1

TL;DR
How can i unlock the bootloader with SP Flash Tool?
(scroll down below)

iam using lenovo k8 note, Suddenly my mobile restarted and stucked with logo screen, and some times i got error like dll image fail. for that i have searched in google and flashed cache.img file. Now phones is booting only in fastboot mode or stock recovery. so now i need to backup my data from phone.please guide me, how to get those data from internal memory.

Note: i have not rooted my phone.
Note: i have backup of full rom using sp flashtool which is encrypted. As i tried below answers which were not worked. So i given to service center which they are saying it is hardware issue. Now i want to get my data which is encrpted. is there any alternate solution to solve my issue. Please follow this link once which followed entirely
https://chat.stackexchange.com/transcript/95995/2019/7/10

ROM is Android Oreo build number OMB27.43-70 and OEM unlocking is not enabled in Developer Settings.

What i have tried so far

  • I have created my own scatter file with WwR MTK 2.51.
  • did a full ROM dump with SP Flash Tool (59 gb size), the partition starts from SYS0 to SYS34. i have splitted it in all of its partitions and saved to harddisk.

    preloader,pgpt,recovery,para,expdb,frp,nvcfg,nvdata,metadata,protect1,protect2,seccffg,oemkeystore,proinfo,md1img,md1dsp,md1arm7,md3img,scp1,scp2,nvram,lk,lk2,boot,logo,tee1,tee2,efuse,keystore,system,cache,userdata,otp,flashinfo,sgpt  
    
  • checked the recovery.img (from readback) with AIK it does unpack successful, so i am sure the scatter file is pointing to the right area of memory.

  • I read about Lenovo MTK Secure Boot and found a Download Agent for the Lenovo K8 Plus, which seems to work for my Lenovo K8 Note.

    I tried all of these Download Agents, only the first will work

    MTK_AllInOne_DA.bin 
    DA_PL.bin 
    DA_PL_CRYPTO20.bin 
    DA_SWSEC.bin 
    DA_SWSEC_CRYPTO20.bin
    
  • I have flashed back the stock recovery.img from SP Flash Tool, it was sucessful. so after that i tried to install twrp but got

    ERROR: STATUS_SEC_IMGHDR_TYPE_MISMATCH(0xC0020029) 
    [HINT]: 
    verified boot is enabled. 
    please download signed image (recovery-verified.img) or disable verified boot.
    
  • I followed this Tutorial and signed the twrp.img with some random key. Trying to flash twrp-3.3.1-0-manning-signed.img from SP Flash Tool gives the same error. got some information from hovatek

    Message: BROM ERROR: STATUS_SEC_IMGHDR_TYPE_MISMATCH (0xC0020029) 
    Meaning: You are trying to flash modified files to a device that only accepts signed or verified images 
    Solution: 
    Download and flash the official firmware (usually have -verified or -signed prefixes)
    

I gave up and decided to unlock the bootloader, but this doesn't work either
(because of OEM lock)

fastboot oem unlock 
< waiting for any device > 
(bootloader) Start unlock flow 
FAILED (remote: 'Unlock operation is not allowed') 
fastboot: error: Command failed

Therefore i tried to flash boot.img recovery.img and system.img from here

  • i have set option --> downloaded --> selected tick for --> usb-checksum and storage-checksum (i tried with and without checksum)

  • first time flashing stucked at recovery.img which is showing 100%, after that got error, then showing

    ERROR: STATUS_UNKNOWN_STORAGE_TYPE(0xc0040009) and
    Message: BROM ERROR: STATUS_DOWNLOAD_EXCEPTION (0xC0050003) 
    Meaning: There was an interruption during writing to one or more partitions 
    Solution: 
    - Repeat flashing with the latest version of SP Flash Tool 
    - Try using a different Port, USB cord and PC 
    - Try flashing one partition at a time
    
  • taking a look into sp ft logs which shows

    [00668152] [00:38:26:564109] [Tid0x00000be0] [info] data_mux receive timeout. #(data_mux.cpp, line:71) #(device_log_source.cpp, line:63)  
    [00668153] [00:38:26:611019] [Tid0x00000be0] [info] Rx DA log timeout, continue. #(device_log_source.cpp, line:62)
    

i gave up now because flashing system.img stopped at 3%. this may caused by eMMC is probably weared out at this particular area, or the timeout is caused by a weak connection. i already tried different usb cables.

the goal is still to decrypt my data which is afaik only possible on the device itself. I have a backup of the encrypted partition so i can restore it to the phone after unlocking/factory reset, if neccessary. (at the moment all my data is still on the phone, i haven't performed a successful factory reset, yet)

fastboot oem unlock
fastboot flash userdata C:\adb\userdata.img 
fastboot flash metadata C:\adb\metadata.img 
fastboot boot C:\adb\twrp-3.3.1-0-manning.img

please note chip-off method is not a solution, i already have a full ROM dump but it is encrypted.

TL;DR
The question is now, how can i unlock the bootloader with SP Flash Tool?
(as alecxs suggested it may possible to flash seccfg.bin + lk.bin from another Lenovo K8 Note, but i need help on digging more into this)

2

1 Answer 1

1

1) install Preloader drivers

3xLkU.jpg

2) find scatter file (usually included in stock rom)
if you can not find it copy this into txt file

############################################################################################################
#
#  General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
  info: 
    - config_version: V1.1.2
      platform: MT6797
      project: manning
      storage: EMMC
      boot_channel: MSDC_0
      block_size: 0x20000
############################################################################################################
#
#  Layout Setting
#
############################################################################################################
- partition_index: SYS2
  partition_name: recovery
  file_name: recovery.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x8000
  physical_start_addr: 0x8000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

3) download SP Flash Tool and readback original recovery from phone for
Region EMMC_USER with
start_addr and
partition_size from scatter file
- click Read Back
- remove battery
- connect USB cable

KpuEf.jpg

4) flash TWRP to recovery with SP Flash Tool
- uncheck all checkboxes
- double click on recovery (Location field) and select twrp-3.3.1-0-manning.img
- select "Download only"
- click on Download
- remove battery
- connect USB cable

GnMLw.png

5) reboot into TWRP recovery
- insert battery
- press and hold Volume Up
- disconnect USB cable
- reconnect USB cable
- release Volume Up when this screen appears
- confirm with Volume Down

QBhiN.jpg

6) make a TWRP backup of Data, then open phone from PC and copy Internal Storage

Wkyht.jpg

15
  • 1
    i don't think this really matters, but just in case here is enlarged twrp.img to 16 MB (filled with zero bytes with HxD) mediafire.com/file/g2tsm0fxox16jv0/twrp-3.3.1-0-manning.zip
    – alecxs
    Jul 9, 2019 at 18:06
  • i can confirm this method works for Cubot King Kong MT6580 - SP Flash Tool can definitely flash TWRP with locked bootloader, and TWRP does successful decrypt userdata with default_password - things may change in future
    – alecxs
    Jul 10, 2019 at 5:16
  • but i downloaded twrp which mentioned in the above link, and flashed but got error like "pmt changed the rom".
    – anonymouss
    Jul 10, 2019 at 5:30
  • 1
    do not 'Firmware upgrade' or 'Format All + Download' unless you have a full ROM dump, you can seriously brick your phone without backup or wrong scatter file. try with other USB cable or connect and re-install drivers to another port
    – alecxs
    Jul 10, 2019 at 5:46
  • 1
    no replies from anyone, backup of 58 gb dump is it waste? alecxs - can u check this link theregister.co.uk/2016/07/01/… and stackoverflow.com/questions/22406368/…
    – anonymouss
    Aug 12, 2019 at 5:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .