4

I was just curious as I don't understand the MTK preloader that much. Considering if a wrong one is flashed, then you are left with unrecoverable brick (correct me if I'm wrong). So, it seemed odd to me that it would be kept in the same flash as other partitions like system, data, cache, etc.

I have tried checking some partitions directly from the phone which seem to indicate that it might be sharing the same flash memory as other partitions, but the scatter files that I have seem to indicate otherwise. I also did some search on XDA Developers, but it left me even more confused.

Any help will be appreciated.

Improve this question

6 Answers 6

Reset to default
3

The eMMC has what's called "hardware partitions" or regions that the full flash memory pool is divided into by the memory controller.

These regions operate at a lower level than the usual logical/software partitions we're used to, like the ones that might be listed in a GUID partition table. So when you read from something like /dev/mmcblk0, you're already being limited to the user region, and won't see the preloader.

What other regions are there? New specs mandate different regions, but on my device there are four: user, rpmb, boot1, and boot2.

The preloader is in boot1 and/or boot2 region. Your system may have it as /dev/mmcblk0boot0 and /dev/mmcblk0boot1.

My boot1 looks like:

│00000000 43 4F 4D 42 4F 5F 42 4F 4F 54 00 00 01 00 00 00 │◆│COMBO_BOOT......│
│00000010 00 10 00 00 FF FF FF FF FF FF FF FF FF FF FF FF │▒│................│

Mediatek headers start at 0x1000:

│00001000 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 │▒│MMM.8...FILE_INF│
│00001010 4F 00 00 00 01 00 00 00 01 00 0C 05 10 0F 20 00 │▒│O............. .│

And the actual preloader code is just below:

│000010F0 00 00 00 00 05 00 00 EA 80 21 10 00 88 DF 10 00 │▒│.........!......│
│00001100 00 00 27 00 A8 65 27 00 00 00 20 00 F0 1D 25 00 │▒│..'..e'... ...%.│
│00001110 C4 61 9F E5 00 40 86 E5 00 00 A0 E3 00 10 A0 E3 │▒│.a...@..........│
│00001120 00 20 A0 E3 00 30 A0 E3 00 40 A0 E3 00 50 A0 E3 │▒│. [email protected]..│

The boot ROM ("brom") is separate from the preloader and does not exist in writeable flash, but in read-only memory. Its main job is to read the boot0 region from eMMC to RAM, authorize it, and transfer control to it.

Improve this answer
1

It's present in the Boot ROM, not a directly visible partition in the eMMC.

Source: MediaTek details: SoC startup

The Boot ROM will be embedded inside the processor chip in generic chipsets. (read more) (no idea about MTK)

Further Technical details on working of Preloader: MediaTek details: Partitions and Preloader

Improve this answer
4
  • The links have been helpful, but they all seem to point out that Boot ROM memory is read-only, if that's the case how comes it is possible to flash a preloader, am i missing something?
    – AguThadeus
    Commented Oct 9, 2016 at 16:32
  • Yes, it's confusing.. As far as I have understood, it's not listed as a partition in the partition table, But I nowhere see if it's present in the flash itself or a separate memory.. These things are propriety to MTK and they won't reveal it, unless someone reverse engineers and finds it out..
    – Gokul NC
    Commented Oct 10, 2016 at 6:02
  • Thanks, let me check some chinese forums perhaps I might get something
    – AguThadeus
    Commented Oct 10, 2016 at 6:59
  • @GokulNC OR rips an MTK phone apart.
    – Dan Brown
    Commented Oct 10, 2016 at 14:52
1

Preloader is most certainly a partition visible in a smart device's partition index/filesystem. This partition is present on virtually every Lenovo device manufactured today. It is not embedded in the processor chip, but rather is located within the eMMC SD internal storage. So to answer your original question, yes, the MTK preloader is in the same eMMC flashable storage card as /system, /boot, /data, etc.

Improve this answer
1
  • I don't think that is the case because I tried dumping /dev/block/mmcblk0 (which is the device containing the various partitions in my device) starting from the first memory block using dd, I then examined it using a hexeditor searching for any presence of preloader signature but there wasn't any, I have an untested hypothesis that perhaps the emmc is abstracted into memory regions and only certain regions are visible in normal mode but I am still not sure 100%
    – AguThadeus
    Commented Nov 4, 2017 at 12:31
1

Preloader is present in eMMC.

/dev/block/mmcblk0 is located in eMMC as linear address.mmcblk0 starts with mbr, not including preloader. You can easily check by putting this mmcblk0 in eMMC raw tool and by clicking Load partition structure button.

But preloader is located as logical address.

Improve this answer
0

You can buy special dongles or flash boxes such as Infinity CM2 and read the firmware. This way, you will be able to dump the firmware in factory format and do some debugging.

Usually, the preloader file is located in boot0 or recently in Boot1.

Improve this answer
0

Yes, it is stored on the same storage as the rest of the partitions, except in its own partition. Think of it like three partitions or regions:

  1. Boot0: holds your preloader
  2. Boot1: from my personal experience, usually holds nothing
  3. EMMC: is like an extended partition (a partition that holds more partitions) and holds your system, data, cache, etc.

You can use SP Flash Tool to check this yourself by making a readback of the different regions and inspecting them with a hex editor.

Improve this answer
1
  • I think this confirms my assumptions, I found about this a while ago but was reluctant to post it as an answer because I wasn't completely sure. I don't know about the naming used in your phone but all phones I have examined have three regions EMMC_BOOT_1 for preloader, EMMC_BOOT_2 (contains null bytes) and EMMC_USER which is used as mmcblk0 holding other phone partitions
    – AguThadeus
    Commented Mar 26, 2018 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .