Develop Bugs

[HOW TO]Guideline / Install MTK drivers / How to Root / Flash a Rom / IMEI Restore

In this Thread i will explain how to set up MTK drivers and Flashtools.
Guideline:
Post #1 : Set up MTK drivers in Windows 8 / 8.1 / 10
Post #2 : Use Flashtools for MTK Devices
Post #3 : How to Flash Custom Roms / Roms download Guide / How to Root Stock Rom
Post #4 : Windows 10 MTK Drivers installation ( just in case post #1 dont work )
Post #5 : Lost IMEI Backup​
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
How to Install MTK drivers in Windows 8 / 8.1 / 10
what we need:
MTK Vcom Preloader Driver 2.0
Download : https://www.androidfilehost.com/?fid=24438995911977169
First thing we need is to Disable the Signed Driver verification on Windows :
To disable driver signature verification, we’re going to need to get into the Troubleshooting options from the boot manager.
The easiest way to bring this screen up is using this secret trick.
Hold down the SHIFT key while you click Restart.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Once your computer has rebooted you will be able to choose the Troubleshoot option.
Then head into Advanced options.
Then Startup Settings.
Since we are modifying boot time configuration settings, you will need to restart your Computer one last time.
After restarting your computer a second time,
choose Disable driver signature enforcement from the list by typing the number 7 on your keyboard.
That’s all there is to it. Your PC will then reboot and you will be able to install unsigned drivers.
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
Now its Time to open SP_Driver_v2.0.zip and start the DriverInstall.exe
it will open the install prompt . Press okay and dont change the installation path
Code:
C: // program files / Mediatek / Driver Package
during the installation it will start the verification window security.
Click on Install this driver software anyway
There will be an Error Message . - We Ignore it !
-Now Open your Device Manager and leave it open.
-Power Off your Phone and connect it with your Pc.
-you will see Under ports ( COM & LPT ) a Preloader unknown device
right click on there and click on Driver update/installation.
-Choose manually search for drivers
-Browse to C:// program files / Mediatek / Driver Package and apply.
-If all went good you have successfully installed the MTK Vcom Drivers. :good:
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>​

How to Use Flashtools
i use SP_Flash_Tool_Windows_v5.1520.00.000 and never had a problem with it.
Its for most all MTK Phones and for all Elephone Devices
Download Link: https://www.androidfilehost.com/?fid=24438995911977217
- Extract the Flashtool zip folder to your Desktop
- Click flash_tool.exe to open the Tool
- You will see two "folder buttons" Download agent and Scatter-loading
- Into Download agent place the MTK_AllInOne_DA.bin file .
its in your Flashtools folder
- Into Scatter-loading place the Scatter.txt
All Stock Roms / Custom Recoverys have one Scatter.txt in their Zip files.
- Make sure that every partition is checked
-IMPORTANT NOW, Flashing Part-
-Power Off your Device!
-Press on the Download Button!
-Connect your Device with PC and wait until all is flashed
-you will see a Green Mark when all is done
-Disconnect your Device and press Power button to Reboot.
:fingers-crossed::good::fingers-crossed:
------------------------------------------------------------------------------------------------------------------------------------------------​

How to Install Custom Roms
You don't need to root your phone to use Custom Roms like
Eragon Rom
or
Nexus Rom
because within installation it will get root with SuperSU
P.s: if you run into a problem e.g Bootloop . (newest Rom dont work well with our Custom Roms , related to its Partition.Img)
You could Flash the Stock ROM 02150725 to solve it
--------------------------------------------------------------------------------------------------
1. Place the Rom.Zip into your Internal or External Sdcard
2. If you are on Stock Rom just Flash a Custom Recovery
Best Recovery without any bug is Philz v2 but you can also use Twrp Recovery
3. Hold Vol+ and Power simultaneously
you will get into the Bootloader Menu
4. Navigate with Vol+ to Recovery and apply with Vol-
5. In Recovery perform a Fullwipe , wipe System , Data , Cache , Dalvik
(In Philz Recovery wipe "clean to install a new rom"
In TWRP Recovery Wipe /advanced Wipe /wipe System,Data,Cache,dalvik)
6. Install the Rom.Zip located in your Sdcard
7. Reboot
<><><><><><><><><><><><><><><><><><><><><><><><><> <><><><><><><><><><><><><><><><><><><><><><><><>
Custom Roms and Stock Roms
Eragon Rom - http://forum.xda-developers.com/elephone-p8000/development/rom-06-9-eragon-1-0-android-5-1-t3195007
Nexus Rom - http://forum.xda-developers.com/elephone-p8000/development/rom-nexus-t3235626
CyanogenMod 12.1 - http://forum.xda-developers.com/elephone-p8000/orig-development/rom-cyanogenmod-12-1-p8000-t3259022
Flyme - http://bbs.elephone.hk/thread-8682-1-1.html#.VuQ3WYQrHIU flash via Flashtools
Vibe - http://bbs.elephone.hk/thread-8192-1-1.html Flash via Flashtools
Emui - http://forum.xda-developers.com/ele...-emui-v3-1-lite-04-02-2016-android-5-t3309296
Stock Roms
2015.07.25 - http://bbs.elephone.hk/thread-6536-1-4.html#.VuQ3C4QrHIU
2015.08.15 - http://bbs.elephone.hk/thread-7096-1-4.html#.VuQ3DoQrHIU
2015.09.07 - http://bbs.elephone.hk/thread-7743-1-2.html#.VuQ3QYQrHIU
2015.10.14 - http://bbs.elephone.hk/thread-8751-1-2.html#.VuQ3K4QrHIU
2015.11.05 - http://bbs.elephone.hk/thread-9163-1-2.html#.VuQ3NYQrHIU
2015.12.03 - http://bbs.elephone.hk/thread-9415-1-1.html#.VuQ3UYQrHIU
2016.02.17 - http://bbs.elephone.hk/thread-9898-1-1.html#.VuQ3SYQrHIU
Custom Recoverys
Philz v2: https://www.androidfilehost.com/?fid=24052804347838441
Twrp 2.8.7.0 : https://www.androidfilehost.com/?fid=24269982086997788 thx hanuma
Twrp 3.0.0.0 : https://mega.nz/#!wZM01byD!JTkRCVaJoxm5YmE2sFQBB2e1wnDIYo1AWAetqY8e60o thx hanuma
SuperSU root
Thread:
http://forum.xda-developers.com/showthread.php?t=1538053
100% bug free Supersu v.2.46.zip
https://download.chainfire.eu/696/SuperSU/
<><><><><><><><><><><><><><><><><><><><><><><><><> <><><><><><><><><><><><><><><><><><><><><><><><>
How to Root Stock Rom
-If you want to Root your prefered Stock Rom
-Place SuperSU into your Sdcard
-Flash a Custom Recovery with Flashtools and its Scatter.txt
-Hold Vol+ and Power to get into Bootloader Menu
-Navigate with Vol+ and apply Recovery with Vol-
-Flash Supersu.zip
-Reboot​

Windows 10 MTK VCOM USB Drivers for 32 & 64 bit + Driver install tutorial
To determine the version of Windows 10 that you have (32 bit or 64 bit):
- Right-click on Start then click on System
- In the System window that opens, in System section, you will find your version of Windows next to System type
To disable Windows 10 64 bit driver signature enforcement:
- On your 64 bit Windows 10 desktop click on Start then on Settings
- Click on Update & security then in the left pane click on Recovery
- Under Advanced startup click on Restart now button
- Click on Troubleshoot then on Advanced options
- Click on Startup Settings then on Restart button
- The computer will restart with the Startup Settings screen
- To disable the driver signature enforcement until next restart press on number key 7 or F7 on your keyboard.
- After restart you can proceed with the unsigned MTK drivers installation for your 64 bit Windows
- After you install the unsigned drivers, to use them again in the future, you have to repeat this procedure
To install the MTK VCOM USB Drivers on 32 & 64 bit Windows 10:
- Download the drivers *.zip archive and extract the folder from inside on to the desktop:
https://www.androidfilehost.com/?fid=24269982087012126
Right-click on Start then click on Device Manager
In the Device Manager Window click on the first item – your computer name
Click on Action then Add legacy hardware
On the Welcome to the Add hardware Wizard window click on Next button
Select Install the hardware that I manually select from a list (Advanced) and then click on Next button
Click on Show All Devices then on Next button
In the Add Hardware window click on Have Disk… button
In the Install From Disk windows click on Browse… button
In the next window – Locate file – browse for the folder that you have extracted on the desktop at the beginning
Select the version of the driver according to your Windows 10 version – x64 for 64 bit and x86 for 32 bit and click Open button
Click the OK button to load the driver
From the list of drivers select MTK USB Port and click on Next button
If a red warning window will open, click on Install this driver software anyway
This action will add the following drivers in to the operating system:
- MediaTek DA USB VCOM Port
- MediaTek PreLoader USB VCOM Port – for transferring the firmware to your device
- MTK USB DEBUG Port
- MTK USB Modem Port
- MTK USB port – for transfering PreLoader to your device (and recovery in case of bad or corrupt firmware)
Now we need to remove the device that we have installed but leave the drivers in the operating system.
To do that, in the Device Manager window we expand Ports (COM & LPT) section
Right-click and click Uninstall on the MTK USB Port
- In the Confirm Device Uninstall window make sure that the box Delete the driver software for this device is empty
- You need to leave the drivers in the operating system and only remove the device that you added
- Click on the OK button to finalise
Now, when you will connect your turned off MTK device to the Windows 10 computer by USB, the device will be recognized either trough a MediaTek Preloader USB VCOM Port interface or as a MTK USB port if it is bricked or it has bad/corrupt firmware. The SP Flash Tool will be able to transfer the firmware to your device trough this interfaces. Make sure you connect the device after you press the Download button in SP Flash Tool, as the communication interface will only be alive for 2 seconds if no data is being sent.
Download SP Flash Tool v3 & v5 – Latest versions:
http://laurentiumihet.ro/technology/download-sp-flash-tool-v3-v5-latest-versions/
TUT found here : http://laurentiumihet.ro/technology...-for-32-64-bit-drivers-installation-tutorial/
cheers​

Lost IMEI Restore
A common problem many face in their phone is loss of IMEI no. This is results in no network detection by your phone. U can come to know you have lost your IMEI by checking Settings->About phone->Phone information. There under IMEI section you won’t be finding your mobile IMEI numbers displayed.
Don’t worry you can restore your IMEI’s. Just follow this guide and you will be able to restore your IMEI. I will split the tutorial into two parts.
BACKING IMEI :
-First step before performing all these things is that your phone should be rooted.
When your phone is in normal state with everything functioning install Root explorer and navigate to the below location
Code:
>ROOT>DATA>NVRAM>MD>NVRAM>NVD_IMEI>MP0B_001
-Now copy this MP0b_001 file to your SD card or PC whichever place you feel the file we be safer.
-Now download MTK Droid tools .
-Now extract the zip file and open the MTK droid tools exe file.
-Now in your phone turn on USB Debugging by going to Settings->About phone-> Developer options and there turn on USB debugging.
-Now connect your phone and MTK droid tools should be able to detect your phone. U should see a window like this appearing after your
phone has been detected.
-Now press the ROOT button present in lower right corner. When it asks Supersu grant in your mobile click allow. After MTK droid gets
access u should see a green colour box appearing in the lower left corner which means u have correctly granted access to MTK droid.
-Now click on the IMEI/Nvram tab. A window should open and click backup NVRAM and MTK droid tools would take a backup of NVram in
its folder.
RESTORING IMEI :
-Now when you lose IMEI first try this method. Now take the MPDB_001 file which you took backup at the first step and navigate through
Root explorer to this location ->ROOT->DATA->NVRAM->MD->NVRAM->NVD_IMEI.
-Now paste that file and replace the one present there. Set the permissions for that file as RWER-ER-E. Now reboot your phone and you
should be able to get your IMEI back.
If you still haven’t got IMEI open MTK droid tools and connect your phone and press ROOT again and give MTK droid tools root access.
-Now click on IMEI/Nvram tab and select Restore option and restore the NVram backup which you took earlier. Now reboot your phone and
you should be able to get your IMEI.
Extreme method :
-After performing all the above if you haven’t still got IMEI. Now switch off your phone and open SP Tools and connect your phone.
Click on format and format your whole phone. ( This wipes whole of the phone including NVram region ).
-Now flash stock ROM through SP Tools and after it completes start up your phone. ( Don’t be surprised. Your IMEI will still be in lost state
only ). Now root your phone.
-After successful rooting now connect your phone to MTK Droid tools and again press ROOT button and grant root access to MTK Droid
tools. Now click on IMEI/NVram tab.
-Now as you see in the image above you can see two boxes IMEI1 and IMEI 2. Now enter your device IMEI numbers manually in those two
boxes.( You can get your IMEI no’s from your phone box ). Now click replace IMEI. Now reboot your phone and you should be definitely able
to get your IMEI restored.
MTK DROID TOOLS LINK : https://www.androidfilehost.com/?fid=24438995911972546
found: http://www.androiddevs.net/restoring-lost-imei-mtk-phone/​

Beautiful @skeleton1911
What a gread job!
Gesendet von meinem Elephone P8000 mit Tapatalk

Thanks for this great work.
And for all the Linux Users out there. SPFlashtool also work perfekt with x86-64 Linux distros.
The most anoying point and greatest drawback is, that with newer Ubuntu based distros like Mint, since 14.04, the builtin modem-manager don't like Mediatek, so you have to blacklist Mediatek in the udev rules.
How this will done, is written in that great tutorial by Miss Montage.
Cheers
The direct link for Tapatalk Users: http://forum.xda-developers.com/general/rooting-roms/tutorial-how-to-setup-spflashtoollinux-t3160802

jknarf said:
Thanks for this great work.
And for all the Linux Users out there. SPFlashtool also work perfekt with x86-64 Linux distros.
The most anoying point and greatest drawback is, that with newer Ubuntu based distros like Mint, since 14.04, the builtin modem-manager don't like Mediatek, so you have to blacklist Mediataek in the udev rules.
How this will done, is written in that great tutorial by Miss Montage.
Cheers
The direct link for Tapatalk Users: http://forum.xda-developers.com/general/rooting-roms/tutorial-how-to-setup-spflashtoollinux-t3160802
Click to expand...
Click to collapse
arnicika said:
Beautiful @skeleton1911
What a gread job!
Gesendet von meinem Elephone P8000 mit Tapatalk
Click to expand...
Click to collapse
thank you very much

This should be pinned!

BlueFlame4 said:
This should be pinned!
Click to expand...
Click to collapse
Already done
Gesendet von meinem Elephone P8000 mit Tapatalk

A German Translation for #1 and #2 is available there: http://www.android-hilfe.de/thema/a...n-und-anwenden-unter-windows-8-8-1-10.759025/

skeleton1911 said:
Lost IMEI Restore
RESTORING IMEI :
-Now when you lose IMEI first try this method. Now take the MPDB_001 file which you took backup at the first step and navigate through
Root explorer to this location ->ROOT->DATA->NVRAM->MD->NVRAM->NVD_IMEI.
[...]​
Click to expand...
Click to collapse
Please note neither the name of the IMEI file nor its position seem to be constant, but may vary from one Stock ROM version to another.
In my case (Stock Rom version 20151203) it took me some time to find a file named "MP0B_001" within the following location:
/nvdata/md/NVRAM/NVD_IMEI
Maybe the easiest way to find the IMEI file is to search for the keyword "NVD_IMEI" within some root file manager as this does not seem to change.

@skeleton1911 I'm having problems with MTK DROID TOOLS, it won't detect my elephone p8000.
I was wondering can you help me with this?

Rav3r1 said:
@skeleton1911 I'm having problems with MTK DROID TOOLS, it won't detect my elephone p8000.
I was wondering can you help me with this?
Click to expand...
Click to collapse
you want to restore your imei?
do this: it just takes a minute
You can solve your imei problem with this "MTK Engineering Mode" from playstore.
You open the app and go to: MTK Settings, Connectivity, CDS Information, Radio Information, Phone 1.
Here you have at the top "AT+". here you complete to >>AT+EGMR=1,7,"123456789012345"<<, of course with your imei, which ist standing on the akku-cover.
Then, very important: You have to put in a space after "AT+", so it looks like >>AT+ EGMR=1,7,"123456789012345"<<
Click "SEND AT COMMAND". Thats it.
For the second imei do the same with >>AT+ EGMR=1,10,"123456789012345"<<

In Lost IMEI Restore part of tutorial MtkDroidTools v2.5.3.zip link to infected file. PLEASE REMOVE or change to https://androiddatahost.com/cj8vrp
SHA256: 40fe0934c24b17bc49e9b96c24c873fc5c4e0744ee31c8c5193c50168ee43839
File name: MtkDroidTools v2.5.3.zip
Detection ratio: 32 / 52
Analysis date: 2016-12-15 22:42:21 UTC ( 2 days, 1 hour ago )
virustotal.com/en/file/40fe0934c24b17bc49e9b96c24c873fc5c4e0744ee31c8c5193c50168ee43839/analysis/

@skeleton1911
I believe that first post need a big refresh.
The new All-In-One Mediatek driver don't need to disable driver signing. and contain both USB ADB and USB preloader driver for Mediatek chips
For the Flashtool version (Windows/Linux) there is a specific thread where you can redirect all user to get latest version of Flashtool program.

ASUS ZenPad Z8 (ZT581KL) (P008) (Verizon) - Firmware

I found some firmware files for the Asus Zenpad Z8 ZT581KL for Verizon. Neither Asus or Verizon host any firmware for this device, despite having other similar device firmware available (like the ZT500KL, etc), which sucks.
VZW_ZT581KL_V3.4.16_all_user_M101901_16.0.0_160519.zip
ASUS Factory VZW_ZT581KL_V5.4.1_all_user_M101901_16.0.0_170202 androidhost.ru.zip
ZT581KL_T3.3.8_pre_burn_image_20160516.zip
ZT581KL_Z581KL_EMERGENCY_DLOAD.7z
ZT581KL_FUSE_Security_Keybox_160728.rar
Z581KL_initrd_diff.zip
ASUS.Flash.Tool.v1.0.0.45.zip
Running a stock, factory reset device, I was able to flash VZW_ZT581KL_V3.4.16_all_user_M101901_16.0.0_160519.zip using Asus Flash Tool 1.0.0.45, which successfully downgraded Tablet from V3.4.23 to V3.4.16.
I tried flashing ZT581KL_T3.3.8_pre_burn_image_20160516.zip but it did not work and error-ed out with no brick or anything. Usually the firmware is in a .raw format so you can flash either via zip file which has raw file in root folder of archive, or via the raw file itself. I tried both and was not successful. For some reason this archive had a .bin file instead of a .raw file. I tried renaming them but still didn't work. However, I was able to extract the .bin to find the firmware files inside just like the other version firmwares (that were in raw). One thing I have not tried yet, is to try manually flashing the individual firmware files from the extracted bin, and see if that works--or if someone else with this tablet wants to try, here are the files. If successful, it might lower kernel version down more to allow root exploits to root device.
I have not tried flashing V5.4.1, but I'm confident it will work. I do not know if via the Asus Flash Tool/Asus Tablet will allow doing a flash to V5.4.1 and downgrade back down to V3.4.16, but just did V.3.4.23 (stock orig fw already on device) to V.3.4.16 and it worked. I did receive an OTA to upgrade to V3.4.18 (or was it V.3.4.21, I can't remember) and took the upgrade (then flashed back to V.3.4.16), so it appears that when doing an OTA it will "leap-frog" to the next higher version release until you are on the newest build, so the first OTA you get won't do a direct upgrade from V3.4.16- to V5.4.1 or V5.4.5, but will upgrade it in an incremental way, via the next higher version release.
Hopefully someone can try to root their tablet if any of these files are of any help. I might work up courage to try 3.38 again via manual fastboot, but if you do it and succeed, I would love to hear about it.
The other files hosted ZT581KL_Z581KL_EMERGENCY_DLOAD.7z and ZT581KL_FUSE_Security_Keybox_160728.rar have to do with re-flashing the Qualcomm Snapdragon SoC (un-bricking), and the other one something to do with clearing/setting FUSE when the phone leaves factory or something, I'm not sure. Hopefully they can be of some use to someone to unlock this device. It would be nice. So here u go.
https://www.androidfilehost.com/?w=files&flid=289525 - link to ASUS_ZenPad_Z8_ZT581KL_P008_Verizon files

Has anyone tried flashing 'ZT581KL_T3.3.8_pre_burn_image_20160516' yet? Just wondering if it was successful; I haven't tried it yet.

smokejumper76 said:
Has anyone tried flashing 'ZT581KL_T3.3.8_pre_burn_image_20160516' yet? Just wondering if it was successful; I haven't tried it yet.
Click to expand...
Click to collapse
can you tell me how to extract the .raw from .bin, I will try to flash the device.

fuyangui said:
can you tell me how to extract the .raw from .bin, I will try to flash the device.
Click to expand...
Click to collapse
I used 7zip to extract the firmware from the archive.. Open 'ZT581KL_T3.3.8_pre_burn_image_20160516.zip' with 7zip. It should come up with a folder named 'ZT581KL_T3.3.8_pre_burn_image_20160516'. Go in that folder. There will then be a file shown called 'userdata.bin'. In 7zip, if you right click that file, then select 'Open Inside', it should open inside the .bin file and show the firmware files. From there, you can extract them somewhere. Hopefully, you can try to apply each .img file separately (fastboot), one at a time, and see if it works. Thank you!

Sorry to resurrect this old thread but I might have some info that will help others.
First off thanks for the OP for the download links as I cannot find the OEM ROMS anywhere for this device.
Second here are some more instructions that you may need if you are having issues with this device.
Use ASUS FLash Tool v1.0.0.45, it has the device model that you need and was the one that worked for me. Then download ASUS Factory VZW_ZT581KL_V5.4.1_all_user_M101901_16.0.0_170202 androidhost.ru.zip from the link the OP posted, it should be the first file, then this is the step that I missed and took forever to figure out. You have to open that zip file and extract the .raw file, so you should have a file called ZT581KL_all_VZW_user_V5.4.1.raw. That is the file that you need to select in the Asus Flash Tool by clicking the little box with a down arrow inside it, then boot your tablet into Fastboot (Hold down the Power and Volume Down buttons) then once in fastboot, make sure you select the right model for this tablet it should be, ZT581KL, then I left Wipe Data as no, then connect your tablet to your computer with a USB cable, and you should see your Serial Number and a round icon under the State column. Then once that is all correct click the Start button, you may get an error about some FPS thing that can't be downloaded or something just hit OK, then you should see under the Description column that it's flashing the ROM, wait for a while and you should then have a "Flash Image Successfully (The serial number for your device will show here)" under the description and your tablet will reboot.
My tablet was originally on v5.4.5, this ROM will take you back to v5.4.1 but then through the tablet settings you can do an upgrade to v5.4.4 then do another one and it will be at v5.4.5 then you are all set.
So the issue I was having with the tablet was after a factory reset it would freeze at the setup screen and not let me continue, it took me forever to find out how to get it fixed and the instructions above worked for me, so if anyone else is having similar issues then hopefully this will help. I literally spent days and searched through about 70 forums to try and find a fix for it, I even reached to Asus for help, which they basically told me I had to pay to send it in and have it fixed, I was just about to give up when I came upon this thread and the OP's download links, so thanks again smokejumper76. If anyone has any questions about my instructions feel free to reply/comment.
Thanks!

Downgrade success
I used the files provided by OP and was able to successfully flash from 5.4.1 to 3.4.16. I got this tablet from a friend a few years back that he acquired from his work when it went out of business. It has the frp lock on it and im looking at the few available options. So, since this tablet had been sitting for two years. Its Guinea pig time. I'll flash the 3.3.8 and check back. It seems you can go forward or backward in so versions with the flash tool. So I'm not too worried about brick. If I can just get usb debugging on I'll be gold. Possible exploits if it runs.

Well. The 3.3.8 is not packaged properly for flashing. And that 600mb file expands to 9gb. There is a file "system.img" inside that's roughly the right size as the system and has the correct file structure. I have a friend who is going to help me repack that rom correctly for flashing. Meanwhile I am going to look into the 3.4.16 rom and see if I can't set usb debug to on and flash the modded image. From there I should be able to sideload su. I'll report back.

mofugggz said:
Well. The 3.3.8 is not packaged properly for flashing. And that 600mb file expands to 9gb. There is a file "system.img" inside that's roughly the right size as the system and has the correct file structure. I have a friend who is going to help me repack that rom correctly for flashing. Meanwhile I am going to look into the 3.4.16 rom and see if I can't set usb debug to on and flash the modded image. From there I should be able to sideload su. I'll report back.
Click to expand...
Click to collapse
Any update? Thank you for your efforts!

smokejumper76 said:
Any update? Thank you for your efforts!
Click to expand...
Click to collapse
I have the same tablet as well. Root would be great, any chance of unlocking the BL?

klister said:
I have the same tablet as well. Root would be great, any chance of unlocking the BL?
Click to expand...
Click to collapse
hi
any advance with this?
Enviado desde mi P008 mediante Tapatalk

WHat is the password to the files

I used the emergency download file to unbrick the Japanese version of z581kl. However, maybe the partition structure is different, when I try to write to the system partition, it says that there is no partition. What should i do? I'm sorry for my bad English.

allisondanielle said:
WHat is the password to the files
Click to expand...
Click to collapse
https://www.asusflashtool.com/ - Description Page with Password
Unzip Password: asusflashtool.com

I installed ZT581KL_T3.3.8_pre_burn_image_20160516.zip on my z581kl.
That resulted in Android 6.0 AOSP working!
There is a bug that screen rotation is not possible, but everything else is fine.
There is a bug that the screen cannot be rotated, but other than that, everything is fine. After installing TWRP, you need to mount /system and the location of system.img, and then execute the following command from the TWRP terminal.
mkdir new-system
mount system.img new-system
cp -a -R -p new-system/* /system
Translated with www.DeepL.com/Translator (free version)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

清水侑磨 said:
I installed ZT581KL_T3.3.8_pre_burn_image_20160516.zip on my z581kl.
That resulted in Android 6.0 AOSP working!
There is a bug that screen rotation is not possible, but everything else is fine.
There is a bug that the screen cannot be rotated, but other than that, everything is fine. After installing TWRP, you need to mount /system and the location of system.img, and then execute the following command from the TWRP terminal.
mkdir new-system
mount system.img new-system
cp -a -R -p new-system/* /system
Translated with www.DeepL.com/Translator (free version)View attachment 5251235View attachment 5251237View attachment 5251239
Click to expand...
Click to collapse
I flashed the zt581kl image using EDL mode as described in this blog because the partition structure of the zt581kl is different from that of the zt581kl.
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com

Hi. New to the forum. I’m looking to downgrade my asus zt581kl so that I can root. Can someone show me the exactly step by step to downgrade my table? The above replies are a bit confusing to follow.

Tmupt said:
Hi. New to the forum. I’m looking to downgrade my asus zt581kl so that I can root. Can someone show me the exactly step by step to downgrade my table? The above replies are a bit confusing to follow.
Click to expand...
Click to collapse
Maybe start here:
https://www.getdroidtips.com/v5-4-1-nougat-verizon-asus-zenpad-z8/

I've been messing around with some of the files, and I was able to brick and unbrick the device following the firehose SOP PDF instructions. It basically flashes a barebones boot w/o any OS, and you have to flash a complete firmware to it to restore it back.
I was also able to install TWRP but it showed 0 space avail, I think because I didn't wipe it. I'll play with that later.
Used these links (use google translate)
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com
zenpad 3 8.0に簡単にTWRPを導入する+fastbootの裏技
xxxxx
itgameinfo.blogspot.com
I need to ask @清水侑磨 about how to flash ZT581KL_T3.3.8_pre_burn_image_20160516.zip. I think the userdata.bin file is a NAND dump created by Chinese Miracle 2 / Infinity Box but I'm having problems getting it to read the partitions. I was able to get the tablet in EDL mode, so I'm not sure what I'm doing wrong.

Anyone have a QPST .QCN file for ZT581KL for this device? Flashing 3.3.8 from that preburn file will nuke your IMEI. Mine got changed to all 1s and lost provisioning connectability w/ carrier. in fastboot/adb, so I need to restore it. If anyone could make a QCN (with your IMEI removed of course) so I can do that I would be most appreciative.

smokejumper76 said:
I've been messing around with some of the files, and I was able to brick and unbrick the device following the firehose SOP PDF instructions. It basically flashes a barebones boot w/o any OS, and you have to flash a complete firmware to it to restore it back.
I was also able to install TWRP but it showed 0 space avail, I think because I didn't wipe it. I'll play with that later.
Used these links (use google translate)
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com
zenpad 3 8.0に簡単にTWRPを導入する+fastbootの裏技
xxxxx
itgameinfo.blogspot.com
I need to ask @清水侑磨 about how to flash ZT581KL_T3.3.8_pre_burn_image_20160516.zip. I think the userdata.bin file is a NAND dump created by Chinese Miracle 2 / Infinity Box but I'm having problems getting it to read the partitions. I was able to get the tablet in EDL mode, so I'm not sure what I'm doing wrong.
Click to expand...
Click to collapse
Sorry for the late reply.
To boot AOSP, instead of burning the system.img from edl or fastboot, use adb.
The method is as follows
1、Start TWRP.
2、Connect your PC to USB.
3、Go to the directory where system.img is located, and press
adb push system.img /sdcard/
4、Enter the shell
adb shell
5、Mount system.img.
mkdir new-system
mount system.img new-system
6、Copy the contents of the mounted system.img to the system partition.
cp -a -R -p new-system/* /system
(If this fails, check that the system partition is mounted. If the system partition is mounted but you cannot write to it, format the system partition.)
7、After rebooting, you should see an Android message
Translated with www.DeepL.com/Translator (free version)

LG V30 Unbrick guide (Qualcomm EDL 9008 Mode, Hardbirck, with no download mode)

If you try this method, I nor anybody else is responsible for any further damage done to your phone.
Models Confirmed : V300L
We currently have firehose for V30.
Therefore, we can program UFS flash memory in 9008 mode.
It requires rawprogram?.xml(s) and patch?.xml(s) to program it.
It's easy to generate rawprogram?.xml(s) from kdz file, but generate patch?.xml(s) is not easy. (Unfortunately, I couldn't have time to generate patch?.xml(s)).
I have edited kdztools to generate rawprogram?.xml(s) easily (You can generate it by using "-r" argument. Currently, generate patch?.xml(s) is not supported. I'll add it soon).
I used patch?.xml(s) in post. it works well, but boot loop in the LG Logo.
However, it was possible to enter download mode.
------------------- GUIDE -------------------​1. Download rawprogram?.xml patch?.xml with images from link. (It uses V300L30h000906.kdz)
2. Download firehose (prog_ufs_firehose_8998_lgev30.elf) from link.
<< Linux >>
3. Build qdl or download pre-built binary
4. Extract zip or tar.gz files 1, 2, 3 in any folder.
5. Run
Code:
$ ./qdl --storage ufs prog_ufs_firehose_8998_lgev30.elf rawprogram0.xml patch0.xml rawprogram1.xml patch1.xml rawprogram2.xml patch2.xml rawprogram3.xml patch3.xml rawprogram4.xml patch4.xml rawprogram5.xml patch5.xml rawprogram6.xml patch6.xml
in the terminal.
6. If LG logo shows, enter to the download mode.
<< Windows >>
3-6. You can program by QFIL similar as qdl.
7. Connect to any Windows PC with LGUP (must support Android Pie).
8. Flash kdz with ChipErase. (IMPORTANT)
9. If it boots successfully, your device has unbricked.

you can create rawprogramer and patch.xml with this program
I have already tried it on lg v10 kdz with successful.
after extract kdz :
1-open qualcomtool 2.4 and go to EMMC tabe.
2-clic browse and select primarygpt_0.bin
3- select all partitions and click exract partition
4- click extract firmware
you will find every things you need in extracted folder.
you can edid rowprogramer.xml with notepad ++ .
edit : tryed with lg v30 kdz not work
(gpt not present when select file)

Thank you for your work

download problem
quickwshell said:
If you try this method, I nor anybody else is responsible for any further damage done to your phone.
Models Confirmed : V300L
We currently have firehose for V30.
Therefore, we can program UFS flash memory in 9008 mode.
It requires rawprogram?.xml(s) and patch?.xml(s) to program it.
It's easy to generate rawprogram?.xml(s) from kdz file, but generate patch?.xml(s) is not easy. (Unfortunately, I couldn't have time to generate patch?.xml(s)).
I have edited kdztools to generate rawprogram?.xml(s) easily (You can generate it by using "-r" argument. Currently, generate patch?.xml(s) is not supported. I'll add it soon).
I used patch?.xml(s) in post. it works well, but boot loop in the LG Logo.
However, it was possible to enter download mode.
------------------- GUIDE -------------------​1. Download rawprogram?.xml patch?.xml with images from link. (It uses V300L30h000906.kdz)
2. Download firehose (prog_ufs_firehose_8998_lgev30.elf) from link.
<< Linux >>
3. Build qdl or download pre-built binary
4. Extract zip or tar.gz files 1, 2, 3 in any folder.
5. Run
Code:
$ ./qdl --storage ufs prog_ufs_firehose_8998_lgev30.elf rawprogram0.xml patch0.xml rawprogram1.xml patch1.xml rawprogram2.xml patch2.xml rawprogram3.xml patch3.xml rawprogram4.xml patch4.xml rawprogram5.xml patch5.xml rawprogram6.xml patch6.xml
in the terminal.
6. If LG logo shows, enter to the download mode.
<< Windows >>
3-6. You can program by QFIL similar as qdl.
7. Connect to any Windows PC with LGUP (must support Android Pie).
8. Flash kdz with ChipErase. (IMPORTANT)
9. If it boots successfully, your device has unbricked.
Click to expand...
Click to collapse
thank you so much,but can't download zip from this website,if you can offer other download way,such as google,mega,onedrive,i will apreciate it so much,thanks for your work

Johoneycn said:
thank you so much,but can't download zip from this website,if you can offer other download way,such as google,mega,onedrive,i will apreciate it so much,thanks for your work
Click to expand...
Click to collapse
Sorry for the late reply
mega. nz/#!zCZBkC4D!Vxo9wrd1c9vsZgCfQIrLelcp3unTY7sJAqMXjANvzjQ is V30_UNBRICK.zip
and mega. nz/#!PLIBzQ6L!JKtfq_RH2iFgcQckkRi_LtZGt9u2zaO2YF6x8dtHL6A is a firehose.

It is a shame we resort to such lengths for this. Shame on vendors. It is like pure gold or diamonds when we come across a programmer...

Hi, @quickwshell, could you see this: Help! bootloop per 5 sec, cannot enter rec, download or fastboot. Does the problem I'm facing now is what your method targeting to?

@quickwshell
Thank you so much for sharing firehorse for v30 and this solution. I have LS998 bricked bootloop after interrupting upgrade as @zacox123. I tried your files posted but still phone cant get download mode. Now Im trying to create rawprogram.xml and patch.xml from specific firmware model ls998 but I want to know what partitions are necesary just for getting download mode and then try to upgrade for usb mode.
Could you please help me?
thanks in advance

Pulian said:
@quickwshell
Thank you so much for sharing firehorse for v30 and this solution. I have LS998 bricked bootloop after interrupting upgrade as @zacox123. I tried your files posted but still phone cant get download mode. Now Im trying to create rawprogram.xml and patch.xml from specific firmware model ls998 but I want to know what partitions are necesary just for getting download mode and then try to upgrade for usb mode.
Could you please help me?
thanks in advance
Click to expand...
Click to collapse
How did you do with your phone? Have you made your phone into 9008 mode? Did you use the correct tool?
I have not processed my problem yet. But I read some other posts introducing that, use qpst or miracle box or any similar tools with the edl file provided by @quickwshell to flash in twrp directly, instead of getting download mode back. Maybe you can have a trial.

I was converting my lg [email protected] for unlocking. I have tools for flashing and I did it before with others phones. Accidently flashing process was interrupted and phone got that condition, no download mode. Now I'm using testpoint connection and UMT (tool for repair Qualcomm Phones) for trying to recover download mode. I suppose you can use QFIL for programming after we have correct rawprogramer.xml and patch.xml. Let me finish my test and I'll post results.
Pd: bootloader is not unlocked and I don't know if I can write twrp and it'll work.
Could you share links referring this topic and phone? Thanks.

Well, it definitely worked :good:.
Partitions extracted from us998 firmware
. Now I'm flashing again.
Pd: sorry for inverted picture. I make it from cellphone without edition

Do we need any special process before the computer work, @quickwshell and @Pulian? Is any special cable or teardown work needed? I have never used 9008 before but see other brands like xiaomi cannot simply enter 9008 mode directly.
---------- Post added at 04:27 PM ---------- Previous post was at 04:08 PM ----------
Pulian said:
Well, it definitely worked :good:.
Partitions extracted from us998 firmware
. Now I'm flashing again.
Pd: sorry for inverted picture. I make it from cellphone without edition
Click to expand...
Click to collapse
I see octoplus in your pic. Could you please share your tools and detailed steps? I have never tried 9008, so I hope some extra hand-by-hand instructions. Thanks.
The post I read is from an Android community app, and I'm afraid I cannot provide a link to it. And the author of that post said he had not tested yet, just some common sense and rough idea. I'd hear more from you, afterwards you have succeeded.

Thanks again @quickwshell. Firehorse file is the most important think for starting.
1. I extracted files partitions from firmware KDZ using this software https://forum.xda-developers.com/showthread.php?t=2600575
2.. I used testpoint for getting EDL (QUALCOM 9008) connection. https://forum.xda-developers.com/showpost.php?p=78573920&postcount=2
3. I tried firmware posted here without success (Maybe it works on others). So I wrote critical partitions extracted from my specific firmware (US998) using UMT box and I didnt need to create .xml files because this tool can read and detect internal partitions.
4. I got download mode and just write firmware by USB using octoplusbox. Phone Alive!!
I think every step here can be replaced using diferent software. good luck!

nate0 said:
It is a shame we resort to such lengths for this. Shame on vendors. It is like pure gold or diamonds when we come across a programmer...
Click to expand...
Click to collapse
yes,i think so too, lg is too bad on the software

Pulian said:
Thanks again @quickwshell. Firehorse file is the most important think for starting.
1. I extracted files partitions from firmware KDZ using this software https://forum.xda-developers.com/showthread.php?t=2600575
2.. I used testpoint for getting EDL (QUALCOM 9008) connection. https://forum.xda-developers.com/showpost.php?p=78573920&postcount=2
3. I tried firmware posted here without success (Maybe it works on others). So I wrote critical partitions extracted from my specific firmware (US998) using UMT box and I didnt need to create .xml files because this tool can read and detect internal partitions.
4. I got download mode and just write firmware by USB using octoplusbox. Phone Alive!!
I think every step here can be replaced using diferent software. good luck!
Click to expand...
Click to collapse
After getting download mode back, do we need chiperase like @quickwshell mentioned? I don't know if octoplusbox did it before writing firmware and I suppose most people would still use LGUP for firmware writing. Did you lose s/n, imei, etc. after phone booting? If not, I guess partition dl should be OK.

I didnt touch imei and security partitions. My phone worked after flashing without problems.

Pulian said:
Thanks again @quickwshell. Firehorse file is the most important think for starting.
1. I extracted files partitions from firmware KDZ using this software https://forum.xda-developers.com/showthread.php?t=2600575
2.. I used testpoint for getting EDL (QUALCOM 9008) connection. https://forum.xda-developers.com/showpost.php?p=78573920&postcount=2
3. I tried firmware posted here without success (Maybe it works on others). So I wrote critical partitions extracted from my specific firmware (US998) using UMT box and I didnt need to create .xml files because this tool can read and detect internal partitions.
4. I got download mode and just write firmware by USB using octoplusbox. Phone Alive!!
I think every step here can be replaced using diferent software. good luck!
Click to expand...
Click to collapse
I searched a lot for UMT Box and it seems like one has to collect it with the dongle or else it's not gonna work. Getting frustrated here Are there any way other than umt? Can you or anyone suggest?

moyedchowdhury said:
I searched a lot for UMT Box and it seems like one has to collect it with the dongle or else it's not gonna work. Getting frustrated here Are there any way other than umt? Can you or anyone suggest?
Click to expand...
Click to collapse
use cracked miracle box

seloka180 said:
use cracked miracle box
Click to expand...
Click to collapse
THANKS FOR COMING BACK. Mine is a LS998 converted into US998.
I'm So disappointed right now. Past few days have been unbearable. Even my Blood pressure is getting high
I'll describe what happened so that the situation is understood and you could suggest accordingly.
*I unlocked bootloader by wtf method.
*Tried several roms.
*Decided to stay on LOS 17.1 Q [Nearly got f*****g everything]
*Flushed a module via magisk which offered pixel boot animation(actually was searching for smartpixel to turn off 50% pixels)
*Rebooted and the device stuck into bootloop
*Rebooted into fastboot mode and reinstalled twrp and reboot- No luck
*Used a guide to wipe different partitions via fastboot and then reinstall twrp. Success but still boot stuck.
*Tried to go into download mode by pressing volume up while connecting USB, went into the mode but "waiting for any connection..." showed and was not detected by device mgr.
*Thought relocking the bootloader might get me into download mode.(That's when I burnt my luck I guess...)
*Did lock the bootloader.
*Aaaand still not detected in device manager.
*Moreover, now showing that Your device has failed a routine security check and will not boot!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
*Opened the back and test pointed motherboard, detected in 9008 mode
*Tried QFIL with V30_Unbrick.zip, sahara error.
*Tried a bunch of other tools most of them were so old that they didn't even have the firehose for this model.
Please someone help.

seloka180 said:
use cracked miracle box
Click to expand...
Click to collapse
Can't thank you enough mate! Used it and miracle did happen. I even tried to use it before but after you said it, I tried hard this time. Searched here and there, then took some risk and started to do things like this way -
I had V30_UNBRICK.zip unzipped in a folder with firehose and xml files.
*Disable defender or any other antivirus. (Normally not recommended, but it's the first thing I do when doing these things, also I have an extra laptop where I do all these which doesn't have any private or necessary files, never had any problem though).
*Also, disable driver signature enforcement on Windows(https://windowsreport.com/driver-signature-enforcement-windows-10/)
1. I searched and found Miracle box Thunder v2.93 with loader (No box needed)
2. Select Qualcomm, then flashing and Write Flash.
3. Untick the auto button beside firehose.
4. Under "write flash"
see this image
i. Select firehose, this doesn't recognize the .elf file so renamed it to .mbn (finger was crossed) and it worked!
ii. There are six rawprogram?.xml and patch?.xml (Here, ? = 1, 2, 3....6), I only used rawprogram0.xml and
iii. patch0.xml
5. Got everything ready and then detached the phone from cable.
6. Pressed the start button right after entering into Testpoint EDL Mode. The process starts and failed after a while due to missing files. Then I matched which files were present corresponding to the lines in the xml file, after that deleted all the extra lines(i. e. file was not present in the V30_UNBRICK.zip) from rawprogram0.xml and saved the file (patch0.xml was untouched). I used Notepad++ for editing.
7. Again detached the phone, detached battery, reattached battery, pressed the start button right after I shorted the edl test points, even before the device was detected in the device manager, no delay.
8. The process was completed, files flashed. These files were flashed so that we can now flash proper kdz with download mode. Do not turn on the phone. Or else you'll get into bootloop.
9. Detached the battery, shorted power button for a while(skip if you don't understand), reattached the battery.
10. Pressed volume up and inserted USB cable. Not detected first time. Detached and reattached with pressing volume up button hard this time.
11. witnessed one of the happiest moment seeing it was detected as an LG device in device manager. Wasn't 100% sure yet.
12. Flashed chiperase(important) with patched LGUP in dev mode. And it was done.
13. I will upload the XML file, you can use it with the existing files inside V30_UNBRICK.zip.
the xml file here
Before doing all that I spent five horrific days searching for a solution and almost ordered a motherboard from Aliexpress with a price tag of $100. I tried to be as elaborative as possible so that whoever next encounter the issue don't have to go through what I experienced past few days. If you're reading this and having a problem understanding anything, read again, repeat 10 times, then repeat more 10 times(worked for me), still no solution? knock me here (also: [email protected]). I could help you(with v 30, g6) remotely if I have time, no charges, donate if you will and if you don't I'll still be happy to help. Keep flashing, peace.
---------- Post added at 05:36 AM ---------- Previous post was at 04:57 AM ----------
quickwshell said:
If you try this method, I nor anybody else is responsible for any further damage done to your phone.
Models Confirmed : V300L
We currently have firehose for V30.
Therefore, we can program UFS flash memory in 9008 mode.
It requires rawprogram?.xml(s) and patch?.xml(s) to program it.
It's easy to generate rawprogram?.xml(s) from kdz file, but generate patch?.xml(s) is not easy. (Unfortunately, I couldn't have time to generate patch?.xml(s)).
I have edited kdztools to generate rawprogram?.xml(s) easily (You can generate it by using "-r" argument. Currently, generate patch?.xml(s) is not supported. I'll add it soon).
I used patch?.xml(s) in post. it works well, but boot loop in the LG Logo.
However, it was possible to enter download mode.
------------------- GUIDE -------------------​1. Download rawprogram?.xml patch?.xml with images from link. (It uses V300L30h000906.kdz)
2. Download firehose (prog_ufs_firehose_8998_lgev30.elf) from link.
<< Linux >>
3. Build qdl or download pre-built binary
4. Extract zip or tar.gz files 1, 2, 3 in any folder.
5. Run
Code:
$ ./qdl --storage ufs prog_ufs_firehose_8998_lgev30.elf rawprogram0.xml patch0.xml rawprogram1.xml patch1.xml rawprogram2.xml patch2.xml rawprogram3.xml patch3.xml rawprogram4.xml patch4.xml rawprogram5.xml patch5.xml rawprogram6.xml patch6.xml
in the terminal.
6. If LG logo shows, enter to the download mode.
<< Windows >>
3-6. You can program by QFIL similar as qdl.
7. Connect to any Windows PC with LGUP (must support Android Pie).
8. Flash kdz with ChipErase. (IMPORTANT)
9. If it boots successfully, your device has unbricked.
Click to expand...
Click to collapse
Thank you, Your post helped me to understand a lot of things. Without whome I'd be having an expensive brick which can't even be used to build anything.
This is the way I recovered. So posting it here for people might get help.
seloka180 said:
use cracked miracle box
Click to expand...
Click to collapse
Can't thank you enough mate! Used it and miracle did happen. I even tried to use it before but after you said it, I tried hard this time. Searched here and there, then took some risk and started to do things like this way -
I had V30_UNBRICK.zip unzipped in a folder with firehose and xml files.
*Disable defender or any other antivirus. (Normally not recommended, but it's the first thing I do when doing these things, also I have an extra laptop where I do all these which doesn't have any private or necessary files, but never had any problems).
*Also, disable driver signature enforcement on Windows(https://windowsreport.com/driver-sig...nt-windows-10/)
1. I searched and found Miracle box Thunder v2.93 with loader (No box needed)
2. Select Qualcomm, then flashing and Write Flash.
3. Untick the auto button beside firehose.
4. Under "write flash"
see this image
i. Select firehose, this doesn't recognize the .elf file so renamed it to .mbn (finger was crossed) and it worked!
ii. There are six rawprogram?.xml and patch?.xml (Here, ? = 1, 2, 3....6), I only used rawprogram0.xml and
iii. patch0.xml
5. Got everything ready and then detached the phone from cable.
6. Pressed the start button right after entering into Testpoint EDL Mode. The process starts and failed after a while due to missing files. Then I matched which files were present corresponding to the lines in the xml file, after that deleted all the extra lines(i. e. file was not present in the V30_UNBRICK.zip) from rawprogram0.xml and saved the file (patch0.xml was untouched). I used Notepad++ for editing.
7. Again detached the phone, detached battery, reattached battery, pressed the start button right after I shorted the edl test points, even before the device was detected in the device manager, no delay.
8. The process was completed, files flashed. These files were flashed so that we can now flash proper kdz with download mode.
9. Detached the battery, shorted power button for a while(skip if you don't understand), reattached the battery.
10. Pressed volume up and inserted USB cable. Not detected first time. Detached and reattached with pressing volume button hard this time.
11. witnessed one of the happiest moment seeing it was detected as an LG device in device manager. Wasn't 100% sure yet.
12. Flashed chiperase(important) with patched LGUP in dev mode. And it was done.
13. I will upload the XML file, you can use it with the existing files inside V30_UNBRICK.zip.
the xml file here
Before doing all that I spent five horrific days searching for a solution and almost ordered a motherboard from Aliexpress with a price tag of $100. I tried to be as elaborative as possible so that whoever next encounter the issue don't have to go through what I experienced past few days. If you're reading this and having a problem understanding anything, read again, repeat 10 times, then repeat more 10 times(worked for me). Keep flashing, peace.

How To Guide Flash stock ROM or downgrade ColorOS 12 on OPPO Reno6 5g(CPH2251-MT6877 chip) by using free MTK client GitHub tool.

Hey Guys,
After color OS 12 (and android 12) upgrade on OPPO reno6 5G device, users were facing issues like third part apps not working(Intune company portal work profile, Ritam news app etc),battery draing very rapidly,always on display not working and many more.
So, here I have come up with a method to flash stock ROM or downgrade color OS 12 and switch back to Color OS 11.3 which have android 11. So without wasting time lets start
Note: Data will be erased in this method so please take backup of you data on phone.
This has been tested on Indian version, I am not sure if it will work for other countries.
I strongly recommend to take full firmware backup using method below before proceeding
Backup full firmware(ROM) of any MediaTek device using MTK client| Oppo reno6 5G | MT6877
Hello Guys, Many times we encounter a situation where we need to do some software update, flash custom ROM, install stock ROM etc, so it is advisable to take full firmware/ROM backup of your device. If required then you can flash this backup to...
forum.xda-developers.com
Step1: Pre-requisite -Installing required drivers and setup
From links below download and install drivers and setup.
Install mediaTek driver.
Install python (during installation of python please select "install for all user" from customization and tick add path to system variable).
install usbdk.
download extarct Mtk client tool.
go to folder where you extract mtk client
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
open cmd here and run below command
cd mtkclient
pip3 install -r requirements.txt
In default setting it takes 2 hour to flash but after change it takes 13 min only. So, If you want to increase flashing speed then open mtk_daxflash.py file from library folder, search "dsize = min(length, 0x200)" and replace it with "dsize = min(length, 0x2004)" , save and close the file.
You need to close the command prompt and reopoen it in order to take effect of change.
Reference(https://github.com/bkerler/mtkclient/issues/271)
New Qcom Mtk Driver V3.0.5.1.rar | by TUSER HP for Generic Device/Other
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
androidfilehost.com
Download Python
The official home of the Python Programming Language
www.python.org
GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
Releases · daynix/UsbDk
Usb Drivers Development Kit for Windows. Contribute to daynix/UsbDk development by creating an account on GitHub.
github.com
Step2: Download and extract the stock firmware
CPH2251_A.13_ColorOS11.3_Android11_Latest.rar
drive.google.com
Step3: Flash the firmware
on cmd type below command to flash the firmware
python mtk wl "stock ROM location full path"
it will wait for devices.. Power off the phone, wait 10 sec then press vol up + vol down together and then plug the usb cable.
Once device detected , it will display devices information and start flashing
While flashing it will dump the preloader, this file is very important so, please keep this file safely. this file may require in future.
Step4: Boot the phone
Once flashing completed, press vol up + power button together for 30 sec. Wait for device to boot.
Step5: Flashing the preloader.bin (only if required)
In case, even after flashing completed successfully but some time device does not boot, only black screen, no charging sign either then don't panic, device has entered into emergency download mode, if you face the same then it's time to flash preloader.bin file. Follow below steps
1) download SP flash tool specific version v5.2148. (https://androidmtk.com/smart-phone-flash-tool)
2) download attached preloader.bin, scatter file and auth file from link below and place all these files at same folder.
MT6877_flashing_preloader.zip
drive.google.com
3) open sp flash tool, select download agent files from mtk folder as shown on image and load scater file and auth files respectively.
4) In cmd run command "python mtk payload". Now press and hold vol+ vol- or all the buttons together, it should show payload sent successfully.
5) Now in sp flash tool click on Download button, it should flash the preloader successfully.
6) once preloader is flash successfully you can turn on the phone by pressing vol+ and power button together for 20 sec. If attached preloader does't flash then you can try flashing your device backup preloader.bin created/shown on step3.
So by this way we flashed stock firmware on oppo reno6 5G.
Tips: If due to some reason flashing did not completed successfully then please press vol up and power button together for 30-40 sec to boot the phone (exit the brom mode).
Disclaimer: I have tested this method on my phone, it's 100% working but I will not responsible if damage any damage happens to your device while doing this. So do it at your own risk.

It's work sir
Many thanks
Nand kumar said:
Step1: Pre-requisite -Installing required drivers and setup
Install MediaTek drivers, in windows 10 you need to disable driver signature enforcement.
Install paython, usbdk.
download extarct Mtk client tool.
go to folder where you extract mtk client
open cmd here and run below command
cd mtkclient
pip3 install -r requirements.txt
Click to expand...
Click to collapse
In this step the command should be
pip install -r requirements.txt
it's will work

killian07 said:
It's work sir
Many thanks
In this step the command should be
pip install -r requirements.txt
it's will work
Click to expand...
Click to collapse
Did you also took firmware back using my method or you just flashed the ROM?

Thanks for your work

You are welcome sir.

Edit : Comment removed it can create confusion

Edit : Comment removed it can create confusion

Thank you

Edit : Comment removed it can create confusion

Edit : Comment removed it can create confusion

Thank you sir

Edit : Comment removed it can create confusion

Thank you

Edit : Comment removed it can create confusion

Edit : Comment removed it can create confusion

Nand kumar said:
Hey Guys,
After color OS 12 (and android 12) upgrade on OPPO reno6 5G device, users were facing issues like third part apps not working(Intune company portal work profile, Ritam news app etc),battery draing very rapidly,always on display not working and many more.
So, here I have come up with a method to flash stock ROM or downgrade color OS 12 and switch back to Color OS 11.3 which have android 11. So without wasting time lets start
Note: Data will be erased in this method so please take backup of you data on phone.
I strongly recommend to take full firmware backup using method below before proceeding
Backup full firmware(ROM) of any MediaTek device using MTK client| Oppo reno6 5G | MT6877
Hello Guys, Many times we encounter a situation where we need to do some software update, flash custom ROM, install stock ROM etc, so it is advisable to take full firmware/ROM backup of your device. If required then you can flash this backup to...
forum.xda-developers.com
Step1: Pre-requisite -Installing required drivers and setup
Install MediaTek drivers, in windows 10 you need to disable driver signature enforcement.
Install paython, usbdk.
download extarct Mtk client tool.
go to folder where you extract mtk client
View attachment 5541629
open cmd here and run below command
cd mtkclient
pip3 install -r requirements.txt
Windows+10_MTK+VCOM+USB+Preloader+Drivers.zip | by karimovic44 for Generic Device/Other
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
androidfilehost.com
Download Python
The official home of the Python Programming Language
www.python.org
GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
Releases · daynix/UsbDk
Usb Drivers Development Kit for Windows. Contribute to daynix/UsbDk development by creating an account on GitHub.
github.com
Step2: Download and extract the stock firmware
View attachment 5541657
CPH2251_A.13_ColorOS11.3_Android11_Latest.rar
drive.google.com
Step3: Flash the firmware
on cmd type below command to flash the firmware
python mtk wl "stock ROM location full path"
it will wait for devices.. Power off the phone, wait 10 sec then press vol up + vol down together and then plug the usb cable.
Once device detected , it will display devices information and start flashing
View attachment 5541639
View attachment 5541641
View attachment 5541645
While flashing it will dump the preloader, this file is very important so, please keep this file safely. this file may require in future.
View attachment 5541661
Step4: Boot the phone
Once flashing completed, press vol up + power button together for 30 sec. Wait for device to boot.
so by this way we flashed stock firmware on oppo reno6 5G.
Tips: If due to some reason flashing did not completed successfully then please press vol up and power button together for 30-40 sec to boot the phone (exit the brom mode).
Disclaimer: I have tested this method on my phone, it's 100% working but I will not responsible if damage any damage happens to your device while doing this. So do it at your own risk.
Click to expand...
Click to collapse
Thank you sir, it's working.
I followed this method and now I have successfully downgraded my ColorOs 12 to ColorOs 11.3 on my oppo reno6 5g.

Oukitel WP17 [Root][GSI ARM64 A/B Treble-Enabled]

WP17 is a rugged phone with Infrared Night Vision Camera, Helio G95 8GB+128GB 6.78“FHD+ 90Hz 64MP Triple Camera+16MP Selfie 8300mAh Android 11 Global Version.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Bought me a Oukitel WP17, but couldn't find much information about this phone.
So I'm going to post info here for everyone to see and participate in how to flash, root and update the phone.

Update:
Using the MTK-bypass Small utility to disable bootrom protection(sla and daa).
According to this Exploit, this MT6785 Oukitel WP17 is fully unlocked, and should be flashable:
Windows10:
[2022-10-13 02:45:23.376773] Found device = 0e8d:0003
[2022-10-13 02:45:23.766358] Device hw code: 0x813
[2022-10-13 02:45:23.776413] Device hw sub code: 0x8a00
[2022-10-13 02:45:23.786386] Device hw version: 0xca00
[2022-10-13 02:45:23.796588] Device sw version: 0x0
[2022-10-13 02:45:23.806536] Device secure boot: False
[2022-10-13 02:45:23.816739] Device serial link authorization: False
[2022-10-13 02:45:23.816739] Device download agent authorization: False
[2022-10-13 02:45:23.836660] Disabling watchdog timer
[2022-10-13 02:45:23.846734] Insecure device, sending payload using send_da
[2022-10-13 02:45:23.896695] Found send_dword, dumping bootrom to bootrom_813.bin
Linux:
[2022-10-13 09:15:03.350097] Found port = /dev/ttyACM0
[2022-10-13 09:15:03.423994] Device hw code: 0x813
[2022-10-13 09:15:03.425119] Device hw sub code: 0x8a00
[2022-10-13 09:15:03.425523] Device hw version: 0xca00
[2022-10-13 09:15:03.425902] Device sw version: 0x0
[2022-10-13 09:15:03.426248] Device secure boot: False
[2022-10-13 09:15:03.426595] Device serial link authorization: False
[2022-10-13 09:15:03.426923] Device download agent authorization: False
However, flashing this phone in any Sp flash tool, is ending up in:
ERROR : STATUS_SEC_PUBK_AUTH_MISMATCH_N (0xC002001B)
​The PUBK_AUTH part of this error message, is the Authorization for flashing Signed/verified image files. In the Oukitel WP17 firmware folder, downloaded from Oukitel Downlod Center, are their only certain files marked as verified.img, and now after testing in Sp flash tool, loading ALL non-verified files, you can flash these files to the phone without problems.
.

Stock Oukitel Android 11 recovery​
Let's fix this phone​Download these files:​Oukitel WP17 firmware: ASW2100YJ_2201_T2046
Python 6.3.1
Mediatek VCOM, CDC, USB Serial & Smartwatch Drivers
UsbDk_Brom-mode
MTKClient
Flash_Tool_v5.2028
Computer with internet
But before we can start, we need to format the phone, to delete all old configurations and settings.
1. Start by extracting the firmware file to your desktop. Now open up the MTKClient zip file and drag all files to your firmware folder.
​
2. Now you Install all needed drivers: Mediatek VCOM, CDC, USB / UsbDk_Brom-mode.
3. Extract the Flash_Tool to your desktop and open the flash_tool.exe.
ONLY check the UNverified files. We will flash the verified files later. Click on the Download button when you're done. Take your dead phone and connect it to the computer with the USB cable. Hold down Volume+ Volume- and power-button together, hold the buttons until the flashing start.
Once you have flashed the UN-verified files to your phone, we start the process of flashing the verified files.
4. Now we need access to the verified files. open a prompt in the firmware.
To do that, go to the start menu and type CMD.
4. Right-click and copy the address and paste it in the prompt window.
​5. Now we have to configure MTKClient to be able to communicate with the phone.
Past in these commands one at a time in to the promt window.
Code:
python setup.py install
pip3 install -r requirements.txt
6. And now finally after you have set up the environment in python.
The flashing of the verified files to you phone can begin. copy and paste in the hole commands.
Code:
python mtk w md1img,spmfw,scp1,scp2,sspm_1,sspm_2,cam_vpu1,cam_vpu2,cam_vpu3,gz1,gz2,lk,lk2,logo,dtbo,tee1,tee2 md1img-verified.img,spmfw-verified.img,scp-verified.img,scp-verified.img,sspm-verified.img,sspm-verified.img,cam_vpu1-verified.img,cam_vpu2-verified.img,cam_vpu3-verified.img,gz-verified.img,gz-verified.img,lk-verified.img,lk-verified.img,logo-verified.bin,dtbo-verified.img,tee-verified.img,tee-verified.img
​Press Enter,
On the phone: Hold down Volume+ Volume- and power-button together, hold the buttons until the flashing start. Sit back and wait
.
​Your phone will end up like this after boot.
Done ....
Now Update your phone by Android update service by going in to 'Settings / System and update phone.
.

-- IMEI Restore --​
After formatting the phone. I use ModemMETA tool to restore my IMEI.
​Select the “Smart Phone” option from “Platform Type” section. Same as , select “USB” option from “PORT” section.
Press the Connect button in Modem METAtool. Hold down the Volume+ Volume- and power buttons at the same time while plugging in the USB cable. Meta tool will detect the device and it will start to load Boot file, karnel port etc. You can see all the process in “Connection Stages” section.
After completing the configuration process, you will be able to see “Connect” message at the bottom of the tool.
Now click on “Load DB”. “Load Database file from target”.
Now click on search box and select IMEI download option from drop down menu.
A new IMEI window will pop up in front of you.
Type in yor IMEI : and hit on “Write” button from same window.
ILLEGAL to Creating your own: 12345.12345.1234
if everything went well, it looks like this.​
​

Update:
Easy rooting with Magisk ......​
This will Unlock your bootloader!.
Unlocking your bootloader will send your phone in to a emergency state, and delete all personal data on the device. Back up everything that is important to you, before proceeding with rooting your phone -
​
Download and extract AA - Install Android to your desktop. Turn off your phone and enter 'fastboot mode'. Connect your phone to the computer and open AA - Install ROOT.dat.
​Install Magisk25.
.

-- WARNING --​Thinking of upgrading to Android 12 / Android 13 ?​
The camera drivers found in the Android 11 version your phone was shipped with -​Are NOT in the Android 11 version from the Oukitel Download Center !.​You will brake your 64MP Camera if you flash GSI ore the version from Download Center .​
Although I copied all the files required to restore the camera, which you can find below in a zip file -
Are the drivers in all other roms and GSI's to control the camera missing.
--FM drivers are located in kernel. Most other oem drivers are in vendor. And the definitions are in system
​However, there is an easy fix for this, and that is to make a backup of your working phone firmware before you start installing other versions of Android, so that you can always restore your phone from this backup, with the correct drivers and get a fully functional phone again.
​Dump/extract/backup your Oukitel WP17 firmware.​It is ALWAYS a good practice to backup your firmware. Any phones sooner or later will have issues and since you don't have a copy to restore yor phone, you will spend money sending it in for repair which sometimes costs more than the phone is worth. There are many ways to make a copy of your phone's firmware. search on the internet or use this simple guide:
All the files you need can be found under this video​
And to everyone who already broken their phone and is now looking for a way to restore their phone. Have I already ordered a new WP17 that I will create a firmware backup of, and make available for you and a manual for how to restore. I will keep you updated on that, but it takes a long time to get things shipped from China these days.
.

Android 12 / 13 on Oukitel WP17 -​I created a small script that quickly installs Android 12 and 13 on your phone.
Get rid of the pesky red text on the screen.
​Android 12 ...​
​Android 13 ...​
​To begin with, you need to decide which version of Android you want on your phone.
To help you on your way, I suggest you check out the link below. It's important that you choose the ARM64 AB version.
Generic System Image (GSI) list
Notes about tinkering with Android Project Treble. Contribute to phhusson/treble_experimentations development by creating an account on GitHub.
github.com
In this example, let's say you want to install Spark OS Android 13.
​Go to the download page and select the latest version.
1. Extract Android 13 from the downloaded file to your desktop.
2. Rename the file to GSI.img
3. Download and extract AA - Install Android to your desktop
4. Move the GSI.img file to the install folder.
​Double-click on AA - Install Android.
Turn off your phone.
Press and hold Volume+ Power and Ptt button until you get to the bootloader menu.
Select Fastboot mode.
​Connect your USB cable to your phone, Look at your phone, and press Volume+ button 2 times when prompted to start. That's all. Sit back and relax for a couple of minutes.
​The installation script will install your chosen Android version and reboot the phone when everything is done. After boot install Magisk25.
.
​

Udate:
I have created a new lk.img file to remove the 'Orange State' Warning during boot of Android.
The file is added to the installation scripts.

Hi,
I've just intalled SparkOS (the same file you show in the tutorial) on my WP17.
The default camera has been replaced and now I can't use the triple camera or infrared.
I was wondering if you knew how to install/flash the NightVision Camera_Oukitel WP17.zip back onto the phone. Or maybe where to put the files?
Best regards, picipi.
PS: keep on the great work!

.
No. Sorry, not yet. The problem is the drivers for the camera. The Android version your phone is shipped with has these drivers pre-installed. As I wrote before, if you flash GSI or other versions of android, these drivers are not included, and you will have problems with your camera.
This forum is aimed primarily at those who have had problems with their phone and need help getting their phone to a working condition for calling and normal daily operation. However the NightVision Camera can be partly fixt by installing the default camera app.
It's important for EVERYONE with Android 11 stock firmware, to extract a copy of the firmware as a backup, before flashing other GSI roms. And share a link here on the forum, so others can restore their phones to.
There are many ways to do this. Find a method that suits you best:
pull Stock Android Firmware - Google Search
Perhaps this one for Windows users:
How to use SP Flash tool to backup Mediatek firmware
Update: I suggest you use Wwr tool + SP flash tool for the dump instead of SP Flash tool alone as you can proceed without first having the scatter file and using MTK Droid Tools (which is now outdated
www.hovatek.com
PS..
When you extract you firmware. DO NOT copy the USERDATA partition!, this partition can hold up to 20-40 gigabits of your old useless user data, of you using your phone on a daily bases.
.

--- BlissOS Android 13 and lightning fast ---​
​
This rom has the bare minimum of needed apps, no bloatware and lightning fast.
highly recommended and fit's the Oukitel WP17 spec perfectly.
Download the rom here:
BlissOSv16.0-arm64-bgN-slim-Unofficial​
1. Extract Android 13 from the downloaded file to your desktop.
2. Rename the file to GSI.img
3. Download and extract AA - Install Android to your desktop
4. Move the GSI.img file to the install folder.
Enjoy ...

If you choose to go back to stock rom, and you have formatted the phone to flash GSI, is the precise partition deleted, and you end up with missing google key / Red txt on the top of your phone.
Here is the file you flash to get rid of that Red txt…
Code:
fastboot flash persist persist.img
_____________________________________________________________________________________
Update:
Some users reported it doesn't work for them.
For me it did the trick, but it doesn't work for everyone.
.
.

.....

Hey, thank you so much, got my WP17 working again but now I don't have IMEI and I'm getting a watermark saying "No google key and tee key" any ideas how to fix this ?

JustNabus said:
Hey, thank you so much, got my WP17 working again but now I don't have IMEI and I'm getting a watermark saying "No google key and tee key" any ideas how to fix this ?
Click to expand...
Click to collapse
.
The IMEI fix: https://forum.xda-developers.com/t/...rm64-a-b-treble-enabled.4504207/post-87571063
Working on a solution for the "No google key and tee key".
Don't forget to update the Android system for camera fix.
.

SwedishForenger said:
.
The IMEI fix: https://forum.xda-developers.com/t/...rm64-a-b-treble-enabled.4504207/post-87571063
Working on a solution for the "No google key and tee key".
Don't forget to update the Android system for camera fix.
.
Click to expand...
Click to collapse
I forgot to say that I don't have any backup on my IMEI and I've no idea where the box is. Is there any other way to get it ? I've sent an email to Oukitel but no answer so far

.
Yes. just copy and paste these numbers. Ore just scramble the numbers around.
IMEI 1: 35524555061532
IMEI 2: 35524555061573
​If you don't want to use these IMEI numbers, you can just take the IMEI number under the battery from one of your old phones you already have lying around. it doesn't matter how old they are, even an old Nokia from 1990 works perfectly fine.
_______________________________________________________________________________________​Disclaimer​Editing or changing the serial number or IMEI of your device is illegal in some countries.
I take no responsibility for your actions. This is for educational purposes only.
.

To remove the Red txt "No google key and tee key".​Some people have sent me a pm and say that flashing persist.img didn't work for them.
Try this instead:
Code:
adb devices
pm uninstall -k --user 0 com.mediatek.engineermode
Reboot the phone.
.

noob here, can you create a youtube video on how to install a custom rom to this phone?

dalelad said:
noob here, can you create a youtube video on how to install a custom rom to this phone?
Click to expand...
Click to collapse
.
It's not relay necessary.
There are only 4 small simple steps to perform, the Installer does everything else for you.
Oukitel WP17 [Root][GSI ARM64 A/B Treble-Enabled]
WP17 is a rugged phone with Infrared Night Vision Camera, Helio G95 8GB+128GB 6.78“FHD+ 90Hz 64MP Triple Camera+16MP Selfie 8300mAh Android 11 Global Version. Bought me a Oukitel WP17, but couldn't find much information about this phone. So...
forum.xda-developers.com
It's important for EVERYONE with Android 11 stock firmware, to extract a copy of the firmware as a backup, before flashing other GSI roms. And share a link here on the forum, so others can restore their phones to.
There are many ways to do this. Find a method that suits you best:
pull Stock Android Firmware - Google Search
.