing it then it works
- CVE-2014-0973 is patched in the bootloader
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    As you know, root has been achieved on this device. Now, let's move on to recovery. The recovery.img is a lot like the boot.img, in the way that you can boot from it. In theory, if we make a 3e recovery.bin for this device (TWRP/CWM), and we boot from it, we will be able to install any rom. Let's let the Recovery.bin development start!

    THIS DEVICE DOES NOT SUPPORT FLASHING RECOVERIES. YOU HAVE TO BOOT FROM THEM IN FASTBOOT.

    This device now has 2 custom recoveries, those 2 being TWRP (Team Win Recovery Project) and CM (CyanogenMod) Recovery. CyanogenMod recovery is much like the stock recovery, with the only difference being that CM Recovery can install files that don't have the Amazon ZIP Signature. TWRP, on the other hand, has a touchscreen display, and is much more user friendly than CM Recovery. The links to both are here:
    You can do many things in a Custom Recovery, such as:
    • Install custom ROMs (Found here)
    • Install modifications to your current OS (XPosed Framework, Root, etc.)
    • Install GAPPS (Google Applications, including Play Store and Play Services)
    • Wipe your current ROM
    • Backup your current ROM
    • Restore a backup of a previous ROM
    If you have any questions, ask them here.
    Now, press the thank button here and thank the developers that made these recoveries and ROMs possible, and you are good to go.
    Good Luck!
    7
    - With the recovery I previously posted - i have identified several issues
    - Signature checking of the update package was mandatory - I have just disabled this
    - I have also found that partitions are not been mounted correctly and this accounts for why updates were failing
    - I temporarily hack this to work and was able to flash a non amazon update.zip, flashed a modified gapps 5.1 package and SuperSU.zip :)
    - I will produce a new version which will enable us to easily root and install a proper GAPPS package
    - It is a little crude in operation, but we will also be able to use this to load any ROM we want when fully working
    - Then work can begin to port CM-12.1

    EDIT: Added screenshot showing fresh FireOS rooted and gapps installed by flashing SuperSU.zip and Modified Gapps 5.1 package
    5
    I have released Cyanogenmod Recovery here
    3
    Why Port Cyanogen Recovery?

    In case some of you wondering... "Why Port Cyanogen Recovery?"

    - I have never worked with MediaTek devices so this will be easier and quicker to get running.
    - I am planning to port TWRP very soon, however...
    - This will fulfil the immediate need for a recovery to enable users to at least be able to root and install gapps easily.
    3
    Wait did you already try it on the device? What recovery.img are you using?

    - I built one from source: Cyanogen 12.1 recovery
    - See attached picture