[ot][spam] log: trying to take control of my free government phone
i have a serrano hot pepper l55b phone purportedly with a unisoc chipset, running android 10 based on treble. these phones can be gotten very cheaply, with a free plan, in the usa. although i think the phone you get from the program changes. i got mine because i got on foodstamps, at my family's request, and i wasn't set up with a working phone, and this worked out for me. it would be a good thing to make the phone run a custom rom so all the other people who use it could use a normal phone. it is not normal when bought. it is full of advertisements, very slow, and it wouldn't let me use it to tether. i think it has other limitations too. i searched earlier for OEM unlocking on the phone, but did not find it. now, with my experience just working on the unihertz titan, i found OEM unlocking. it is under system->advanced->developer options. although somebody told me this phone could not run a gsi, it looks pretty likely to me that it can. if the bootloader can be unlocked, and there is a public factory flasher, then we just need to put an appropriate treble system partition on it, and it might run like a thousand dollar phone from silicon valley, dunno
dmesg when running and plugged in: [3974073.464782] usb 1-4: New USB device found, idVendor=0e8d, idProduct=2008, bcdDevice= 2.23 [3974073.464790] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [3974073.464795] usb 1-4: Product: HPP-L55B [3974073.464799] usb 1-4: Manufacturer: Hot Pepper Inc
then with usb debugging enabled: [3974182.695809] usb 1-4: new high-speed USB device number 42 using xhci_hcd [3974182.819725] usb 1-4: New USB device found, idVendor=0e8d, idProduct=201c, bcdDevice= 2.23 [3974182.819732] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [3974182.819737] usb 1-4: Product: HPP-L55B [3974182.819741] usb 1-4: Manufacturer: Hot Pepper Inc
i did an `adb reboot fastboot` and it completely worked. takes me to a fastbootd menu on the phone one of the entries says "Secure boot - yes", which could be discouraging options include "Enter recovery" and "Reboot to bootloader"
"Reboot to bootloader" places it into the same-looking system as the unihertz titan, where it is waiting for commands from fastboot. unfortunately, when i do "fastboot flashing unlock", it says "unlock failed" :( so flashing this phone may be a long-term adventure in learning the bootloaders and flashing protocols
but i'll at least reboot into windows and try a factory flasher out! there are at least 3 different factory flashers i'm imagining there's a good chance an exploit or opening the hardware would be needed to reflash the phone. this is likely increasing my dissociated discouragement.
so, the windows flasher i tried needs a .pac file for the phone . it needs two partitions from it, and won't do much of anything without them, including apparently downloading data from the phone. i'm not sure where to find this factory image for this phone, but could look more places. another thing i found is that there are of course a handful of hardware dongles for working with this chipset and phones directly. this idea is inspiring. if the dongle approach works, then i might be able to bypass any lock restrictions on the device by simply treating it as a new device i am building. it looks like the partitions it needs, fd1 and fd2, may simply be the user and system partitions. i found a janky instruction guide for generating a .pac file from backup images of a rooted phone. they actually use the windows flasher tool, to pack the files into a .pac file.
i websearched for some time. the chipset is SC9832E, and looking for that chipset i found similar experiences to mine, where oem unlocking can be enabled but fastboot still fails. there's some documentation of working around this for the qin 2 pro at https://en.typeblog.net/1c72/how-i-unlocked-xiaomi-qin-2-pro-and-installed-p...
it looks like there is a modified fastboot binary being used, that can extract a special code from the phone that can be used to unlock it it seems like it makes sense to try to get ahold of that binary, run it, and figure out what its secret protocol is
this link seems helpful, if untrustworthy: https://romprovider.com/xiaomi-qin2-pro-unlock-bootloader/ it contains a google drive link to android_device_unlock.rar the original post seems helpful, but most of the primary material seems to be in russian, a language i have not myself learned yet. my browser isn't showing the automatic "translate" popup and i failed to find the search button on the russian site. the dev of the open source OS i got working with the unihertz titan uses a qin 2 pro: https://github.com/phhusson/treble_experimentations/issues/1602#issuecomment... hovatek has a lot of unisoc information. they link to a fastboot for unlocking that is on mega.nz: https://www.hovatek.com/forum/thread-32287.html the mega.nz link just loads a lot of ads for me. it's great to find a more normative set of information for this phone chipset.
On 7/19/22, Undiscussed Horrific Abuse, One Victim of Many <gmkarl@gmail.com> wrote:
this link seems helpful, if untrustworthy: https://romprovider.com/xiaomi-qin2-pro-unlock-bootloader/ it contains a google drive link to android_device_unlock.rar
i've uploaded the version of the .rar at that website to https://bafybeifgh34qlpdcsxfe42z3jysp3fzk66r577dbsylniggw5vjvn2yk5y.ipfs.dwe... since it seems hard to access
the oem command does not work on this phone. i did find at https://www.xda-developers.com/how-to-discover-hidden-fastboot-commands/ that oem commands are likely sent as strings straight to the device, and can usually be enumerated by grepping for strings in the boot loader. the device has a vbmeta partition, i guess all devices with verified boot enabled likely do. i'm a little surprised the boot thing from russia didn't work. i could ask more at their forum, or ask the dev with the similar device; i think i'd like to learn a little more about it first. i'm a little curious about profiling the bootloader to see what it might be. i could also try to reverse engineer the factory flasher a little, and see if there are some useful codes or identifying information. when I connect the phone to the system, it behaves similar to the mediatek phone, offering a brief serial interface and relating commands via it. it actually responds to my 'backyard mediatek flasher''s handshake, with the same 'READY' exchange protocol. The output of test.py is this: Device preloader version: 0x3 hw_code=0x699 unk1=0x0 hw_subcode=0x8a00 hw_version=0xcb00 unk2=0x2 unk3=0x0 These are very similar values to the mediatek situation. It implies that the two are speaking the same protocol, whatever protocol it is. The chipsets are both based on arm.
left out: i could also look harder for ways to root the phone, or to access its flash storage internally [it would be great to pick up the flash reads with a near-field radio but i have separate inhibition around that goal, so it seems a separate thing]
so, i tried booting up the mediatek flasher, to see if it would do anytihng, and ran into the same issue i ran into with the unisoc flasher: it refuses to run unless you provide it with a partition map in advance, and i haven't found a factory image for this phone yet. _however_, i know from working with the protocol under the hood with the mediatek phone, that it doesn't actually use the partition map for anything for most of the protocol. it's a soft barrier. unfortunately i don't remember how the protocol works and didn't document what i found well.
these commands are apparently documented for the mediatek preloader here: http://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preload... ! i'm not certain yet whether that means that this unisoc chipset is based on mediatek, or if it is some shared thing that both use.
these lines explain a lot of how the mediatek exploit i was reviewing a session or two on these phones worked: CMD_READ16 0xa2 Read data from the SoC memory (16 bit length parameter) CMD_WRITE16 0xd2 Write data into SoC memory (16 bit length parameter) CMD_READ32 0xd1 Read data from the SoC memory (32 bit length parameter) CMD_WRITE32 0xd4 Write data into SoC memory (32 bit length parameter) it can read and write from SoC memory the commenting in the exploit talked about this, but i didn't know the commands
this hardware code is actually in the mediatek platform table 0x0699: 0x6739 this unisoc chipset might be an MT6739 i found you can try to compare the two chipsets at phonedb.net unisoc chipset: https://phonedb.net/index.php?m=processor&id=769&c=spreadtrum_sc9832e mediatek chipset: https://phonedb.net/index.php?m=processor&id=748&c=mediatek_mt6739 - they are both based on 4x ARM Cortex-A53 MPcore . - they are specified with different emmc revisions; the mediatek chipset is a newer emmc revision, despite being released a year prior - they have different embedded GPUs - they appear to support the same suites of cellular data protocols - they support the same display pixel dimensions and their modem featuresets have the same strings - the mediatek chipset supports opencl and vulkan (gpu driver features), which the unisoc chipset does not the unisoc page links to a datasheet. the link is broken. they seem similar enough for it to be worthwhile spending some time seeing if things that work on the mediatek chipset work on the unisoc one with the same bootloader hw code.
i tried to search xda for mt6739 information and am getting this error: "The forums are currently offline while we are performing system maintenance. Be back soon!" google shows that there is indeed discussion around the mt6739 given the use of hw_code and separate use of platform, there is probably some underlying thing that both mediatek and unisoc share. it seems likely that bootloader stuff would work on both the same, although they might need different download agents. it could be interesting to compare the unisoc download agent with the mediatek download agent, if it uses one.
i'm realising that i can figure out the sizes and orders of partitions without needing root access the other phone used a gpt partition table i might be able to make a partition map by hand, to try the factory tools
$ fastboot getvar all (bootloader) max-download-size: 0x8000000 (bootloader) variant: (bootloader) logical-block-size: 0x200 (bootloader) erase-block-size: 0x80000 (bootloader) hw-revision: cb00 (bootloader) battery-soc-ok: yes (bootloader) battery-voltage: 3823mV (bootloader) partition-size:sgpt: 4200 (bootloader) partition-type:sgpt: raw data (bootloader) partition-size:flashinfo: 1000000 (bootloader) partition-type:flashinfo: raw data (bootloader) partition-size:userdata: 2aedfbe00 (bootloader) partition-type:userdata: f2fs (bootloader) partition-size:cache: 13000000 (bootloader) partition-type:cache: ext4 (bootloader) partition-size:super: c6800000 (bootloader) partition-type:super: raw data (bootloader) partition-size:tee2: ce0000 (bootloader) partition-type:tee2: raw data (bootloader) partition-size:tee1: 500000 (bootloader) partition-type:tee1: raw data (bootloader) partition-size:dtbo: 800000 (bootloader) partition-type:dtbo: raw data (bootloader) partition-size:logo: 800000 (bootloader) partition-type:logo: raw data (bootloader) partition-size:boot: 1800000 (bootloader) partition-type:boot: raw data (bootloader) partition-size:loader_ext2: 10000 (bootloader) partition-type:loader_ext2: raw data (bootloader) partition-size:loader_ext1: 10000 (bootloader) partition-type:loader_ext1: raw data (bootloader) partition-size:lk2: 100000 (bootloader) partition-type:lk2: raw data (bootloader) partition-size:lk: 100000 (bootloader) partition-type:lk: raw data (bootloader) partition-size:nvram: 500000 (bootloader) partition-type:nvram: raw data (bootloader) partition-size:gz2: 1000000 (bootloader) partition-type:gz2: raw data (bootloader) partition-size:gz1: 1000000 (bootloader) partition-type:gz1: raw data (bootloader) partition-size:mcupmfw: 100000 (bootloader) partition-type:mcupmfw: raw data (bootloader) partition-size:spmfw: 100000 (bootloader) partition-type:spmfw: raw data (bootloader) partition-size:md1dsp: 1000000 (bootloader) partition-type:md1dsp: raw data (bootloader) partition-size:md1img: 4000000 (bootloader) partition-type:md1img: raw data (bootloader) partition-size:proinfo: 300000 (bootloader) partition-type:proinfo: raw data (bootloader) partition-size:sec1: 200000 (bootloader) partition-type:sec1: raw data (bootloader) partition-size:persist: 3000000 (bootloader) partition-type:persist: ext4 (bootloader) partition-size:seccfg: 800000 (bootloader) partition-type:seccfg: raw data (bootloader) partition-size:protect2: ade000 (bootloader) partition-type:protect2: ext4 (bootloader) partition-size:protect1: 800000 (bootloader) partition-type:protect1: ext4 (bootloader) partition-size:metadata: 2000000 (bootloader) partition-type:metadata: raw data (bootloader) partition-size:md_udc: 169a000 (bootloader) partition-type:md_udc: ext4 (bootloader) partition-size:nvdata: 2000000 (bootloader) partition-type:nvdata: ext4 (bootloader) partition-size:nvcfg: 800000 (bootloader) partition-type:nvcfg: ext4 (bootloader) partition-size:vbmeta_vendor: 800000 (bootloader) partition-type:vbmeta_vendor: raw data (bootloader) partition-size:vbmeta_system: 800000 (bootloader) partition-type:vbmeta_system: raw data (bootloader) partition-size:vbmeta: 800000 (bootloader) partition-type:vbmeta: raw data (bootloader) partition-size:frp: 100000 (bootloader) partition-type:frp: raw data (bootloader) partition-size:expdb: 1400000 (bootloader) partition-type:expdb: raw data (bootloader) partition-size:para: 80000 (bootloader) partition-type:para: raw data (bootloader) partition-size:recovery: 1800000 (bootloader) partition-type:recovery: raw data (bootloader) partition-size:boot_para: 100000 (bootloader) partition-type:boot_para: raw data (bootloader) partition-size:pgpt: 8000 (bootloader) partition-type:pgpt: raw data (bootloader) partition-size:preloader: 40000 (bootloader) partition-type:preloader: raw data (bootloader) off-mode-charge: 1 (bootloader) warranty: yes (bootloader) unlocked: no (bootloader) secure: yes (bootloader) kernel: lk (bootloader) product: x038_k39tv1_bsp (bootloader) is-userspace: no (bootloader) slot-count: 0 (bootloader) version-baseband: MOLY.LR12A.R3.MP.V140.8.P7 (bootloader) version-bootloader: x038_k39tv1_bsp-ba63681-20220219163459- (bootloader) version-preloader: (bootloader) version: 0.5 all: Done!!
there are a lot more bootloader commands at https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/mtk_preload... i'm thinking it would make sense to dump the ram and look for OEM commands in it.
i'm thinking i could probably make this phone work by just treating it like a mediatek phone. i'm wondering if when spreadtrum rebranded to unisoc, they outsourced some of their stuff to mediatek or whatever mediatek uses, like other companies do as other companies grow bigger faster than they do. this chipset is the first chipset produced by unisoc, after they rebranded from spreadtrum. i'm wondering if the people who said that spreadtrum wasn't like mediatek, and was unreasonable to unlock, were talking about pre-unisoc stuff.
unfortunately i don't presently have access to my kernel sources to try any mtk exploits that come with mtkclient. mediatek wrote a linux kernel driver that engages the boot loader, and mtkclient patches it. i'm on a redhat enterprise linux system that has expired. mtkclient]$ python3 mtk gettargetconfig Preloader - CPU: MT6739/MT6731() Preloader - HW version: 0x0 Preloader - WDT: 0x10007000 Preloader - Uart: 0x11002000 Preloader - Brom payload addr: 0x100a00 Preloader - DA payload addr: 0x201000 Preloader - CQ_DMA addr: 0x10212000 Preloader - Var1: 0xb4 Preloader - Disabling Watchdog... Preloader - HW code: 0x699 Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False Preloader - Get Target info Preloader - HW subcode: 0x8a00 Preloader - HW Ver: 0xcb00 Preloader - SW Ver: 0x2 Main - Getting target info... Preloader - Target config: 0x0 Preloader - SBC enabled: False Preloader - SLA enabled: False Preloader - DAA enabled: False Preloader - SWJTAG enabled: False Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False Preloader - Root cert required: False Preloader - Mem read auth: False Preloader - Mem write auth: False Preloader - Cmd 0xC8 blocked: False
i'm installing a free kernel from centos 7 to try it out. of course, this is probably a different kind of phone, it might be interesting, and at least might give me an error i can websearch for. my system may fail to reboot, in which case it could be a while ;p i'm thinking maybe for working aroudn i would start another redhat subscription, boot off some kind of boot media, and install a normative kernel
haha the patches are for linux 5.x and i have linux 3.x might not be as big as it sounds since the versioning changed, but it sounds ridiculously big
i added the patch to my specfile and am building a new rpm i canceled the unihertz titan build. the host had been running for 6 hours. i'm just a little confused.
if you're using gcc 9 on a system designed for gcc 4, you'd better do PATH=/bin:/usr/bin:/sbin:/usr/sbin before building your 3.10 kernel sources.
totally a unisoc-branded mediatek 6739 $ adb shell getprop [Build.BRAND]: [MTK] [camera.disable_zsl_mode]: [1] [dalvik.vm.appimageformat]: [lz4] [dalvik.vm.dex2oat-Xms]: [64m] [dalvik.vm.dex2oat-Xmx]: [512m] [dalvik.vm.dex2oat-max-image-block-size]: [524288] [dalvik.vm.dex2oat-minidebuginfo]: [true] [dalvik.vm.dex2oat-resolve-startup-strings]: [true] [dalvik.vm.dexopt.secondary]: [true] [dalvik.vm.heapgrowthlimit]: [256m] [dalvik.vm.heapsize]: [512m] [dalvik.vm.image-dex2oat-Xms]: [64m] [dalvik.vm.image-dex2oat-Xmx]: [64m] [dalvik.vm.isa.arm.features]: [default] [dalvik.vm.isa.arm.variant]: [cortex-a53] [dalvik.vm.minidebuginfo]: [true] [dalvik.vm.mtk-stack-trace-file]: [/data/anr/mtk_traces.txt] [dalvik.vm.usejit]: [true] [dalvik.vm.usejitprofiles]: [true] [debug.atrace.tags.enableflags]: [0] [debug.force_rtl]: [false] [debug.sf.disable_backpressure]: [1] [dev.bootcomplete]: [1] [dev.mnt.blk.product]: [dm-5] [dev.mnt.blk.root]: [dm-3] [dev.mnt.blk.vendor]: [dm-4] [drm.service.enabled]: [true] [gsm.current.phone-type]: [1] [gsm.network.type]: [Unknown] [gsm.operator.alpha]: [] [gsm.operator.iso-country]: [us] [gsm.operator.isroaming]: [false] [gsm.operator.numeric]: [] [gsm.sim.num.pin]: [] [gsm.sim.num.pin2]: [] [gsm.sim.num.puk]: [] [gsm.sim.num.puk2]: [] [gsm.sim.num.simlock]: [] [gsm.sim.preiccid_0]: [] [gsm.sim.state]: [ABSENT] [gsm.sim1.type]: [] [gsm.version.baseband]: [MOLY.LR12A.R3.MP.V140.8.P7] [gsm.version.ril-impl]: [android reference-ril 1.0] [hwservicemanager.ready]: [true] [init.svc.adbd]: [running] [init.svc.agpsd]: [running] [init.svc.apexd]: [running] [init.svc.apexd-bootstrap]: [stopped] [init.svc.ashmemd]: [running] [init.svc.audioserver]: [running] [init.svc.batterywarning]: [running] [init.svc.bluetooth-1-0]: [running] [init.svc.bootanim]: [stopped] [init.svc.bootlogoupdater]: [stopped] [init.svc.bpfloader]: [stopped] [init.svc.camerahalserver]: [running] [init.svc.cameraserver]: [running] [init.svc.ccci3_mdinit]: [stopped] [init.svc.ccci_mdinit]: [running] [init.svc.drm]: [running] [init.svc.flash_recovery]: [stopped] [init.svc.fuelgauged]: [running] [init.svc.fuelgauged_nvram]: [stopped] [init.svc.gatekeeperd]: [running] [init.svc.gnss_service]: [running] [init.svc.gpu]: [running] [init.svc.gpu-1-0]: [running] [init.svc.gsid]: [stopped] [init.svc.health-hal-2-0]: [running] [init.svc.hidl_memory]: [running] [init.svc.hwservicemanager]: [running] [init.svc.idmap2d]: [stopped] [init.svc.incidentd]: [running] [init.svc.installd]: [running] [init.svc.iorapd]: [stopped] [init.svc.ipsec_mon]: [running] [init.svc.keystore]: [running] [init.svc.lbs_dbg]: [running] [init.svc.lbs_hidl_service]: [running] [init.svc.light-hal-2-0]: [running] [init.svc.lmkd]: [running] [init.svc.logd]: [running] [init.svc.logd-auditctl]: [stopped] [init.svc.logd-reinit]: [stopped] [init.svc.media]: [running] [init.svc.media.swcodec]: [running] [init.svc.mediacodec]: [running] [init.svc.mediadrm]: [running] [init.svc.mediaextractor]: [running] [init.svc.mediametrics]: [running] [init.svc.mnld]: [running] [init.svc.mobile_log_d]: [running] [init.svc.mtk_secure_element_hal_service]: [running] [init.svc.mtkcodecservice-1-1]: [stopped] [init.svc.netd]: [running] [init.svc.netdagent]: [running] [init.svc.netdiag]: [running] [init.svc.nvram-hidl-1-1]: [running] [init.svc.nvram_daemon]: [stopped] [init.svc.power-hal-1-0]: [running] [init.svc.pq-2-2]: [running] [init.svc.rcs_volte_stack]: [running] [init.svc.servicemanager]: [running] [init.svc.statsd]: [running] [init.svc.storaged]: [running] [init.svc.surfaceflinger]: [running] [init.svc.system_suspend]: [running] [init.svc.tee_check_keybox]: [stopped] [init.svc.teed]: [running] [init.svc.terservice]: [stopped] [init.svc.thermal]: [running] [init.svc.thermal_manager]: [stopped] [init.svc.thermald]: [running] [init.svc.thermalloadalgod]: [running] [init.svc.tombstoned]: [running] [init.svc.ueventd]: [running] [init.svc.usbd]: [stopped] [init.svc.vendor.audio-hal-2-0]: [running] [init.svc.vendor.bip]: [running] [init.svc.vendor.cas-hal-1-1]: [running] [init.svc.vendor.ccci3_fsd]: [stopped] [init.svc.vendor.ccci_fsd]: [running] [init.svc.vendor.ccci_rpcd]: [running] [init.svc.vendor.configstore-hal]: [running] [init.svc.vendor.drm-clearkey-hal-1-2]: [running] [init.svc.vendor.drm-hal-1-0]: [running] [init.svc.vendor.drm-widevine-hal-1-2]: [running] [init.svc.vendor.epdg_wod]: [running] [init.svc.vendor.gatekeeper-1-0]: [running] [init.svc.vendor.gralloc-2-0]: [running] [init.svc.vendor.gsm0710muxd]: [running] [init.svc.vendor.hwcomposer-2-1]: [running] [init.svc.vendor.keymaster-4-0-trustkernel]: [running] [init.svc.vendor.memtrack-hal-1-0]: [running] [init.svc.vendor.ril-daemon-mtk]: [running] [init.svc.vendor.sensors-hal-2-0]: [running] [init.svc.vendor.thermal-hal-1-0]: [running] [init.svc.vendor.usb-hal-1-1]: [running] [init.svc.vendor.vibrator-1-0]: [running] [init.svc.vendor.volte_imcb]: [running] [init.svc.vendor.volte_stack]: [running] [init.svc.vendor.volte_ua]: [running] [init.svc.vendor.wifi_hal_legacy]: [running] [init.svc.vndservicemanager]: [running] [init.svc.vold]: [running] [init.svc.volte_imsm_93]: [running] [init.svc.volte_md_status]: [running] [init.svc.volte_rcs_ua]: [running] [init.svc.vtservice]: [running] [init.svc.vtservice_hidl]: [running] [init.svc.wfca]: [running] [init.svc.wificond]: [running] [init.svc.wlan_assistant]: [running] [init.svc.wmt_launcher]: [running] [init.svc.wmt_loader]: [stopped] [init.svc.wpa_supplicant]: [running] [init.svc.xthink_factory]: [stopped] [init.svc.zygote]: [running] [log.tag]: [M] [log.tag.APM_AudioPolicyManager]: [D] [log.tag.stats_log]: [I] [media.stagefright.thumbnail.prefer_hw_codecs]: [true] [mediatek.wlan.ctia]: [0] [net.bt.name]: [Android] [net.qtaguid_enabled]: [1] [net.tcp.default_init_rwnd]: [60] [persist.adb.nonblocking_ffs]: [0] [persist.log.tag.APM-KpiMonitor]: [I] [persist.log.tag.APM-ServiceJ]: [I] [persist.log.tag.APM-SessionJ]: [I] [persist.log.tag.APM-SessionN]: [I] [persist.log.tag.APM-Subscriber]: [I] [persist.log.tag.AT]: [I] [persist.log.tag.AdnRecord]: [I] [persist.log.tag.AdnRecordCache]: [I] [persist.log.tag.AdnRecordLoader]: [I] [persist.log.tag.AirplaneHandler]: [I] [persist.log.tag.AutoRegSmsFwk]: [I] [persist.log.tag.C2K_RIL-DATA]: [I] [persist.log.tag.CapaSwitch]: [I] [persist.log.tag.CarrierExpressServiceImpl]: [I] [persist.log.tag.CarrierExpressServiceImplExt]: [I] [persist.log.tag.CdmaMoSms]: [I] [persist.log.tag.CdmaMtSms]: [I] [persist.log.tag.ConSmsFwkExt]: [I] [persist.log.tag.CountryDetector]: [I] [persist.log.tag.DC-C-1]: [I] [persist.log.tag.DC-C-2]: [I] [persist.log.tag.DCT-C-0]: [I] [persist.log.tag.DCT-C-1]: [I] [persist.log.tag.DCT-I-0]: [I] [persist.log.tag.DCT-I-1]: [I] [persist.log.tag.DMC-ApmService]: [I] [persist.log.tag.DMC-Core]: [I] [persist.log.tag.DMC-DmcService]: [I] [persist.log.tag.DMC-EventsSubscriber]: [I] [persist.log.tag.DMC-ReqQManager]: [I] [persist.log.tag.DMC-SessionManager]: [I] [persist.log.tag.DMC-TranslatorLoader]: [I] [persist.log.tag.DMC-TranslatorUtils]: [I] [persist.log.tag.DSSelector]: [I] [persist.log.tag.DSSelectorOP01]: [I] [persist.log.tag.DSSelectorOP02]: [I] [persist.log.tag.DSSelectorOP09]: [I] [persist.log.tag.DSSelectorOP18]: [I] [persist.log.tag.DSSelectorOm]: [I] [persist.log.tag.DSSelectorUtil]: [I] [persist.log.tag.DataDispatcher]: [I] [persist.log.tag.DataOnlySmsFwk]: [I] [persist.log.tag.DcFcMgr]: [I] [persist.log.tag.DupSmsFilterExt]: [I] [persist.log.tag.ExternalSimMgr]: [I] [persist.log.tag.GsmCallTkrHlpr]: [I] [persist.log.tag.GsmCdmaConn]: [I] [persist.log.tag.GsmCdmaPhone]: [I] [persist.log.tag.IMSRILRequest]: [I] [persist.log.tag.IMS_RILA]: [I] [persist.log.tag.IccCardProxy]: [I] [persist.log.tag.IccPhoneBookIM]: [I] [persist.log.tag.IccProvider]: [I] [persist.log.tag.ImsApp]: [I] [persist.log.tag.ImsBaseCommands]: [I] [persist.log.tag.ImsCall]: [I] [persist.log.tag.ImsCallProfile]: [I] [persist.log.tag.ImsCallSession]: [I] [persist.log.tag.ImsEcbm]: [I] [persist.log.tag.ImsEcbmProxy]: [I] [persist.log.tag.ImsManager]: [I] [persist.log.tag.ImsPhone]: [I] [persist.log.tag.ImsPhoneBase]: [I] [persist.log.tag.ImsPhoneCall]: [I] [persist.log.tag.ImsService]: [I] [persist.log.tag.ImsVTProvider]: [I] [persist.log.tag.IsimFileHandler]: [I] [persist.log.tag.IsimRecords]: [I] [persist.log.tag.LCM-Subscriber]: [I] [persist.log.tag.MAPI-CommandProcessor]: [I] [persist.log.tag.MAPI-MdiRedirector]: [I] [persist.log.tag.MAPI-MdiRedirectorCtrl]: [I] [persist.log.tag.MAPI-NetworkSocketConnection]: [I] [persist.log.tag.MAPI-SocketConnection]: [I] [persist.log.tag.MAPI-SocketListener]: [I] [persist.log.tag.MAPI-TranslatorManager]: [I] [persist.log.tag.MDM-Subscriber]: [I] [persist.log.tag.MDMI-CommandProcessor]: [I] [persist.log.tag.MDMI-CoreSession]: [I] [persist.log.tag.MDMI-MdmiRedirector]: [I] [persist.log.tag.MDMI-MdmiRedirectorCtrl]: [I] [persist.log.tag.MDMI-NetworkSocketConnection]: [I] [persist.log.tag.MDMI-Permission]: [I] [persist.log.tag.MDMI-Provider]: [I] [persist.log.tag.MDMI-SocketConnection]: [I] [persist.log.tag.MDMI-SocketListener]: [I] [persist.log.tag.MDMI-TranslatorManager]: [I] [persist.log.tag.MGsmSMSDisp]: [I] [persist.log.tag.MSimSmsIStatus]: [I] [persist.log.tag.MSmsStorageMtr]: [I] [persist.log.tag.MSmsUsageMtr]: [I] [persist.log.tag.MTKSST]: [D] [persist.log.tag.MtkAdnRecord]: [I] [persist.log.tag.MtkConSmsFwk]: [I] [persist.log.tag.MtkCsimFH]: [I] [persist.log.tag.MtkDupSmsFilter]: [I] [persist.log.tag.MtkEmbmsAdaptor]: [I] [persist.log.tag.MtkFactory]: [I] [persist.log.tag.MtkGsmCdmaConn]: [I] [persist.log.tag.MtkIccCardProxy]: [I] [persist.log.tag.MtkIccPHBIM]: [I] [persist.log.tag.MtkIccProvider]: [I] [persist.log.tag.MtkIccSmsIntMgr]: [I] [persist.log.tag.MtkImsManager]: [I] [persist.log.tag.MtkImsService]: [I] [persist.log.tag.MtkIsimFH]: [I] [persist.log.tag.MtkPhoneNotifr]: [I] [persist.log.tag.MtkPhoneNumberUtils]: [I] [persist.log.tag.MtkPhoneSwitcher]: [D] [persist.log.tag.MtkRecordLoader]: [I] [persist.log.tag.MtkRetryManager]: [I] [persist.log.tag.MtkRuimFH]: [I] [persist.log.tag.MtkSIMFH]: [I] [persist.log.tag.MtkSIMRecords]: [I] [persist.log.tag.MtkSmsCbHeader]: [I] [persist.log.tag.MtkSmsManager]: [I] [persist.log.tag.MtkSmsMessage]: [I] [persist.log.tag.MtkSpnOverride]: [I] [persist.log.tag.MtkSubCtrl]: [I] [persist.log.tag.MtkUiccCard]: [I] [persist.log.tag.MtkUiccCardApp]: [I] [persist.log.tag.MtkUiccCtrl]: [I] [persist.log.tag.MtkUsimFH]: [I] [persist.log.tag.Mtk_RIL_ImsSms]: [I] [persist.log.tag.MwiRIL]: [I] [persist.log.tag.NetAgentService]: [I] [persist.log.tag.NetAgent_IO]: [I] [persist.log.tag.NetLnkEventHdlr]: [I] [persist.log.tag.NetworkPolicy]: [I] [persist.log.tag.NetworkStats]: [I] [persist.log.tag.OperatorUtils]: [I] [persist.log.tag.PKM-Lib]: [I] [persist.log.tag.PKM-MDM]: [I] [persist.log.tag.PKM-Monitor]: [I] [persist.log.tag.PKM-SA]: [I] [persist.log.tag.PKM-Service]: [I] [persist.log.tag.Phone]: [I] [persist.log.tag.PhoneConfigurationSettings]: [I] [persist.log.tag.PhoneFactory]: [I] [persist.log.tag.PowerHalAddressUitls]: [I] [persist.log.tag.PowerHalMgrImpl]: [I] [persist.log.tag.PowerHalMgrServiceImpl]: [I] [persist.log.tag.PowerHalWifiMonitor]: [I] [persist.log.tag.PowerWrap]: [I] [persist.log.tag.ProxyController]: [I] [persist.log.tag.RFX]: [I] [persist.log.tag.RIL]: [I] [persist.log.tag.RIL-CC]: [I] [persist.log.tag.RIL-DATA]: [I] [persist.log.tag.RIL-Fusion]: [I] [persist.log.tag.RIL-Netlink]: [I] [persist.log.tag.RIL-OEM]: [I] [persist.log.tag.RIL-PHB]: [I] [persist.log.tag.RIL-Parcel]: [I] [persist.log.tag.RIL-RP]: [I] [persist.log.tag.RIL-SIM]: [I] [persist.log.tag.RIL-SMS]: [I] [persist.log.tag.RIL-SocListen]: [I] [persist.log.tag.RIL-Socket]: [I] [persist.log.tag.RILC]: [I] [persist.log.tag.RILC-MTK]: [I] [persist.log.tag.RILC-OP]: [I] [persist.log.tag.RILC-RP]: [I] [persist.log.tag.RILD]: [I] [persist.log.tag.RILMD2-SS]: [I] [persist.log.tag.RILMUXD]: [I] [persist.log.tag.RIL_Mux]: [I] [persist.log.tag.RIL_UIM_SOCKET]: [I] [persist.log.tag.RP_DAC]: [I] [persist.log.tag.RP_DC]: [I] [persist.log.tag.RP_IMS]: [I] [persist.log.tag.RTC_DAC]: [I] [persist.log.tag.RadioManager]: [I] [persist.log.tag.RetryManager]: [I] [persist.log.tag.RfxAction]: [I] [persist.log.tag.RfxChannelMgr]: [I] [persist.log.tag.RfxCloneMgr]: [I] [persist.log.tag.RfxContFactory]: [I] [persist.log.tag.RfxController]: [I] [persist.log.tag.RfxDT]: [I] [persist.log.tag.RfxDebugInfo]: [I] [persist.log.tag.RfxDefDestUtils]: [I] [persist.log.tag.RfxDisThread]: [I] [persist.log.tag.RfxFragEnc]: [I] [persist.log.tag.RfxHandlerMgr]: [I] [persist.log.tag.RfxIdToMsgId]: [I] [persist.log.tag.RfxIdToStr]: [I] [persist.log.tag.RfxMainThread]: [I] [persist.log.tag.RfxMclDisThread]: [I] [persist.log.tag.RfxMclMessenger]: [I] [persist.log.tag.RfxMclStatusMgr]: [I] [persist.log.tag.RfxMessage]: [I] [persist.log.tag.RfxObject]: [I] [persist.log.tag.RfxOpUtils]: [I] [persist.log.tag.RfxRilAdapter]: [I] [persist.log.tag.RfxRilUtils]: [I] [persist.log.tag.RfxRoot]: [I] [persist.log.tag.RfxSM]: [I] [persist.log.tag.RfxSocketSM]: [I] [persist.log.tag.RfxStatusMgr]: [I] [persist.log.tag.RfxTimer]: [I] [persist.log.tag.RfxTransUtils]: [I] [persist.log.tag.RilClient]: [I] [persist.log.tag.RilMalClient]: [I] [persist.log.tag.RilOemClient]: [I] [persist.log.tag.RilOpProxy]: [I] [persist.log.tag.RmcCapa]: [I] [persist.log.tag.RmcCdmaSimRequest]: [I] [persist.log.tag.RmcCdmaSimUrc]: [I] [persist.log.tag.RmcCommSimOpReq]: [I] [persist.log.tag.RmcCommSimReq]: [I] [persist.log.tag.RmcCommSimUrc]: [I] [persist.log.tag.RmcDcCommon]: [I] [persist.log.tag.RmcDcDefault]: [I] [persist.log.tag.RmcDcPdnManager]: [I] [persist.log.tag.RmcDcReqHandler]: [I] [persist.log.tag.RmcDcUtility]: [I] [persist.log.tag.RmcEccNumberUrcHandler]: [D] [persist.log.tag.RmcEmbmsReq]: [I] [persist.log.tag.RmcEmbmsUrc]: [I] [persist.log.tag.RmcGsmSimRequest]: [I] [persist.log.tag.RmcGsmSimUrc]: [I] [persist.log.tag.RmcImsCtlReqHdl]: [I] [persist.log.tag.RmcImsCtlUrcHdl]: [I] [persist.log.tag.RmcNwHdlr]: [D] [persist.log.tag.RmcNwRTReqHdlr]: [D] [persist.log.tag.RmcNwReqHdlr]: [D] [persist.log.tag.RmcOemHandler]: [I] [persist.log.tag.RmcOpRadioReq]: [I] [persist.log.tag.RmcPhbReq]: [I] [persist.log.tag.RmcPhbUrc]: [I] [persist.log.tag.RmcRadioReq]: [I] [persist.log.tag.RmcRatSwHdlr]: [D] [persist.log.tag.RmcWp]: [I] [persist.log.tag.RpAudioControl]: [I] [persist.log.tag.RpCallControl]: [I] [persist.log.tag.RpCdmaOemCtrl]: [I] [persist.log.tag.RpCdmaRadioCtrl]: [I] [persist.log.tag.RpFOUtils]: [I] [persist.log.tag.RpMDCtrl]: [I] [persist.log.tag.RpMalController]: [I] [persist.log.tag.RpModemMessage]: [I] [persist.log.tag.RpPhbController]: [I] [persist.log.tag.RpPhoneNumberController]: [D] [persist.log.tag.RpRadioCtrl]: [I] [persist.log.tag.RpRadioMessage]: [I] [persist.log.tag.RpRilClientCtrl]: [I] [persist.log.tag.RpSimController]: [I] [persist.log.tag.RtcCapa]: [I] [persist.log.tag.RtcCommSimCtrl]: [I] [persist.log.tag.RtcDC]: [I] [persist.log.tag.RtcEccNumberController]: [D] [persist.log.tag.RtcEmbmsAt]: [I] [persist.log.tag.RtcEmbmsUtil]: [I] [persist.log.tag.RtcIms]: [I] [persist.log.tag.RtcImsConference]: [I] [persist.log.tag.RtcImsDialog]: [I] [persist.log.tag.RtcModeCont]: [I] [persist.log.tag.RtcNwCtrl]: [I] [persist.log.tag.RtcPhb]: [I] [persist.log.tag.RtcRadioCont]: [I] [persist.log.tag.RtcRatSwCtrl]: [D] [persist.log.tag.RtcWp]: [I] [persist.log.tag.SIMRecords]: [I] [persist.log.tag.SimSwitchOP01]: [I] [persist.log.tag.SimSwitchOP02]: [I] [persist.log.tag.SimSwitchOP18]: [I] [persist.log.tag.SlotQueueEntry]: [I] [persist.log.tag.SmsPlusCode]: [I] [persist.log.tag.SpnOverride]: [I] [persist.log.tag.Telecom]: [I] [persist.log.tag.UiccCard]: [I] [persist.log.tag.UiccController]: [I] [persist.log.tag.UxUtility]: [I] [persist.log.tag.VT]: [I] [persist.log.tag.VsimAdaptor]: [I] [persist.log.tag.WORLDMODE]: [I] [persist.log.tag.WfoApp]: [I] [persist.log.tag.legacy_power@2.1-impl]: [I] [persist.log.tag.libPowerHal]: [I] [persist.log.tag.mtkperf_client]: [I] [persist.log.tag.mtkpower@1.0-impl]: [I] [persist.log.tag.power@1.3-impl]: [I] [persist.log.tag.powerd]: [I] [persist.logd.size]: [] [persist.qiku.operators.isabroad]: [1] [persist.radio.airplane_mode_on]: [1] [persist.radio.multisim.config]: [ss] [persist.sys.alarm.test]: [true] [persist.sys.boot.reason]: [] [persist.sys.boot.reason.history]: [shutdown,userrequested,1658268108 cold,powerkey,1658267933 cold,powerkey,1658267865] [persist.sys.dalvik.vm.lib.2]: [libart.so] [persist.sys.device_provisioned]: [1] [persist.sys.displayinset.top]: [0] [persist.sys.gps.lpp]: [0] [persist.sys.isolated_storage]: [true] [persist.sys.locale]: [en-US] [persist.sys.strictmode.visual]: [] [persist.sys.timezone]: [America/New_York] [persist.sys.usb.config]: [adb] [persist.sys.videoConferenceConstraint]: [0] [persist.vendor.audiohal.besloudness_state]: [1] [persist.vendor.audiohal.firstboot]: [0] [persist.vendor.camera3.pipeline.bufnum.base.imgo]: [5] [persist.vendor.camera3.pipeline.bufnum.base.lcso]: [5] [persist.vendor.camera3.pipeline.bufnum.base.rrzo]: [5] [persist.vendor.camera3.pipeline.bufnum.base.rsso]: [5] [persist.vendor.camera3.pipeline.bufnum.min.high_ram.fdyuv]: [8] [persist.vendor.camera3.pipeline.bufnum.min.high_ram.imgo]: [8] [persist.vendor.camera3.pipeline.bufnum.min.high_ram.lcso]: [8] [persist.vendor.camera3.pipeline.bufnum.min.high_ram.rrzo]: [8] [persist.vendor.camera3.pipeline.bufnum.min.high_ram.rsso]: [8] [persist.vendor.camera3.pipeline.bufnum.min.low_ram.fdyuv]: [6] [persist.vendor.camera3.pipeline.bufnum.min.low_ram.imgo]: [6] [persist.vendor.camera3.pipeline.bufnum.min.low_ram.lcso]: [6] [persist.vendor.camera3.pipeline.bufnum.min.low_ram.rrzo]: [6] [persist.vendor.camera3.pipeline.bufnum.min.low_ram.rsso]: [6] [persist.vendor.connsys.chipid]: [0x6739] [persist.vendor.connsys.dynamic.dump]: [0] [persist.vendor.connsys.fm_chipid]: [mt6627] [persist.vendor.connsys.patch.version]: [20200629194517a] [persist.vendor.duraspeed.app.on]: [1] [persist.vendor.duraspeed.support]: [1] [persist.vendor.ims_support]: [1] [persist.vendor.log.tel_log_ctrl]: [1] [persist.vendor.mims_support]: [2] [persist.vendor.mtk.provision.int.01]: [26,0;27,1;66,0;] [persist.vendor.mtk.vilte.enable]: [1] [persist.vendor.mtk.viwifi.enable]: [0] [persist.vendor.mtk.volte.enable]: [1] [persist.vendor.mtk.wfc.enable]: [0] [persist.vendor.mtk_ct_volte_support]: [1] [persist.vendor.mtk_dynamic_ims_switch]: [1] [persist.vendor.mtk_rcs_ua_support]: [1] [persist.vendor.mtk_sim_switch_policy]: [2] [persist.vendor.mtk_wfc_support]: [1] [persist.vendor.operator.optr]: [OP08] [persist.vendor.operator.seg]: [SEGDEFAULT] [persist.vendor.operator.spec]: [SPEC0200] [persist.vendor.radio.airplane.mode.on]: [true] [persist.vendor.radio.c_capability_slot]: [0] [persist.vendor.radio.fd.counter]: [150] [persist.vendor.radio.fd.off.counter]: [50] [persist.vendor.radio.fd.off.r8.counter]: [50] [persist.vendor.radio.fd.r8.counter]: [150] [persist.vendor.radio.msimmode]: [ss] [persist.vendor.radio.mtk_data_type]: [0] [persist.vendor.radio.mtk_dsbp_support]: [1] [persist.vendor.radio.mtk_ps2_rat]: [L/W/G] [persist.vendor.radio.mtk_ps3_rat]: [G] [persist.vendor.radio.nitz_oper_code]: [312250] [persist.vendor.radio.nitz_oper_lname]: [T-Mobile] [persist.vendor.radio.nitz_oper_sname]: [T-Mobile] [persist.vendor.radio.pendcapswt]: [0] [persist.vendor.radio.raf1]: [81930] [persist.vendor.radio.rilj_nw_type1]: [20] [persist.vendor.radio.signal_band]: [-1] [persist.vendor.radio.sim.mode]: [0] [persist.vendor.radio.simswitch]: [1] [persist.vendor.radio.smart.data.switch]: [1] [persist.vendor.radio.terminal-based.clir_m]: [4] [persist.vendor.radio.terminal-based.clir_n]: [0] [persist.vendor.radio.terminal-based.cw]: [disabled_tbcw] [persist.vendor.radio.ut.imsi.info]: [+)(*,().-0/***,$$$$] [persist.vendor.radio.ut.xui.info_1]: [kah2)0(*+(*,0,*8ek_&h[&l%egZad]&[ge] [persist.vendor.radio.volte_state]: [1] [persist.vendor.radio.wfc_state]: [0] [persist.vendor.ss.modem_version]: [0] [persist.vendor.sys.pq.adl.idx]: [0] [persist.vendor.sys.pq.bluelight.default]: [128] [persist.vendor.sys.pq.hdr.en]: [1] [persist.vendor.sys.pq.hfg.en]: [2] [persist.vendor.sys.pq.iso.shp.en]: [2] [persist.vendor.sys.pq.mdp.ccorr.en]: [0] [persist.vendor.sys.pq.mdp.color.dbg]: [1] [persist.vendor.sys.pq.mdp.color.idx]: [0] [persist.vendor.sys.pq.mdp.dre.en]: [2] [persist.vendor.sys.pq.mdp.hdrvp.dre.en]: [2] [persist.vendor.sys.pq.mdp.vp.dre.en]: [1] [persist.vendor.sys.pq.shp.idx]: [2] [persist.vendor.sys.pq.ultrares.en]: [2] [persist.vendor.vilte_support]: [1] [persist.vendor.viwifi_support]: [1] [persist.vendor.volte_support]: [1] [persist.vendor.vt.RTPInfo]: [1] [pm.boot.disable_package_cache]: [true] [pm.dexopt.ab-ota]: [speed-profile] [pm.dexopt.bg-dexopt]: [speed-profile] [pm.dexopt.boot]: [verify] [pm.dexopt.first-boot]: [quicken] [pm.dexopt.inactive]: [verify] [pm.dexopt.install]: [speed-profile] [pm.dexopt.shared]: [speed] [qemu.hw.mainkeys]: [0] [ril.csim.mlpl_mspl_ver0]: [,] [ril.ecclist]: [112,911,000,08,110,118,119,999] [ro.actionable_compatible_property.enabled]: [false] [ro.adb.secure]: [1] [ro.allow.mock.location]: [0] [ro.apex.updatable]: [true] [ro.audio.silent]: [0] [ro.audio.usb.period_us]: [16000] [ro.base_build]: [noah] [ro.baseband]: [unknown] [ro.bionic.2nd_arch]: [] [ro.bionic.2nd_cpu_variant]: [cortex-a53] [ro.bionic.arch]: [arm] [ro.bionic.cpu_variant]: [cortex-a53] [ro.board.platform]: [mt6739] [ro.boot.atm]: [disabled] [ro.boot.avb_version]: [1.1] [ro.boot.boot_devices]: [bootdevice,11230000.mmc] [ro.boot.bootlogo_number]: [A95J] [ro.boot.bootreason]: [reboot] [ro.boot.dtb_idx]: [0] [ro.boot.dtbo_idx]: [0] [ro.boot.dynamic_partitions]: [true] [ro.boot.flash.locked]: [1] [ro.boot.hardware]: [mt6739] [ro.boot.hardware.revision]: [A95_P0] [ro.boot.meta_log_disable]: [0] [ro.boot.mode]: [normal] [ro.boot.vbmeta.avb_version]: [1.1] [ro.boot.vbmeta.device_state]: [locked] [ro.boot.vbmeta.digest]: [2da5ae63ddaa673b35209bd71a5e3ab00226c7fc368dcd559c3f61f665165a48] [ro.boot.vbmeta.hash_alg]: [sha256] [ro.boot.vbmeta.size]: [10176] [ro.boot.verifiedbootstate]: [green] [ro.boot.veritymode]: [enforcing] [ro.boot.veritymode.managed]: [yes] [ro.bootimage.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.bootimage.build.date.utc]: [1655563843] [ro.bootimage.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.bootloader]: [unknown] [ro.bootmode]: [normal] [ro.build.branch.name]: [] [ro.build.characteristics]: [default] [ro.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.build.date.utc]: [1655563843] [ro.build.description]: [Serrano-user 10 QP1A.190711.020 607 release-keys] [ro.build.display.id]: [HPP-L55B-J-7.0.0] [ro.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.build.flavor]: [Serrano-user] [ro.build.host]: [xx] [ro.build.id]: [QP1A.190711.020] [ro.build.product]: [Serrano] [ro.build.system_root_image]: [false] [ro.build.tags]: [release-keys] [ro.build.type]: [user] [ro.build.user]: [xx] [ro.build.version.all_codenames]: [REL] [ro.build.version.base_os]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/566:user/release-keys] [ro.build.version.codename]: [REL] [ro.build.version.incremental]: [607] [ro.build.version.min_supported_target_sdk]: [23] [ro.build.version.preview_sdk]: [0] [ro.build.version.preview_sdk_fingerprint]: [REL] [ro.build.version.release]: [10] [ro.build.version.sdk]: [29] [ro.build.version.security_patch]: [2022-05-05] [ro.build.x.display.id]: [HPP-L55B-J-7.0.0.2022061823] [ro.camera.sound.forced]: [0] [ro.carrier]: [unknown] [ro.com.android.dataroaming]: [true] [ro.com.android.mobiledata]: [true] [ro.com.google.acsa]: [true] [ro.com.google.clientidbase]: [android-chinoe] [ro.com.google.gmsversion]: [10_202102] [ro.config.alarm_alert]: [Alarm_Classic.ogg] [ro.config.max_starting_bg]: [4] [ro.config.notification_sound]: [OnTheHunt.ogg] [ro.config.per_app_memcg]: [false] [ro.config.ringtone]: [Ring_Synth_04.ogg] [ro.control_privapp_permissions]: [enforce] [ro.crypto.state]: [encrypted] [ro.crypto.type]: [file] [ro.crypto.volume.filenames_mode]: [aes-256-cts] [ro.dalvik.vm.native.bridge]: [0] [ro.debuggable]: [0] [ro.device_owner]: [false] [ro.frp.pst]: [/dev/block/platform/bootdevice/by-name/frp] [ro.hardware]: [mt6739] [ro.hardware.egl]: [mtk] [ro.hwui.use_vulkan]: [] [ro.iorapd.enable]: [false] [ro.kernel.zio]: [38,108,105,16] [ro.lmk.downgrade_pressure]: [60] [ro.lmk.kill_heaviest_task]: [true] [ro.lmk.kill_timeout_ms]: [100] [ro.lmk.upgrade_pressure]: [30] [ro.lmk.use_minfree_levels]: [true] [ro.logd.kernel]: [false] [ro.logd.size.stats]: [64K] [ro.mediatek.rsc_name]: [default] [ro.mediatek.version.branch]: [alps-mp-q0.mp1] [ro.mediatek.version.release]: [alps-mp-q0.mp1-V9.196.1_xthink.q0mp1.k61v1.64.bsp_P10] [ro.mediatek.wlan.p2p]: [1] [ro.mediatek.wlan.wsc]: [1] [ro.mtk_modem_monitor_support]: [1] [ro.mtk_perf_fast_start_win]: [1] [ro.mtk_perf_response_time]: [1] [ro.mtk_perf_simple_start_win]: [1] [ro.odm.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.odm.build.date.utc]: [1655563843] [ro.odm.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.odm.build.id]: [QP1A.190711.020] [ro.odm.build.tags]: [release-keys] [ro.odm.build.type]: [user] [ro.odm.build.version.incremental]: [607] [ro.odm.build.version.release]: [10] [ro.odm.build.version.sdk]: [29] [ro.odm.product.cpu.abilist]: [armeabi-v7a,armeabi] [ro.odm.product.cpu.abilist32]: [armeabi-v7a,armeabi] [ro.odm.product.cpu.abilist64]: [] [ro.oem_unlock_supported]: [1] [ro.opa.eligible_device]: [true] [ro.opengles.version]: [196610] [ro.postinstall.fstab.prefix]: [/system] [ro.product.board]: [HotPepper] [ro.product.brand]: [HotPepper] [ro.product.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.product.build.date.utc]: [1655563843] [ro.product.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.product.build.id]: [QP1A.190711.020] [ro.product.build.tags]: [release-keys] [ro.product.build.type]: [user] [ro.product.build.version.incremental]: [607] [ro.product.build.version.release]: [10] [ro.product.build.version.sdk]: [29] [ro.product.cpu.abi]: [armeabi-v7a] [ro.product.cpu.abi2]: [armeabi] [ro.product.cpu.abilist]: [armeabi-v7a,armeabi] [ro.product.cpu.abilist32]: [armeabi-v7a,armeabi] [ro.product.cpu.abilist64]: [] [ro.product.device]: [HPP-L55B] [ro.product.first_api_level]: [28] [ro.product.locale]: [en-US] [ro.product.manufacturer]: [Hot Pepper Inc] [ro.product.model]: [HPP-L55B] [ro.product.name]: [Serrano] [ro.product.odm.brand]: [HotPepper] [ro.product.odm.device]: [HPP-L55B] [ro.product.odm.manufacturer]: [Hot Pepper Inc] [ro.product.odm.model]: [HPP-L55B] [ro.product.odm.name]: [Serrano] [ro.product.product.brand]: [HotPepper] [ro.product.product.device]: [HPP-L55B] [ro.product.product.manufacturer]: [Hot Pepper Inc] [ro.product.product.model]: [HPP-L55B] [ro.product.product.name]: [Serrano] [ro.product.property_source_order]: [odm,vendor,product,system] [ro.product.system.brand]: [HotPepper] [ro.product.system.device]: [HPP-L55B] [ro.product.system.manufacturer]: [Hot Pepper Inc] [ro.product.system.model]: [HPP-L55B] [ro.product.system.name]: [Serrano] [ro.product.vendor.brand]: [HotPepper] [ro.product.vendor.device]: [HPP-L55B] [ro.product.vendor.manufacturer]: [Hot Pepper Inc] [ro.product.vendor.model]: [HPP-L55B] [ro.product.vendor.name]: [Serrano] [ro.product.xdev_model]: [x038_k39tv1_bsp] [ro.property_service.version]: [2] [ro.revision]: [0] [ro.secure]: [1] [ro.setupwizard.rotation_locked]: [true] [ro.sf.lcd_density]: [240] [ro.surface_flinger.primary_display_orientation]: [0] [ro.sys.usb.bicr]: [no] [ro.sys.usb.charging.only]: [yes] [ro.sys.usb.mtp.whql.enable]: [0] [ro.sys.usb.storage.type]: [mtp] [ro.system.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.system.build.date.utc]: [1655563843] [ro.system.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.system.build.id]: [QP1A.190711.020] [ro.system.build.tags]: [release-keys] [ro.system.build.type]: [user] [ro.system.build.version.incremental]: [607] [ro.system.build.version.release]: [10] [ro.system.build.version.sdk]: [29] [ro.telephony.default_network]: [9,9,9,9] [ro.telephony.iwlan_operation_mode]: [default] [ro.telephony.sim.count]: [1] [ro.treble.enabled]: [true] [ro.vendor.ap_info_monitor]: [0] [ro.vendor.build.date]: [Sat Jun 18 22:50:43 CST 2022] [ro.vendor.build.date.utc]: [1655563843] [ro.vendor.build.fingerprint]: [HotPepper/Serrano/HPP-L55B:10/QP1A.190711.020/607:user/release-keys] [ro.vendor.build.id]: [QP1A.190711.020] [ro.vendor.build.security_patch]: [2022-05-05] [ro.vendor.build.tags]: [release-keys] [ro.vendor.build.type]: [user] [ro.vendor.build.version.incremental]: [607] [ro.vendor.build.version.release]: [10] [ro.vendor.build.version.sdk]: [29] [ro.vendor.camera.isp-version.major]: [3] [ro.vendor.camera3.zsl.default]: [150] [ro.vendor.enable.geo.fencing]: [1] [ro.vendor.md_apps.load_date]: [2022/06/18 22:42:25 GMT +08:00] [ro.vendor.md_apps.load_gencfg]: [GEN93_USER] [ro.vendor.md_apps.load_type]: [user] [ro.vendor.md_apps.load_verno]: [MOLY.LR12A.R3.MP.V140.8.P7] [ro.vendor.md_apps.support]: [1] [ro.vendor.md_auto_setup_ims]: [1] [ro.vendor.md_mims_support]: [2] [ro.vendor.md_prop_ver]: [1] [ro.vendor.mediatek.rsc_name]: [default] [ro.vendor.mediatek.version.branch]: [alps-mp-q0.mp1] [ro.vendor.mediatek.version.release]: [alps-mp-q0.mp1-V9.196.1_xthink.q0mp1.k61v1.64.bsp_P10] [ro.vendor.mtk.bt_sap_enable]: [true] [ro.vendor.mtk_aal_support]: [1] [ro.vendor.mtk_agps_app]: [1] [ro.vendor.mtk_audio_alac_support]: [1] [ro.vendor.mtk_audio_ape_support]: [1] [ro.vendor.mtk_audio_tuning_tool_ver]: [V2.2] [ro.vendor.mtk_besloudness_support]: [1] [ro.vendor.mtk_blulight_def_support]: [1] [ro.vendor.mtk_c2k_lte_mode]: [0] [ro.vendor.mtk_camera_app_version]: [2] [ro.vendor.mtk_config_max_dram_size]: [0x80000000] [ro.vendor.mtk_data_config]: [1] [ro.vendor.mtk_eccci_c2k]: [1] [ro.vendor.mtk_embms_support]: [1] [ro.vendor.mtk_emmc_support]: [1] [ro.vendor.mtk_exchange_support]: [1] [ro.vendor.mtk_external_sim_only_slots]: [0] [ro.vendor.mtk_f2fs_enable]: [1] [ro.vendor.mtk_fd_support]: [1] [ro.vendor.mtk_flv_playback_support]: [1] [ro.vendor.mtk_gps_support]: [1] [ro.vendor.mtk_log_hide_gps]: [1] [ro.vendor.mtk_lte_support]: [1] [ro.vendor.mtk_md1_support]: [9] [ro.vendor.mtk_md_sbp_custom_value]: [8] [ro.vendor.mtk_md_world_mode_support]: [1] [ro.vendor.mtk_mdmi_support]: [1] [ro.vendor.mtk_omacp_support]: [1] [ro.vendor.mtk_pq_color_mode]: [1] [ro.vendor.mtk_pq_support]: [2] [ro.vendor.mtk_protocol1_rat_config]: [Lf/Lt/W/G] [ro.vendor.mtk_ps1_rat]: [Lf/Lt/W/G] [ro.vendor.mtk_ril_mode]: [c6m_1rild] [ro.vendor.mtk_rild_read_imsi]: [1] [ro.vendor.mtk_telephony_add_on_policy]: [0] [ro.vendor.mtk_wappush_support]: [1] [ro.vendor.mtk_wfd_support]: [1] [ro.vendor.mtk_widevine_drm_l3_support]: [1] [ro.vendor.mtk_world_phone_policy]: [0] [ro.vendor.net.upload.benchmark.default]: [blocking] [ro.vendor.num_md_protocol]: [2] [ro.vendor.operator.optr]: [OP08] [ro.vendor.operator.seg]: [SEGDEFAULT] [ro.vendor.operator.spec]: [SPEC0200] [ro.vendor.product.cpu.abilist]: [armeabi-v7a,armeabi] [ro.vendor.product.cpu.abilist32]: [armeabi-v7a,armeabi] [ro.vendor.product.cpu.abilist64]: [] [ro.vendor.radio.max.multisim]: [ss] [ro.vendor.rc]: [/vendor/etc/init/hw/] [ro.vendor.sim_me_lock_mode]: [0] [ro.vendor.sim_refresh_reset_by_modem]: [1] [ro.vendor.sys.current_rsc_path]: [/system/etc/rsc/default] [ro.vendor.system.mtk_dmc_support]: [1] [ro.vendor.system.mtk_mapi_support]: [1] [ro.vendor.system.mtk_mdmi_support]: [1] [ro.vendor.vnd.current_rsc_path]: [/vendor/etc/rsc/default] [ro.vendor.wfd.dummy.enable]: [1] [ro.vendor.wfd.iframesize.level]: [0] [ro.vendor.wifi.sap.interface]: [ap0] [ro.vendor.wlan.gen]: [gen2] [ro.vndk.version]: [29] [ro.wifi.channels]: [] [ro.x.code.branch]: [sys] [ro.x.config.dev_pro]: [5,4,5,4,5,48,12.0,#,#,#,2] [ro.x.product.model]: [A95J] [ro.zygote]: [zygote32] [ro.zygote.preload.enable]: [0] [security.perf_harden]: [1] [selinux.restorecon_recursive]: [/data/misc_ce/0] [service.bootanim.exit]: [1] [service.sf.present_timestamp]: [1] [setupwizard.theme]: [glif_v3_light] [sys.boot.reason]: [shutdown,userrequested] [sys.boot.reason.last]: [shutdown,userrequested] [sys.boot_completed]: [1] [sys.factory.hardware.info]: [true] [sys.ipo.disable]: [1] [sys.ipo.pwrdncap]: [2] [sys.isolated_storage_snapshot]: [true] [sys.logbootcomplete]: [1] [sys.oem_unlock_allowed]: [1] [sys.rescue_boot_count]: [1] [sys.retaildemo.enabled]: [0] [sys.sysctl.extra_free_kbytes]: [5400] [sys.sysctl.tcp_def_init_rwnd]: [60] [sys.system_server.start_count]: [1] [sys.system_server.start_elapsed]: [13452] [sys.system_server.start_uptime]: [13452] [sys.usb.config]: [adb] [sys.usb.configfs]: [1] [sys.usb.controller]: [musb-hdrc] [sys.usb.ffs.aio_compat]: [1] [sys.usb.ffs.ready]: [1] [sys.usb.state]: [adb] [sys.use_memfd]: [false] [sys.user.0.ce_available]: [true] [sys.wifitracing.started]: [1] [sys.x.screenoff.timeout]: [0] [vendor.MB.running]: [0] [vendor.audiohal.speech.shm_init]: [1] [vendor.camera.mdp.cz.enable]: [0] [vendor.camera.mdp.dre.enable]: [0] [vendor.cdma.ril.uicc.mccmnc]: [] [vendor.connsys.driver.ready]: [yes] [vendor.connsys.formeta.ready]: [yes] [vendor.debug.pq.acaltm.dbg]: [0] [vendor.debug.pq.adl.dbg]: [0] [vendor.debug.pq.cz.isp.tuning]: [0] [vendor.debug.pq.dre.dbg]: [0] [vendor.debug.pq.dre.demowin.x]: [536805376] [vendor.debug.pq.dre.isp.tuning]: [0] [vendor.debug.pq.dredriver.blk]: [0] [vendor.debug.pq.dredriver.dbg]: [0] [vendor.debug.pq.dshp.en]: [2] [vendor.debug.pq.hdr.dbg]: [0] [vendor.debug.pq.hdrdriver.dbg]: [0] [vendor.debug.pq.hfg.isp.tuning]: [0] [vendor.debug.pq.shp.en]: [2] [vendor.gsm.gcf.testmode]: [0] [vendor.gsm.project.baseband]: [TK_MD_BASIC(LWCTG_R3_6739)] [vendor.gsm.ril.ct3g]: [] [vendor.gsm.ril.eboot]: [0] [vendor.gsm.ril.fulluicctype]: [] [vendor.gsm.ril.uicc.mccmnc]: [] [vendor.gsm.ril.uicctype]: [] [vendor.gsm.sim.extended.format1]: [0] [vendor.gsm.sim.retry.pin1]: [] [vendor.gsm.sim.retry.pin2]: [] [vendor.gsm.sim.retry.puk1]: [] [vendor.gsm.sim.retry.puk2]: [] [vendor.gsm.sim.ril.phbready]: [false] [vendor.gsm.sim.slot.lock.card.valid]: [0] [vendor.gsm.sim.slot.lock.policy]: [0] [vendor.gsm.sim.slot.lock.service.capability]: [0] [vendor.gsm.sim.slot.lock.state]: [1] [vendor.ims.eims.pdn.info]: [] [vendor.mtk.atci.boot_completed]: [1] [vendor.mtk.md1.status]: [ready] [vendor.mtk.nvram.ready]: [1] [vendor.mtk.vdec.waitkeyframeforplay]: [9] [vendor.mtk_thumbnail_optimization]: [true] [vendor.mtkcamapp.cshot.platform]: [-1] [vendor.net.ims.ipsec.version]: [2.0] [vendor.ril.active.md]: [9] [vendor.ril.apc.support]: [1] [vendor.ril.call.emci_support]: [0] [vendor.ril.cdma.3g.dualact]: [0] [vendor.ril.cdma.card.type.1]: [255] [vendor.ril.data.allow_data_slot]: [0] [vendor.ril.data.legacy_allow_mode]: [-1] [vendor.ril.data.preferred_data_mode]: [1] [vendor.ril.data.ssc.mode]: [3] [vendor.ril.disable.eboot]: [0] [vendor.ril.ecc.service.category.list]: [] [vendor.ril.fd.mode]: [1] [vendor.ril.ipo.radiooff]: [0] [vendor.ril.mtk]: [1] [vendor.ril.mux.ee.md1]: [0] [vendor.ril.mux.report.case]: [0] [vendor.ril.mux.start]: [0] [vendor.ril.muxreport.run]: [0] [vendor.ril.nw.signalstrength.lte.1]: [-108,-1] [vendor.ril.nw.worldmode.activemode]: [1] [vendor.ril.nw.worldmode.keep_3g_mode]: [0] [vendor.ril.sim.onoff.state1]: [11] [vendor.ril.sim.onoff.support]: [1] [vendor.ril.simswitch.no_reset_support]: [1] [vendor.ril.simswitch.tpluswsupport]: [1] [vendor.ril.special.ecclist]: [] [vendor.rild.libargs]: [-d /dev/ttyC0] [vendor.rild.libpath]: [mtk-ril.so] [vendor.service.nvram_init]: [Ready] [vendor.trustkernel.fs.mode]: [3] [vendor.trustkernel.fs.state]: [ready] [vendor.trustkernel.keybox.deployed]: [true] [vendor.trustkernel.log.state]: [enable] [vendor.trustkernel.productionline.state]: [ready] [vendor.trustkernel.ready]: [true] [vold.has_adoptable]: [1] [vold.has_quota]: [1] [vold.has_reserved]: [1] [vold.post_fs_data_done]: [1] [wifi.direct.interface]: [p2p0] [wifi.interface]: [wlan0] [wifi.tethering.interface]: [ap0] [xthink.factorytest.camera_main2_info]: [ ] [xthink.factorytest.camera_main_info]: [ ] [xthink.factorytest.camera_sub2_info]: [ ] [xthink.factorytest.camera_sub_info]: [ ] [xthink.factorytest.chip]: [FT6336d003 ] [xthink.factorytest.emmcvendor]: [150100514531334d420] [xthink.factorytest.firmware]: [0x05 ] [xthink.factorytest.mtk_fb_panel_name]: [GC9503_CMI ]
mtkclient actually works without the kernel patch ! $ mtk printgpt DA_handler - Device is unprotected. DA_handler - Device is in Preloader-Mode :( DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin xflashext - Patching da2 ... DAXFlash - Successfully uploaded stage 1, jumping .. Preloader - Jumping to 0x200000 Preloader - Jumping to 0x200000: ok. DAXFlash - Successfully received DA sync DAXFlash - Uploading stage 2... DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - Successfully uploaded stage 2 DAXFlash - EMMC FWVer: 0x0 DAXFlash - EMMC ID: QE13MB DAXFlash - EMMC CID: 150100514531334d420da525d2998409 DAXFlash - EMMC Boot1 Size: 0x400000 DAXFlash - EMMC Boot2 Size: 0x400000 DAXFlash - EMMC GP1 Size: 0x0 DAXFlash - EMMC GP2 Size: 0x0 DAXFlash - EMMC GP3 Size: 0x0 DAXFlash - EMMC GP4 Size: 0x0 DAXFlash - EMMC RPMB Size: 0x400000 DAXFlash - EMMC USER Size: 0x3a3e00000 DAXFlash - HW-CODE : 0x699 DAXFlash - HWSUB-CODE : 0x8A00 DAXFlash - HW-VERSION : 0xCB00 DAXFlash - SW-VERSION : 0x2 DAXFlash - CHIP-EVOLUTION : 0x0 DAXFlash - DA-VERSION : 1.0 DAXFlash - Upload data was accepted. Jumping to stage 2... DAXFlash - DA Extensions successfully added GPT Table: ------------- boot_para: Offset 0x0000000000008000, Length 0x0000000000100000, Flags 0x00000000, UUID f57ad330-39c2-4488-b09b-00cb43c9ccd4, Type EFI_BASIC_DATA recovery: Offset 0x0000000000108000, Length 0x0000000001800000, Flags 0x00000000, UUID fe686d97-3544-4a41-21be-167e25b61b6f, Type EFI_BASIC_DATA para: Offset 0x0000000001908000, Length 0x0000000000080000, Flags 0x00000000, UUID 1cb143a8-b1a8-4b57-51b2-945c5119e8fe, Type EFI_BASIC_DATA expdb: Offset 0x0000000001988000, Length 0x0000000001400000, Flags 0x00000000, UUID 3b9e343b-cdc8-4d7f-a69f-b6812e50ab62, Type EFI_BASIC_DATA frp: Offset 0x0000000002d88000, Length 0x0000000000100000, Flags 0x00000000, UUID 5f6a2c79-6617-4b85-02ac-c2975a14d2d7, Type EFI_BASIC_DATA vbmeta: Offset 0x0000000002e88000, Length 0x0000000000800000, Flags 0x00000000, UUID 4ae2050b-5db5-4ff7-d3aa-5730534be63d, Type EFI_BASIC_DATA vbmeta_system: Offset 0x0000000003688000, Length 0x0000000000800000, Flags 0x00000000, UUID 1f9b0939-e16b-4bc9-bca5-dc2ee969d801, Type EFI_BASIC_DATA vbmeta_vendor: Offset 0x0000000003e88000, Length 0x0000000000800000, Flags 0x00000000, UUID d722c721-0dee-4cb8-838a-2c63cd1393c7, Type EFI_BASIC_DATA nvcfg: Offset 0x0000000004688000, Length 0x0000000000800000, Flags 0x00000000, UUID e02179a8-ceb5-48a9-3188-4f1c9c5a8695, Type EFI_BASIC_DATA nvdata: Offset 0x0000000004e88000, Length 0x0000000002000000, Flags 0x00000000, UUID 84b09a81-fad2-41ac-0e89-407c24975e74, Type EFI_BASIC_DATA md_udc: Offset 0x0000000006e88000, Length 0x000000000169a000, Flags 0x00000000, UUID e8f0a5ef-8d1b-42ea-2a9c-835cd77de363, Type EFI_BASIC_DATA metadata: Offset 0x0000000008522000, Length 0x0000000002000000, Flags 0x00000000, UUID d5f0e175-a6e1-4db7-c094-f82ad032950b, Type EFI_BASIC_DATA protect1: Offset 0x000000000a522000, Length 0x0000000000800000, Flags 0x00000000, UUID 1d9056e1-e139-4fca-0b8c-b75fd74d81c6, Type EFI_BASIC_DATA protect2: Offset 0x000000000ad22000, Length 0x0000000000ade000, Flags 0x00000000, UUID 7792210b-b6a8-45d5-91ad-3361ed14c608, Type EFI_BASIC_DATA seccfg: Offset 0x000000000b800000, Length 0x0000000000800000, Flags 0x00000000, UUID 138a6db9-1032-451d-e991-0fa38ff94fbb, Type EFI_BASIC_DATA persist: Offset 0x000000000c000000, Length 0x0000000003000000, Flags 0x00000000, UUID 756d934c-50e3-4c91-46af-02d824169ca7, Type EFI_BASIC_DATA sec1: Offset 0x000000000f000000, Length 0x0000000000200000, Flags 0x00000000, UUID a3f3c267-5521-42dd-24a7-3bdec20c7c6f, Type EFI_BASIC_DATA proinfo: Offset 0x000000000f200000, Length 0x0000000000300000, Flags 0x00000000, UUID 8c68cd2a-ccc9-4c5d-578b-34ae9b2dd481, Type EFI_BASIC_DATA md1img: Offset 0x000000000f500000, Length 0x0000000004000000, Flags 0x00000000, UUID 6a5cebf8-54a7-4b89-1d8d-c5eb140b095b, Type EFI_BASIC_DATA md1dsp: Offset 0x0000000013500000, Length 0x0000000001000000, Flags 0x00000000, UUID a0d65bf8-e8de-4107-3494-1d318c843d37, Type EFI_BASIC_DATA spmfw: Offset 0x0000000014500000, Length 0x0000000000100000, Flags 0x00000000, UUID 46f0c0bb-f227-4eb6-2fb8-66408e13e36d, Type EFI_BASIC_DATA mcupmfw: Offset 0x0000000014600000, Length 0x0000000000100000, Flags 0x00000000, UUID fbc2c131-6392-4217-1eb5-548a6edb03d0, Type EFI_BASIC_DATA gz1: Offset 0x0000000014700000, Length 0x0000000001000000, Flags 0x00000000, UUID e195a981-e285-4734-2580-ec323e9589d9, Type EFI_BASIC_DATA gz2: Offset 0x0000000015700000, Length 0x0000000001000000, Flags 0x00000000, UUID e29052f8-5d3a-4e97-b5ad-5f312ce6610a, Type EFI_BASIC_DATA nvram: Offset 0x0000000016700000, Length 0x0000000000500000, Flags 0x00000000, UUID 9c3cabd7-a35d-4b45-578c-b80775426b35, Type EFI_BASIC_DATA lk: Offset 0x0000000016c00000, Length 0x0000000000100000, Flags 0x00000004, UUID e7099731-95a6-45a6-e5a1-1b6aba032cf1, Type EFI_BASIC_DATA lk2: Offset 0x0000000016d00000, Length 0x0000000000100000, Flags 0x00000000, UUID 8273e1ab-846f-4468-99b9-ee2ea8e50a16, Type EFI_BASIC_DATA loader_ext1: Offset 0x0000000016e00000, Length 0x0000000000010000, Flags 0x00000004, UUID d26472f1-9ebc-421d-14ba-311296457c90, Type EFI_BASIC_DATA loader_ext2: Offset 0x0000000016e10000, Length 0x0000000000010000, Flags 0x00000000, UUID b72ccbe9-2055-46f4-67a1-4a069c201738, Type EFI_BASIC_DATA boot: Offset 0x0000000016e20000, Length 0x0000000001800000, Flags 0x00000000, UUID 9c1520f3-c2c5-4b89-4282-fe4c61208a9e, Type EFI_BASIC_DATA logo: Offset 0x0000000018620000, Length 0x0000000000800000, Flags 0x00000000, UUID 902d5f3f-434a-4de7-8889-321e88c9b8aa, Type EFI_BASIC_DATA dtbo: Offset 0x0000000018e20000, Length 0x0000000000800000, Flags 0x00000000, UUID bece74c8-d8e2-4863-fe9b-5b0b66bb920f, Type EFI_BASIC_DATA tee1: Offset 0x0000000019620000, Length 0x0000000000500000, Flags 0x00000004, UUID ff1342cf-b7be-44d5-5ea2-a435addd2702, Type EFI_BASIC_DATA tee2: Offset 0x0000000019b20000, Length 0x0000000000ce0000, Flags 0x00000000, UUID a4da8f1b-fe07-433b-cb95-84a5f23e477b, Type EFI_BASIC_DATA super: Offset 0x000000001a800000, Length 0x00000000c6800000, Flags 0x00000000, UUID c2635e15-61aa-454e-409c-ebe1bdf19b9b, Type EFI_BASIC_DATA cache: Offset 0x00000000e1000000, Length 0x0000000013000000, Flags 0x00000000, UUID 4d2d1290-36a3-4f5d-b4af-319f8ab6dcd8, Type EFI_BASIC_DATA userdata: Offset 0x00000000f4000000, Length 0x00000002aedfbe00, Flags 0x00000000, UUID fdce12f0-a7eb-40f7-5083-960972e6cb57, Type EFI_BASIC_DATA flashinfo: Offset 0x00000003a2dfbe00, Length 0x0000000001000000, Flags 0x00000000, UUID 0fbbafa2-4aa9-4490-8389-5329328505fd, Type EFI_BASIC_DATA Total disk size:0x00000003a3e00000, sectors:0x0000000001d1f000
this page appears to enumerate the commands to unlock mediatek phones: https://www.droidwin.com/unlock-bootloader-on-mediatek-devices-using-mtkclie... there are 3 fastboot commands to try, and then some mtk downloadagent tricks
the dance of $ mtk e metadata,userdata,md_udc $ mtk da seccfg unlock ran without error and i'm trying out https://github.com/phhusson/treble_experimentations/releases/download/v415/s... i expect i have more to do, though, before a gsi image will just run
the 'super' partition had about the same size and i tried to flash it. this made it bootloop into fastboot. it turns, websearching, that 'super' is an extended partition, that contains 'system' inside it as a logical partition. i reflashed my imaged super and the phone works again, AND ! it gives the boot message that my bootloader is unlocked :D it sounds like new versions of fastboot know to look inside the super partition, even if mtkclient doesn't immediately do that
so unlocking bootloader: https://www.hovatek.com/forum/thread-40300.html flashing treble_experimentations: https://www.xda-developers.com/flash-generic-system-image-project-treble-dev... the system partition is inside the extended super partition it has secure boot enabled, so there are more hoops to navigate
fastboot is giving me 'this partition doesn't exist' even when updated to latest version :/ i can see 'system' listed in the header of super.bin
ok, there are two different fastboots. the userspace fastboot, fastbootd, can look inside the super partition. when this one is running, there is a graphical menu on the phone saying "fastbootd" and `fastboot getvar is-userspace` returns "yes". the simpler one doesn't look inside super and returns "no". i got into fastbootd by booting into android then doing `adb reboot fastboot` . there are also tools to extract/repack the super partition off the phone.
this worked. the phone is now running the open source treble OS, android 12. i did not have to change the secure boot partition. - unlock the phone using mtkclient da seccfg unlock [link for details a couple posts back] - reboot into fastbootd, the graphical fastboot, and flash the system image with arm32_binder64-ab seems quite likely one could pull fastbootd out of the mix. and other things, some day.
b2sums 71ad9faaef18ceb973c527db29cb1fc3f27ab2286b49e7f4238645f4048815d6ad18773ed52455aecfae7d7221daaab183b9f55a92e545cc36601d1970dda26f v415-2022-07-19-system-squeak-arm32_binder64-ab-vanilla.img size=1308471296 boots=true my partitions from the image i took: f0676fef12a6fdc9074d939d7996c0a564fe4739bb6e31231ca38e4e05b4146345b7afabff97a54aacb39af11cb2fcf2df209abfdd17d24121eddb3d8f46d95c boot size=25165824 a834b19291e54808ba8367ca60e6abd9c744138541284b12bb6caa532fae419b063c26022121148fef68a7d8dc0fa83eb2f00454138c1c54753f7148f6911e0d boot_para size=1048576 a0710951ceaea9a341c0671ad163de6919e90791257c89e078f2bb953e37a8f8a795efe8e31e509e2e723a54b36f8e58b4a1b739e642a4b8affd88264545392b cache size=318767104 2c7497ff142e16092991cba2af39ffec51de988524eb9d05e10e16504e6b1b16fb22febade6755bef224de1cd9b4dc45b91987721f2b44dcc6c2852b416b7cf5 dtbo size=8388608 b01850bf6173db9f5f87f84eaa7d41a502857b93543239a2fcef81790514af222dc9f98aabefb104ff3cec0a3df2af6c71de526a0fb85401618a7654a173cf82 expdb size=20971520 9f28dc4bc3ca4a3ef6d860f6d44801de5d49f4c86bb2410c524c154d4a38de07d58f981837e5c90952f81b5be4294f498e57557203135f30d5bd6f09c7e2a7c3 flashinfo size=16777216 b02dd7288f71fe5b526980e19426527d85a6ef402af59e6a8d5f920ee80444a4454254bfb7a0059a22bdb128c63e254218bf12453bcf1d78c7a0026a2bee0cd3 frp size=1048576 adb7fdd3cee262e9cb5d9e331c5a0c9b79583294e07c0bf80ddfe7031291a6b85176567b13227cdb63a47d693a51b17f40aba27745809ffd11375f118b21e4e0 gpt_backup size=16896 286494ab0ffd66da42cd0440d34c2d4d8173252f826a432774dfdff147c708d8a8d4fd9a4d5d92c5b477f3794a23cfae2d7115ebfc692b375f2da70fe88d3b61 gpt_main size=17408 2293a7a4f497aa92964e1728a0bfca919f255c5b4f8528f1260adfe53248ef48fc1fba8266e7301cbfc2ae5cfe2794eded1571ed1ea1333c3c93585e0d5ba3d1 gz1 size=16777216 2293a7a4f497aa92964e1728a0bfca919f255c5b4f8528f1260adfe53248ef48fc1fba8266e7301cbfc2ae5cfe2794eded1571ed1ea1333c3c93585e0d5ba3d1 gz2 size=16777216 162c177df974a4b9c497150d0f7d952bd3cb8e9316e9ffd3b1d6dd420b89d9f849e48e289fbac79f7151e780e893bc9e8d8cf4749ed3bf6419cfe67a78fb63c6 lk2 size=1048576 162c177df974a4b9c497150d0f7d952bd3cb8e9316e9ffd3b1d6dd420b89d9f849e48e289fbac79f7151e780e893bc9e8d8cf4749ed3bf6419cfe67a78fb63c6 lk size=1048576 f2aa73345a55ea0959a1aa28cdb37997436ec5d36c3bdcc4332332ab0a97f74d16352ed2240dd4a7b487da377f298e8df8e039bae769441755c104d27b0ac19e loader_ext1 size=65536 f2aa73345a55ea0959a1aa28cdb37997436ec5d36c3bdcc4332332ab0a97f74d16352ed2240dd4a7b487da377f298e8df8e039bae769441755c104d27b0ac19e loader_ext2 size=65536 cf6a1eda8b68e6ef111e3e99554dc923d9301e541f6cda998ff1504480adb1c19ac31aa328d1b8c949f530bab34d4df51109da4f4f01d63eff2f18741a565c67 logo size=8388608 43ca91e6c647ce53b8bd238c8d1e66ff95e21a9205887ba084468743aa883cf5c2fad09db28d1ccdb96cab93646b167bd83c802fe508de7d93cb5249af187559 mcupmfw size=1048576 24f3515bafc49dc12c1457a06f503445ceaabac0b8efbdf3c03e048320316719016eac61b195b31085e790e96835fdceb8e4265bdb91abeb18c86e5d2f176356 md1dsp size=16777216 0be5fd2f65c602cfea474eda086b74f7ea5d8ccd7556098a38a02351438f4b1e38f2fded06410a86d3fb718fa41ae093aee3ddd992bf30cb51388baf59b76fe4 md1img size=67108864 1e86bd658db1fb52b3de5da58152c399aa2ff4e5438c733b4a33bfccc6a287e9cfc4021fd2e721939b862ab59f9617d64f5e5ee1dfe2dcc87d06c2797bc21a11 md_udc size=23699456 30643d30e8b6fe727a33b5737b8be4c15129b1e1de1d7d6a23f1aeaafbc1f81967a7fa4767525e87a403daee3c245fcdb8334cadf20ca96c47df17eecb19a950 metadata size=33554432 dbe4b0a0519da6139897ff019a0b38a202325c4718251ae07ff846fab539772683fa1c39dcf3496298f43afc10bb385a3b2a88b1f7b3a09278978384ce83ad51 nvcfg size=8388608 b6d842b010c5d78ee91846cb3d1c92b32543cf65f326abf778b6c981a372c58ae193062a3335addf50bfb06d91cc84d2888eda8b5846b9c1e79f141ffbbf797d nvdata size=33554432 7e39527db7bbf056c6b48a31c0cd1a56faf62ca3619df931713fc3b08d1f737743f80a1adc1f5f46fd112877f38e730cc84cf69bf2bc3f600b54e48399c9c54f nvram size=5242880 b15323a38433b97b0cfb5fa87ab0e52a8cd5a77afac37275223543a6bab3a39a68386b5cb5300202b7de2c7361a55b0fd22ae5d5e08d78694d295cfa978c8439 para size=524288 87dfbbe3b72af8fa0f38913959f3c5a66e69b3bfbeccfca925d1dcba7310f13ef566a4bb67c1d4040ff93820cdddb56841766362175549b9cb976f7c37869a92 persist size=50331648 6ece667ad916b39bdbf654ae502b094c0ae0e72581775d08fc6a349d64d6d14cfbcead928d85cf61c1888d8062f46fc7d0445381a7a95eb94df12cb5bfce6054 proinfo size=3145728 64f6709f93f9323b49f6dd5e60ea5f43d2ac7f65d6baa3124f2d79cd87179c7943cb568e6b1055c2730988a7cc092742c68d91daed10bdd105d1c143dc97422f protect1 size=8388608 7d4f79d8a2fd1f8ad760d758a6dd1ca866f1fad5c01396258b90bb7a0caecd9c131661dfa9672d633e211f8cd5b164e0bb7f585037d35cfff741751a689f010f protect2 size=11395072 bcc54767f957ec77c8a94151a4e5c4787763570d2acdada205a424fc1d892d2b4b0eb03fb1ae5fcfd28b685b11a66e30399a1428d36dd8873addbb4e2a6670d3 recovery size=25165824 5069f4e376673bbfd3eda944555ce956bc65458172934a798085066e627e22a25666704ad929e6875c03746c3dad2e42e7bc822229c5a5ea7b8010098d552c45 sec1 size=2097152 83f5caf87761b60b087bb9ee8059989eb71b4757f7c6bb9793d7e56ea04ab0bf1003d7146e529c5104e03aff0170d0eaa943a048aa59503416bc066847853bce seccfg size=8388608 3dee9d34f6e08205abf5900e78dc7a88d6ca3d1b5e9b5adafbf47adf284a9802699799b0082ce4d08924cff63604914f996445bc4a4cbc126c0ef73be236072a spmfw size=1048576 2e3fc9b36c95a62eb4cd6f1ac87db82f3a7b4bc93118a00225441f2260aeb9cba878fd1d0dc59e174fe31ea0e44e466f82ba62b2ce4e26b6f281e8722dae49d6 super size=3330277376 0e5441daadd74dc24f90a584d8e26ea1c4011aa8dca85e836fca31850daa838446d4a246ac397fbac88a45d1c5a1ef185fc86f325e5d33a0eed0018db166c742 tee1 size=5242880 db56434317634911149dcd2f8101d5dcee37731565ff00cc404cb289fc4410e3cdedf94a0c96afd035218f3b923553d0299a2a4046403ccf6b78a44b742e71f7 tee2 size=13500416 ce4fa88a5e8ee978732e5b875bb765d04795454cb0ded36d086cb138e5cd4ac5b11c5bd2bbc02e38117f6900f5722c0d5694431473599ae6c6434e3ac2aed4e6 userdata size=11523833344 43b5c1a5df199f4620e2f37acbd01c6ce3e37d1d191de4e504e48e3d48de802900ad39945399ac71d77e080958ac6cf9c2bcceda58866928228c004923eacd7e vbmeta size=8388608 85c808c0bfeae8912997448d6e503276a6e4e51c24e3170b1c5f4a630a8307c15b9d529d7b879b291cb0621ec67c8591088a7d49ef8566e36701a13afa884416 vbmeta_system size=8388608 e31f4e5c7361e9a49d12866afa25cea5f22610c9ce416ab6663d42fdc96c27eb2a6268595276e57a287a73d3258e8f8bc2c6a2e53e01cbb525ab2df106cafdfc vbmeta_vendor size=8388608
none of the images with, like, an app store on them, fit on the partition given there is read/write access to the whole flash, it could be repartitioned. the userdata partition is much larger than the system partition, and with an open rom userdata could be moved entirely to a microsd card. the chipset is 64 bit, but the os is 32 bit. leaves one wondering what would be involved in changing that. that would mean changing more than just the system partition, though, i infer. i'm flashing back my userdata, since it seems to work ok with treble, and then planning on reflashing the system partition, installing f-droid manually, and falling asleep. the flash has 18-19 minutes left. might fall asleep first, uncertain.
it is so incredible how responsive this phone is now previously, i would tap or swipe part of the screen, and it would register touches elsewhere, and it was impossible to do anything it just does what i say to do now it is like having palsy and having it go away
other roms than vanilla didn't work on my phone, which makes it hard to activate apps i've purchased in the past, or use google services when appropriate. i asked in one of the chats and learned that fastboot will resize my system partition up if i delete the product partition with fastboot delete-logical-partition product
9bbe800b250d3d80a6b3bfc650ea59154870c5161e8fce7a9c4cb31beb619c8edeb15dd4672adabd7b19fa0905617c3a0e45d907ebb80c40dbb0cf0e6e1a3d5b v415-2022-07-20-system-squeak-arm32_binder64-ab-gogapps.img size=1905078272 boots=true the phone is much slower after boot with the google services framework and other google apps installed
from https://forum.xda-developers.com/t/how-to-decrypt-and-split-adopted-storage.... # How to partition and to have adopted storage at same time. You don't need to root your device but the device i done this with is rooted 1. You need to enabled Developer Options. 2. Enable the USB Debugging option. 3. Make sure your SD card is formatted as portable, then get the adb executable from android sdk or any other source. 4. Connect your device to your PC and run the adb devices command. If your device is connected correctly you will see your device listed in the output. 5. Run adb shell sm list-disks adoptable. This will show you the list of disks that can be used for what we want. 6. For my device it showed me disk:179,128 so i ran adb shell sm partition disk:179,128 mixed 80 on my 32 GB SD card. It gave me 5 GB as adoptable storage and the rest for other uses. (This will format your SD card.) # How to decrypt adopted storage. 1. Your device must be rooted. 2. Using a file browser like ES Explorer, browse to /data/misc/vold. 3. The .key file there is the encryption key of your adopted storage. 4. Open that file with a hex editor to view the 16-byte key. 5. On any Linux distro you can do this first mount your SD card, in my case SD card was mounted at /dev/sdb2. 6. Then run this command dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt aes-cbc-essiv:sha256 <You put the 16 bytes of hex data from the file here> 0 /dev/sdb2 0" This might give you a error but ignore it. 7. If your key is correct you can mount it by mount -t ext4 /dev/mapper/crypt1 /mnt/1/ 8. Finally you can run cd /mnt/1 to browse the decrypted storage.
bf6ebf2485a112e4293db8014a9f9f8ec63f65724856d6c62e7b785d3ad7e3a1f20c098ed510406376387c70799470ccda5fd2c6d10a6ec295dc54df37c3e26f v313-2022-07-20-system-roar-arm32_binder64-ab-gogapps.img size=1550332304 boots=true an app i wanted to use wasn't working in android 12, so i'm trying android 11
the android 11 build has this google thing where, if you use google services framework and the system is not registered with google, it boms you with constant loud popups about that being the case. in order to resolve it, i had to navigate the popups to both register an account with the device, and extract the gsf id, and then log in to google with the same account separately in a web browser, and enter the id at https://www.google.com/android/uncertified/ to use a custom rom officially, then reboot the phone. gsf does not seem to be the way to go. i understand there are existing open source shims started to replace it. they might be very old, not sure. the android 12 build does not do this, so the issue may be resolved for new builds.
i got my app working in android 11. the v313 image has a bug where there is no app switcher. maybe early dev of a few things. to make the app work, i had to enable an android permission that i had not enabled in android 12. so i'm trying android 12 again.
android 12 works with temporary permission enabling i'm jumping through adb hoops to set partitions back up
I found it documented that the HPP-L55B contains this mediatek chipset. It is a different phone from the L55B that contains a unisoc. The person who suggested they were the same on a chat made a mistake. I've been having trouble moving, holding goals, eating food, for many hours now, ever since my last "please help me sleep outside" post. I'm worried about my appointments mid-day today, how to get to them.
Phh treble android 12 has been working incredibly on this low end phone for me, but today misbehaviors began accumulating to the point of notability again. Although the phone is still incredibly more responsive than on its factory OS. - popups prevent use of OpenKeychain("ChromeSync" one word, looks like possibly a phishing thing maybe or a way to deter pgp) - I was trying to set up a matrix client and text kept pasting in among my typing, making registration very difficult The popup is new to me, but the text pasting has happened to me a lot, it's part of a suite of keyboard misbehaviors I get on my devices. What's exciting is that I can image the phone etc and bisect what stimulates the issues. If the cause is outside the code stored on the system and user partitions of the device, that will be frustrating, but good to know, and also unlikely. I don't know if or when I will do that, as I have bad experiences, likely from trauma, associated with resisting cracking of my personal devices. But it's quite exciting that I have so many more tools to do so. It's good to have a phone work. We'll see.
I'd like to add that I'm not really conscious of the phone misbehaviors. If I knew they were malicious, I would take my devices to authorities or security consultants or whatnot, but I can't tell if I'm imagining them or not because I have amnesia around the intermittent things, neurologic issues that make similar experiences, and bad confusing flashbacks prevent investigation and verification. One of my big goals is having and using a device that behaves reliably. So hashed backups of working firmware, and a norm of reverting to them, would be a great step. I'm guessing that OpenKeychain won't stimulate frequent popups if I build it from source rather than downloading a binary.
my phone has bricked and i am trying to reflash it. unfortunately i have lost copy of the “persist” partition. while it is bricked, this partition is strangely mutating. i believe i may have uploaded it to w3.storage, but it doesn’t seem to be downloading from the ipfs hash i have. i am still working on this some, but eventually i will take a break.
meanwhile, phhussonm the dev of the treble builds i was using on this phone, has apparently left dev work. the last release is now the one i was running. i’m planning to downgrade to one more stable. i flashed the factory super partition, and the phone booted to recovery and complained of corruption, giving me the option to factory reset it. doing this made it functional again w00t i’ll be flashing an open source rom again. i may contact the vendor for kernel sources. a rom was released yesterday, dunno if it works this phone is $14 at my local walmart
to figure this stuff out, i used losetup —partscan to process the partition table of a complete flash image i took using mtkclient i’m now using that partition map to recover my old userdata partition and reflash it to get everything back how it was, maybe. this could restimulate the brick i dunno. looks like it may take like half an.hour. i’m using phhusson treble_experimentations v414 and it’s looking much better than v415 already — for example it reports strong LTE service which I didn’t have before. i’ve also learned there is a “treble app” which can fix connection issues, and also some other workarounds to configure in the phone settings for e.g. bluetooth to be more reliable. 927cdc11519965df75007bdafdf1b6b2eaf459b4803fa5538bda910acd0dc3cdc34388bd4c748acb1969548bab424c978648eaed5b791f201f44842a32490b34 v414-2022-11-05-system-squeak-arm32_binder64-ab-vanilla.img
i left it alone for a while and returned. after the userdata partition reflashed it behaves like the battery is busted, only powering when plugged and then not booting. given their are two compounding factors (different os release and the partition could be borked) it makes sense to wipe it and possibly copy data manually maybe a future day
missing basic and normative tools: - dump dirtree from an e2fs filesystem - extract encryption keys from device and decrypt userdata image - access device logical partitions via flashing cable other stuff the encryption key and decryption situation just looks like a lot of work to me, more than often makes sense for me nowadays, sadly. my data is likely to go on hold, making space for functionality. future note: back up /data while it is decrypted !! i’m trying to archive this stuff, so it’s still queued. one thing i found is it possible to disable encryption on these phones. i think that was in the vendor docs, not certain. another thing i found is mtkclient has a command for viewing logs. wonder what it shows.
https://source.android.com/docs/security/features/encryption/file-based#enab... FBE is enabled by adding the option fileencryption=contents_encryption_mode[:filenames_encryption_mode[:flags]] to the fs_mgr_flags column of the fstab line for userdata. This option defines the encryption format on internal storage. It contains up to three colon-separated parameters: maybe just removing this from fstab would make it easier to recover from things
i spent some time learning about things my device’s partitions are all mounted in the ramdisk loaded by the kernel, completely separate from the system partition i’ve been reflashing. the ramdisk is in a partition in another custom android format called bootimg. there are tools online from the android source to make these images and unpack them. the unix magic file utility also shows the ramdisk offset to manually extract it. these various partitions can yield fruit, for example there may be logfiles in the cache partition. it looks like the way to disable encryption would be to repack my bootimg partition. the recovery image is a gzipped cpio archive. worried some about my use of time.
Hi Karl - glad you have been able to eat. I no things have been difficult - Good luck! ------- Original Message ------- On Sunday, November 6th, 2022 at 6:33 AM, Undescribed Horrific Abuse, One Victim & Survivor of Many <gmkarl@gmail.com> wrote:
things are back to normal. it appears as if it is the same.
after rebooting my system back to linux, it actually unhibernated! often it will just boot up again, fscking the disk to handle nothing having been cleanly closed. it is great to have the hibernation-resuming working this time.
participants (5)
-
Undescribed Horrific Abuse, One Victim & Survivor of Many
-
Undiscussed Horrific Abuse, One Past Victim of Many
-
Undiscussed Horrific Abuse, One Victim of Many
-
Undiscussed Past Horrific Abuse, One Victim Of Many
-
ytooR