MT6261 and MT6260 Source Code Discussion - Other SmartWatches

The Mediatek Source Code is very deep water especially the MT6260 and MT6261.
For editing Firmwares based on these chipsets there are many unknown secrets.
This thread should help to collect as many secrets as possible in one place.

NVRAM Settings in FullFlash
I need help to find out how to extract these infos from FullFlash?
Internal RAM:
Size = 0x0000D000 (52KB)
External RAM:
Type = SRAM
Size = 0x00400000 (4MB/32Mb)
NOR Flash:
Device ID = "[GigaDevice] GD25LQ64" (237)
Size = 0x00800000 (8MB/64Mb)

MT6261 and MT6260 Memory Mapping Table
I need to find out how to get the execution base adress in Fullflash of:
1. INTSRAM_CODE
2. INTSRAM_DATA
3. CACHED_EXTSRAM
4. IMAGE_BUFFER

You should check out this thread
https://r.tapatalk.com/shareLink?ur...share_tid=3289272&share_fid=3793&share_type=t
Sent from my BLA-L29 using Tapatalk

Does anybody here know how I should program this chipset??

rojeen said:
Does anybody here know how I should program this chipset??
Click to expand...
Click to collapse
Unless you know assembly, or enough C to reverse engineer stuff, dont bother

Related

[WIP] Open Bootloader Development for Archos Gen8

Hey geeks,
you might know my hardware hacking thread already:
http://forum.xda-developers.com/showthread.php?t=1199450
Some time ago i started thinking about starting with an open bootloader for Archos Gen8.
So i started from scratch and made use of external boot mode to completely start from external MicroSD and leave the internal memory alone.
Remark: This is a geek project, there's no GUI or something. So don't expect anything useful right now.
At the moment you'll need some hardware hacking, because you'll need a serial console over uart3.
Unfortunately you'll also need a dirty hack to power up the MicroSD permanently.
Don't hesitate to ask for details about it.
So this is for the weird ones out there...
Right now there's work in progress, because stock kernel stucks at some point in the boot process.
Maybe there's some setup missing in the bootcode (it's very basic at the moment) or stock kernel relies heavily on avboot at some point.
I will work on this issue whenever i'll find some time.
Anyway it might be still an interesting project for at least a very few of you, so here's the source code:
- x-loader-archos
- u-boot-2011.09-archos
As pointed out the Archos implementation is very basic at the moment, but the code itself works very well and had been tested on A101IT Gen8.
To further devices, e.g. A70S Gen8, the machine id had to be included in the board file, the rest of the setup in early stage should be very similar.
The code bases:
- x-loader (https://gitorious.org/x-loader/x-loader)
- u-boot (taken from this archive: http://www.technexion.com/images/downloads/ARM_CPU_Modules/TDM-3730/linux-2.6.32-tdm3730.tar.xz)
I'd like to switch to official u-boot release 2011.09 as a base soon.
To start playing with it:
- open your case and start hacking, to get serial console working
- tweak the hardware to power the MicroSD slot permanently
- create a bootable MicroSD for OMAP systems
- place the binaries on your card
- insert the card and use vitalifs kernel module to reboot your device in external bootmode
Please refer to these posts from vitalif (thanks a lot for contributing!!!):
http://forum.xda-developers.com/showpost.php?p=22719203&postcount=105
http://forum.xda-developers.com/showpost.php?p=22765441&postcount=108
You might start digging in the source code and create your own loader:
- use a linux machine with a recent distribution
- setup a cross environment with ARM cross compiler suitable for ARMV7
- extract the sources to directory of your choice
- to compile x-load:
Code:
cd ./x-loader-archos
make archos_config
make
- to compile u-boot-2011.09-archos:
Code:
cd ./u-boot-2011.09-archos
make a101it_config
make
It might be required to tweak the top-level Makefiles to point at your toolchain.
I used my ready to work toolchain (for 32-bit linux only) here:
http://forum.xda-developers.com/showthread.php?t=1328027
Unfortunately i haven't found some time to create a project page at gitorious,
but hopefully i'll manage to do so in the next weeks...
I know this is a very very special project, but anyway if there's some interest, this might lead to something useful in the end.
If the bootcode is working very nice some day, it might also be possible to replace stock loader, but that's fiction yet.
You might ask what for...
I say... it's just for fun!
cheers,
scholbert
Boot console output... so far
Hey,
it had been posted already but her again for completeness...
The console log on UART3 starting custom kernel configured with stock config:
Code:
Texas Instruments X-Loader 1.5.1 (Mar 26 2012 - 20:41:11)
Found 0256 MB
Archos Gen8
Reading boot sector
Loading u-boot.bin from mmc
Done!
U-Boot 2011.09 (Mar 23 2012 - 18:53:39)
OMAP3630/3730-GP ES1.2, CPU-OPP2, L3-165MHz, Max CPU Clock 1 Ghz
Archos 101IT Gen8 + LPDDR/MMC
I2C: ready
DRAM: 256 MiB
MMC: OMAP SD/MMC: 0
Using default environment
In: serial
Out: serial
Err: serial
Die ID #144800029ff800000160a4bb18027009
Hit any key to stop autoboot: 0
reading boot.scr
** Unable to read "boot.scr" from mmc 0:1 **
reading uImage
2987000 bytes read
Booting from mmc ...
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-2.6.29-omap1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2986936 Bytes = 2.8 MiB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux.............................................................
................................................................................
..................................................... done, booting the kernel.
<6>Initializing cgroup subsys cpu
<5>Linux version 2.6.29-omap1 ([email protected]) (gcc version 4.4.1 (GCC) ) #1
PREEMPT Thu Mar 22 23:59:34 CET 2012
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c5387f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Archos A101IT board
fixup_archos: [console=ttyS2,115200n8 androidboot.console=ttyGS0 init=/linuxrc d
ebug omapdss.debug=0 vram=4915200 omapfb.vram=0:4915200 omapfb.debug=0 mmc_block
.split=0.0001:512M]
Memory policy: ECC disabled, Data cache writeback
<7>On node 0 totalpages: 65536
<7>free_area_init_node: node 0, pgdat c05fd368, node_mem_map c06a5000
<7> Normal zone: 512 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 65024 pages, LIFO batch:15
<4>L2 CACHE is enabled in bootloader
<6>OMAP3630 ES1.2
<6>DIE ID: 144800029FF800000160A4BB18027009
<6>FEATURE_STATUS: 00000c00
<6>SRAM: Mapped pa 0x40200000 to va 0xfc800000 size: 0x100000
<6>Reserving 4915200 bytes SDRAM for VRAM
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
<5>Kernel command line: console=ttyS2,115200n8 androidboot.console=ttyGS0 init=/
linuxrc debug omapdss.debug=0 vram=4915200 omapfb.vram=0:4915200 omapfb.debug=0
mmc_block.split=0.0001:512M
<3>Unknown boot option `androidboot.console=ttyGS0': ignoring
<3>Unknown boot option `omapdss.debug=0': ignoring
<6>Clocking rate (Crystal/DPLL/ARM core): 26.0/332/600 MHz
BTW, i extracted the function from Archos loader setup up PLL and MPU stuff.
Need some time to extract the stock setup for PLL at early stage.
Maybe this will give some answers.
One of my next plans is, to build some kind of bare bone kernel (console only), which may be used for recovery and debug purpose.
Maybe this gives it a kick and things start up to a login shell
TBC
Have fun!
scholbert
One of my next plans is, to build some kind of bare bone kernel (console only), which may be used for recovery and debug purpose.
Maybe this gives it a kick and things start up to a login shell.
Click to expand...
Click to collapse
Seems like an internal monologue... but i like to point out that i stopped this project for a while.
So don't expect anything like a brick recovery tool or similar.
If others will join in it might be possible that it would led to something,
but as long as no one even starts hacking the hardware this is just for me...
Happy days!
scholbert
scholbert said:
Seems like an internal monologue... but i like to point out that i stopped this project for a while.
So don't expect anything like a brick recovery tool or similar.
If others will join in it might be possible that it would led to something,
but as long as no one even starts hacking the hardware this is just for me...
Happy days!
scholbert
Click to expand...
Click to collapse
Shame you stopped your efforts for now, I always followed your posts with much interest. However I can understand it is frustrating being on your own.
Thanks for what you did this far and for posting your info .
divx118
Sorry to read that, this was a very very interesting reading.
But I don't have the knowledge to make the necessary hardware hack, and above all, my wife would kill me if she saw me opening the tab
Thanks again for all that amazing information scholbert
Hey,
first off all thanks for your interest and your replies
Some words on your comments though...
divx118 said:
Shame you stopped your efforts for now, I always followed your posts with much interest. However I can understand it is frustrating being on your own.
Click to expand...
Click to collapse
I did not want to sound frustrated, because i'm not.
All i do with the device and all that hacking stuff is fun and mostly for educational purpose
Maybe i'll continue working with this stuff, but for now i wanted to point out to not expect too much.
Some guys out there, bricked their devices and were looking for a solution.
That's why i wrote it down.
Basically it should be possible to recover bricks by using external boot procedure, but it's still far from a simple solution.
grim-a101 said:
Sorry to read that, this was a very very interesting reading.
But I don't have the knowledge to make the necessary hardware hack, and above all, my wife would kill me if she saw me opening the tab
Click to expand...
Click to collapse
Yeah that's a good point, the barrier for this kind of hacking is little high.
Unfortunately you'll have to tweak the hardware, to gain access to the serial debugging port and cheat the power management of the MicroSD slot.
Most of you simply want to use the device and do some less harder tweaks at system level.
Anyway, there are some other possibilities as well (e.g. using USB and TI Flash) to access the platform. Maybe i'll do some research here as well.
Thanks again for appreciation!!!
Regards,
scholbert

[REF][R&D] Building Bootloaders on Qualcomm Devices

This is a research & development thread for building your own bootloaders on a
number of modern Qualcomm based devices, utilizing extracted partitions and
corresponding partition table information. We'll focus in particular on those
devices using the Snapdragon SoC/PoP chipset.
Code:
Thread difficulty: [B][COLOR=Red]Hard[/COLOR][/B]
Thread type: Development
Thread completeness: Fair
Building your own Bootloaders on Qualcomm Devices
Table of Content:
Introduction
Qualcomm/Intel HEX files
<WIP> QFIT (Qualcomm Factory Image Tools)
<WIP> The MBR Image
<TBD> BoToX (Bootloader Tool Box)
<WIP> Building for Windows Phone 8
<TBA> Compiling Bootloaders
<WIP> References
INTRODUCTION
All modern Qualcomm mobile chipsets contain some functionality for sideloading
binary code from an external source in case the normal boot procedure fails or
is interrupted by some other HW signal, like JTAG or other JIG debug
connection. In addition this side loading functionality is crucial for the
programming and formatting of additional memory devices like eMMC and SD cards
that are external to the processor and it's accompanying PoP memory. It is
also used by OEMs to revive soft-bricked devices and update the many
bootloaders used in the Qualcomm bootloader chain. However, all these features
and their various functionality are closely guarded secrets usually kept from
the public by very strict NDA for their company employees. Thus it has been
very difficult for the developer community to try to understand, use and
benefit from these most useful functions. Instead the dark side of mobile
phone community have made continuous profits in reversing the manufacturer
schemes by providing their own hacks and programs to offer mobile owners
various solutions for a charge, that is often out of proportion for what is
actually done. This is especially true for services requiring debricking by
various JIGs (such as the proprietary Anyway Jig and various JTAG solutions.)
All these solution rely on the possession of some inside information about the
device in question.
This thread is an attempt to alleviate this situation and allow anyone who
wishes, to freely flash and take charge of their own hardware, in the true
spirit of the XDA community. Here I will present information about how
Qualcomm put together their own bootloaders and how you could do the same, if
you only had the source code or talent to write your own or modify already
existing such. Although, there is one big hitch. Most new chipsets are using
a very secure authentication scheme (Secure Boot 3.0) to prevent
non-developers from flashing and using arbitrary boot code.
The information herein have been collected from older available Qualcomm tools
such as QPST and QXDM, and from pieces of their documents found around the
internet. Another important and challenging source have been the many Chinese
websites where people have managed to get some of this working and actually
bothered writing/blogging about it. Thank you China!
I will not go into details about the various bootloaders as they are already
covered elsewhere, for example, in this thread. I have also chosen to focus
primarily on the Qualcomm Snapdragon processor/modem SoC series, as they are
the most popular chips used in most mid- to upper-level smartphones today.
These devices typically include the MSM8x60 series consisting of the widely
popular MSM8660 and MSM8960 SoCs, currently found around the world. Another
highly relevant chipset is that of MSM8260A which is found in many Windows
Phone's, in particular in WP8.
...​REFERENCES
<WIP>​==================================================
If you find any errors or have any relevant additional information
that can be important for the correctness and content of this thread.
Please let me know by either posting here or sending me a PM.
Also, please do not ask any questions that is not of direct relevance
or help in the discussions in this thread . They will not be answered
and removed.
==================================================
​Enjoy!
Qualcomm/Intel HEX files
This is a text-based (ASCII) file format originally introduced by Intel to
distribute PROM code, that include error checking for redundancy. Today
Qualcomm use this file format to distribute their modem/processor boot code
used in downloading bootloaders in the OEM build-processes or for emergency
download modes etc. There are several dozens of variations on the HEX format,
so we will not go into the details of other formats or uses, but only for that
used in the Qualcomm bootchain.
To convert the Qualcomm provided Intel-HEX files into binaries, you can either
use the simple pre-compiled windows and linux binary hex2bin (src), or you can
compile the much more flexible and complete EPROM file-converter utilities of
srecord, which can handle many more HEX formats including hex-diffing and
hex-merging etc. One of the Qualcomm image build "toolkit" programs, the
"emmcswdownload.exe" already contain a hex-to-bin converter, but it is usually
appending more than one binary file as described in the required XML partition
file. For details about this see the next section about QFIT.
Next we jump right into describing the Qualcomm (aka Intel-32) HEX-file
format. The content of a typical HEX-file, let's say the MPRG8660.HEX are as
follows:
Code:
:020000042A00D0
:10000000D1DC4B843410D773FFFFFFFFFFFFFFFFEE
:10001000FFFFFFFF500000005000002A348802005C
:10002000348802008488022A000000008488022AA2
...
:108850001CAF012A000000005CC4012A8CC4012A5C
:1088600000000000FCBF012AFCC0012A04C0012A4C
:10887000BCC2012AC4C2012ACCC2012A00000000E5
:0488800000000000F4
:040000052A000000CD
:00000001FF
Let's break this down. First things to know are that:
Each line is a record.
Hexadecimal values are always in uppercase.
The sum of all the bytes in each record should be 00 (modulo 256).
So for example, a typical record can be broken down as:
Code:
[SIZE=2]
:[B][COLOR=DarkRed]10[/COLOR]0020[COLOR=Blue]00[/COLOR][/B][COLOR=Green]348802008488022A000000008488022A[/COLOR][COLOR=Red][B]A2[/B][/COLOR]
: 10 0020 00 348802008488022A000000008488022A A2[/SIZE] [SIZE=2]
| | | | ----------------+--------------- |
| | | | | +-- Checksum (1 byte)
| | | | +-------------------- Data (0-255 bytes, here 16)
| | | +--------------------------------------- Record type (1 byte)
| | +------------------------------------------- Address (2 bytes)
| +----------------------------------------------- Data Byte Count (1 byte, here 16)
+-------------------------------------------------- Start of record delimiter[/SIZE]
There are 6 record types defined (for Intel-32 HEX):
'00' = Data Record
'01' = End Of File (EOF) Record
'02' = Extended Segment Address Record
'03' = Start Segment Address Record
'04' = Extended Linear Address Record
'05' = Start Linear Address Record
But only 4 are used for Qualcomm processor/modem HEX-files:
00: Data Record
01: End Of File (EOF) Record
04: Extended Linear Address Record
05: Start Linear Address Record
Where "04" (Extended Linear Address Record) allow for 32 bit addressing (up to
4GiB). The address field is 0000, the byte count is 02. The two data bytes
(two hex digit pairs in big-endian order) represent the upper 16 bits of the
32 bit address for all subsequent 00 type records until the next 04 type
record comes. If there is not a 04 type record, the upper 16 bits default to
0000. To get the absolute address for subsequent 00 type records, the address
specified by the data field of the most recent 04 record is added to the 00
record addresses.
While the "05" (Start Linear Address Record), contain the address that is
loaded directly into the program counter (PC / R15) of the ARM processor. The
address field is 0000, the byte count is 04. The 4 data bytes represent the
32-bit value loaded into the register.
NOTE: The data field endianness may be byte-swapped.
Qualcomm use the following convention for naming their HEX boot-loader
"programmer" files. This is especially true when used in conjunction with
their emmcswdownload.exe. (See this section.)
yPRGxxxx.HEX
where "y" is one of the following:
Code:
[SIZE=2]N = NAND
A = NOR
M = eMMC
arm = Is used to bypass automatic selection by QPST by renaming a custom version to "armprg.hex"
flash = ??
[/SIZE]
<< Here Be More Dragons >>
<< Here Be Snap Dragons 2 >>
<< Here Be Snap Dragons 3 >>
<< Here Be Snap Dragons 4 >>
<< Here Be Snap Dragons 5 >>
<< Here Be Snap Dragons 6 >>
one more awesome guide from E:V:A
It would be cool if someone made a synalysis grammar for the hex codes E:V:A documented above.
For those of us hacking on our Mac OS X machines.
I'm closing this thread until I can actually fulfill my promises.
Sorry! Stay tuned.

[Q] Decrypt the userdata ?

Hi there,
I am actually trying to find a way to decrypt my phone (which was encrypted by a password, not a PIN code, which I set up, and I remember the password, no worries for that).
I actually have a root shell using adb, so I can dump everything on the phone.
My problems is that I don't really know how can I do it ?
I was thinking about a kind of brute-force in offline mode, to guess the secret password, but, the only tools I already found :
Edit: Sorry, i can't post the links, but :
Are both based on a PIN code, and I don't really know where I can find the required file (the footer, and the header), so it seems not working
Is someone already done that before, on a Galaxy S4 ?
Thanks in advance,
Regards,
4m0ni4c.
Ok, so i'm progressing !
Now I successfully found where is the major information I need to execute my script, i got :
Magic : 0xD0B5B1C5
Major Version : 1
Minor Version : 0
Footer Size : 216 bytes
Flags : 0x00000008
Key Size : 256 bits
Failed Decrypts: 0
Crypto Type : aes-cbc-essiv:sha256
Encrypted Key : 0x0000000000000000000000000000000000000000000000000000000000000000
Salt : 0x00000000000000000000000000000000
----------------
But because the Encrypted Key and the Salt seems not really good (Oh really ?) the next step is also not working well !
If someone have any idea why, I am not refusing any help ^^
Regards.

Dz09 smart watch mt6261 clone 32mb - having issues finding firmwares.

Hey everyone,
ok so i have a dz09 clone i bought off ebay, seller said it was real, obviously not lol. either a 32mb or 64mb im not sure.
i can flash the dz09 mt6261 v2.1 by gencho81 with flashtool 5.14 just fine and it works as it should however i am looking for a gt08(s) file or similar to flash onto the watch to change the look of the menus and such to the (round) icons .
I looked all morning and found tons of firmwares through the google drive you guys have provided but all of them have the flash error in the flash tool stating that the maui/moly doesnt match and it refuses to flash.
any help would be greatly appreciated.
Thanks
Matt
=============== Memory Detection Report ===============
Internal RAM:
Size = 0x0000D000 (52KB)
External RAM:
Type = SRAM
Size = 0x00400000 (4MB/32Mb)
NOR Flash:
Device ID = "[GigaDevice] GD25LQ64" (237)
Size = 0x00800000 (8MB/64Mb)
NAND Flash:
ERROR: NAND Flash was not detected!
============ RAM Test ============
Data Bus Test :
[D0][D1][D2][D3][D4][D5][D6][D7][D8][D9][D10][D11][D12][D13][D14][D15]
OK!
Address Bus Test :
[A1][A2][A3][A4][A5][A6][A7][A8][A9][A10][A11][A12][A13][A14][A15][A16][A17][A18][A19][A20][A21]
OK!
RAM Pattern Test :
Writing ...
0x44332211,
0xA5A5A5A5,
0xA5A5A500,
0xA500A500,
0xA5000000,
0x00000000,
0xFFFF0000,
0xFFFFFFFF,
OK!
Increment/Decrement Test :
Writing ...
OK!
=============== Memory Detection Report ===============
Internal RAM:
Size = 0x0000D000 (52KB)
External RAM:
Type = SRAM
Size = 0x00400000 (4MB/32Mb)
NOR Flash:
Device ID = "[GigaDevice] GD25LQ64" (237)
Size = 0x00800000 (8MB/64Mb)
NAND Flash:
ERROR: NAND Flash was not detected!
============ NOR Test ============
Address Bus Test(High Address Pins): [A22]
OK!
Pattern Test(0x5A5A):
(0x00008000),(0x00010000),(0x00018000),(0x00020000),(0x00028000),(0x00030000),(0x00038000),(0x00040000),(0x00048000),(0x00050000),(0x00058000),(0x00060000),(0x00068000),(0x00070000),(0x00078000),(0x00080000),(0x00088000),(0x00090000),(0x00098000),(0x000A0000),(0x000A8000),(0x000B0000),(0x000B8000),(0x000C0000),(0x000C8000),(0x000D0000),(0x000D8000),(0x000E0000),(0x000E8000),(0x000F0000),(0x000F8000),(0x00100000),(0x00108000),(0x00110000),(0x00118000),(0x00120000),(0x00128000),(0x00130000),(0x00138000),(0x00140000),(0x00148000),(0x00150000),(0x00158000),(0x00160000),(0x00168000),(0x00170000),(0x00178000),(0x00180000),(0x00188000),(0x00190000),(0x00198000),(0x001A0000),(0x001A8000),(0x001B0000),(0x001B8000),(0x001C0000),(0x001C8000),(0x001D0000),(0x001D8000),(0x001E0000),(0x001E8000),(0x001F0000),(0x001F8000),(0x00200000),(0x00208000),(0x00210000),(0x00218000),(0x00220000),(0x00228000),(0x00230000),(0x00238000),(0x00240000),(0x00248000),(0x00250000),(0x00258000),(0x00260000),(0x00268000),(0x00270000),(0x00278000),(0x00280000),(0x00288000),(0x00290000),(0x00298000),(0x002A0000),(0x002A8000),(0x002B0000),(0x002B8000),(0x002C0000),(0x002C8000),(0x002D0000),(0x002D8000),(0x002E0000),(0x002E8000),(0x002F0000),(0x002F8000),(0x00300000),(0x00308000),(0x00310000),(0x00318000),(0x00320000),(0x00328000),(0x00330000),(0x00338000),(0x00340000),(0x00348000),(0x00350000),(0x00358000),(0x00360000),(0x00368000),(0x00370000),(0x00378000),(0x00380000),(0x00388000),(0x00390000),(0x00398000),(0x003A0000),(0x003A8000),(0x003B0000),(0x003B8000),(0x003C0000),(0x003C8000),(0x003D0000),(0x003D8000),(0x003E0000),(0x003E8000),(0x003F0000),(0x003F8000),(0x00400000),(0x00408000),(0x00410000),(0x00418000),(0x00420000),(0x00428000),(0x00430000),(0x00438000),(0x00440000),(0x00448000),(0x00450000),(0x00458000),(0x00460000),(0x00468000),(0x00470000),(0x00478000),(0x00480000),(0x00488000),(0x00490000),(0x00498000),(0x004A0000),(0x004A8000),(0x004B0000),(0x004B8000),(0x004C0000),(0x004C8000),(0x004D0000),(0x004D8000),(0x004E0000),(0x004E8000),(0x004F0000),(0x004F8000),(0x00500000),(0x00508000),(0x00510000),(0x00518000),(0x00520000),(0x00528000),(0x00530000),(0x00538000),(0x00540000),(0x00548000),(0x00550000),(0x00558000),(0x00560000),(0x00568000),(0x00570000),(0x00578000),(0x00580000),(0x00588000),(0x00590000),(0x00598000),(0x005A0000),(0x005A8000),(0x005B0000),(0x005B8000),(0x005C0000),(0x005C8000),(0x005D0000),(0x005D8000),(0x005E0000),(0x005E8000),(0x005F0000),(0x005F8000),(0x00600000),(0x00608000),(0x00610000),(0x00618000),(0x00620000),(0x00628000),(0x00630000),(0x00638000),(0x00640000),(0x00648000),(0x00650000),(0x00658000),(0x00660000),(0x00668000),(0x00670000),(0x00678000),(0x00680000),(0x00688000),(0x00690000),(0x00698000),(0x006A0000),(0x006A8000),(0x006B0000),(0x006B8000),(0x006C0000),(0x006C8000),(0x006D0000),(0x006D8000),(0x006E0000),(0x006E8000),(0x006F0000),(0x006F8000),(0x00700000),(0x00708000),(0x00710000),(0x00718000),(0x00720000),(0x00728000),(0x00730000),(0x00738000),(0x00740000),(0x00748000),(0x00750000),(0x00758000),(0x00760000),(0x00768000),(0x00770000),(0x00778000),(0x00780000),(0x00788000),(0x00790000),(0x00798000),(0x007A0000),(0x007A8000),(0x007B0000),(0x007B8000),(0x007C0000),(0x007C8000),(0x007D0000),(0x007D8000),(0x007E0000),(0x007E8000),(0x007F0000),(0x007F8000),(0x00800000),
OK!
so i found out its 64mb, all the roms are doing reverse colors and touch, is this fixable?
How do you know its real or clone?
Stock ROM needed
I have wasted my watch by NOR Flash test before making a readback backup.
my watch is
version k93d-cob-dz09-IPS7789cpt-YLBA01-HSJ2-v05.06-20161215
branch 11c
umeox61d_bt_11c
build build_no
serial#:
build time
2016/12/15 9:58
mre version 3100
hal_verno
if any body have this ROM or watch, kindly share .
The only ROM so far worked is mati36 ROM
[
blur on bottom, and inverted colours. but every other thing is full ok (Touch, Call, etc)
please share if you have exact same verions as metioned above
neokleon said:
I have wasted my watch by NOR Flash test before making a readback backup.
my watch is
version k93d-cob-dz09-IPS7789cpt-YLBA01-HSJ2-v05.06-20161215
branch 11c
umeox61d_bt_11c
build build_no
serial#:
build time
2016/12/15 9:58
mre version 3100
hal_verno
if any body have this ROM or watch, kindly share .
The only ROM so far worked is mati36 ROM
[
blur on bottom, and inverted colours. but every other thing is full ok (Touch, Call, etc)
please share if you have exact same verions as metioned above
Click to expand...
Click to collapse
I don't know if you already solved it but you can try with some of these that are working for me:
http://www.needrom.com/download/smartwatch-dz09-working-touchscreen/
https://drive.google.com/drive/folders/0B_hRh3DjuBoeNl9tM3ZRc0pDeTQ
https://drive.google.com/drive/folders/0B_hRh3DjuBoeeGdhcEozRXNtbjQ
I also wanted a "custom rom" but at least after flash i could get a profiles setting i had not before and it was annoying cause it beeps so loud xD
I have one of these dz09 watches and the day I got it I had it connected to my phone and all was well then the battery died and now the damn thing won't charge or turn on at all? Any clue on how to fix it or maybe just need a new battery for it?
Sent from my Samsung SM-S327VL using XDA Labs
hello guys i bought this smart watch from gearbest i tried update rom but faild and i tried lotof roms just double screen or touchscreen not working please can some one send me a backup for this DZ09 MTK61d

Please help! Iradish X3 / X3 Vip Smart watch ROM

Hello friends!
I accidentally wiped my watch's original firmware while trying to make a readback form it (I have ruined the backup and deleted the stock ROM). It's a total brick now, thied every single ROM i have found here (32 MB ones) Touchscreen does not work on any of them :crying:
Please, if anybody has the Iradish X3 / X3 Vip Smart watch original ROM dump, please help and post it here - for me and for everyone else who might need it. It's a MTK6261a
Here is some data about the watch form the test I made in Flash tool:
=============== Memory Detection Report ===============
Internal RAM: Size = 0x0000D000 (52KB)
External RAM: Type = SRAM
Size = 0x00400000 (4MB/32Mb)
NOR Flash: Device ID = "[Winbond] SF_W25Q32JV" (275)
Size = 0x00400000 (4MB/32Mb)
NAND Flash: ERROR: NAND Flash was not detected!
============ NOR Test ============
Address Bus Test(High Address Pins):
OK!
Thank you!
I also need the firmware
scoderr,
I also accidentally removed the firmware trying to back it up. Could you please share it to me? I find that you've the firmware but on a Russian site from which file is not downloading. My watch currently dead, sharing firmware will help me a lot. Thanks in advance.
Chinese Smartwatch MTK-6261 - firmware
Hello, I had exactly the same problem with Touchscreen, I did not work with any software I downloaded from the Internet. Worked with software from another watch I read and downloaded. Here's a link I hope you can help: _ttps://mega.nz/#!aAtEgSxK!Yn9zMfh-Ez3NhJjSCbpeLlrPUFwaMVBFQpA3JT06j0w
[ drive.google.com / open?id=1HeYTwUUW9mAfLbVE2SAH4kM_Kq-VXJdY ]
firmware

Categories

Resources