Rooting/Unlocking the EE Rook (ZTE Blade A410) -- Help needed plz

[scott]

My phone is a Rook from the UK carrier EE. This is a carrier-branded ZTE Blade A410 (a MediaTek device). My particular device is network-unlocked but otherwise unmodified from its original stock 5.1.1 ROM.
I would like to unlock the bootloader and root it, but everything I try hits a wall, undoubtedly because I'm such a noob. Please help if you can:

So I made myself a developer, and in Developer Options toggled on both USB debugging and OEM unlocking.

I had no trouble to install either the ZTE ADB interface drivers or the fastboot interface drivers on my Windows 10 box. I also have a second Linux machine.

1. I install the Android SDK to get adb and fastboot. Trying "adb reboot bootloader" then "fastboot oem unlock" gets me the disclaimer screen on my phone, telling me to press Volume Up to confirm unlocking the bootloader, and Volume Down to cancel. But when I press Volume Up nothing happens at all.

2. I can also avoid adb: I boot into stock recovery via Volume Up + Power, and from there into fastboot. Same result.

3. If try "adb reboot oem-unlock" the phone just reboots normally,

Next I came to this forum and have tried both the MTK Droid Tools and the SP Flash Tool. My hope was either to root the phone directly, or to install CWM Recovery and use that to root, or even just to try to unlock the bootloader manually using the ideas of http://forum.xda-developers.com/galaxy-n...t-t2016628 to unlock the boot loader and then proceed as above. No dice:

I follow the tutorial on using MTK Droid Tool to make a backup (thread-468). Please look at the attached screen-shot. Questions:

1. the tutorial says that I should get a yellow box next to the PHone details, but the box is blue, as you can see. What does this mean? Is it a problem?

2. In the thread with the list of errors, it says that if I get the "TotalBytesPerChunk ...." error, that I should check that an SD is inserted. One **is**inserted. Could it be faulty? Also, you say to install BusyBox -- There are many many different BUsyBox installers in the Play store. Does it matter which one I install?

3. In the thread with the list of errors, it says that if I get the "SU is inaccessible" error that i should ensure that the phone is rooted. Well, this phone is NOT rooted, I am hoping to use the tool to flash a rooted ROM, but first I want to take a backup of the stock ROM that is on my device.

I'm now at wits end. Could someone give me a decent line of attack that might actually lead somewhere? Ideally, I'd love to: 1. Back up my current ROM so that I can restore if something goes wrong, then I'd like to unlock the bootloader and root, in either order.

Along the way, I've got very confused about just which drivers need to be loaded for the different steps. There is the MediaTek Preloader USB VCOM driver, the MediaTek DA USB VCOM Driver, the MediaTek USB Port Driver, the MediaTek USB VBCOM Driver, the ZTE ADB USB driver, and the Android Bootloader Interface Driver. AAAAAAAAAAAAAAAAAAAAAAAAARRRRRRRRRRRRRRRRRRRRRGH!

As a final try, I thought I would try to use the SP Flash Tool to dump the param partition, because the post from xda-developers that I mention above made me think that I could perhaps unlock the bootloader by changing a single byte of ROM. Alas, the tutorial https://www.hovatek.com/forum/thread-526.html has me start by making a scatter file. But when I bring up MTK Droid Tools and click on "Blocks Map", I get this beautiful partition map -- BUT THE "Create Scatter File" BUTTON IS NOT ENABLED!!!! So I can't proceed this way either.

Even more than answer to the three questions above, I'd be so grateful for some help with how to proceed: Can I go:

First back up my ROM (can i do this with Mtk Droid Tools and SP Flash Tool even though my device isn't rooted? , then Root. Or do I first have to root (without a backup). And in that case, which tool with which driver? etc etc.

Thanks for any help you can give me to untangle this spaghetti.

[hovatek]

Thanks for any help you can give me to untangle this spaghetti.

This issue is not as complicated as you might think it is.
I'll answer your questions first before telling you the best line of action.

1. That method of unlocking bootloader is very unlikely to work. We have several devices with the same challenge and are working on it
2. You'll get the same result
3.
1. Yellow box means the phone is rooted. Blue means its not rooted. It's only natural you get a blue box since yours isn't rooted
2. This is more informational than an error message, relax
3. The phone is not rooted, SU (root) will be inaccessible and MTK droid tools of little use to you

What to do.

If you really want to backup your phone then an SP flash tool readback is your best bet and you'll need the scatter file for your exact model

If you wish to root then you'll need a custom recovery ported for your exact model. We could help with that if you can get the scatter file, boot.img and recovery.img from the factory firmware for your phone model

In essense, it all boils down to you being able to download the official firmware for your model or at least it's scatter file. If you're able to do this then you have a really good shot at backing up and rooting

[scott]

Thanks for any help you can give me to untangle this spaghetti.

This issue is not as complicated as you might think it is.
I'll answer your questions first before telling you the best line of action.

1. That method of unlocking bootloader is very unlikely to work. We have several devices with the same challenge and are working on it
2. You'll get the same result
3.
1. Yellow box means the phone is rooted. Blue means its not rooted. It's only natural you get a blue box since yours isn't rooted
2. This is more informational than an error message, relax
3. The phone is not rooted, SU (root) will be inaccessible and MTK droid tools of little use to you

What to do.

If you really want to backup your phone then an SP flash tool readback is your best bet and you'll need the scatter file for your exact model

If you wish to root then you'll need a custom recovery ported for your exact model. We could help with that if you can get the scatter file, boot.img and recovery.img from the factory firmware for your phone model

In essense, it all boils down to you being able to download the official firmware for your model or at least it's scatter file. If you're able to do this then you have a really good shot at backing up and rooting

Thank you so much for this reply. Two follow-up questions then:

1. With the phone on and connected to the Windows 10 via USB, and the ZTE Handset ADB Interface driver loaded, I start MTK Droid Tools as administrator. The PHone Information is populated (as in the screenshot that I attached to the earlier post), and the "Blocks Map" button is enabled. When I click it, a "Block Info" window pops-up. A screen-shot of this window is attached to this post. Now it's true that the "Create Scatter file" button is greyed-out -- but isn't the information of the scatter file just this Block devices Info? Actually, if I compare that screen shot with ones in the china-iphone.ru posts of user rua1, perhaps you also need to know if my phone is ext4 or yaffs etc. For this, I attach the log.txt file from the same directory as MTKdroidTools.exe
Between the screen shot and the log.txt file that I've attached to this post, is there enough information to enable one to construct the scatter file?

If it does, then perhaps you can give me an example of a good scatter file, or point me to some definition of the format, so I can create one.

2. Given the scatter file (only), can I then get the stock images i need off my phone itself? (even though it's not rooted). (I do this with the Flash Tool? ). And then to root the phone I need to unpack and muck about with the .img files and reflash them back? Perhaps you could point me to a checklist of the changes required.

This might get me root, but I'd still need to find the right unlocked bootloader and CWM file. Perhaps the fact that it's a ZTE Blade A410 means that I can use these files from some other Blade. In any case I'll burn that bridge when i get to it . For the moment, I'm just asking if between the screen-shot of the block info and the log.txt file I have enough info to create the scatter file (once you kindly give me an example or point me to a description of the required format).

3. About unlocking the bootloader and the disclaimer screen where Volume Up does nothing: I have no doubt that you don't need me to tell you this, but just in case it's a clue: I know that if i could use fastboot to unlock the bootloader, this would factory-reset the device. Now since this phone is running Android 5.1.1, it has some sort of "factory reset protection", and I wondered if it was this "protection" which was preventing from unlocking the bootloader. Just for fun, then, i booted into Recovery and tried to do a wipe and factory reset, and the strangest thing happened: there flashed on my phone's screen the following grammatically-challenged error message:

frp have not wipe; factory reset failed

I get this message whenever I try to do a factory reset from recovery -- even if I set "OEM unlocking" in the developer options, which the device tells me removes factory reset protection. I'm not sure how this helps me unlock the bootloader, but it's a strange message and just in case it's of use to you, I thought i should point it out. In absence of anything else, I thought I'd dump the parameter partition and compare it with the one in xda-developers where they change a single byte to unlock it.

Thank you for telling me if I have the ingredients to make the scatter file, and for your opinion about whether .img files from some other flavour of ZTE Blade might work for me.

-scott

attachment 1: scott block info.jpg screen snippet of the block ino as output by MTK Droid Tools 5.6.3d
attachment 2: log.txt from the MTKDroid Tools directory

[scott]

OK, so after many hours of struggle, I have managed to find a candidate scatter.txt file on the Internet, and to generate two other candidates. Of course all three are different. I'd appreciate your help in deciding which one is the right one for me to use (if any).


1. The first candidate was obtained as follows:

If you look at the log.txt file I attached in my previous post, you'll see the memorable lines

30/01/16 17:34:54 --->>> Connect to device <<<---
30/01/16 17:34:54 -rwxrwxrwx shell shell 795076 2012-06-29 10:18 recovery
30/01/16 17:34:54 /system/etc/firmware/modem_1_lwg_n.img
30/01/16 17:34:54 3+0 records out
30/01/16 17:34:54 12 bytes transferred in 0.002 secs (6000 bytes/sec)
30/01/16 17:34:54 Hardware : MT6735M

From this i guessed that my particular phone has that MT6735M processor. A google search found me a forum called "AndroiudUrdu.net", which had a large collection of scatter.txt files. The first attachment to this post is the file MT6735M_Android_scatter.txt at http://forum.androidurdu.net/showthread.php?tid=10


The 2nd and third scatter.txt files were generated by me (incredible but true) using MTK ROM Studio, both starting from the same partition table -- namely the one in the log.txt file of my previous post. To be honest, I'm not 100% what I did to generate the two different scatter.txt files from the same partition table. But I think the difference is just whether or not I asked the MTK ROM Studio software to "clean up" or "check" the ROM for 'dangerous' files that shouldn't be flashed.

Questions:

1. I note that MTK Droid Tools tells me that the hardware is MT6735M, while MTK ROM Studio seems to say that it's MT6516. Which one is right? Does it matter? Do I need to care?

2. Is it safe (and is it possible) for me to use the scatter.txt file that MTK ROM Studio generated in order to instruct the SP Flash Tool to back up the various partitions on my phone?

3. If I wan a full back-up in case of problems, can I just make a scatter.txt file using ALL of the partitions that I found in log.txt of Droid Tools (equivalently, the out put of 'cat /proc/emmc' on my phone. OK OK, i saw that I should never back up and reflash two of the partitions (can't remember which), and also that I prob won't be able to back up the 'personal data' of the userdata and cache partitions. But except for those four, can I back up the others using SP Flash Tool? Or is the fact that i'm not rooted // have a locked boot loader mean that either the back-up or the reflash will fail.

I'll probably try to upload (back-up) the files myself, but I think i'm going to wait for you to tell me it's safe and possible to reflash them, should i ever want to.

And then if all that works, I'm only left with the question of modifying the imgs to obtain root and unlock the bootloader.

I admit that this was a larger pain in the butt than I anticipated it being.

Thank you in advance for your answers, and for any warnings or advice you think i need.

/sbp>

[scott]

It occurs to me that if i have correctly understood and extracted the scatter file, and if I can indeed use it to flash partitions, then with luck I might be just about done.

If http://forum.xda-developers.com/galaxy-n...t-t2016628 applies to android generally (and the whole thread suggests that it might), then perhaps i only need to flash the single "para" partition to change one byte and the bootloader will be unlocked. Once that's done, i can flash CWM and then root in the perfectly ordinary manner. Vastly better than building stuff myself.

Would you know if I'm correct to think that the partition called "para" in my partition list is the same as the partition called "param" in that xda-developers thread?

thanks

[hovatek]

Would you know if I'm correct to think that the partition called "para" in my partition list is the same as the partition called "param" in that xda-developers thread?

thanks

The para edit guide says root is needed (cross-check)
So you're still back to the scatter file hunt in order to extract recovery.img using sp flash tool
Once we have recovery.img, the custom recovery is as good as sorted out.
I'll take a look at the scatter files to pick a template we'll be working with.
Put ROM studio aside for now, you'll likely end up with inconsistence

[hovatek]

Good news is, you have what you need to manually create a scatter file.
You'll use MT6735M_Android_scatter.txt

1. Open this scatter file using notepad++
2. Delete BIRDTOOLMINVER[3.9] at the top then save it
3. I'll use recovery.img as an example

Blocksmap says

Scatter: 000003B000
Size: 0000016C00

The scatter file says

- partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2d80000
physical_start_addr: 0x2d80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

The Mod

Replace all 0s in front of the first non-zero character with 0x

Scatter: 000003B000 = 0x3B00000
Size: 0000016C00 = 0x16C0000

You then edit
* linear start address = physical start address = Scatter

* Partition size = Size

The new values for recovery will be

- partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3B00000
physical_start_addr: 0x3B00000
partition_size: 0x16C0000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x0

Do the same for other items on your blocks map.
You can then do a readback using https://www.hovatek.com/forum/thread-526.html

[scott]

Good news is, you have what you need to manually create a scatter file.
You'll use MT6735M_Android_scatter.txt

1. Open this scatter file using notepad++
2. Delete BIRDTOOLMINVER[3.9] at the top then save it
3. I'll use recovery.img as an example

Blocksmap says

Scatter: 000003B000
Size: 0000016C00

The scatter file says

- partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2d80000
physical_start_addr: 0x2d80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00

The Mod

Replace all 0s in front of the first non-zero character with 0x

Scatter: 000003B000 = 0x3B00000
Size: 0000016C00 = 0x16C0000

You then edit
* linear start address = physical start address = Scatter

* Partition size = Size

The new values for recovery will be

- partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3B00000
physical_start_addr: 0x3B00000
partition_size: 0x16C0000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x0

Do the same for other items on your blocks map.
You can then do a readback using https://www.hovatek.com/forum/thread-526.html

OH man I can't believe I didn't see this reply first .
But thank you very much. Just to make sure I understand:
your assertion is that the MT6735M scatter file which i found is a 'good' template -- I just need to manually update the actual physical start address and size for each partition i want to back up. (and I can trust the address/size numbers I get from droid tools). with that modified scatter file, I can start to read back my ROM.
I'm so exhausted from this effort, i just want to make sure i understand your instructions before I proceed further.

I do have one little question, assuming that my understanding is correct:
If i understand you, the core of my mistake over the past day or two is that it's wrong to think that MTK ROM Studio can produce a good scatter file from the output of
cat /proc/emmc
Is that right? I assumed that Mtk ROM Studio would produce something better than a file i randomly downloaded from some random site. But it's true that there were all sorts of inconsistencies already which should have tipped me off.

If i got that right, please just ignore my post of a few minutes ago about the error i was getting from SP_Flash_Tool. IN fact, just for the benefit of the next guy, i'll answer that post myself. (and then sleep for a few hours).
thanks again!

[hovatek]

If i got that right, please just ignore my post of a few minutes ago about the error i was getting from SP_Flash_Tool. IN fact, just for the benefit of the next guy, i'll answer that post myself. (and then sleep for a few hours).
thanks again!

* Yes, the scatter file you downloaded is for your chipset and all you need to do is update the block addresses which MTK Droidtools has correctly provided.
* ROM studio (from my experience ) doesn't work too great so I only use it for older chipsets and for testing

[scott]

So i seem to inch along, but not much more. I am sorry to still be a bother:


I successfully created a scatter. txt file which I hope is exactly as you instructed me to: I took the original MT6735M_Android_scatter.txt and and altered the start addresses and length to reflect reality according to the log.txt file and output of Droid Tools. And armed with this, I succeeded in using Flash Tools v5.1547 to READ BACK my phone's to a bunch of .img files. I also took one large ROM(*.img file to have a single back up.

I'll attach these files to this post.

THe problem is the very next step, which was to use Droid Tools to process the .img file and create a CWM appropriate for me. ALas, here is the output of Droid Tools: see the attached file "Capture2.JPG".

I just don't know what i now do to get rid of that "error in signature" so that Droid Tools will make a CWM.

Thanks for your help.

scott