ROM - Factory Image



  • Hello

    I’m a developer working on a device with Creo Mark 1 similar HW Specs/Components (CPU/GPU/Display/RAM/Storage/Camera Sensor/Battery/etc…).

    Such mobile devices is AMOI L861. You can find related stock & custom roms for instance on NEEDROM (Categories / AMOI / Other Subs).

    I would be interested to check/test Fuel OS 1.6.0.0 or 1.5.0.0 compatibility with such device. Yet I haven’t found until now any public (official or unofficial) repository including such ROM or Factory Image in order to load it through SP Flash Tool.

    May You suggest any links/references or otherwise has anyone provided to dump (i.e. SP Flash Tools) a recent factory image from his device ?

    Besides, sharing/exchanging infos could be useful also to test Custom ROM development for Creo Mark 1 based on L861 references = together with other people I’m working also on optimized Custom Kernel for such HW platform / device tree.

    Thanks.



  • Hello

    A scatter file is required In order to dump current image/partitions of your Mark1 phone.

    In order to so You can follow the full instructions available at :

    where You also find the download links for required drivers & software.

    .
    However, since there are some issues using MTK Droid Tools with devices using MT67xx chipsets, You can also retrieve partition info (useful to manually prepare scatter file) using MTK Engineering Mode available on Play Store :

    Once installed, launch it & access MTK Mode, swipe right to Hardware Testing -> scroll down and select Memory -> EMMC -> and take screenshots of Common Info tab contents and upload them here in order to manually arrange scatter file for MARK 1.

    0_1478601732549_MTK 1440580200571.jpg
    .
    Once We have a scatter file for MARK 1 it will be easier to define how to proceed in order to dump/readback the device & prepare flashing custom rom images.

    .
    P.S.: I’m attaching the IMEI check done for L861 device. It could be useful to check if there is also a manufacturer-sharing between MARK 1 & L861. You can check your IMEI at :

    0_1478373418635_2016-11-01 (1).png



  • Hello

    While waiting for MARK-1 Scatter file submission in order to analyze it, I’m leaving the instructions to dump/readback MARK-1 partition images with SP Flash Tool.
    .
    .
    1. Launch SP Flash Tool , chose Readback label, then click on Add button.

    alt text
    .
    .
    2. Double click on the ticked row in order to open Dialog Window in order to choose the location & name for saved file.

    If for instance You want to save BOOT.IMG , write its name, then on next dialog window write Region (EMMC_USER for all partitions, except PRELOADER.BIN , that has region EMMC_BOOT_1) / Start Address / Length (Size) according to scatter file contents.

    alt text
    .
    .
    3. Once done with first partition, add the other partitions by clicking on Add button & repeating step 2. Remember to use region EMMC_BOOT_1 for preloader.bin .

    Once added all the partitions found in scatter file, click on Readback button.

    alt text
    .
    .
    4. Shutdown your phone & connect via USB cable to your computer (in case of VCOM / ADB driver issues you can download & install package from HERE).

    If everything ok You’ll get the Success Message window.

    alt text
    .
    .
    Using SP Flash Tool Readback You can dump/save all these partitions :

    preloader.bin
    pgpt
    proinfo
    nvram
    protect1
    protect2
    seccfg
    lk.bin
    boot.img
    recovery.img
    secro.img
    para
    logo.bin
    frp
    expdb
    tee1 —> trustzone.bin
    —> use this name
    tee2 —> trustzone2.bin —> use this name
    system.img
    cache.img
    userdata.img
    intsd
    flashinfo
    sgpt



  • Hello

    In order to arrange a flashable package these are the required elements :

    • Scatter File TXT
    • boot.img
    • cache.img
    • lk.bin
    • logo.bin
    • preloader.bin
    • secro.img
    • recovery.img
    • system.img
    • trustzone.bin (or trustzone1.bin - trustzone2.bin according to device)
    • userdata.img

    .
    As I’ve written before, I suggest You to retrieve partition info from Creo MARK 1 through MTK Engineering Mode available on Play Store :

    https://play.google.com/store/apps/details?id=com.themonsterit.EngineerStarter

    Once installed, launch it & access MTK Mode/Settings :

    • Swipe right to Hardware Testing

    • Scroll down and select Memory -> EMMC

    • Take screenshots of Common Info tab contents

    • Upload those screenshots here in order to manually arrange scatter file for MARK 1.

    .
    In order to give You a sample of partition info You can retrieve through MTK Engineering, I’m attaching the partition info I’ve used to arrange scatter file for AMOI L861 device (same CPU / GPU / RAM Memory / Storage / Display / Front&Rear Cameras / Radio of Creo Mark 1) :

    Region = EMMC_USER

    Name - Start - Size

    pgpt - 0x0000000000000000 - 0x0000000000080000
    proinfo - 0x0000000000080000 - 0x0000000000300000
    nvram - 0x0000000000380000 - 0x0000000000500000
    protect1 - 0x0000000000880000 - 0x0000000000a00000
    protect2 - 0x0000000001280000 - 0x0000000000a00000
    seccfg - 0x0000000001c80000 - 0x0000000000040000
    lk - 0x0000000001cc0000 - 0x0000000000060000
    boot - 0x0000000001d20000 - 0x0000000001000000
    recovery - 0x0000000002d20000 - 0x0000000001000000
    secro - 0x0000000003d20000 - 0x0000000000600000
    para - 0x0000000004320000 - 0x0000000000080000
    logo - 0x00000000043a0000 - 0x0000000000800000
    frp - 0x0000000004ba0000 - 0x0000000000100000
    expdb - 0x0000000004ca0000 - 0x0000000000a00000
    tee1 - 0x00000000056a0000 - 0x0000000000500000
    tee2 - 0x0000000005ba0000 - 0x0000000000c60000
    system - 0x0000000006800000 - 0x00000000b0000000
    cache - 0x00000000b6800000 - 0x000000001a800000
    userdata - 0x00000000d1000000 - 0x0000000180000000
    intsd - 0x0000000251000000 - 0x00000004f5b80000
    flashinfo - 0x0000000746b80000 - 0x0000000001000000
    sgpt - 0x0000000747b80000 - 0x0000000000080000

    Region = EMMC_BOOT_1

    Name - Start - Size

    preloader - 0x0000000000000000 - 0x0000000000040000

    .
    Once somebody uploads partition info of its MARK1 (unfortunately I don’t own such device, otherwise I could have already done it) I’ll prepare the right scatter file for MARK1 that will help to backup the device & to flash stock/custom ROMs.



  • It’s showing stock rom should be there and mtk engineering app not found



  • Hi guys am unable to understand make a group so that I can get the instructions what to do



  • 0_1478676433286_Scatterattempt.jpg

    Unable to prepare scatter file



  • Hello

    @Don-Alex , thank you for the first part of the partition table. MTK Droid Tools allows the direct creation of scatter file only with MT65xx rooted devices.

    May You provide please also the other listed partitions after the first 14, that You see scrolling down the ‘Block Info’ window on MTK Droid Tools ?

    .
    Besides, since MTK Droid tool may return wrong partition details for MT67xx devices (officially it doesn’t support them), it can be helpful that we check retrieved values.

    Therefore, please post also the infos You can retrieve from MTK Engineering Mode available on Play Store :

    https://play.google.com/store/apps/details?id=com.themonsterit.EngineerStarter

    Once installed, launch it & access MTK Mode/Settings :

    • Swipe right to Hardware Testing

    • Scroll down and select Memory -> EMMC

    • Take screenshots of Common Info tab contents

    • Upload those screenshots here in order to manually arrange scatter file for MARK 1.

    .
    @Girija-Das In case of download issues of MTK Engineering Mode app from Play Store, I’ve placed a copy of related APK in an online shared folder where I’m saving tools & other stuff useful for MARK-1 analysis / modding :

    In order to install directly with APK package You should enable ‘Unknown Sources’ on MARK-1 (go to Settings > Security).

    .
    @prateek-routray If You have any issues with given instructions, don’t hesitate to provide more details about issues & to ask support here = I’ve opened this topic/discussion on such purpose ;).

    .
    P.S.: Thanks again to everyone for partecipating.



  • @Raw-Main 0_1478687214603_Screenshot_2016-11-09-15-51-46.png
    This happens on clicking MTK mode/settings



  • @Raw-Main 0_1478688016685_Save.jpg
    Here’s the complete list



  • @Raw-Main yes pro bro that’s what’s happening, see that screenshot? Above😧
    We want custom roms like miui so we are trying to cooperate so help us in the process



  • @Girija-Das Exactly



  • Hello

    @Don-Alex thanks for the full MTK Droid Screenshot.

    @Don-Alex and @Girija-Das If You open the phone dialer & dial the EngineerMode Dial Code - see attached image - are You prompted with a similar KO message or does it allow You to access MTK EngineerMode ?

    0_1478691543940_image (2).jpg



  • @Raw-Main doesn’t opens



  • @Raw-Main bro I am waiting till I can get the stock ROM so that I can root and get volte and other stuffs if anything goes wrong I will fix it with your tutorials



  • @Raw-Main That doesn’t work either



  • @Girija-Das and @Don-Alex if developer options are enabled on your device it could mean that a different code is required or even that EngineerMode App isn’t available in /system/app path.

    Sometimes vendors choose to customize access to EngineerMode. Some (such as Xiaomi) allow it tapping several times i.e. on Kernel Version (Settings > About Phone). Others use different EngineerMode dial-codes for their MTK devices, such ones that are available for instance on :

    You can also try a different APK to test EngineerMode access :

    .
    Besides, I’ve already contacted @CREO-Support / @CREO-Team last week by email, asking about Official Factory Image availability or file/instructions to perform emergency firmware flash / device recovery.

    Still no answers = I’ve only received tracking updates from @AzharSaidi and @Swobhagya-Barik for such support ticket.



  • @Raw-Main Can you please mention the device which you found to be similar to Creo Mark 1



  • Hello

    @Don-Alex Such device is AMOI L861 according to IMEI check -> if You and other users want to check also Creo MARK-1’s IMEI You can do so on this free frontend to GSMA ImeiDB access/check :

    0_1478696868024_2016-11-01 (1).png

    I’m working on a L861 re-branded/re-boxed device, that was sold on Italian market - model : STONEX ONE.

    It has the following main HW specifications :

    • CPU : Mediatek Helio X10 MT6795 (2 GHz)
    • GPU : PowerVR G6200
    • RAM / Memory: 3 GB - LPDDR3 / clock 1866 MHz
    • ROM / Storage: 32 GB
    • Display : AGC Dragontrail Glass - 5.5" IPS LCD - QuadHD 2560x1440 (534ppi)
    • Rear Camera : Sony IMX230 - 21MP
    • Front Camera : 8MP FHD
    • Battery : 3000 mAh
    • SD Support : Yes, officially up to 64GB cards
    • Bluetooth : v4.0 + A2DP
    • Wireless : 802.11a/ac/b/g/n
    • GSM/LTE : Quad Band (850/900/1800/1900) + LTE + WCDMA (see IMEI check)
    • Sensors : Accelerometer - Proximity - Light - Gyro - Compass

    .
    I’ve uploaded its stock & custom (pre-rooted + TWRP recovery) roms - Android 5.1 based on NEEDROM (Categories / AMOI / Other Subs).

    Further downloads/references on main repository, that I’m using for such device - https://goo.gl/9GSjzW .

    .
    However, until we don’t manage to have a factory image working package for MARK-1, I wouldn’t suggest to try flashing L861 roms on Creo MARK-1 = without such a package only Creo Service Centers could revert MARK-1 to stock FuelOS rom.

    Besides, it could be useful also to have EngineerMode Access, because it allows to recover lost device IMEI after flash (without being compelled to try with MediaTek SNWrite tool).



  • Hello

    @Don-Alex , @Girija-Das @prateek-routray and everybody else is following this discussion, Partition info retrieved by MTK Droid Tools is NOT right / valid in order to prepare a scatter file (there are overlaps & other EMMC scatter issues).

    Therefore, unless we manage to access EngineerMode (trying with other dial-codes / other APK - see former message), at present time the only way to retrieve right partition info & create a valid scatter file for MARK-1 would be using Miracle Box ( http://www.amiraclebox.com ).

    .
    I haven’t discussed before about such method because :

    • Latest Build Miracle Box 2.39 is NOT officially available at present time = their main & mirror (mediafire) download links for package setup are broken because of malware alert removal. I’ve written to support, but they haven’t replied yet.

    • Standalone Minimalist Build Miracle Box 2.27A is available on some technical websites/boards (such as HOVATEK ), but unfortunately it uses a loader with same malware issues.

    This means that - even using the minimalist build - it would better to launch Miracle Box in a sandboxed environment (using ToolWiz Time Freeze or Sandboxie), unless there could be a dedicated computer without personal data for testing purposes (owing to compatibility issues with full Virtual Machines environments).

    .
    I hope to find / provide an issue-free package soon. Meanwhile I’m leaving anyway the instructions to create the scatter file & also backup directly preloader + partitions/images.

    Requirements : MTK VCOM drivers. If not installed, You can download the full package (MTK VCOM + ADB) from https://goo.gl/9GSjzW - Tools subfolder .

    .
    1. Launch Miracle Box & wait until its dashboard finishes loading.

    0_1478714643048_Miracle-Box-1.jpg

    2. Click the MTK tab & tick on ‘Read’.

    0_1478714719296_Miracle-Box-3.jpg

    3. Select MT6795 or MT67xx chipset from the Boot Select scrolldown menu.

    0_1478714894080_Miracle-Box-4.jpg

    4. Tick on ‘Save as scatter file’ and click on Start button.

    0_1478715102458_Miracle-Box-5a.jpg

    5. You should now see >> Waiting for USB Port at the bottom left corner.

    Connect the phone to the PC (must be switched off), then press the Power button just once (to ensure that your device is detected immediately).

    DO NOT hold down the power button else the phone will boot up normally.

    0_1478715217215_Miracle-Box-6.jpg

    6. Select which block / partition you would like to backup. Tick all if you want a full firmware backup / dump or tick only Preloader / Boot / Cache / LK / Logo / Recovery / Secro / System / Trustzone(1-2) / Userdata (to prepare minimal flash image) then click OK.

    Select folder for savings and click OK.

    0_1478715545871_Miracle-Box-8a.jpg

    7. Miracle Box will begin backup process. Once finished it will prompt with a Done / Success message, afterwards you can disconnect the phone.

    .

    The resulting scatter file will require some changes in order to be compatible with SP Flash Tool for Dump/Readback & Flash/Download ROM :

    • Replace string config_version: V1.1.1 to config_version: V1.1.2

    • Change the extensions from bin to img for the following files inside savings folder : Boot / Cache / Recovery / Secro / System / Userdata.
      Then, change the file_name line in the scatter file for these files accordingly & check that these partitions have set the following attributes :
      type: NORMAL ROM
      operation_type: UPDATE

    • Remove the bin extensions for the following files (if backupped) : Pgpt / Proinfo / Nvram / Protect1 / Protect2 / Para / Expdb / Seccfg / Oemkeystore / Keystore / Frp / Nvdata / Metadata / Flashinfo.
      Change the file_name line in the scatter file for these files to NONE.



  • @Raw-Main Thanks for the instructions , will try in a sandboxed environment.



  • @Don-Alex okay bro make us know if you succeed everything’s going above my head😲😒actually i don’t have a dedicated computer so i hope if you can do it perfectly



  • @Raw-Main hey bro if you get the fuel os rom will u be able to make miui 8 stable rom for us?



  • Hello

    @Don-Alex thanks for your cooperation ;) .

    .
    @Girija-Das once we manage to get a full dump (scatter + images/partitions) of stock FuelOS MARK-1 ROM, we’ll have everything that is required to :

    • A. safely revert to stock without taking the device to a service center

    • B. restore MARK-1 IMEI 1&2 (using MTK SNWrite or MAUI Meta 3G Tools) if MTK Engineer Mode couldn’t be available on MARK-1 even with alternative digit strings or apps

    • C. extract kernel image & libraries / config files, that are required to port CyanogenMod, MIUI, custom roms from other devices with MT6795 chipset & similar HW specs (or even quite the same such as AMOI L861).

    .
    Owing to the lack of any official stock firmware download link / retrieval instructions, we must proceed carefully.



  • @Don-Alex bro please tell it is a success it’s our chance to go into a stable miui rom if succeed then





  • @Raw-Main i will follow this one if he fails to do it



  • Hello

    @Girija-Das however such ADB procedure requires a rooted device in order to dump all partitions & has the following issues :

    • A. it doesn’t provide a scatter file

    • B. device doesn’t boot usign preloader dumped image with such procedure

    So it could be useful for backup purposes, but it’s not enough to build a full flashable ROM image.

    .
    Besides, @CREO-Support has just confirmed that doesn’t provide neither any factory image nor even GPL source code (devoid of CREO’s specific code) = therefore the only way to get required files for factory/stock image is retrieving/dumping them from MARK-1 devices.



  • @Raw-Main if there was any full tutorial i can do it easily but i saw a video on YouTube that says how to backup or dump full 64bit mtk devices, but it will be uploaded in sometime it said



  • Hello

    @Girija-Das & @Don-Alex in addition to the instructions I’ve posted before for Miracle Box, You can also check Hovatek’s demo video for version 2.27A on Youtube :

    .
    I confirm that Miracle Box gets the job well done (full backup/dump + scatter), but unfortunately it requires to be launched in a sandboxed or dedicated environment .

    .
    In the end I’ve also managed to get Miracle Box 2.27A working on a Virtualbox VM with Guest OS Windows7 32bit (check VM trial images directly provided by Microsoft - LINK - if You don’t have one), but - besides installing VCOM/ADB Drivers & Miracle Box on Guest OS - it required to :

    .
    This third method works & bypass Anti-VM protection used by Miracle Box’s code. However - owing to its complexity - I don’t suggest it as first one to try in order to have a protected environment.



  • @Raw-Main As soon as I connect the phone (switched off) , the MTK VCOM port displays as connected.
    But when the charging logo app appears the device gets disconnected . I managed to install the drivers properly and the phone appears as connected via Vcom port for a short period of time (ie: till it vibrates and shows the charging logo). Removing the battery may work , but then again , it has a non removable battery
    Can u suggest a solution…Rest of the things are fine
    Thanks.


Log in to reply