1

TL;DR
How can i unlock the bootloader with SP Flash Tool?
(scroll down below)

iam using lenovo k8 note, Suddenly my mobile restarted and stucked with logo screen, and some times i got error like dll image fail. for that i have searched in google and flashed cache.img file. Now phones is booting only in fastboot mode or stock recovery. so now i need to backup my data from phone.please guide me, how to get those data from internal memory.

Note: i have not rooted my phone.
Note: i have backup of full rom using sp flashtool which is encrypted. As i tried below answers which were not worked. So i given to service center which they are saying it is hardware issue. Now i want to get my data which is encrpted. is there any alternate solution to solve my issue. Please follow this link once which followed entirely
https://chat.stackexchange.com/transcript/95995/2019/7/10

ROM is Android Oreo build number OMB27.43-70 and OEM unlocking is not enabled in Developer Settings.

What i have tried so far

  • I have created my own scatter file with WwR MTK 2.51.
  • did a full ROM dump with SP Flash Tool (59 gb size), the partition starts from SYS0 to SYS34. i have splitted it in all of its partitions and saved to harddisk.

    preloader,pgpt,recovery,para,expdb,frp,nvcfg,nvdata,metadata,protect1,protect2,seccffg,oemkeystore,proinfo,md1img,md1dsp,md1arm7,md3img,scp1,scp2,nvram,lk,lk2,boot,logo,tee1,tee2,efuse,keystore,system,cache,userdata,otp,flashinfo,sgpt  
    
  • checked the recovery.img (from readback) with AIK it does unpack successful, so i am sure the scatter file is pointing to the right area of memory.

  • I read about Lenovo MTK Secure Boot and found a Download Agent for the Lenovo K8 Plus, which seems to work for my Lenovo K8 Note.

    I tried all of these Download Agents, only the first will work

    MTK_AllInOne_DA.bin 
    DA_PL.bin 
    DA_PL_CRYPTO20.bin 
    DA_SWSEC.bin 
    DA_SWSEC_CRYPTO20.bin
    
  • I have flashed back the stock recovery.img from SP Flash Tool, it was sucessful. so after that i tried to install twrp but got

    ERROR: STATUS_SEC_IMGHDR_TYPE_MISMATCH(0xC0020029) 
    [HINT]: 
    verified boot is enabled. 
    please download signed image (recovery-verified.img) or disable verified boot.
    
  • I followed this Tutorial and signed the twrp.img with some random key. Trying to flash twrp-3.3.1-0-manning-signed.img from SP Flash Tool gives the same error. got some information from hovatek

    Message: BROM ERROR: STATUS_SEC_IMGHDR_TYPE_MISMATCH (0xC0020029) 
    Meaning: You are trying to flash modified files to a device that only accepts signed or verified images 
    Solution: 
    Download and flash the official firmware (usually have -verified or -signed prefixes)
    

I gave up and decided to unlock the bootloader, but this doesn't work either
(because of OEM lock)

fastboot oem unlock 
< waiting for any device > 
(bootloader) Start unlock flow 
FAILED (remote: 'Unlock operation is not allowed') 
fastboot: error: Command failed

Therefore i tried to flash boot.img recovery.img and system.img from here

  • i have set option --> downloaded --> selected tick for --> usb-checksum and storage-checksum (i tried with and without checksum)

  • first time flashing stucked at recovery.img which is showing 100%, after that got error, then showing

    ERROR: STATUS_UNKNOWN_STORAGE_TYPE(0xc0040009) and
    Message: BROM ERROR: STATUS_DOWNLOAD_EXCEPTION (0xC0050003) 
    Meaning: There was an interruption during writing to one or more partitions 
    Solution: 
    - Repeat flashing with the latest version of SP Flash Tool 
    - Try using a different Port, USB cord and PC 
    - Try flashing one partition at a time
    
  • taking a look into sp ft logs which shows

    [00668152] [00:38:26:564109] [Tid0x00000be0] [info] data_mux receive timeout. #(data_mux.cpp, line:71) #(device_log_source.cpp, line:63)  
    [00668153] [00:38:26:611019] [Tid0x00000be0] [info] Rx DA log timeout, continue. #(device_log_source.cpp, line:62)
    

i gave up now because flashing system.img stopped at 3%. this may caused by eMMC is probably weared out at this particular area, or the timeout is caused by a weak connection. i already tried different usb cables.

the goal is still to decrypt my data which is afaik only possible on the device itself. I have a backup of the encrypted partition so i can restore it to the phone after unlocking/factory reset, if neccessary. (at the moment all my data is still on the phone, i haven't performed a successful factory reset, yet)

fastboot oem unlock
fastboot flash userdata C:\adb\userdata.img 
fastboot flash metadata C:\adb\metadata.img 
fastboot boot C:\adb\twrp-3.3.1-0-manning.img

please note chip-off method is not a solution, i already have a full ROM dump but it is encrypted.

TL;DR
The question is now, how can i unlock the bootloader with SP Flash Tool?
(as alecxs suggested it may possible to flash seccfg.bin + lk.bin from another Lenovo K8 Note, but i need help on digging more into this)

0

1) install Preloader drivers

3xLkU.jpg

2) find scatter file (usually included in stock rom)
if you can not find it copy this into txt file

############################################################################################################
#
#  General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
  info: 
    - config_version: V1.1.2
      platform: MT6797
      project: manning
      storage: EMMC
      boot_channel: MSDC_0
      block_size: 0x20000
############################################################################################################
#
#  Layout Setting
#
############################################################################################################
- partition_index: SYS2
  partition_name: recovery
  file_name: recovery.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x8000
  physical_start_addr: 0x8000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  is_upgradable: true
  empty_boot_needed: false
  reserve: 0x00

3) download SP Flash Tool and readback original recovery from phone for
Region EMMC_USER with
start_addr and
partition_size from scatter file
- click Read Back
- remove battery
- connect USB cable

KpuEf.jpg

4) flash TWRP to recovery with SP Flash Tool
- uncheck all checkboxes
- double click on recovery (Location field) and select twrp-3.3.1-0-manning.img
- select "Download only"
- click on Download
- remove battery
- connect USB cable

GnMLw.png

5) reboot into TWRP recovery
- insert battery
- press and hold Volume Up
- disconnect USB cable
- reconnect USB cable
- release Volume Up when this screen appears
- confirm with Volume Down

QBhiN.jpg

6) make a TWRP backup of Data, then open phone from PC and copy Internal Storage

Wkyht.jpg

  • i don't think this really matters, but just in case here is enlarged twrp.img to 16 MB (filled with zero bytes with HxD) mediafire.com/file/g2tsm0fxox16jv0/twrp-3.3.1-0-manning.zip – alecxs Jul 9 at 18:06
  • i can confirm this method works for Cubot King Kong MT6580 - SP Flash Tool can definitely flash TWRP with locked bootloader, and TWRP does successful decrypt userdata with default_password - things may change in future – alecxs Jul 10 at 5:16
  • but i downloaded twrp which mentioned in the above link, and flashed but got error like "pmt changed the rom". – anonymouss Jul 10 at 5:30
  • do not 'Firmware upgrade' or 'Format All + Download' unless you have a full ROM dump, you can seriously brick your phone without backup or wrong scatter file. try with other USB cable or connect and re-install drivers to another port – alecxs Jul 10 at 5:46
  • 1
    no replies from anyone, backup of 58 gb dump is it waste? alecxs - can u check this link theregister.co.uk/2016/07/01/… and stackoverflow.com/questions/22406368/… – anonymouss Aug 12 at 5:21

protected by Community Jul 9 at 15:38

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.