[Tutorial] How to back up Mediatek firmware using Miracle Box
[Tutorial] How to back up Mediatek firmware using Miracle Box
17-09-2016, 12:13 AM
(16-09-2016, 11:28 PM)bellskar Ok Well.
First of all. thanks that it's showing some hope to backup 64bit MT67xx devices.
Second. The loader file is detected as Virus by the AVG antivirus. But I have added it as an exception to ignore it. Is it alright to use it?
Third. Miracle Box is now running without any issues. But it couldn't catch my phone in time.. I am sure the Preloader VCOM drivers are perfectly installed on all of the USB ports on my laptop. and it works fine with SP Flash Tool when I need to flash anything. I have also verified in the Device Manager when the correct device appears for a few seconds on connecting the phone (turned off) as you know the preloader time period until the phone goes to charging mode.
.............
..............
Hello.,
I am no expert on this, but I had just discovered this program one week ago. But I was having same problems as you. Not that it matters but, my phone has an mt6735. Your drivers show (Android) at the end. And I had that too, I thought that was correct. It is not. Those drivers do or should work in spft but do not work in miricle box. I have not completely solved my problem but I do have a method that works for me.
First off i had to do the manuely installed drivers method, then uninstall and delete the ones with (Android) on the end. Then I can connect one time to miricle box. The manually installed driver shows up and phone connects to miricle.
But then if I connect a second time the (Android) driver is back. I haven't figured that one out yet , anyway.
Hope this works for you too.
This post was last modified: 17-09-2016, 02:01 AM by mr mazak.
17-09-2016, 01:42 AM
(17-09-2016, 12:13 AM)mr mazak(16-09-2016, 11:28 PM)bellskar Ok Well.
First of all. thanks that it's showing some hope to backup 64bit MT67xx devices.
Second. The loader file is detected as Virus by the AVG antivirus. But I have added it as an exception to ignore it. Is it alright to use it?
Third. Miracle Box is now running without any issues. But it couldn't catch my phone in time.. I am sure the Preloader VCOM drivers are perfectly installed on all of the USB ports on my laptop. and it works fine with SP Flash Tool when I need to flash anything. I have also verified in the Device Manager when the correct device appears for a few seconds on connecting the phone (turned off) as you know the preloader time period until the phone goes to charging mode.
.............
..............
Hello.,
I am now expert on this, but I had just discovered this program one week ago. But I was having same problems as you. Not that it matters but, my phone has an mt6735. Your drivers show (Android) at the end. And I had that too, I thought that was correct. It is not. Those drivers do or should work in spft but do not work in miricle box. I have not completely solved my problem but I do have a method that works for me.
First off i had to do the manuely installed drivers method, then uninstall and delete the ones with (Android) on the end. Then I can connect one time to miricle box. The manually installed driver shows up and phone connects to miricle.
But then if I connect a second time the (Android) driver is back. I haven't figured that one out yet , anyway.
Hope this works for you too.
Thank you. Yes I found that and after uninstalling and reinstalling the driver manually worked out well. But problem persists on wards. Every next connection fails. But for that I found a way, Just uninstall from the device manager (with delete driver checkbox checked) and connect the phone again. It reloads the driver again and Miracle box detects it immediately. There is no need to re-install repeatedly. but uninstall.
In Simple-------
- Keep the Miracle Box running on one side. (awaiting USB connection)
- Keep the Device Manager open on the other side. And from menu View > Show Hidden Devices. (this will always show the device for uninstalling)
- Connect the phone (turned off) via USB. If Miracle Box detects, well and good. If not, Uninstall/delete the working device from device manager.
- Disconnect and Connect the phone (turned off) again. This will reload/reinstall the drivers automatically and Miracle Box should detect it.
At least this workaround is not missing with me . And yes, device name is not making trouble later on. Now it's always as "MediaTek PreLoader USB VCOM (Android)" but it works once and after every uninstall.
This post was last modified: 17-09-2016, 01:50 AM by bellskar.
17-09-2016, 01:48 AM
- First, all default checked, but unchecking /system and /cache
- Then only /system and /cache
- Then /NVRAM and /userdata
It still can't backup /userdata. ends up with SUM ERR [start_addr] [partition_size] only after a few seconds.
Haven't yet tried to flash it back on the phone to try it.
17-09-2016, 08:24 PM
(17-09-2016, 01:48 AM)bellskar Miracle Box doesn't seem to be working flawlessly with dumping the firmware in FULL. Always ends up with SUM ERR at large partition. Needed to backup in parts.
- First, all default checked, but unchecking /system and /cache
- Then only /system and /cache
- Then /NVRAM and /userdata
It still can't backup /userdata. ends up with SUM ERR [start_addr] [partition_size] only after a few seconds.
Haven't yet tried to flash it back on the phone to try it.
there's no need of backing up userdata and cache
as you'll most likely end up wiping them in recovery mode after flashing
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
17-09-2016, 11:35 PM
(17-09-2016, 08:24 PM)X3non there's no need of backing up userdata and cacheYes probably. But it also failed during /system when selected to backup whole ROM.. I mentioned that I had to backup it separately.
as you'll most likely end up wiping them in recovery mode after flashing
Just wanted to know if it's a known issue to some or it's just me.
18-09-2016, 09:07 AM
(17-09-2016, 11:35 PM)bellskar Yes probably. But it also failed during /system when selected to backup whole ROM.. I mentioned that I had to backup it separately.
Just wanted to know if it's a known issue to some or it's just me.
Your partition sizes are probably too large and thus, reach timeout.
Another issue could be the PC or USB cord you're using
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
04-10-2016, 10:43 AM
04-10-2016, 01:43 PM
(04-10-2016, 10:43 AM)killing4fun I have a problem, when i try to launch miracle box from loader (Miracle_Loader.exe) i get an error saying "Sorry, this application cannot run under a Virtual Machine". I'm on windows 10 x64 and i'm not running it on a virtual machine.
Check your task manager and exit Android processes running
This post was last modified: 04-10-2016, 01:43 PM by hovatek.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
18-10-2016, 02:10 PM
(04-06-2016, 09:57 AM)hovatek This guide will enable you easily backup an MTK phone's firmware without having to root it. Other methods you could consider are MTK Droid tools @ https://www.hovatek.com/forum/thread-468.html (root required) and SP Flash tool Readback / ROM dump @ https://www.hovatek.com/forum/thread-526.html (root not required)
Note
* If you get the inactive start button error when using Miracle, then see https://www.hovatek.com/forum/thread-14815.html
Requirements
* Download Miracle Box @ https://docs.google.com/uc?id=0B66Lx4_xW...t=download
* PC
* USB cord
* Manually install Mediatek VCOM drivers (see https://www.hovatek.com/forum/thread-440.html )
Procedure
1. Extract the Miracle Box zip into a folder and launch Miracle loader exe
2. Wait till Miracle Box opens to the Dashboard
3. Click the MTK tab
4. Tick Read
5. Select the phone's chipset type from the dropdown
5a. If you want the backup saved in an SP Flash tool friendly format (with a scatter file) then tick Save as scatter file.
6. Click the Start button
7. You should now see >> Waiting for USB Port at the bottom left corner. Connect the phone to the PC (must be switched off still with battery inside) then press the Power button just once (this is to ensure that your device is detected immediately). DO NOT hold down the power button else the phone will boot up normally
8. If you did not tick Save as scatter file, a box should pop up. Navigate to the location you wish to save the firmware (in .bin format) then click Save
8a. If you ticked Save as scatter file then a box should popup asking you to select which block / partition you would like to backup. Tick all if you want a full firmware backup / dump or tick only what you need to backup then click OK
8b. Navigate to the location you wish to save the files to then click OK
9. Wait while Miracle Box begins backing up the phone. If you did not tick Save as scatter file, it should look something like
9a. If you ticked Save as scatter file, it should look something like
10. Once backup has been completed, you should see a Done message
11. Disconnect then power on the phone
Note
For the scatter backup, you can rename the file extensions in order to use them in SP flash tool, e.g recovery.bin to recovery.img
I have an Allview X3 Soul Style on MT6753 platform, 3 GB RAM, Dual Sim, running Android 6.0 Marshmallow.
I managed to make a full ROM backup, as scatter, with Miracle Box 2.27A.
The resulting scatter file is as follows:
Code:
############################################################################################################
#
# General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
info:
- config_version: V1.1.1
platform: MT6753
project: mtk_android
storage: EMMC
boot_channel: MSDC_0
block_size: 0x20000
############################################################################################################
#
# Layout Setting
#
############################################################################################################
- partition_index: SYS0
partition_name: PRELOADER
file_name: preloader.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x400000
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADER
reserve: 0x00
- partition_index: SYS1
partition_name: PGPT
file_name: pgpt.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS2
partition_name: PROINFO
file_name: proinfo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x80000
physical_start_addr: 0x80000
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS3
partition_name: NVRAM
file_name: nvram.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x380000
physical_start_addr: 0x380000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS4
partition_name: PROTECT1
file_name: protect1.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x880000
physical_start_addr: 0x880000
partition_size: 0xA00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS5
partition_name: PROTECT2
file_name: protect2.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1280000
physical_start_addr: 0x1280000
partition_size: 0xA00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS6
partition_name: LK
file_name: lk.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1C80000
physical_start_addr: 0x1C80000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS7
partition_name: PARA
file_name: para.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D00000
physical_start_addr: 0x1D00000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS8
partition_name: BOOT
file_name: boot.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D80000
physical_start_addr: 0x1D80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS9
partition_name: RECOVERY
file_name: recovery.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2D80000
physical_start_addr: 0x2D80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS10
partition_name: LOGO
file_name: logo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x3D80000
physical_start_addr: 0x3D80000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS11
partition_name: EXPDB
file_name: expdb.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x4580000
physical_start_addr: 0x4580000
partition_size: 0xA00000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS12
partition_name: SECCFG
file_name: seccfg.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x4F80000
physical_start_addr: 0x4F80000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS13
partition_name: OEMKEYSTORE
file_name: oemkeystore.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x5000000
physical_start_addr: 0x5000000
partition_size: 0x200000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS14
partition_name: SECRO
file_name: secro.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x5200000
physical_start_addr: 0x5200000
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS15
partition_name: KEYSTORE
file_name: keystore.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x5800000
physical_start_addr: 0x5800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS16
partition_name: TEE1
file_name: tee1.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x6000000
physical_start_addr: 0x6000000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS17
partition_name: TEE2
file_name: tee2.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x6500000
physical_start_addr: 0x6500000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS18
partition_name: FRP
file_name: frp.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x6A00000
physical_start_addr: 0x6A00000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS19
partition_name: NVDATA
file_name: nvdata.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x6B00000
physical_start_addr: 0x6B00000
partition_size: 0x2000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS20
partition_name: METADATA
file_name: metadata.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x8B00000
physical_start_addr: 0x8B00000
partition_size: 0x2500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS21
partition_name: SYSTEM
file_name: system.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0xB000000
physical_start_addr: 0xB000000
partition_size: 0x10C000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS22
partition_name: CACHE
file_name: cache.bin
is_download: true
type: YAFFS_IMG
linear_start_addr: 0x117000000
physical_start_addr: 0x117000000
partition_size: 0x19000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS23
partition_name: USERDATA
file_name: userdata.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x130000000
physical_start_addr: 0x130000000
partition_size: 0x616B80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
- partition_index: SYS24
partition_name: FLASHINFO
file_name: flashinfo.bin
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x746B80000
physical_start_addr: 0x746B80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: UPDATE
reserve: 0x00At the same time you have to make the following modifications:
- change the extension from ".bin" to ".img" for the following partitions: boot, recovery, secro, system, cache and userdata.
- remove the ".bin" extension for the following partitions: pgpt, proinfo, nvram, protect1, protect2, para, expdb, seccfg, oemkeystore, keystore, frp, nvdata, metadata and flashinfo.
- unpack "recovery.img" to find the proper file system type (e.g. EXT4) for the following partitions: protect1, protect2, nvdata, system, cache, userdata. If you look at the scatter file created by Miracle Box you will notice that the "system" partition type is "YAFFS". After I unpacked recovery.img, i discovered that "system" partition type is actually "EXT4" (look at fstab.mt6735 file)
Code:
# 1 "vendor/mediatek/proprietary/hardware/fstab/mt6735/fstab.in"
# 1 "<built-in>"
# 1 "<command-line>"
# 1 "vendor/mediatek/proprietary/hardware/fstab/mt6735/fstab.in"
# 20 "vendor/mediatek/proprietary/hardware/fstab/mt6735/fstab.in"
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system /system ext4 ro wait,verify
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/userdata /data ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,resize,forceencrypt=/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/metadata,
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/cache /cache ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect1 /protect_f ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect2 /protect_s ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvdata /nvdata ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,formattable
# 37 "vendor/mediatek/proprietary/hardware/fstab/mt6735/fstab.in"
/devices/mtk-msdc.0/11230000.msdc0* auto vfat defaults voldmanaged=sdcard0:auto
/devices/mtk-msdc.0/11240000.msdc1* auto auto defaults voldmanaged=sdcard1:auto,encryptable=userdata
/devices/platform/mt_usb* auto vfat defaults voldmanaged=usbotg:auto
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/frp /persistent emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvram /nvram emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/proinfo /proinfo emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk /bootloader emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/para /misc emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot /boot emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/recovery /recovery emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/logo /logo emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/expdb /expdb emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/secro /secro emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/seccfg /seccfg emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee1 /tee1 emmc defaults defaults
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee2 /tee2 emmc defaults defaultsI have only one question: Is preloader.bin (extracted with Miracle Box) compatible with SP Flash Tool?
Off course you do not have to flash it if your phone is not dead, but preloader.bin must be present in the ROM folder in order for SP FLash Tool to perform a succesful flash.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
