Database Users

[How To] Root - Backup - Custom Recovery - Blu Studio C (D830U)

What you will need:
KingRoot V4.5.0.901 (latest version as of this posting)
Rooting your phone will void your warranty.
Terminal Emulator for Android
Replace KingUser with SuperSU
MtkDroidTools v2.5.3-updated
adbd Insecure v2.00
SP Flash Tool
I am not going to get into how to install ADB drivers, MtkDroidTools, or SP Flash Tool. If you are not experienced with rooting, flashing, etc., please do some research.
Okay, let's get started
First you will need to get your phone rooted. Download KingRoot using the link above and follow this guide.
Next you will need to replace KingUser with SuperSU.
Now that we have the phone rooted and SuperSU in place, we can use MtkDroidTools to make a backup of the phone.
This video will show you how to backup your phone with MtkDroidTools (make sure you have downloaded the version I provided, as this has updated ADB files). Also make sure you enabled adbd Insecure before you connect your phone (you don't need to check enable at boot).
Once you have a successful backup, you need to create the files for flashing (scroll down to PREPARING EXTRACTED MTK ANDROID FLASH FILES FOR FLASH TOOLS) if you need to flash back to the original firmware.
Hopefully you now have a backup of your phone. Now we can install a custom recovery. You can use either TWRP (rename to recovery.img) or PhilZ.
The easiest way to flash the custom recovery is with SP Flash Tool. Connect your phone (you don't need adbd Insecure enabled for this). Run flash_tool.exe as administrator. For scatter-loading File click on the Scatter-loading folder
and navigate to your MtkDroidTools backups folder. There should be a folder that starts with BLU-STUDIO-C. Open that folder and select MT6582_Android_scatter.txt. For the recovery file, navigate to the one you downloaded (TWRP or PhilZ) by clicking on the Location column next to RECOVERY.
Make sure RECOVERY is the only box checked before proceeding. Now you have your scatter file and custom recovery loaded. Click on the Download button. Nothing will happen at this point. Now shut down your phone (not restart). Once your phone shuts down completely, plug it in via USB and you should see it begin to flash the custom recovery. If not, then you need to make sure you have the necessary drivers installed. Once it's complete, you can close out SP Flash Tool and disconnect your phone. After your phone is disconnected, hold down the power and volume up buttons until the recovery menu appears :good:
Post your feedback, and if you encounter any problems, please be as descriptive as possible. Good Luck
Credits:
@AlexZap who was the first to help me along this crazy journey
@yuweng for all his help in backing up the phone and for PhilZ recovery
@bigrammy for porting TWRP Recovery
@rua1 for MtkDroidTools
@carliv for CarlivTouchRecovery

Thanks for this guide, it has worked for me so far (backing up with mtkdroidtools now). Can I ask, why is it neccessary to use SPFT to flash the recovery? I have used fastboot to flash the recovery without issues. I just
$ fastboot oem unlock
and then was able to
$ fastboot flash recovery recovery.img
and it worked.
html
Also, would you be able to port some custom roms for this phone?

cteeto said:
Thanks for this guide, it has worked for me so far (backing up with mtkdroidtools now). Can I ask, why is it neccessary to use SPFT to flash the recovery? I have used fastboot to flash the recovery without issues. I just
$ fastboot oem unlock
and then was able to
$ fastboot flash recovery recovery.img
and it worked.
html
Also, would you be able to port some custom roms for this phone?
Click to expand...
Click to collapse
Glad it worked out for you. Yes, fastboot is also an option (as you all ready know).
Recovery could probably be flashed with Flashify, but haven't tried it. I am not a developer, so no I can't port any ROM's, and take no credit for the custom recoveries listed here.

If someone can post Cyanogenmod for a phone that uses the same hardware, I can port that for this phone.

sandix said:
If someone can post Cyanogenmod for a phone that uses the same hardware, I can port that for this phone.
Click to expand...
Click to collapse
ABSOLUTLY.......this would just be AMAZING...if anyone could manage to make a Cyanogenmod for this phone.....:good:

Bricked Blu Studio C (D830U)
Hey,
Was wondering if you could help me out here, as I'm a TOTAL Noob when it Comes to BLU phones But not to flashing....
I've Bricked by Phone, The Computer and SP Flash Tools still recognize the phone..
I've Downloaded the proper ROM from NeedRom.com....
My Issues:
1. Can you Verify WHICH Driver I should Be Using for a FULL either Erase/Download Or a Firmware Upgrade (Not Sure Which)
2. I need a Scatter File the Contains ALL the Memory address and Supplies ALL the Check Marks for a FULL Rewrite Flash....The One with the rom is missing Preloader Android, Cache, and usrdata...
When I did JUST the Scatter file flash attempt I got the BROM_ERROR : S_DL_GET_DRAM_SETTING_FAIL ( 5054 )
I googled that and it said the Perloader wsn't right So I added the Perloader (And checked the "firmware.info file" and seen the Memory:
preloader 0x0000000000c00000 0x0000000000000000 2 /dev/misc-sd
So I tried Anyway and got the same error except this time it's 4032.
So Basically Can you tell Me Which Files In the ROM I Download Go Into Which SLOTS on SPFTools, and Which memory address' are correct the firmware file or the Scatter??
I really don't want to keep slamming the phone with "STUFF" and REALLY screw something up, I think I'm lucky it's even being recognized at this point....
Also the MTK_Allinone_DA.bin that comes with SPFTools is the right one??!?!
I'm Using Version 5.13.52.200
I'm Assuming Just a FULL Scatter file would solve the problem?!?!?
ANYHELP In this Would be VERY much Appreciated....
Thanks
Mike
EDIT:
Ok, I got it to 4001 Error, And it's saying that error is it's not connecting with the preloader, So I'm thinking (hoping) if I can get those 3 files, even if the cache is empty as long as the memory address is right, and the scatter.txt, and do a Firmware upgrade, Hope, will solve the problem, if not, On to Test Pins...

@bobl61
Could work together to enhance MTKDroid liek as
Increae number of CPU recognize by it (ex. MT67xx - just recognize it - not work with it)
Update the apk included and sued by MTKDroid (like MobileUncle/Root Explorer/SuperSU)

Upload the ROM or the link I think I know what's the problem @Miker1029

Fixed from the dead!
Swaelae113 said:
Upload the ROM or the link I think I know what's the problem @Miker1029
Click to expand...
Click to collapse
Hey Thanks, I've made some progress today, The rom is on Need Rom.com so best to just google Needrom and D830U as It's internal search doesn't work so well....
I Got a New (Cheap, Used Phone) and to my Suprise It's an MT65XX Chip set Also (ACK!!!!!)..................... NO WAY IT JUST BOOTED UP!!!!!!!!!!!!!!!!!!!!!!!!!!! TOOK FOREVER!!!!!
Ok I learned that with the Downloaded ROM from Needrom, You Need to Go to MTK Tools and Process blocks for flash, The go to the Directory you Extracted the ROM to, And It'll bring up the MD5 file click it and It'll create the Scatterfile and the "!FLASH" Directory, Then Navigate to the !FLASH (something) Directory and you'll have your scatterfile.txt, Load it up, I added ALL files (see Screen Shot) and it's booted up.... You need to use Preloader Drivers for it, And I HAD TO FORMAT AND FLASH.... And what you see in the SPFlashtool screen shot is what I flashed....
I'm not a GUIDE writer sorry, But Hopefully this will give hope to those like me (that have been bricked for ALONG TIME) Hope.....
If anyone needs info on this Ask, I'll try and answer.....
Mike

IMEI Problem
Miker1029 said:
Hey Thanks, I've made some progress today, The rom is on Need Rom.com so best to just google Needrom and D830U as It's internal search doesn't work so well....
I Got a New (Cheap, Used Phone) and to my Suprise It's an MT65XX Chip set Also (ACK!!!!!)..................... NO WAY IT JUST BOOTED UP!!!!!!!!!!!!!!!!!!!!!!!!!!! TOOK FOREVER!!!!!
Ok I learned that with the Downloaded ROM from Needrom, You Need to Go to MTK Tools and Process blocks for flash, The go to the Directory you Extracted the ROM to, And It'll bring up the MD5 file click it and It'll create the Scatterfile and the "!FLASH" Directory, Then Navigate to the !FLASH (something) Directory and you'll have your scatterfile.txt, Load it up, I added ALL files (see Screen Shot) and it's booted up.... You need to use Preloader Drivers for it, And I HAD TO FORMAT AND FLASH.... And what you see in the SPFlashtool screen shot is what I flashed....
I'm not a GUIDE writer sorry, But Hopefully this will give hope to those like me (that have been bricked for ALONG TIME) Hope.....
If anyone needs info on this Ask, I'll try and answer.....
Mike
Click to expand...
Click to collapse
Update, Just a Heads Up I'm Assuming from Googling around, that Installing the NVRAM will wipe your IMEI, Still working on this aspect, But it doesn't seem to be Hindering the phone in anyway, As I said It Took along time to boot up, So I'm not sure if Re-writing the NVRAM made it work or not, I do know I formatted + Download, and It Sat On the Splash Screen, I shut down and Flashed just the NVRAM file, and It booted.....
NOW Should I go for a Custom Recovery??? LOL.... I'll wait.... But now that I know I can Fix it......Hmmmmm
Mike

Miker1029 said:
Hey Thanks, I've made some progress today, The rom is on Need Rom.com so best to just google Needrom and D830U as It's internal search doesn't work so well....
I Got a New (Cheap, Used Phone) and to my Suprise It's an MT65XX Chip set Also (ACK!!!!!)..................... NO WAY IT JUST BOOTED UP!!!!!!!!!!!!!!!!!!!!!!!!!!! TOOK FOREVER!!!!!
Ok I learned that with the Downloaded ROM from Needrom, You Need to Go to MTK Tools and Process blocks for flash, The go to the Directory you Extracted the ROM to, And It'll bring up the MD5 file click it and It'll create the Scatterfile and the "!FLASH" Directory, Then Navigate to the !FLASH (something) Directory and you'll have your scatterfile.txt, Load it up, I added ALL files (see Screen Shot) and it's booted up.... You need to use Preloader Drivers for it, And I HAD TO FORMAT AND FLASH.... And what you see in the SPFlashtool screen shot is what I flashed....
I'm not a GUIDE writer sorry, But Hopefully this will give hope to those like me (that have been bricked for ALONG TIME) Hope.....
If anyone needs info on this Ask, I'll try and answer.....
Mike
Click to expand...
Click to collapse
You are correct. I didn't realize the video on how to backup the stock rom did not include the next step which is to create the files needed to flash with MTK. Good catch, Miker1029 :good:

bobl61 said:
You are correct. I didn't realize the video on how to backup the stock rom did not include the next step which is to create the files needed to flash with MTK. Good catch, Miker1029 :good:
Click to expand...
Click to collapse
Hey Thanks, Maybe you can redo it or whatever, I was bricked for Months (Mainly Because i didn't know the Phone Type), Check out the screenshots to see the extent I went to Googling My Butt Off trying to figure it out, But once I did, All went good, I've flashed Atleast 100 Phones, For me, Friends, Family, Never had the Kind of issues I had with the MTK Chipset...
But now that I have it, It's rooted, Flashed, Xposed Framework Installed and working, Exactly what I was "Originally" trying to do....LOL, It's good now tho...
Now Funny thing I lost My Compass on it, and Sensor detector says it's working fine, So Not sure what's Interfering With it.... Hate to Re-Flash
SOOO, If I GOTTA re-flash Been looking around for 6.0 (Marshmallow) Build for it (No Luck)
1st Pic, Just the Face.
2nd Pic, Where I Cut the Battery Connector (Casing) to the Board so I could Disconnect the Battery without taking the phone apart....
3rd Pic, I left the screws out as There's a Little spring on the Bottom-Left (Looking from the back) that Makes the speaker work, And On the Bottom-Right is the antenna connection that I can't get to "Snap" back in..... So I left the screws out to fix those minor issues, I'm trying to NOT open it anymore then I already have LOL
Mike

I want custom ROM for blu studio c 5+5
[Q

So i did this exactly as its written and now my d830u its freezing in blu logo... and im not able to enter recovery img, i used the philz link since the other one is deleted... hope any1 could help!

bertucci25 said:
So i did this exactly as its written and now my d830u its freezing in blu logo... and im not able to enter recovery img, i used the philz link since the other one is deleted... hope any1 could help!
Click to expand...
Click to collapse
Little. More details would be nice..
Did you download the rom from needrom?
Did you create the flashable files from that rom?
Did you generate and add scatter file?
Did you format and flash?
Did you check device manager to see if it's using the pre drives?
Did you remove any and alll USB / MTK drives, except the pre driver?
Disd you start the flash THEN plug on the phone? Does MTK say on the bottom PRE driver?
And finally i believe my issue was some kind of lock up as the battery isnt removable so i cut the casing to access the battery connector and basically stated the flash and attached the battery connection..
Alls i can say is i was at the exact same spot as you i flashed 3 or 4 totally incorrect roms, and had that driver issue, when i finally got the proper rom and fixed the driver issue it worked, and it did take like 20 to 30 minutes for the ohone to boot the 1st time..
Mike
---------- Post added at 11:05 AM ---------- Previous post was at 10:33 AM ----------
Also, i used the recovery that came with the rom and when it finally booted up, i flashed the custom recovery...
And if you decide to go with disconnecting the battery be careful as some months after the female connection on the board broke completely off... I hate any phone without a way to break the electrical connection think it's stupid..
Good luck,
Mike

Miker1029 said:
Little. More details would be nice..
Did you download the rom from needrom?
Did you create the flashable files from that rom?
Did you generate and add scatter file?
Did you format and flash?
Did you check device manager to see if it's using the pre drives?
Did you remove any and alll USB / MTK drives, except the pre driver?
Disd you start the flash THEN plug on the phone? Does MTK say on the bottom PRE driver?
And finally i believe my issue was some kind of lock up as the battery isnt removable so i cut the casing to access the battery connector and basically stated the flash and attached the battery connection..
Alls i can say is i was at the exact same spot as you i flashed 3 or 4 totally incorrect roms, and had that driver issue, when i finally got the proper rom and fixed the driver issue it worked, and it did take like 20 to 30 minutes for the ohone to boot the 1st time..
Mike
---------- Post added at 11:05 AM ---------- Previous post was at 10:33 AM ----------
Also, i used the recovery that came with the rom and when it finally booted up, i flashed the custom recovery...
And if you decide to go with disconnecting the battery be careful as some months after the female connection on the board broke completely off... I hate any phone without a way to break the electrical connection think it's stupid..
Good luck,
Mike
Click to expand...
Click to collapse
Ok i'm going to explain my journey from soft-to-revive history:
I was trying to install a custom recovery for my D830U (Blu) and end up in this thread. I made all the steps
-Rooted the phone with kingroot
-Removed kingroot and installed SuperSU
-Instaled insecure adbd insecure
-I made a backup of my stock rom with MtkDroidsTool(wich is the needrom provided, since i flashed my phone while ago)
-Drivers are installed (VCOM)
Everything is downloaded from the links in the post
Ok at this point i did everything exactly like the guide, great
Ok now the part were "something" failed is:
I got the scatter file in the mtkdroidstool backup folder and REPLACED the recovery to the PhilZ recovery.img in the link of the first post. And flashed normaly. Here is where things got bad
I disconnected the phone and realized it got bootloop, couldnt start the phone and can't get into recovery (when i press vol+ button it goes to black screen), because i installed a bad/not compatible philz recovery.img(AGAIN ITS FROM THE PROVIDED LINK) ok now i'm worried but no problem, i tried to reflash with original stock rom and eventually after many tries i got into a normal recovery mode and the phone boots normal..
Now my phone is at the start point. Can you tell me which version of custom recovery are you currently using? Or what procedure should i follow to get into it? Again thanks! Cheers.

Ya I'll upload the recovery i used, I'll get it here sometime today..
I'm not sure which it is, as i said, the power connection for the battery broke off the board awhile ago, so it's either philz or twrp.
Also, if I'm remembering correctly, you have to add the other drivers, not the pre driver, you can try it with the pre, and if you don't get the green check use the other ones, and when you go flash, I'd backup your recovery you have now and put it somewhere safe...
Ill also add the version of xposed i used, if i can find it.. I know i had to install the. Zip files from recovery...
Mike

I believe this is the custom recovery i flashed, i no longer have the phone to test, but i believe i removed all except the stock and custom..
As i said back up your current recovery..
Let me know so i can mark it my puter.. Thanks
Mike
Also let me add, I had a bad philz also, not sure if i got it here, or somewhere else, but i have it marked as philz doesnt work on my computer...

Ok folks, two downloads, can you provide an update?
I'm trying to help with an obscure phone..
So a report back, for the people, would be nice.
Mike

Miker1029 said:
Ok folks, two downloads, can you provide an update?
I'm trying to help with an obscure phone..
So a report back, for the people, would be nice.
Mike
Click to expand...
Click to collapse
Hey mike im going to test this today i'll update my progress in a few! wish me good luck :silly:

[DIY] Fire HD 6/7 bootloader unlock / ultimate unbrick :

The opportunity to unlock the Fire HD 6/7 bootloader and unbrick all bricks is upon us ! Sadly, it's about ~4 years too late.
Nonetheless, if you are proficient with IDA Disassembler and Python, please follow these instructions to accomplish these 2 objectives.
1) Zero out rpmb partition ( mmcblk0rpmb ) - this will set all the bricks free and enable them to boot (this is how anti-rollback is wiped)
2) Enable permanent bootloader unlock (more advanced)
Here are the relevant posts on how to do this:
https://forum.xda-developers.com/hd...fire-hd-8-2018-downgrade-unlock-root-t3894256 (full instructions)
https://forum.xda-developers.com/amazon-fire/development/downgrade-fire-7-2015-softbrick-t3894671 (rpmb partition zeroing method for Fire 7 2015)

bibikalka said:
The opportunity to unlock the Fire HD 6/7 bootloader and unbrick all bricks is upon us ! Sadly, it's about ~4 years too late.
Nonetheless, if you are proficient with IDA Disassembler and Python, please follow these instructions to accomplish these 2 objectives.
1) Zero out rpmb partition ( mmcblk0rpmb ) - this will set all the bricks free and enable them to boot (this is how anti-rollback is wiped)
2) Enable permanent bootloader unlock (more advanced)
Click to expand...
Click to collapse
Yeah, I saw the Fire HD 8 thread and was wondering if it'd be possible for us. Unfortunately, I'm neither proficient with IDA Disassembler nor python. And currently my Fire is on the latest FireOS, unrooted, with the wrong recovery installed. So right now I can't get into recovery to downgrade and fix it, and the preloader method doesnt work because the read/write commands don't work on the newer FireOS. I am interested in if this is possible though!
Update: I attempted using the files from the Fire 7 thread and this is what I got:
Code:
[2019-01-29 17:33:56.846249] Waiting for bootrom
[2019-01-29 17:34:07.704879] Found port = /dev/ttyACM0
[2019-01-29 17:34:07.744128] Handshake
[2019-01-29 17:34:07.766738] Disable watchdog
b''
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 57, in main
handshake(dev)
File "/root/fire7-2015-downgrade-unbrick/fire7-2015-downgrade-unbrick/modules/handshake.py", line 11, in handshake
dev.write32(0x10007000, 0x22000000)
File "/root/fire7-2015-downgrade-unbrick/fire7-2015-downgrade-unbrick/modules/common.py", line 152, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/root/fire7-2015-downgrade-unbrick/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: Serial protocol mismatch
I was using the linux iso for unbricking, so I'm not sure if that had something to do with it. Also, I hand-typed that error message so if there are any inconsistencies that may be why (I didn't have an internet connection to post from the iso).

spenceboy98 said:
Yeah, I saw the Fire HD 8 thread and was wondering if it'd be possible for us. Unfortunately, I'm neither proficient with IDA Disassembler nor python. And currently my Fire is on the latest FireOS, unrooted, with the wrong recovery installed. So right now I can't get into recovery to downgrade and fix it, and the preloader method doesnt work because the read/write commands don't work on the newer FireOS. I am interested in if this is possible though!
Update: I attempted using the files from the Fire 7 thread and this is what I got:
Code:
...
RuntimeError: Serial protocol mismatch
I was using the linux iso for unbricking, so I'm not sure if that had something to do with it. Also, I hand-typed that error message so if there are any inconsistencies that may be why (I didn't have an internet connection to post from the iso).
Click to expand...
Click to collapse
See this post for the proper output:
https://forum.xda-developers.com/showpost.php?p=78792151&postcount=14
I think HD 2014 does not switch to the bootrom mode, and is in the pre-loader mode. That's why it says protocol mismatch. With Fire 7 I got the initial stages to work - so it did go into the right mode! But with HD 2014 I got the same messages as you, under Windows. So I think it's just not switching into the bootrom mode.
We need some old timers here if we are to get this done!!!
@powerpoint45

bibikalka said:
I think HD 2014 does not switch to the bootrom mode, and is in the pre-loader mode. That's why it says protocol mismatch. With Fire 7 I got the initial stages to work - so it did go into the right mode! But with HD 2014 I got the same messages as you, under Windows. So I think it's just not switching into the bootrom mode.
We need some old timers here if we are to get this done!!!
Click to expand...
Click to collapse
I'm willing to pop open the back of my Fire HD 6 to check some pins if necessary. Hopefully we're not the only ones wanting to see progress for this device.

spenceboy98 said:
I'm willing to pop open the back of my Fire HD 6 to check some pins if necessary. Hopefully we're not the only ones wanting to see progress for this device.
Click to expand...
Click to collapse
Oh, there are plenty of motherboard pictures floating around:
https://forum.xda-developers.com/showpost.php?p=78789821&postcount=90
Gotta find something like these pins : CMD, CLK, DAT0. I could not spot any labels on the motherboard pictures. If the pin is outside of a shield, it'd be trivial to pop the cover, and short the pin. Then one still has to get the right addresses for HD 2014 to make everything work

bibikalka said:
Oh, there are plenty of motherboard pictures floating around:
https://forum.xda-developers.com/showpost.php?p=78789821&postcount=90
Gotta find something like these pins : CMD, CLK, DAT0. I could not spot any labels on the motherboard pictures. If the pin is outside of a shield, it'd be trivial to pop the cover, and short the pin. Then one still has to get the right addresses for HD 2014 to make everything work
Click to expand...
Click to collapse
I didn't see any labels on the board, so I tried a few pins (the ones that xyz` suggested) and I didn't seem to have any luck there. It's possible that I wasn't holding the wire I was using firm enough against the pins, but I don't know. I'm not sure what test points on this motherboard look like and if you have any suggestions or ideas, I'm willing to give it a go.
Also, on a new installation of Ubuntu 18.10, it's not even detecting the preloader. It just boots normally. And when I try in Windows 10, the device shows up as MT65xx Preloader and won't show up as a COM device even after installing the correct drivers.

spenceboy98 said:
I didn't see any labels on the board, so I tried a few pins (the ones that xyz` suggested) and I didn't seem to have any luck there. It's possible that I wasn't holding the wire I was using firm enough against the pins, but I don't know. I'm not sure what test points on this motherboard look like and if you have any suggestions or ideas, I'm willing to give it a go.
Also, on a new installation of Ubuntu 18.10, it's not even detecting the preloader. It just boots normally. And when I try in Windows 10, the device shows up as MT65xx Preloader and won't show up as a COM device even after installing the correct drivers.
Click to expand...
Click to collapse
Yep - it's a tough cookie. No labels on the board, and button pushes don't work either to get the device into the BootRom mode. I could only get the pre-loader mode as well.
We will have to wait for somebody to figure out the electrical connections here. Unfortunately, I don't have time to dig around like that.

(HD7, 7th Gen)
Just chiming in, I tried a few pads on the board (on both sides), and was unable to kick it into bootrom mode. It also looks like our shielding is soldered on. :/
May try some other methods later, but likely not going to have the easiest of times messing with this thing.

r3pwn said:
(HD7, 7th Gen)
Just chiming in, I tried a few pads on the board (on both sides), and was unable to kick it into bootrom mode. It also looks like our shielding is soldered on. :/
May try some other methods later, but likely not going to have the easiest of times messing with this thing.
Click to expand...
Click to collapse
7th Gen, or 4th Gen? Sorry for nitpicking, but it is huge for context!
spenceboy98 said:
Yeah, I saw the Fire HD 8 thread and was wondering if it'd be possible for us. Unfortunately, I'm neither proficient with IDA Disassembler nor python. And currently my Fire is on the latest FireOS, unrooted, with the wrong recovery installed. So right now I can't get into recovery to downgrade and fix it, and the preloader method doesnt work because the read/write commands don't work on the newer FireOS. I am interested in if this is possible though!
...
Click to expand...
Click to collapse
Btw, you can always sideload FireOS 4, and get root that way. Then re-load your current latest fireos via TWRP, and install SuperSu.

bibikalka said:
Btw, you can always sideload FireOS 4, and get root that way. Then re-load your current latest fireos via TWRP, and install SuperSu.
Click to expand...
Click to collapse
I can't because I have FireOS 5 with the twrp img installed (I didn't realize that the latest update.bin didn't include a stock recovery image). And I can't use the unbricking iso because it doesnt work with the latest FireOS. So this method is my best bet for getting back to stock with a stock recovery.
Btw, I'm not sure what exactly happened, but I'm pretty sure that my playing with the pins messed with something. All I get now is the grey Amazon logo and it doesn't boot into the OS. :|

spenceboy98 said:
I can't because I have FireOS 5 with the twrp img installed (I didn't realize that the latest update.bin didn't include a stock recovery image). And I can't use the unbricking iso because it doesnt work with the latest FireOS. So this method is my best bet for getting back to stock with a stock recovery.
Btw, I'm not sure what exactly happened, but I'm pretty sure that my playing with the pins messed with something. All I get now is the grey Amazon logo and it doesn't boot into the OS. :|
Click to expand...
Click to collapse
I see. Usually, recovery is verified each time you boot, and the OS will overwrite it if the checksum does not match. But, in your case, TWRP disabled that feature, so you are out in the cold.
I have 2 tablets that are looping on the white Amazon logo. I tried to restore them via aftv2-tools, but nothing worked. It's interesting you got the same glitch.
Look at the bright side - keep poking around now on your motherboard, you have nothing to lose!

I attempted to overwrite the beginning of EMMC - and got an absolutely dead tablet, see here:
https://forum.xda-developers.com/showpost.php?p=78871662&postcount=784
No bootrom mode as far as I can see ... One of these days I'll open the case, and try to disconnect the battery.

bibikalka said:
7th Gen, or 4th Gen? Sorry for nitpicking, but it is huge for context!
Click to expand...
Click to collapse
2017 Fire HD7, so 7th gen, aka austin

r3pwn said:
2017 Fire HD7, so 7th gen, aka austin
Click to expand...
Click to collapse
You are in the wrong forum.
The 2017 Fire 7 AKA austin doesn't use the suffix HD. It's just Fire or Fire 7.
This is what you are looking for: https://forum.xda-developers.com/amazon-fire/development/unlock-fire-t3899860

spenceboy98 said:
I can't because I have FireOS 5 with the twrp img installed (I didn't realize that the latest update.bin didn't include a stock recovery image). And I can't use the unbricking iso because it doesnt work with the latest FireOS. So this method is my best bet for getting back to stock with a stock recovery.
Btw, I'm not sure what exactly happened, but I'm pretty sure that my playing with the pins messed with something. All I get now is the grey Amazon logo and it doesn't boot into the OS. :|
Click to expand...
Click to collapse
Did put any more time into this? Was it some damaged contact?

bibikalka said:
Did put any more time into this? Was it some damaged contact?
Click to expand...
Click to collapse
No I haven't. Not sure what the issue is. As far as I know it's still not booting up to anything. I just started school recently and I left my Fire HD6 at home, so I haven't had the chance to mess around with it more.

Just for test. Is there any possiblility that pressing the power button with any volume button makes the tablet enter in BootROM. My Fire and my BQ enter in BootROM when I press volume -. Just try all the bootloaders for see if one support it like 5.0.1.
Regards!

bibikalka said:
The opportunity to unlock the Fire HD 6/7 bootloader and unbrick all bricks is upon us ! Sadly, it's about ~4 years too late.
Nonetheless, if you are proficient with IDA Disassembler and Python, please follow these instructions to accomplish these 2 objectives.
1) Zero out rpmb partition ( mmcblk0rpmb ) - this will set all the bricks free and enable them to boot (this is how anti-rollback is wiped)
2) Enable permanent bootloader unlock (more advanced)
Here are the relevant posts on how to do this:
https://forum.xda-developers.com/hd...fire-hd-8-2018-downgrade-unlock-root-t3894256 (full instructions)
https://forum.xda-developers.com/amazon-fire/development/downgrade-fire-7-2015-softbrick-t3894671 (rpmb partition zeroing method for Fire 7 2015)
Click to expand...
Click to collapse
I would love to get my HD 6 working again.

I recently ran the amonet script on my HD 10 and in a few minutes had an unlocked bootloader and TWRP. I read the HD 8 thread where the author posted his exploit and it really is an epic achievement. I'm also hoping the bootloader unlock comes to the 4K firestick as well. It's a lot of work from I read, but the firestick is popular enough to warrant that kind of attention. I have a Fire HD 6 which only boots to a recovery that allows me to reset or reboot but has no option to apply update from adb, so I've been stuck on stock Fire OS. It would be nice to finally get TWRP after so long on the HD 6.

***

Walmart ONN Surf 100005208

Im attempting to get info or at least start a thread on the possibility of ROOTING the (Walmart) ONN Surf 100005208 10.1"

It's a rebranding of the ONA19TB003. Same hardware, new name.

jordianz said:
Im attempting to get info or at least start a thread on the possibility of ROOTING the (Walmart) ONN Surf 100005208 10.1"
Click to expand...
Click to collapse
As @razredge stated, the Onn Surf 10.1 is merely a rebranding of its predecessor tablet. The Surf 10.1 can be rooted with or without TWRP. Follow the guides on rooting the previous Onn 10.1. Everything works exactly the same. TWRP is fully compatible as well.

can you share your stock firmware with me

no
the thing was a brick when i attempted the mod its a MT8768WA chipset not MT8163
Viva La Android said:
As @razredge stated, the Onn Surf 10.1 is merely a rebranding of its predecessor tablet. The Surf 10.1 can be rooted with or without TWRP. Follow the guides on rooting the previous Onn 10.1. Everything works exactly the same. TWRP is fully compatible as well.
Click to expand...
Click to collapse

KaosKreationz said:
the thing was a brick when i attempted the mod its a MT8768WA chipset not MT8163
Click to expand...
Click to collapse
Regardless of chipset platforms, both Onn 10.1" tablet variants can be rooted using the same TWRP and the same root method, and without TWRP by fastboot flashing a Magisk patched boot image.

Viva La Android said:
Regardless of chipset platforms, both Onn 10.1" tablet variants can be rooted using the same TWRP and the same root method, and without TWRP by fastboot flashing a Magisk patched boot image.
Click to expand...
Click to collapse
I keep reading it can’t and I do not want to brick this tablet so tell me exactly how to root it it’s the android 10 preloaded version.
---------- Post added at 08:37 PM ---------- Previous post was at 08:34 PM ----------
KaosKreationz said:
I keep reading it can’t and I do not want to brick this tablet so tell me exactly how to root it it’s the android 10 preloaded version.
Click to expand...
Click to collapse
Also how does one patch the image with magisk if the magisk software does not work on said tablet?
As well as how does one dump the images when so flash nor mt software doesn’t recognize the image.

KaosKreationz said:
I keep reading it can’t and I do not want to brick this tablet so tell me exactly how to root it it’s the android 10 preloaded version.
---------- Post added at 08:37 PM ---------- Previous post was at 08:34 PM ----------
Also how does one patch the image with magisk if the magisk software does not work on said tablet?
As well as how does one dump the images when so flash nor mt software doesn’t recognize the image.
Click to expand...
Click to collapse
Well, you just taught me something I wasn't aware of. I have not yet seen the Onn 10.1" variant with preloaded Android 10. My variant (Onn Surf 10.1, Model No. 100005208) came with Android 9 Pie. And I was able to root it using the TWRP build from my tablet's predecessor, which had the same chipset and also rah on Android 9 Pie. You seem to be referring to an entirely new variant that ships with Android 10. What is your exact model number and your current firmware build number? I'll see what I can find out.

Viva La Android said:
Well, you just taught me something I wasn't aware of. I have not yet seen the Onn 10.1" variant with preloaded Android 10. My variant (Onn Surf 10.1, Model No. 100005208) came with Android 9 Pie. And I was able to root it using the TWRP build from my tablet's predecessor, which had the same chipset and also rah on Android 9 Pie. You seem to be referring to an entirely new variant that ships with Android 10. What is your exact model number and your current firmware build number? I'll see what I can find out.
Click to expand...
Click to collapse
It just got a silent OTA update which I was trying to find in the saved directory but it went right to it and installed before i had a chance to pull it. ****ing thing has been a pain since i got it. trying to root and remove bloat bc its a decent setup and could run pretty fast if it were a clean android OS.
To answer your question it is the ONN 10003562 with MT8768WA Chipset ill update with the firmware one i fix the damn thing it bricked on me again while removing bloatware. this thing has some kinda tamper check or something. i get it starting to run really nice without root and then on reboot its a brick.

KaosKreationz said:
It just got a silent OTA update which I was trying to find in the saved directory but it went right to it and installed before i had a chance to pull it. ****ing thing has been a pain since i got it. trying to root and remove bloat bc its a decent setup and could run pretty fast if it were a clean android OS.
To answer your question it is the ONN 10003562 with MT8768WA Chipset ill update with the firmware one i fix the damn thing it bricked on me again while removing bloatware. this thing has some kinda tamper check or something. i get it starting to run really nice without root and then on reboot its a brick.
Click to expand...
Click to collapse
So you have yet another variant of the Onn 10.1" tablet. That's good to know. My 100005208 was merely a rebranding of its predecessor but it appears now that Onn has released yet another variant. Yeah, hold off on trying to root right now. Anything released with Android 10 out of the box uses the system-as-root (SAR) implementation. While Magisk does support SAR, the rooting process has changed up some. I'll see what I can dig up for you.

Viva La Android said:
So you have yet another variant of the Onn 10.1" tablet. That's good to know. My 100005208 was merely a rebranding of its predecessor but it appears now that Onn has released yet another variant. Yeah, hold off on trying to root right now. Anything released with Android 10 out of the box uses the system-as-root (SAR) implementation. While Magisk does support SAR, the rooting process has changed up some. I'll see what I can dig up for you.
Click to expand...
Click to collapse
ok thanks. the only thing I am able to really do is remove some bloatware. but even then it still runs like ****. I found some OTA's in one of the threads here and also its supposedly a stock from the box backup but the scatter doesnt match the chipset. I was hoping someone could inform me if there is a way to get an android ten backup of the older device and swap out keys or whatever the thing is checking for when it boots and flash it.
very limited with no real su so stuff wont work right when I delete certain bloatware. Also if anyone can inform as to how I can even pull my firmware and recover.img and boot.img etc. I have tried MTK device or whatever that software is as well as sp flashtool and nothing seems to read the device rom. can see the device but cant pull. its been so long since ive used or attempted to root an android device im out of practice.

KaosKreationz said:
ok thanks. the only thing I am able to really do is remove some bloatware. but even then it still runs like ****. I found some OTA's in one of the threads here and also its supposedly a stock from the box backup but the scatter doesnt match the chipset. I was hoping someone could inform me if there is a way to get an android ten backup of the older device and swap out keys or whatever the thing is checking for when it boots and flash it.
very limited with no real su so stuff wont work right when I delete certain bloatware. Also if anyone can inform as to how I can even pull my firmware and recover.img and boot.img etc. I have tried MTK device or whatever that software is as well as sp flashtool and nothing seems to read the device rom. can see the device but cant pull. its been so long since ive used or attempted to root an android device im out of practice.
Click to expand...
Click to collapse
Earlier, you mentioned a "silent OTA." Could you elaborate on that? Did the OTA install seamlessly, without rebooting to recovery? I'm wondering if your variant has A/B partitions.

Viva La Android said:
Earlier, you mentioned a "silent OTA." Could you elaborate on that? Did the OTA install seamlessly, without rebooting to recovery? I'm wondering if your variant has A/B partitions.
Click to expand...
Click to collapse
When I said silently I meant I was sitting at the computer with the tablet hooked up in adb mode and i walked away for maybe 3 minutes to relieve myself and upon returning the tablet was rebooting and installing an update. I swear I had the automatic updates in dev mode turned to off.
Here is what I gather from the device.

KaosKreationz said:
When I said silently I meant I was sitting at the computer with the tablet hooked up in adb mode and i walked away for maybe 3 minutes to relieve myself and upon returning the tablet was rebooting and installing an update. I swear I had the automatic updates in dev mode turned to off.
Here is what I gather from the device.
Click to expand...
Click to collapse
Thanks for the stats. Yeah it looks like you're fully Treble supported but non-A/B. Ok just to make sure I'm not missing something, sort of give me a simple outline on everything you've done from start until now. Did you mention your device was a brick when you got it, or did you brick it initially attempting to root? How did you recover from the brick? I'm assuming SP Flash Tool and I recall you mentioned something about a mismatched scatter file. I believe I have a root solution for you but I want to make sure I have my info correct. Thanks for helping me to help you. You seem to know your Android well.

It was a soft brick via adb removal of bloat ware it was able to be restored from factory settings..
I think I may almost have it but i'm to afraid of flashing the boot.img bc I did brick the first one I had via sp flash. The firmware someone added in this thread a bit back says 100003562 but the chipset is MT6765 not the MT8768WA. I was able to mod that boot.img with magisk but as I stated I'm to afraid to flash it I tried the fastboot boot magiskpatched.img command it seemed to read with no errors but it shutdown and then rebooted. soo im afraid it may cause a loop. Im trying now to figure out a way to remove the dm verity check but have had no success as of yet. if i could just pull my own roms Im sure I could get this to root with magisk maybe.
link to larger files https://drive.google.com/drive/folders/1-j0wj9d0FuLxvHdvW8CjYICp3-xV00cs?usp=sharing
I cant seem to get SP Flash to read the device scatter properly Im unable to pull roms with readback I think i have to set it up manually?
I have attached the screenshots, rom, magisk image created as well as the bug report from soft brick.

It would Be soo much easier if i could get the DM verity off and or pull my roms.

KaosKreationz said:
It would Be soo much easier if i could get the DM verity off and or pull my roms.
Click to expand...
Click to collapse
Ok as you probably know, your device has SAR (system-as-root) implementation, because it shipped with Android 10. It appears that you will need to install Magisk to recovery ramdisk, because your boot image contains no ramdisk. Magisk does support this, as you probably know. Go to this link and look under the heading "Magisk in Recovery"
https://topjohnwu.github.io/Magisk/install.html#magisk-in-recovery
My Moto G7 Play is SAR as well, and has no boot image ramdisk, so I have it rooted with Magisk installed to recovery. It's different indeed, but as of now, it's the only root solution for SAR devices with recovery ramdisk implementations like yours and mine. Magisk will actually "live" within the recovery partition and actually becomes hijacked by Magisk. As you will read in the link I sent, it is still possible to use recovery mode. You will need to get a stock recovery image from somebody with your variant who has pulled the image, or from a stock firmware package. In sum, you will be patching your recovery image, not your boot image. Accordingly, you will be flashing your /recovery partition to achieve root, not your /boot partition. As you know, as long as you are bootloader unlocked, you can flash the patched recovery image using fastboot. You will not need a TWRP for root. In the link I sent, also look for the previous heading "Patching Images." To test and make sure I'm 100% right on this, install the latest Magisk Manager app on your device and open the app. Look in the "Ramdisk" section. If it says NO, then I'm right and you must install Magisk to recovery as I've stated. If it says YES I'm wrong and you need to disregard this entire post.
But please let me know the status on things, and if you manage to get Magisk systemless root installed properly.

Anyone have a 100003562 boot.img or recovery.img for the MT8678WA
---------- Post added at 06:52 PM ---------- Previous post was at 06:45 PM ----------
I tried the recommended and it bricked I'm only able to use and now when the device boots it hangs at the logo screen or does anyone know Walmarts update software command.

(HELP NEEDED) Onn 8" gen 2, 100011885 no boot

So I didn't happen to back up my scatter or boot.img files when I used fastboot to try and flash the TWRP for the onn 10 inch, I was assuming it would work, but now I'm stuck with no recovery, no fastboot, no system, won't boot up when you hold the power button.
The only method of recovery I have is through MTK preloader and spflash, but I don't have the correct factory images or scatter file required to reflash stock. I've been looking everywhere online and can't find the right recovery files or any guides on how to recover from this.
Any help/files/advice would be greatly appreciated!!

Two things, I got access to my old account after a password reset
and, I got my tab back up and running, as well as root & xposed + gravitybox
I'm working on a guide as we speak.

Also, I will be dumping my firmware and adding the 10001885 to the list of stock image dumps on the main onn thread.

Hope this helps if still needing it, scatter file for the 100011885 mt8168 , good luck not responsible for anything lol i still cant get mine to work, anklosburner
Ankylo'sburner said:
So I didn't happen to back up my scatter or boot.img files when I used fastboot to try and flash the TWRP for the onn 10 inch, I was assuming it would work, but now I'm stuck with no recovery, no fastboot, no system, won't boot up when you hold the power button.
The only method of recovery I have is through MTK preloader and spflash, but I don't have the correct factory images or scatter file required to reflash stock. I've been looking everywhere online and can't find the right recovery files or any guides on how to recover from this.
Any help/files/advice would be greatly appreciated!!
Click to expand...
Click to collapse
hope this helps if you still need it for 100011885 mt8168 scatter file, but not responsible for any damages, because i still cant get mine to work, i had it to where it would come on, or i could see back light but thats it, which im impatient too, maybe it takes a min, but i did a readback on every downloadable item and flashed it but idk, let me know if you or how you get yours to work if you do

bbcdt22 said:
Hope this helps if still needing it, scatter file for the 100011885 mt8168 , good luck not responsible for anything lol i still cant get mine to work, anklosburner
hope this helps if you still need it for 100011885 mt8168 scatter file, but not responsible for any damages, because i still cant get mine to work, i had it to where it would come on, or i could see back light but thats it, which im impatient too, maybe it takes a min, but i did a readback on every downloadable item and flashed it but idk, let me know if you or how you get yours to work if you do
Click to expand...
Click to collapse

Hey, i've had that same issue but have since fixed it by flashing the rom to the 100011886. I used some of the posts here to flash both vbmeta.img and boot.img to gain root, with success https://drive.google.com/drive/folders/17LtLtjKg4JJU9EJdIXPsyNjen0H-ilMX?usp=sharing . i eventually went too far and currupted my rom and had a hard time finding the stock ROM. I found the stock ROM to the 100011886 and flashed that to fix the problem, now i run that as my system and it boots up just fine. https://www.mediafire.com/file/107jp6gwbiwq87q/MT8168_ONN_Gen2_100011886.zip/file
fastboot erase super
fastboot flash super super.img

Would you happen to have the preloader bin file for the MT8168? After digging around, you have helped me get closer to bringing my hard brick back to life.
Edit: @bbcdt22

onn. said:
Would you happen to have the preloader bin file for the MT8168? After digging around, you have helped me get closer to bringing my hard brick back to life.
Edit: @bbcdt22
Click to expand...
Click to collapse
I don't, but this thread may help:
[STOCK] Stock Backups/Images/OTAs
Since these tablets don't have an external online resource for downloading system updates, only a sketchy OTA app (com.adups.fota) I'm collecting a library of OTAs, as well as boot/recovery/system images. I have access to a 10.1 with keyboard...
forum.xda-developers.com
Any rom you come across has to be extracted in order to get any necessary files from it. The thread mentions using 7zip but I've personally had better results extracting using ZArchiver. Also, a workaround I've found very useful when dealing with extraction issues, is removing the extension from the file. If all else fails, you may need to erase the super partition and reflash THAT

KMerrimanJr said:
I don't, but this thread may help:
[STOCK] Stock Backups/Images/OTAs
Since these tablets don't have an external online resource for downloading system updates, only a sketchy OTA app (com.adups.fota) I'm collecting a library of OTAs, as well as boot/recovery/system images. I have access to a 10.1 with keyboard...
forum.xda-developers.com
Any rom you come across has to be extracted in order to get any necessary files from it. The thread mentions using 7zip but I've personally had better results extracting using ZArchiver. Also, a workaround I've found very useful when dealing with extraction issues, is removing the extension from the file. If all else fails, you may need to erase the super partition and reflash THAT
Click to expand...
Click to collapse
Thanks for the response. I'm at the end of that thread currently trying to see what I can find to fix my issue. Aside from buying another one from Walmart and trying to see if I can pull everything from a vanilla tablet, I'm not sure if I'll ever find the exact files.

onn. said:
Thanks for the response. I'm at the end of that thread currently trying to see what I can find to fix my issue. Aside from buying another one from Walmart and trying to see if I can pull everything from a vanilla tablet, I'm not sure if I'll ever find the exact files.
Click to expand...
Click to collapse
onn. said:
Thanks for the response. I'm at the end of that thread currently trying to see what I can find to fix my issue. Aside from buying another one from Walmart and trying to see if I can pull everything from a vanilla tablet, I'm not sure if I'll ever find the exact files.
Click to expand...
Click to collapse
When my tab crashed on me, flashing the super image solved my issue but it was a different rom. My tab's model number ended in 885 but the super file I flashed came from an 886, it still worked though

KMerrimanJr said:
When my tab crashed on me, flashing the super image solved my issue but it was a different rom. My tab's model number ended in 885 but the super file I flashed came from an 886, it still worked though
Click to expand...
Click to collapse
I wish I would have waited until I read this today instead of further messing with it yesterday. It looks like everything you have is what I need, but now I am battling trying to get the COM port to stay active when the device is plugged in. I'll tinker with it and see if I can get back to the state I had it in yesterday where it was staying connected.

KMerrimanJr said:
When my tab crashed on me, flashing the super image solved my issue but it was a different rom. My tab's model number ended in 885 but the super file I flashed came from an 886, it still worked though
Click to expand...
Click to collapse
Would you happen to know/remember all the settings you checked in SP Flash Tool (I assume you used that) when you flashed things to get it working? It seems that my PC is able to communicate with the device again, but I'm unsure of how to proceed next.

Have you installed all of the adb & mtk drivers? If so, you should be able to use adb to reboot into the boot loader then use fast boot to flash the super file

KMerrimanJr said:
Have you installed all of the adb & mtk drivers? If so, you should be able to use adb to reboot into the boot loader then use fast boot to flash the super file
Click to expand...
Click to collapse
It's hard bricked at the moment unfortunately, so there's no appearance of life to it. Attached picture is the error I get. https://www.gizmoadvices.com/list-sp-flash-tool-error-codes-solution-fix/ appears show info about the error, but it's not something I know how to fix yet.
The only way I can get the tablet to make moves in device manager (which I assume is a sign that the PC can at least partially recognize/see the device) is to click on Download in SPFT, connect tablet to PC via USB cord, and then hold down power button, which led to the error. Errors in SPFT I've received so far are 0xC0060001 and 0xC0060003.
When the tablet is active in the device manager, I assume that the device is in a powered state. However, when the device is grayed out, I assume it's in a powered off state (see other pic). I've yet to find away to actually flash anything to it.

KMerrimanJr said:
Have you installed all of the adb & mtk drivers? If so, you should be able to use adb to reboot into the boot loader then use fast boot to flash the super file
Click to expand...
Click to collapse
Also, apologies if I'm being a bother, but do you know what version of SPFT you used as well as which DA file?

bbcdt22 said:
Hope this helps if still needing it, scatter file for the 100011885 mt8168 , good luck not responsible for anything lol i still cant get mine to work, anklosburner
hope this helps if you still need it for 100011885 mt8168 scatter file, but not responsible for any damages, because i still cant get mine to work, i had it to where it would come on, or i could see back light but thats it, which im impatient too, maybe it takes a min, but i did a readback on every downloadable item and flashed it but idk, let me know if you or how you get yours to work if you do
Click to expand...
Click to collapse
where did you get this? did you dump it? if so how?

Onn 7" Model 100026191 TWRP Development

Alrighty... So I'm in the weeds here after going through three variants of the Samsung JPop (Which have bootloaders locked up like Fort Knox) and decided today to break down and dish out $59 for this bargain device. First thing I did upon getting it home was fastbooting it, and was able to unlock the bootloader with no issue. (So easy, a caveman could do it)
I've read just about every thread in here and though there seems to be TWRP support for quite a few models of the Onn tablets, I didn't see this one in here. Right now I have a throwaway laptop which is installing ubuntu for building TWRP for this device. Now, I have NEVER built TWRP. But I have plenty of free time, ambition, and am willing to learn. I have the basic guide to building TWRP open elsewhere. I will take whatever help I can get on doing this, big or small. Building a basic TWRP image should be easy enough, but the guides don't really go into device specific details (as expected), so this is where I could use some veteran help.
Device Specs:
Model: 100026191
Out-of-the-box Android Version: 11
Display: 7" 1024 x 600 Resolution
Processor: 2.0 GHz Quad-core CPU
RAM: 2GB
Cameras: 2MP front & back
USB: Type-C

Ubuntu just finished, and I am getting the build environment ready as we speak. Will keep this thread updated with progress and hickups that may occur along the way. Wish this noob some luck!!!!

Alrighty, so here's what I've been able to come up with as far as more detailed system information. Sorry for the late post, had trouble getting wifi working on ubuntu but got it going.
I suspected a MediaTek CPU and was eager to do a readback with SP Flash Tool, but as you can tell from the provided screenshots, it's actually a Cortex-A53 CPU. my goal here is to some how pull my stock recovery out of here. I thought about dd'ing it but someone in another thread advised against it. Does Onn have stock firmwares hidden away in the internet somewhere? Or is there another tool I can use to pull recovery?

Good evening guys and gals. New day, new opportunity. So i'm still stuck at pulling off boot and recovery from this tablet. I used
Code:
/adb shell cat /proc/mtd
to no avail. Permission denied just like with dd.
Today, I got the MTK droid tool and hooked the tablet to it and got these results. Still no scatter file, still no progress on pulling these partitions. (I apologize for my dumbness yesterday, this device is in fact MediaTek)

Alright. Eighty of you have clicked in this thread, zero of you show any motivation to do anything to contribute. You guys must hate this tablet because I went through this entire board, and each thread that even mentioned this model were left with no response. I just want the boot and recovery partitions off of the stock tablet. I am willing to do the rest. I said before, I'd take any help I could get but since this device is "so" insignificant, I'm not trying anything else on it.
I don't know if you guys dodge this device because it's Android 11, or what. But the least you veterans could do is either tell us it's not going to happen (given that you tried), or give us some other ideas we could try. Hell I'll paypal you enough for you to have the device in your hands in order to help. But that's where I stand. Moderator can lock this thread if he wishes. There's nothing else I can do for this device at the moment.

guess i'll return it to walmart
was hoping to root it easily with twrp
just gonna go grab the 8' if this is how it ended for the 7'
thanks for the help though!

I need a firmware for the 100026191

TWRPN00b said:
Alright. Eighty of you have clicked in this thread, zero of you show any motivation to do anything to contribute. You guys must hate this tablet because I went through this entire board, and each thread that even mentioned this model were left with no response. I just want the boot and recovery partitions off of the stock tablet. I am willing to do the rest. I said before, I'd take any help I could get but since this device is "so" insignificant, I'm not trying anything else on it.
I don't know if you guys dodge this device because it's Android 11, or what. But the least you veterans could do is either tell us it's not going to happen (given that you tried), or give us some other ideas we could try. Hell I'll paypal you enough for you to have the device in your hands in order to help. But that's where I stand. Moderator can lock this thread if he wishes. There's nothing else I can do for this device at the moment.
Click to expand...
Click to collapse
I have the boot and recovery images if you want them.
I unfortunately accidentally deleted the original boot image, but I have a magisk patched image still present.
I can walk you through the process of extracting the original if you would prefer that, it's quite simple, I just don't feel like buying a second Onn tablet at the moment.

Just note that if you want to extract the original boot image, do NOT flash the Magisk image, it will permanently erase the original boot image. There is another way, I can walk you through it.

PseudoDistant said:
I have the boot and recovery images if you want them.
I unfortunately accidentally deleted the original boot image, but I have a magisk patched image still present.
I can walk you through the process of extracting the original if you would prefer that, it's quite simple, I just don't feel like buying a second Onn tablet at the moment.
Click to expand...
Click to collapse
I oicked up one of the gen3 tablets. Do you think your way of pulling the boot image would work on it?

alarmdude9 said:
I oicked up one of the gen3 tablets. Do you think your way of pulling the boot image would work on it?
Click to expand...
Click to collapse
My way of pulling the images should work on any Android device that ships Android 8.0+, however if you got it brand new, don't update it.

Factory reset it if it downloaded an update, then disable OTA updates before enabling Wi-Fi.
You can run `adb logcat` while the update is downloading to find out where to download the OTA, and dump the boot partition from that.
From there, if you install Magisk, you can dump the recovery partition with `adb shell`.

PseudoDistant said:
Factory reset it if it downloaded an update, then disable OTA updates before enabling Wi-Fi.
You can run `adb logcat` while the update is downloading to find out where to download the OTA, and dump the boot partition from that.
From there, if you install Magisk, you can dump the recovery partition with `adb shell`.
Click to expand...
Click to collapse
Ok I will have to reset it then go from there. Do you have a guide on how to pull the image?

alarmdude9 said:
Ok I will have to reset it then go from there. Do you have a guide on how to pull the image?
Click to expand...
Click to collapse
When doing first time setup, don't connect to Wi-Fi.
Enable Developer Settings
Disable OTA Updates
Enable USB Debugging
Connect to Wi-Fi
Connect the device to your computer
Run `adb logcat > ota.txt`
Reenable OTA Updates
Go to Software Updates and start downloading the Android 12 update (If it's not the Android 12 update, disable OTA updates again after this one finishes installing, then try logcat again after rebooting)
Search for a link that looks like `https://android.googleapis.com/packages/ota-api/package/827ee737174e0e8f761bcaeb12738221a924c810.zip` in the logcat.
Put the update link in your browser, and download the zip file.
Extract the zip file
There's your boot.img, very conveniently.
The update link I have provided is for the 100074181, the 3rd gen Onn 7, if you happen to have that one then go ahead and just use my link.
Though update to Android 12 before actually using that boot.img with Magisk, it won't work with Android 11.

After you're done with that, and you're rooted.
`adb shell`
`su`
`dd if=/dev/block/by-name/recovery of=/storage/emulated/0/recovery.img`
Then connect your tablet to your PC and enable file transfer in USB settings, then just pull recovery.img out of your tablet and you have the recovery image.

PseudoDistant said:
When doing first time setup, don't connect to Wi-Fi.
Enable Developer Settings
Disable OTA Updates
Enable USB Debugging
Connect to Wi-Fi
Connect the device to your computer
Run `adb logcat > ota.txt`
Reenable OTA Updates
Go to Software Updates and start downloading the Android 12 update (If it's not the Android 12 update, disable OTA updates again after this one finishes installing, then try logcat again after rebooting)
Search for a link that looks like `https://android.googleapis.com/packages/ota-api/package/827ee737174e0e8f761bcaeb12738221a924c810.zip` in the logcat.
Put the update link in your browser, and download the zip file.
Extract the zip file
There's your boot.img, very conveniently.
The update link I have provided is for the 100074181, the 3rd gen Onn 7, if you happen to have that one then go ahead and just use my link.
Though update to Android 12 before actually using that boot.img with Magisk, it won't work with Android 11.
Click to expand...
Click to collapse
Awesome. Thank you so much I do appreciate it. Going to download the zip file because I have a 100071481. You sir are awesome!

alarmdude9 said:
Awesome. Thank you so much I do appreciate it. Going to download the zip file because I have a 100071481. You sir are awesome!
Click to expand...
Click to collapse
Update to Android 12 before using Magisk, just in case.

alarmdude9 said:
Awesome. Thank you so much I do appreciate it. Going to download the zip file because I have a 100071481. You sir are awesome!
Click to expand...
Click to collapse
Could you share the ota? This is the same model I'm using but its bricked rn

MoistSpoon said:
Could you share the ota? This is the same model I'm using but its bricked rn
Click to expand...
Click to collapse
I will look for it. Saved it to a USB drive and of course it decided to be stupid and it is repairing now. Slow going but as soon as it gets done I will look to see if it survived and if so I will get it uploaded.

MoistSpoon said:
Could you share the ota? This is the same model I'm using but its bricked rn
Click to expand...
Click to collapse
Sorry just noticed that the file that PseudoDistant posted is still good. I used this one....
https://forum.xda-developers.com/attachments/magisk_patched-25200_fvdeh-img.5794395/