www.chinaphonearena.com
[Question] MT6737M - Readback Root, Recovery and Unlock Bootloader - Printable Version

+- www.chinaphonearena.com (https://www.chinaphonearena.com/forum)
+-- Forum: Phone & Tablet Root, Hack and Develop (https://www.chinaphonearena.com/forum/Forum-Phone-Tablet-Root-Hack-and-Develop)
+--- Forum: *Tech support* General Phone & Tablet Root, Hack and Develop Root IMEI NVRAM CWM TWRP BRICKED (https://www.chinaphonearena.com/forum/Forum-Tech-support-General-Phone-Tablet-Root-Hack-and-Develop-Root-IMEI-NVRAM-CWM-TWRP-BRICKED)
+--- Thread: [Question] MT6737M - Readback Root, Recovery and Unlock Bootloader (/Thread-Question-MT6737M-Readback-Root-Recovery-and-Unlock-Bootloader)

Pages: 1 2

MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-11-27

Hi guys,
I've followed many thread about "backup", "rooting", "TWRP Port"... in forum..
I tried all but it's not work correctly Sad
My case maybe so different.
Firstly, this is my phone info:
alps
model:droi6737m_35g_m0
android 6.0
id: MRA58K test-keys
and it also call S7 Edge clone
[Only registered and activated users can see links Click here to register]
[Only registered and activated users can see links Click here to register]

I've read it with Miracle Box (ver 2.27A cracked), and I get a backup pack with MT6735_Android_scatter.txt and 10 .bin file. And it easy to unbrick anytime I got bootloop.
But, I dont understand. Why my phone was MT6737m and the backup scatter say MT6735.??? That's first question.
This is Scatter file content
Code:
############################################################################################################
#
#  General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
  info:
    - config_version: V1.1.1
      platform: MT6735
      project: mtk_android
      storage: EMMC
      boot_channel: MSDC_0
      block_size: 0x20000
############################################################################################################
#
#  Layout Setting
#
############################################################################################################
- partition_index: SYS0
  partition_name: PRELOADER
  file_name: preloader.bin
  is_download: true
  type: SV5_BL_BIN
  linear_start_addr: 0x0
  physical_start_addr: 0x0
  partition_size: 0x400000
  region: EMMC_BOOT_1
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: BOOTLOADER
  reserve: 0x00

- partition_index: SYS1
  partition_name: PGPT
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x0
  physical_start_addr: 0x0
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS2
  partition_name: PROINFO
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x80000
  physical_start_addr: 0x80000
  partition_size: 0x300000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS3
  partition_name: NVRAM
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x380000
  physical_start_addr: 0x380000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS4
  partition_name: PROTECT1
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x880000
  physical_start_addr: 0x880000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS5
  partition_name: PROTECT2
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x1280000
  physical_start_addr: 0x1280000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS6
  partition_name: LK
  file_name: lk.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x1C80000
  physical_start_addr: 0x1C80000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS7
  partition_name: PARA
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x1D00000
  physical_start_addr: 0x1D00000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS8
  partition_name: BOOT
  file_name: boot.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x1D80000
  physical_start_addr: 0x1D80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS9
  partition_name: RECOVERY
  file_name: recovery.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x2D80000
  physical_start_addr: 0x2D80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS10
  partition_name: LOGO
  file_name: logo.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x3D80000
  physical_start_addr: 0x3D80000
  partition_size: 0x800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS11
  partition_name: EXPDB
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x4580000
  physical_start_addr: 0x4580000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS12
  partition_name: SECCFG
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x4F80000
  physical_start_addr: 0x4F80000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS13
  partition_name: OEMKEYSTORE
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x5000000
  physical_start_addr: 0x5000000
  partition_size: 0x200000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS14
  partition_name: SECRO
  file_name: secro.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x5200000
  physical_start_addr: 0x5200000
  partition_size: 0x600000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS15
  partition_name: KEYSTORE
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x5800000
  physical_start_addr: 0x5800000
  partition_size: 0x800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS16
  partition_name: TEE1
  file_name: tee1.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x6000000
  physical_start_addr: 0x6000000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS17
  partition_name: TEE2
  file_name: tee2.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x6500000
  physical_start_addr: 0x6500000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS18
  partition_name: FRP
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x6A00000
  physical_start_addr: 0x6A00000
  partition_size: 0x100000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS19
  partition_name: NVDATA
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x6B00000
  physical_start_addr: 0x6B00000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS20
  partition_name: METADATA
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x8B00000
  physical_start_addr: 0x8B00000
  partition_size: 0x2500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS21
  partition_name: SYSTEM
  file_name: system.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0xB000000
  physical_start_addr: 0xB000000
  partition_size: 0x95800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS22
  partition_name: CACHE
  file_name: cache.bin
  is_download: true
  type: YAFFS_IMG
  linear_start_addr: 0xA0800000
  physical_start_addr: 0xA0800000
  partition_size: 0x19000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS23
  partition_name: USERDATA
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0xB9800000
  physical_start_addr: 0xB9800000
  partition_size: 0x117780000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS24
  partition_name: FLASHINFO
  file_name: NONE
  is_download: false
  type: NONE
  linear_start_addr: 0x1D0F80000
  physical_start_addr: 0x1D0F80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: false
  is_reserved: true
  operation_type: RESERVED
  reserve: 0x00

Second, I try to root and install custom recovery to this phone. But I face on some trouble.
When I check it with RootChecker app (on Play Store), it say "Sorry! Root Access is not properly installed on this devices" . Ok! the phone was not rooted.
I try root with Vroot and Kingroot, it seem not success. with Geniusroot (shuame), it say my phone was rooted (what!) . And when I plug to Kingo Root (PC), app say my phone was rooted too. With Kingo root, I try remove root, after that, it still say that phone was rooted (what!?). And I try "root again" method. The phone rooting correctly and it's successful. Root Checker say Phone is rooted. But didnt have any SuperUser authenticator?? I downloaded Kingo SuperUser, and install it; after couple of minutes my phone auto restart and bootloop.
Otherwise, I try install SuperSU or Superuser (on Play Store), after press update SU binary, the phone auto restart and bootloop,too.
Mannn...
I try to install BETA-SuperSU-v2.74-2-20160519174328-forced-systemless.zip with stock recovery but when I choose Update with SD card , it list folders which I'm sure it's not on my memory card.
and I cannot install file via adb because the PC not detect device at that time.
I totally didnt know what to do for Rooting this phone.

Thirdly, same with Rooting method, I cannot install or flash any custom recovery on my phone.
I follow this tut [Only registered and activated users can see links Click here to register]
I have to modified the scatter file from MT6735 to MT6737m for SP Flashtool detect right chip and it works. (If not SPFT say Chip type not match)
This is the modified scatter file (for Readback with SP Flashtool)
Code:
############################################################################################################
#
#  General Setting
#
############################################################################################################
- general: MTK_PLATFORM_CFG
  info:
    - config_version: V1.1.2
      platform: MT6737M
      project: mtk_android
      storage: EMMC
      boot_channel: MSDC_0
      block_size: 0x20000
############################################################################################################
#
#  Layout Setting
#
############################################################################################################
- partition_index: SYS0
  partition_name: PRELOADER
  file_name: preloader.bin
  is_download: true
  type: SV5_BL_BIN
  linear_start_addr: 0x0
  physical_start_addr: 0x0
  partition_size: 0x400000
  region: EMMC_BOOT_1
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: BOOTLOADER
  reserve: 0x00

- partition_index: SYS1
  partition_name: PGPT
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x0
  physical_start_addr: 0x0
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS2
  partition_name: PROINFO
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x80000
  physical_start_addr: 0x80000
  partition_size: 0x300000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS3
  partition_name: NVRAM
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x380000
  physical_start_addr: 0x380000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: BINREGION
  reserve: 0x00

- partition_index: SYS4
  partition_name: PROTECT1
  file_name: NONE
  is_download: false
  type: EXT4_IMG
  linear_start_addr: 0x880000
  physical_start_addr: 0x880000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS5
  partition_name: PROTECT2
  file_name: NONE
  is_download: false
  type: EXT4_IMG
  linear_start_addr: 0x1280000
  physical_start_addr: 0x1280000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: PROTECTED
  reserve: 0x00

- partition_index: SYS6
  partition_name: LK
  file_name: lk.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x1C80000
  physical_start_addr: 0x1C80000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS7
  partition_name: PARA
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x1D00000
  physical_start_addr: 0x1D00000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS8
  partition_name: BOOT
  file_name: boot.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x1D80000
  physical_start_addr: 0x1D80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS9
  partition_name: RECOVERY
  file_name: recovery.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x2D80000
  physical_start_addr: 0x2D80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS10
  partition_name: LOGO
  file_name: logo.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x3D80000
  physical_start_addr: 0x3D80000
  partition_size: 0x800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS11
  partition_name: EXPDB
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x4580000
  physical_start_addr: 0x4580000
  partition_size: 0xA00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS12
  partition_name: SECCFG
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x4F80000
  physical_start_addr: 0x4F80000
  partition_size: 0x80000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS13
  partition_name: OEMKEYSTORE
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x5000000
  physical_start_addr: 0x5000000
  partition_size: 0x200000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS14
  partition_name: SECRO
  file_name: secro.img
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x5200000
  physical_start_addr: 0x5200000
  partition_size: 0x600000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS15
  partition_name: KEYSTORE
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x5800000
  physical_start_addr: 0x5800000
  partition_size: 0x800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS16
  partition_name: TEE1
  file_name: tee1.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x6000000
  physical_start_addr: 0x6000000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS17
  partition_name: TEE2
  file_name: tee2.bin
  is_download: true
  type: NORMAL_ROM
  linear_start_addr: 0x6500000
  physical_start_addr: 0x6500000
  partition_size: 0x500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS18
  partition_name: FRP
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x6A00000
  physical_start_addr: 0x6A00000
  partition_size: 0x100000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS19
  partition_name: NVDATA
  file_name: NONE
  is_download: false
  type: EXT4_IMG
  linear_start_addr: 0x6B00000
  physical_start_addr: 0x6B00000
  partition_size: 0x2000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS20
  partition_name: METADATA
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x8B00000
  physical_start_addr: 0x8B00000
  partition_size: 0x2500000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: INVISIBLE
  reserve: 0x00

- partition_index: SYS21
  partition_name: SYSTEM
  file_name: system.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0xB000000
  physical_start_addr: 0xB000000
  partition_size: 0x95800000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS22
  partition_name: CACHE
  file_name: cache.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0xA0800000
  physical_start_addr: 0xA0800000
  partition_size: 0x19000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS23
  partition_name: USERDATA
  file_name: userdata.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0xB9800000
  physical_start_addr: 0xB9800000
  partition_size: 0x117780000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS24
  partition_name: FLASHINFO
  file_name: NONE
  is_download: false
  type: NORMAL_ROM
  linear_start_addr: 0x1D0F80000
  physical_start_addr: 0x1D0F80000
  partition_size: 0x1000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: false
  is_reserved: true
  operation_type: RESERVED
  reserve: 0x00

I readback success on SP Flashtool and I get a backup folder (about 2.5Gb size)
I try port twrp follow this tut [Only registered and activated users can see links Click here to register]
But when I try to flash it with SP Flashtool, it say " Error: ?? (0x3).
I try to flash (ported) recovery.img with fastboot flash but it failed.

All the problems that led me to a big problem, in fastboot mode, I check fastboot getvar all and I know Bootloader is locked.
I try to unlock with fastboot oem unlock - and I need to "Yes" permission by Vol+ button.
BUT IT'S UNABLE TO PRESS VOL+ . WTHHHHHHHHHHHHHH
I've tried many way but it's impossible to press Yes.
and No (Vol-) was able to press. #$%^&#$%^&*

Yah! I think the key problem is UNLOCK BOOTLOADER. And I cant found out any way to Unlock Bootloader on MT6737m without permission.
That's all problem with my phone. I cant unlock bootloader, i cant flash custom recovery, i cant root it and the backup pack ( which I readback with SP Flashtool) cant be flash because Error: ?? (0x3). The only work is read backup with Miracle but it got MT6735 (thought it can be flash).

I REALLY NEED HELP!!

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-11-29

Any help ??? plsssssss
The only thing I need now that HOW TO UNLOCK BOOTLOADER? I've already enable OEM Unlocking in Developer Option. But when I try fastboot oem unlock in fastboot mode. I cannot be able to press Vol+ button to say Yes. I only allow press Vol- to say NO... my god ... I gonna mad...

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - gottlasz - 2016-11-29

Without unlocking the bootloader there is nothing you can do...
In my case i had to press vol+ many times to make it work.
Anyways i suggest to check all other variables you can with the getvar command, maybe there is something else to change before allowing bootloader unlock.
Or your china clone might not work in fastboot properly...

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-12-01

So sad to know that no way to solve this...
But the only one way to try (a daring way) is modify the para.img
here [Only registered and activated users can see links Click here to register]
How risk is it? How I can do with my mtk devices?

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - gottlasz - 2016-12-02



RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-12-03

(2016-12-02, 18:51)gottlasz Wrote: [Only registered and activated users can see links Click here to register]
How risk is it? How I can do with my mtk devices?

Maybe you can give it a shot but it's a 2012 solution... I'm not sure if it still works at all after 4 years. Pretty much out of date.
Try the command: "fastboot oem unlock-go" this is for miui devices and i think it's not using any hard buttons. But since it's for miui there is very little chance to work either...
So sad! fastboot oem unlock-go not work...
I'm going to try root devices with Dirty Cow exploit on Ubuntu. Hope it work.

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-12-04

Hell yeah!
Finally, I have root my mt6737m device.
I used root script base on Dirty Cow Exploit to get root shell. Then I push Superuser into /system/bin follow to this instructions [Only registered and activated users can see links Click here to register]
After reboot, my phone have rooted and SuperSU work perfect.
However, I dont choose to update the SU binary when SuperSU app request (in my experience, the phone will bootloop after update SU binary by the app)
Anyway, the phone work good after root, I try to install Naptime, SD maid pro, FlashFire...and everthing seen OK.
Tomorrow I will Read rom with Miracle box one more time to save this root process.

RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - tcaudill01 - 2016-12-05



RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - lilngu - 2016-12-05



RE: MT6737M - Readback Root, Recovery and Unlock Bootloader - tcaudill01 - 2016-12-05