Polaroid Link A6 Unlocked Smartphone
2016, May 28
Random notes and tidbits about this device.
Polaroid Link A6 Specifications Brand Polaroid Name Link A6 Type A6 Launch 2015 Body Weight 136 g Dimensions 165.1 x 83.8 x 7.7 mm Colors Black, White SIM type Mini SIM, Micro SIM System OS Android OS v4.4 (KitKat) Chipset Mediatek MT8312 CPU Dual-core 1.2 GHz Cortex-A7 GPU Mali-400 MP1 Display Technology IPS Size 6 inches Resolution 540 x 960 pixels Multitouch yes Memory RAM 1 GB Internal storage 8 GB External storage microSD Camera Front camera 2 MP Rear camera 5 MP, 2560 x 1920 pixels Flash LED Connectivity GSM 850 / 900 / 1800 / 1900 Network 2G / 3G / 4G WLAN Wi-Fi 802.11 b/g/n Bluetooth v4.0, A2DP GPS A-GPS NFC no FM radio no USB microUSB 2.0 Audio 3.5 mm jack Battery Type Li-Ion 2100 mAh Features Sensors Accelerometer Specials Dual SIM
MTK Droid & Root Tools v2.53 Hardware : MT6582 (MT8312 is Fake!) Model : A6 Build number : A6_20151012 Build date UTC : 20151012-031904 Android v : 4.4.2 Baseband v: MOLY.WR8.W1315.MD.WG.MP.V54.P3, 2014/12/23 09:41 Kernel v : 3.4.67 (jenkins@buildserver7) (gcc version 4.7 (GCC) ) #1 SMP Mon Oct 12 10:15:46 CST 2015
shell@A6:/ $ cat /proc/cpuinfo Processor : ARMv7 Processor rev 3 (v7l) processor : 0 BogoMIPS : 2590.72 processor : 1 BogoMIPS : 2590.72 Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x0 CPU part : 0xc07 CPU revision : 3 Hardware : MT8312 Revision : 0000 Serial : 0000000000000000
root@A6:/ # cat /system/build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=KOT49H
ro.build.display.id=ALPS.KK1.MP1.V2.38
ro.build.version.incremental=vH80HG
ro.custom.build.version=vH80HG
ro.build.version.sdk=19
ro.build.version.codename=REL
ro.build.version.release=4.4.2
ro.build.date=Mon Oct 12 11:19:04 CST 2015
ro.build.date.utc=1444619944
ro.build.type=user
ro.build.user=jenkins
ro.build.host=buildserver7
ro.build.tags=release-keys
ro.product.model=q600
ro.product.brand=alps
ro.product.name=q600
ro.product.device=A6
ro.product.board=q600
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=alps
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=
# ro.build.product is obsolete; use ro.product.device
ro.build.product=q600
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=q600-user 4.4.2 KOT49H vH80HG release-keys
ro.build.fingerprint=Polaroid/A6/A6:4.4.2/KOT49H/1428031180:user/release-keys
ro.build.flavor=
ro.build.characteristics=phone
# end build properties
# begin mediatek build properties
ro.mediatek.version.release=ALPS.KK1.MP1.V2.38
ro.mediatek.platform=MT6582
ro.mediatek.chip_ver=S01
ro.mediatek.version.branch=KK1.MP1
ro.mediatek.version.sdk=2
# end mediatek build properties
#
# from out/target/product/q600/obj/CUSTGEN/config/system.prop
#
#
# system.prop for generic sdk
#
rild.libpath=/system/lib/mtk-ril.so
rild.libargs=-d /dev/ttyC0
# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }
# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}
# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}
#ro.sf.lcd_density=200
#add for input point
ro.sf.offset=8
#
wifi.tethering.interface=ap0
#
ro.opengles.version=131072
wifi.direct.interface=p2p0
dalvik.vm.heapgrowthlimit=128m
dalvik.vm.heapsize=256m
# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0
# Power off opt in IPO
sys.ipo.pwrdncap=2
# Switching Menu of Mass storage and MTP
ro.sys.usb.storage.type=mtp,mass_storage
# USB BICR function
ro.sys.usb.bicr=yes
# USB Charge only function
ro.sys.usb.charging.only=yes
# audio
ro.camera.sound.forced=0
ro.audio.silent=0
ro.zygote.preload.enable=0
ro.config.pppoe_enable=1
# yuhuan 20140901 add
ro.camera.full.preview=true
#
# ADDITIONAL_BUILD_PROPERTIES
#
persist.gemini.sim_num=2
ro.gemini.smart_sim_switch=false
ro.gemini.smart_3g_switch=1
ril.specific.sm_cause=0
bgw.current3gband=0
ril.external.md=0
ro.btstack=blueangel
ro.sf.hwrotation=0
ril.current.share_modem=2
launcherplus.allappsgrid=2d
curlockscreen=1
ro.mediatek.gemini_support=true
drm.service.enabled=true
fmradio.driver.enable=1
ril.first.md=1
ril.flightmode.poweroffMD=1
ril.telephony.mode=0
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
persist.mtk.anr.mechanism=1
mediatek.wlan.chip=mediatek.wlan.module.postfix=_
ril.radiooff.poweroffMD=0
ro.config.notification_sound=Proxima.ogg
ro.config.alarm_alert=Alarm_Beep_03.ogg
ro.config.ringtone=Backroad.ogg
persist.mtk.wcn.combo.chipid=-1
ro.fota.oem=MTK_KK
ro.fota.platform=MTK_KK
ro.fota.type=phone
ter.service.enable=0
mediatek.extmd.usbport=0
ro.lte.dc.support=0
ril.active.md=0
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=4.4_r6
ro.custom.modem=3GS2B2B4B5
persist.sys.dalvik.vm.lib=libdvm.so
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
shell@A6:/ $ getprop [af.policy.r_submix_prio_adjust]: [0] [bgw.current3gband]: [0] [bluetooth.HostName]: [Polaroid] [curlockscreen]: [1] [dalvik.vm.heapgrowthlimit]: [128m] [dalvik.vm.heapsize]: [256m] [dalvik.vm.mtk-stack-trace-file]: [/data/anr/mtk_traces.txt] [dalvik.vm.mtk-vm-version]: [0x01] [dalvik.vm.stack-trace-file]: [/data/anr/traces.txt] [debug.MB.running]: [0] [debug.force_rtl]: [0] [debug.hwc.compose_level]: [0] [debug.hwui.render_dirty_regions]: [false] [debug.libMali.patch]: [ALPS01627084] [debug.log2sd.defaultpath]: [internal_sd] [debug.mdlogger.Running]: [0] [debug.mtklog.netlog.Running]: [0] [debug.sf.busyswap]: [1] [debug.st.aux_support]: [0] [dev.bootcomplete]: [1] [dhcp.ipv6.wlan0.dns1]: [] [dhcp.ipv6.wlan0.dns2]: [] [dhcp.ipv6.wlan0.ipaddress]: [] [dhcp.ipv6.wlan0.leasetime]: [] [dhcp.ipv6.wlan0.result]: [] [dhcp.wlan0.dns1]: [XXXXXXXXXXXXX] [dhcp.wlan0.dns2]: [] [dhcp.wlan0.dns3]: [] [dhcp.wlan0.dns4]: [] [dhcp.wlan0.domain]: [] [dhcp.wlan0.gateway]: [XXXXXXXXXXXX] [dhcp.wlan0.ipaddress]: [XXXXXXXXXX] [dhcp.wlan0.leasetime]: [86400] [dhcp.wlan0.mask]: [255.255.255.0] [dhcp.wlan0.mtu]: [] [dhcp.wlan0.pid]: [942] [dhcp.wlan0.reason]: [REBOOT] [dhcp.wlan0.result]: [ok] [dhcp.wlan0.server]: [XXXXXXXXXXX] [dhcp.wlan0.vendorInfo]: [] [drm.service.enabled]: [true] [external_sd_path]: [/storage/sdcard1] [fmradio.driver.enable]: [1] [gsm.3gswitch]: [1] [gsm.baseband.capability2]: [3] [gsm.baseband.capability]: [55] [gsm.current.phone-type]: [1] [gsm.gcf.testmode]: [0] [gsm.network.type]: [unknown] [gsm.operator.alpha.2]: [] [gsm.operator.alpha]: [] [gsm.operator.iso-country.2]: [] [gsm.operator.iso-country]: [] [gsm.operator.isroaming.2]: [false] [gsm.operator.isroaming]: [false] [gsm.operator.numeric.2]: [] [gsm.operator.numeric]: [] [gsm.phone.created]: [true] [gsm.project.baseband.2]: [TOPWISE82_TB_2_KK_HSPA_HW(DEFAULT)] [gsm.project.baseband]: [TOPWISE82_TB_2_KK_HSPA_HW(DEFAULT)] [gsm.ril.eboot]: [-1] [gsm.ril.uicctype.2]: [] [gsm.ril.uicctype]: [] [gsm.roaming.indicator.needed.2]: [false] [gsm.roaming.indicator.needed]: [false] [gsm.serial]: [XXXXXXXXXXXXXXXX] [gsm.sim.inserted]: [0] [gsm.sim.operator.default-name.2]: [] [gsm.sim.operator.default-name]: [] [gsm.sim.retry.pin1.2]: [] [gsm.sim.retry.pin1]: [] [gsm.sim.retry.pin2.2]: [] [gsm.sim.retry.pin2]: [] [gsm.sim.retry.puk1.2]: [] [gsm.sim.retry.puk1]: [] [gsm.sim.retry.puk2.2]: [] [gsm.sim.retry.puk2]: [] [gsm.sim.ril.phbready.2]: [true] [gsm.sim.ril.phbready]: [false] [gsm.sim.state.2]: [ABSENT] [gsm.sim.state]: [ABSENT] [gsm.siminfo.ready]: [true] [gsm.version.baseband]: [MOLY.WR8.W1315.MD.WG.MP.V54.P3, 2014/12/23 09:41] [gsm.version.ril-impl]: [mtk gemini ril 1.0] [init.svc.DMAgent]: [running] [init.svc.GoogleOtaAgent]: [running] [init.svc.MtkCodecService]: [running] [init.svc.NvRAMAgent]: [running] [init.svc.PPLAgent]: [running] [init.svc.aal]: [running] [init.svc.adbd]: [running] [init.svc.agpsd]: [running] [init.svc.batterywarning]: [running] [init.svc.bootanim]: [stopped] [init.svc.bootlogoupdater]: [stopped] [init.svc.ccci_fsd]: [running] [init.svc.ccci_mdinit]: [running] [init.svc.chmod_media]: [stopped] [init.svc.conn_launcher]: [running] [init.svc.debuggerd]: [running] [init.svc.dhcpcd_wlan0]: [running] [init.svc.drm]: [running] [init.svc.drvbd]: [running] [init.svc.emsvr_user]: [running] [init.svc.enableswap]: [stopped] [init.svc.flash_recovery]: [stopped] [init.svc.fotabinder]: [running] [init.svc.gsm0710muxd]: [running] [init.svc.healthd]: [running] [init.svc.installd]: [running] [init.svc.keystore]: [running] [init.svc.matv]: [running] [init.svc.mdlogger]: [running] [init.svc.media]: [running] [init.svc.mobile_log_d]: [running] [init.svc.msensord]: [stopped] [init.svc.mtkbt]: [running] [init.svc.netd]: [running] [init.svc.netdiag]: [running] [init.svc.nvram_daemon]: [stopped] [init.svc.p2p_supplicant]: [running] [init.svc.poad]: [stopped] [init.svc.pq]: [stopped] [init.svc.readsn]: [stopped] [init.svc.ril-daemon]: [running] [init.svc.sbchk]: [stopped] [init.svc.sdcard]: [running] [init.svc.servicemanager]: [running] [init.svc.setusbmsg]: [stopped] [init.svc.sn]: [stopped] [init.svc.surfaceflinger]: [running] [init.svc.terservice]: [stopped] [init.svc.thermal]: [running] [init.svc.thermal_manager]: [stopped] [init.svc.thermald]: [running] [init.svc.ueventd]: [running] [init.svc.vold]: [running] [init.svc.vtservice]: [running] [init.svc.wlanLoader]: [stopped] [init.svc.wmtLoader]: [stopped] [init.svc.xlogboot]: [stopped] [init.svc.xlogdebugchanged]: [stopped] [init.svc.zygote]: [running] [internal_sd_path]: [/storage/sdcard0] [launcherplus.allappsgrid]: [2d] [media.wfd.video-format]: [5] [mediatek.extmd.usbport]: [0] [mediatek.wlan.chip]: [mediatek.wlan.module.postfix=_] [mediatek.wlan.ctia]: [0] [mtk_wifi.fw_path]: [STA] [mux.report.case]: [0] [net.bt.name]: [Android] [net.change]: [net.dns2] [net.dns1]: [XXXXXXXXXXXX] [net.dns2]: [XXXXXXXXXXXX] [net.hostname]: [XXXXXXXXXXXX] [net.qtaguid_enabled]: [1] [net.tcp.buffersize.default]: [4096,87380,524288,4096,16384,524288] [net.tcp.buffersize.edge]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.gprs]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.hsdpa]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.hspa]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.hspap]: [4094,87380,1220608,4096,16384,1220608] [net.tcp.buffersize.hsupa]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.lte]: [524288,1048576,2560000,262144,524288,1048576] [net.tcp.buffersize.umts]: [4094,87380,524288,4096,16384,524288] [net.tcp.buffersize.wifi]: [524288,1048576,2097152,262144,524288,1048576] [nvram_init]: [Ready] [persist.bt.fwdump]: [0] [persist.first_boot]: [0] [persist.gemini.sim_num]: [2] [persist.mtk.aee.aed]: [on] [persist.mtk.anr.mechanism]: [1] [persist.mtk.wcn.combo.chipid]: [0x6582] [persist.radio.default_sim]: [0] [persist.radio.default_sim_mode]: [20] [persist.ril.cfu.querytype]: [] [persist.service.acm.enable]: [] [persist.service.adb.enable]: [] [persist.sys.country]: [US] [persist.sys.dalvik.vm.lib]: [libdvm.so] [persist.sys.first_time_boot]: [false] [persist.sys.language]: [en] [persist.sys.mute.state]: [2] [persist.sys.profiler_ms]: [0] [persist.sys.sd.defaultpath]: [/storage/emulated/0] [persist.sys.timezone]: [America/New_York] [persist.sys.usb.config]: [mtp,adb] [ril.active.md]: [0] [ril.current.share_modem]: [2] [ril.ecclist2]: [] [ril.ecclist]: [] [ril.external.md]: [0] [ril.first.md]: [1] [ril.flightmode.poweroffMD]: [1] [ril.iccid.sim1]: [N/A] [ril.iccid.sim2]: [N/A] [ril.radiooff.poweroffMD]: [0] [ril.ready.sim]: [false] [ril.specific.sm_cause]: [0] [ril.telephony.mode]: [0] [rild.libargs]: [-d /dev/ttyC0] [rild.libpath]: [/system/lib/mtk-ril.so] [ro.adb.secure]: [1] [ro.allow.mock.location]: [0] [ro.audio.silent]: [0] [ro.baseband]: [unknown] [ro.board.platform]: [] [ro.boot.serialno]: [XXXXXXXXXXX] [ro.bootloader]: [unknown] [ro.bootmode]: [unknown] [ro.btstack]: [blueangel] [ro.build.characteristics]: [phone] [ro.build.date.utc]: [1444619944] [ro.build.date]: [Mon Oct 12 11:19:04 CST 2015] [ro.build.description]: [A6-user 4.4.2 KOT49H vH80HG release-keys] [ro.build.display.id]: [A6_20151012] [ro.build.fingerprint]: [Polaroid/A6/A6:4.4.2/KOT49H/1428031180:user/release-keys] [ro.build.flavor]: [] [ro.build.host]: [buildserver7] [ro.build.id]: [KOT49H] [ro.build.product]: [A6] [ro.build.tags]: [release-keys] [ro.build.type]: [user] [ro.build.user]: [jenkins] [ro.build.version.codename]: [REL] [ro.build.version.incremental]: [vH80HG] [ro.build.version.release]: [4.4.2] [ro.build.version.sdk]: [19] [ro.camera.full.preview]: [true] [ro.camera.sound.forced]: [0] [ro.com.google.clientidbase]: [android-polaroid] [ro.com.google.gmsversion]: [4.4_r6] [ro.config.alarm_alert]: [Alarm_Beep_03.ogg] [ro.config.low_ram]: [false] [ro.config.notification_sound]: [Proxima.ogg] [ro.config.pppoe_enable]: [1] [ro.config.ringtone]: [Backroad.ogg] [ro.crypto.fs_flags]: [0x00000406] [ro.crypto.fs_mnt_point]: [/data] [ro.crypto.fs_options]: [noauto_da_alloc,discard] [ro.crypto.fs_real_blkdev]: [/emmc@usrdata] [ro.crypto.fs_type]: [ext4] [ro.crypto.fuse_sdcard]: [true] [ro.crypto.state]: [unencrypted] [ro.custom.build.version]: [vH80HG] [ro.custom.hide_software_updates]: [true] [ro.custom.modem]: [XXXXXXXXXX] [ro.custom.product.device]: [Q600-8382] [ro.custom.screen_off_timeout]: [120000] [ro.debuggable]: [0] [ro.factorytest]: [0] [ro.fota.oem]: [MTK_KK] [ro.fota.platform]: [MTK_KK] [ro.fota.type]: [phone] [ro.gemini.smart_3g_switch]: [1] [ro.gemini.smart_sim_switch]: [false] [ro.hardware]: [mt8312] [ro.lte.dc.support]: [0] [ro.mediatek.chip_ver]: [S01] [ro.mediatek.gemini_support]: [true] [ro.mediatek.platform]: [MT6582] [ro.mediatek.version.branch]: [KK1.MP1] [ro.mediatek.version.release]: [ALPS.KK1.MP1.V2.38] [ro.mediatek.version.sdk]: [2] [ro.mediatek.wlan.p2p]: [1] [ro.mediatek.wlan.wsc]: [1] [ro.mount.fs]: [EXT4] [ro.mtk.hardware]: [mt6582] [ro.mtprof.disable]: [1] [ro.opengles.version]: [131072] [ro.persist.partition.support]: [no] [ro.product.board]: [A6] [ro.product.brand]: [Polaroid] [ro.product.cpu.abi2]: [armeabi] [ro.product.cpu.abi]: [armeabi-v7a] [ro.product.device]: [A6] [ro.product.locale.language]: [en] [ro.product.locale.region]: [US] [ro.product.manufacturer]: [Southern Telecom] [ro.product.model]: [A6] [ro.product.name]: [A6] [ro.revision]: [0] [ro.runtime.firstboot]: [1464292803813] [ro.secure]: [1] [ro.serialno]: [XXXXXXXXXXXXXXXXXXX] [ro.setupwizard.mode]: [OPTIONAL] [ro.sf.hwrotation]: [0] [ro.sf.lcd_density]: [240] [ro.sf.offset]: [8] [ro.sys.usb.bicr]: [yes] [ro.sys.usb.charging.only]: [yes] [ro.sys.usb.mtp.whql.enable]: [0] [ro.sys.usb.storage.type]: [mtp,mass_storage] [ro.wifi.channels]: [] [ro.zygote.preload.enable]: [0] [service.bootanim.exit]: [1] [service.sf.status]: [1] [supolicy.loaded]: [1] [sys.boot.reason]: [0] [sys.boot_completed]: [1] [sys.ipo.pwrdncap]: [2] [sys.ipowin.done]: [1] [sys.settings_secure_version]: [2] [sys.sysctl.extra_free_kbytes]: [6075] [sys.usb.config]: [mtp,adb] [sys.usb.mtpConnect]: [mtpConnection] [sys.usb.state]: [mtp,adb] [sys.usb.vid]: [0BB4] [ter.service.enable]: [0] [vold.post_fs_data_done]: [1] [vold_swap_state]: [0] [wifi.direct.interface]: [p2p0] [wifi.interface]: [wlan0] [wifi.tethering.interface]: [ap0] [wlan.driver.status]: [ok] [wlan.wfd.security.image]: [1]
shell@A6:/ $ df Filesystem Size Used Free Blksize /dev 482.0M 128.0K 481.9M 4096 /sys/fs/cgroup 482.0M 12.0K 482.0M 4096 /mnt/secure 482.0M 0.0K 482.0M 4096 /mnt/asec 482.0M 0.0K 482.0M 4096 /mnt/obb 482.0M 0.0K 482.0M 4096 /mnt/media_rw 482.0M 0.0K 482.0M 4096 /storage/usbotg 482.0M 0.0K 482.0M 4096 /storage/emulated 482.0M 0.0K 482.0M 4096 /custom 295.3M 171.0M 124.3M 4096 /system 885.8M 840.3M 45.5M 4096 /data 5.8G 353.3M 5.5G 4096 /cache 123.0M 4.1M 119.0M 4096 /protect_f 8.8M 4.1M 4.8M 4096 /protect_s 8.8M 4.0M 4.8M 4096 /mnt/cd-rom 18.4M 18.4M 0.0K 2048 /mnt/shell/emulated 5.8G 353.3M 5.4G 4096
shell@A6:/ $ cat /proc/partitions major minor #blocks name 7 0 18834 loop0 253 0 524288 zram0 179 0 7601664 mmcblk0 179 1 1 mmcblk0p1 179 2 10240 mmcblk0p2 179 3 10240 mmcblk0p3 179 4 6144 mmcblk0p4 179 5 307200 mmcblk0p5 179 6 921600 mmcblk0p6 179 7 129024 mmcblk0p7 179 8 6180864 mmcblk0p8 179 64 4096 mmcblk0boot1 179 32 4096 mmcblk0boot0
root@A6:/ # cat /proc/emmc partno: start_sect nr_sects partition_name emmc_p1: 00000400 00000002 "ebr1" emmc_p2: 00004800 00005000 "protect_f" emmc_p3: 00009800 00005000 "protect_s" emmc_p4: 00014c00 00003000 "sec_ro" emmc_p5: 00019c00 00096000 "custom" emmc_p6: 000b4c00 001c2000 "android" emmc_p7: 00276c00 0003f000 "cache" emmc_p8: 002b5c00 00bca000 "usrdata"
root@A6:/dev/block/platform/mtk-msdc.0 # ls -la drwxr-xr-x root root 2009-12-31 19:21 by-num lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0 -> /dev/block/mmcblk0 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0boot0 -> /dev/block/mmcblk0boot0 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0boot1 -> /dev/block/mmcblk0boot1 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p1 -> /dev/block/mmcblk0p1 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p2 -> /dev/block/mmcblk0p2 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p3 -> /dev/block/mmcblk0p3 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p4 -> /dev/block/mmcblk0p4 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p5 -> /dev/block/mmcblk0p5 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p6 -> /dev/block/mmcblk0p6 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p7 -> /dev/block/mmcblk0p7 lrwxrwxrwx root root 2009-12-31 19:21 mmcblk0p8 -> /dev/block/mmcblk0p8fff
shell@A6:/dev/block/platform/mtk-msdc.0 $ cat /proc/dumchar_info Part_Name Size StartAddr Type MapTo preloader 0x0000000001400000 0x0000000000000000 2 /dev/misc-sd mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0 ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1 pro_info 0x0000000000300000 0x0000000000100000 2 /dev/block/mmcblk0 nvram 0x0000000000500000 0x0000000000400000 2 /dev/block/mmcblk0 protect_f 0x0000000000a00000 0x0000000000900000 2 /dev/block/mmcblk0p2 protect_s 0x0000000000a00000 0x0000000001300000 2 /dev/block/mmcblk0p3 seccfg 0x0000000000020000 0x0000000001d00000 2 /dev/block/mmcblk0 uboot 0x0000000000060000 0x0000000001d20000 2 /dev/block/mmcblk0 bootimg 0x0000000000600000 0x0000000001d80000 2 /dev/block/mmcblk0 recovery 0x0000000000600000 0x0000000002380000 2 /dev/block/mmcblk0 sec_ro 0x0000000000600000 0x0000000002980000 2 /dev/block/mmcblk0p4 misc 0x0000000000080000 0x0000000002f80000 2 /dev/block/mmcblk0 logo 0x0000000000300000 0x0000000003000000 2 /dev/block/mmcblk0 ebr2 0x0000000000080000 0x0000000003300000 2 /dev/block/mmcblk0 custom 0x0000000012c00000 0x0000000003380000 2 /dev/block/mmcblk0p5 expdb 0x0000000000a00000 0x0000000015f80000 2 /dev/block/mmcblk0 android 0x0000000038400000 0x0000000016980000 2 /dev/block/mmcblk0p6 cache 0x0000000007e00000 0x000000004ed80000 2 /dev/block/mmcblk0p7 usrdata 0x0000000179400000 0x0000000056b80000 2 /dev/block/mmcblk0p8 bmtpool 0x0000000001500000 0x00000000febf00a8 2 /dev/block/mmcblk0 Part_Name:Partition name you should open; Size:size of partition StartAddr:Start Address of partition; Type:Type of partition(MTD=1,EMMC=2) MapTo:actual device you operate
shell@A6:/ $ mount rootfs / rootfs ro,seclabel,relatime 0 0 tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0 devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0 proc /proc proc rw,relatime 0 0 sysfs /sys sysfs rw,seclabel,relatime 0 0 selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0 none /acct cgroup rw,relatime,cpuacct 0 0 none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0 tmpfs /mnt/secure tmpfs rw,seclabel,relatime,mode=700 0 0 tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0 tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0 none /dev/cpuctl cgroup rw,relatime,cpu 0 0 tmpfs /mnt/media_rw tmpfs rw,seclabel,relatime,mode=755,uid=1000,gid=1000 0 0 tmpfs /storage/usbotg tmpfs rw,seclabel,relatime,mode=755,uid=1000,gid=1000 0 0 tmpfs /storage/emulated tmpfs rw,seclabel,relatime,mode=755,uid=1023,gid=1023 0 0 emmc@custom /custom ext4 ro,seclabel,noatime,noauto_da_alloc,commit=1,data=ordered 0 0 /emmc@android /system ext4 ro,seclabel,noatime,noauto_da_alloc,commit=1,data=ordered 0 0 /emmc@usrdata /data ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0 /emmc@cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0 /emmc@protect_f /protect_f ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0 /emmc@protect_s /protect_s ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0 /dev/block/loop0 /mnt/cd-rom iso9660 ro,relatime 0 0 /dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
root@A6:/ # cat /proc/cmdline console=ttyMT0,921600n1 vmalloc=496M slub_max_order=0 lcm=1-p600_rm68191_qhd_dsi_vdo fps=5194 bootprof.pl_t=405 bootprof.lk_t=1481 hw_info=XXXXXXXXXXXXX printk.disable_uart=1 boot_reason=0
fastboot getvar all (bootloader) partition-size:userdata: 32000000 (bootloader) partition-type:userdata: ext4 (bootloader) partition-size:cache: 7e00000 (bootloader) partition-type:cache: ext4 (bootloader) partition-size:system: 38400000 (bootloader) partition-type:system: ext4 (bootloader) partition-size:expdb: a00000 (bootloader) partition-type:expdb: raw data (bootloader) partition-size:custom: 12c00000 (bootloader) partition-type:custom: ext4 (bootloader) partition-size:ebr2: 80000 (bootloader) partition-type:ebr2: raw data (bootloader) partition-size:logo: 300000 (bootloader) partition-type:logo: raw data (bootloader) partition-size:misc: 80000 (bootloader) partition-type:misc: raw data (bootloader) partition-size:sec_ro: 600000 (bootloader) partition-type:sec_ro: ext4 (bootloader) partition-size:recovery: 600000 (bootloader) partition-type:recovery: raw data (bootloader) partition-size:boot: 600000 (bootloader) partition-type:boot: raw data (bootloader) partition-size:uboot: 60000 (bootloader) partition-type:uboot: raw data (bootloader) partition-size:seccfg: 20000 (bootloader) partition-type:seccfg: raw data (bootloader) partition-size:protect_s: a00000 (bootloader) partition-type:protect_s: ext4 (bootloader) partition-size:protect_f: a00000 (bootloader) partition-type:protect_f: ext4 (bootloader) partition-size:nvram: 500000 (bootloader) partition-type:nvram: raw data (bootloader) partition-size:pro_info: 300000 (bootloader) partition-type:pro_info: raw data (bootloader) partition-size:ebr1: 80000 (bootloader) partition-type:ebr1: raw data (bootloader) partition-size:mbr: 80000 (bootloader) partition-type:mbr: raw data (bootloader) partition-size:preloader: 1400000 (bootloader) partition-type:preloader: raw data (bootloader) kernel: lk (bootloader) product: Q600 (bootloader) version: 0.5 all: Done!! finished. total time: 0.150s
Fastboot does not support some common commands. The following does not work as intended:
fastboot recovery image.img
fastboot boot image.img
fastboot flash recovery recovery.img sending 'recovery' (6144 KB)... OKAY [ 0.233s] writing 'recovery'... FAILED (remote: partition 'recovery' not support flash) finished. total time: 0.247s
Mediatek devices add a specific header to their ramdisk/kernel so you'll need to find a tool that can handle these images or strip/add the header manually.
Most drivers were installed automatically on windows 7 but you may need to find and install some yourself. You will definitely need the Mediatek usb vcom drivers for different things.
Enable developer tools
- Settings on device
- About phone
- Tap build number 7 times
- You are now developer popup
- Go back
- Now have developer options
- Usb debugging enable
- Verify apps over usb disable
Root
I normally create an insecure boot image for the device, boot that and start pushing the required tools to the device using adb. This device does not allow the booting of images via fastboot ie. fastboot boot boot.img.
You can create this insecure image and flash it directly to the device ie. fastboot flash boot boot.img but there is an even easier way thanks to an exploit.
You can run this directly or put it in a shell/batch file.
adb shell "getprop ro.secure 1" adb shell "setprop ro.secure 0" adb shell "getprop ro.secure 0" adb shell "exit" adb shell "setprop ro.debuggable 0" adb shell "getprop ro.debuggable 0" adb shell "exit" adb usb
The device will usually hang so press ctrl-c, disconnect the usb cable to the device, reconnect the cable and upon issuing an adb shell command you will have root. Scary.
Now you can push the required files to the device for root access.
You'll need to source the files from the supersu zip, I was currently using UPDATE-SuperSU-v2.65-20151226141550.zip. Busybox can be found elsewhere.
I must note that su/supersu has changed quite a bit since I was doing this on older different devices. You used to be able to simply push su to the device and that was it. Not anymore, you must push many more files along with their attributes now.
adb shell "mount -o rw,remount -t ext4 /dev/block/mmcblk0p8 /system" adb shell mkdir /system/bin/.ext >null adb shell mkdir /system/etc/init.d >null adb push supersu_manual/armv7/su /system/xbin/daemonsu adb push supersu_manual/armv7/su /system/xbin/su adb push supersu_manual/armv7/su /system/bin/.ext/.su adb push supersu_manual/common/Superuser.apk /system/app/Superuser.apk adb push supersu_manual/common/install-recovery.sh /system/etc/install-recovery.sh adb push supersu_manual/common/99SuperSUDaemon /system/etc/init.d/99SuperSUDaemon adb push busybox /system/xbin/busybox adb shell /system/xbin/busybox touch /system/etc/.installed_su_daemon adb shell chown root.root /system/bin/.ext adb shell chown root.root /system/bin/.ext/.su adb shell chown root.root /system/xbin/su adb shell chown root.root /system/xbin/daemonsu adb shell chown root.root /system/etc/install-recovery.sh adb shell chown root.root /system/etc/init.d/99SuperSUDaemon adb shell chown root.root /system/etc/.installed_su_daemon adb shell chown root.root /system/app/Superuser.apk adb shell chown root.root /system/xbin/busybox adb shell chmod 0777 /system/bin/.ext adb shell chmod 06755 /system/bin/.ext/.su adb shell chmod 06755 /system/xbin/su adb shell chmod 0755 /system/xbin/daemonsu adb shell chmod 0755 /system/etc/install-recovery.sh adb shell chmod 0755 /system/etc/init.d/99SuperSUDaemon adb shell chmod 0644 /system/etc/.installed_su_daemon adb shell chmod 0644 /system/app/Superuser.apk adb shell chmod 0755 /system/xbin/busybox adb shell /system/xbin/su --install adb shell "mount -o ro,remount -t ext4 /dev/block/mmcblk0p8 /system"
Reboot the device and you should have root access.
Build an insecure boot.img (information)
- Unpack the boot.img with a tool of your choice
- Modify the build.prop
- ro.adb.secure=0
- ro.secure=0
- ro.debuggable=1
- Repack the image
Flash the device (information)
adb reboot bootloader fastboot flash boot boot-new.img fastboot reboot
MTK Droid & Root Tools
This tool seems to be the go to tool for most people. Once you run into issues the information is pretty sparse or downright incorrect. Some operations are quite useful such as the scatter creation and splitting up images.
Create a scatter file. The scatter file defines the regions of the flash of your device. You will need this so you know which portion you want to read/write.
- Under phone information click on the blocks map
- Create scatter file
- Make full image in smart phone flash tool (ignore until flash tool section)
- Under root, backup, recovery
- Click to process file rom_ from flashtool
- Load ROM_0 you made in flash tool
- This will split out all the images types into separate files
- Ignore creating the clockworkmod recovery (cwm) file as it will error out with
ERROR :No find KernelGZ ERROR :No Split Boot Image
- You need to make the clockwork mod recovery yourself
Smart Phone Flash Tool
This tool allows you to directly read/write to the device. This tool will require the scatter file that you create using MTK Droid & Root Tools. We want to make an entire backup of the phone which you should do before anything else.
- Click on readback tab
- Add
- Double click entry
- Name it ROM_0
- TYPE: HEX
- START ADDRESS: 0x00
- LENGTH: 0x57F80000
The length value is derived from the scatter file. The value in the scatter column (under MTK tools) for fat or usrdata (usually last item in the list) is wanted. This same value can be pulled from the Smart Phone Flash Tool once the scatter is loaded. In this instance it's called the begin address.
eg usrdata is 0057F80000 ( which is 0x57F80000 )
- Click read back
- Plug your powered off device (very important)
- The data will be read to your pc
Restoring device completly using Smart Phone Flash Tool
- Run Smart Phone Flash Tool
- Click on the download tab
- Download agent should have mtk_allinone_da.bin
- Load scatter
- Download only
- Everything checked except uboot and usrdata
- Click download
- Attach powered off device via usb
- Device will start flashing your device
Porting clockworkmod recovery from another clockworkmod recovery.img
I normally build the recovery.img for a device manually but I have no interest in setting up my build environment again and downloading the massive CyanogenMod source.
Find a clockworkmod recovery that is similar to the device that you own.
For simplicity I named my files as follows
- stock_boot.img
- stock_recovery.img
- porting_recovery.img
Since we are dealing with Mediatek images you'll need a tool that deals with these types of images. Extract the contents of all 3 images and modify as follows:
copy meta_init.modem.rc meta_init.project.rc meta_init.rc from ramdisk folder of boot to ramdisk folder of porting_recovery
copy kernel kernel_header from folder of recovery to folder of porting_recovery
copy fstab ueventd.rc ueventd.goldfish.rc (does not exist in this case) from ramdisk folder of stock_recovery to ramdisk folder of porting_recovery
copy default.prop from ramdisk folder of stock_recovery to ramdisk folder of porting_recovery
Edit ramdisk/default.prop in porting_recovery
Modify with the following
- ro.secure=0
- ro.debuggable=1
- ro.adb.secure=0
Edit ramdisk/etc/recovery.fstab in porting_recovery and replace with the following
# mount point fstype device [device2] /boot emmc /dev/bootimg /recovery emmc /dev/recovery /uboot emmc /dev/uboot /nvram emmc /dev/nvram /cache ext4 /emmc@cache /data ext4 /emmc@usrdata /system ext4 /emmc@android /sdcard datamedia /dev/null /sd-ext vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1
Repack
Flash with Smart Phone Flash Tool as you cannot flash a recovery image on this device. Ie. fastboot flash recovery recovery.img DOES NOT WORK
Open Smart Phone Flash Tool
- Click on download tab
- Load scatter
- Uncheck all
- Double click recovery
- Point to the new recovery.img you created
- Put a checkmark on recovery only
- Click download button
- Attach powered off phone via usb
- Phone will now flash
You can enter recovery by holding volume up and power when turning on an device that is off. You can also use adb if you wish eg. adb reboot recovery also works.