Polaroid Link A6 Unlocked Smartphone

polaroid.a6.white.front

Random notes and tidbits about this device.

Polaroid Link A6 Specifications

Brand               Polaroid
Name                Link A6
Type                A6
Launch              2015

Body
Weight              136 g
Dimensions          165.1 x 83.8 x 7.7 mm
Colors              Black, White
SIM type            Mini SIM, Micro SIM

System
OS                  Android OS v4.4 (KitKat)
Chipset             Mediatek MT8312
CPU                 Dual-core 1.2 GHz Cortex-A7
GPU                 Mali-400 MP1

Display
Technology          IPS
Size                6 inches
Resolution          540 x 960 pixels
Multitouch          yes

Memory
RAM                 1 GB
Internal storage    8 GB
External storage    microSD

Camera
Front camera        2 MP
Rear camera         5 MP, 2560 x 1920 pixels
Flash               LED

Connectivity
GSM                 850 / 900 / 1800 / 1900
Network             2G / 3G / 4G
WLAN                Wi-Fi 802.11 b/g/n
Bluetooth           v4.0, A2DP
GPS                 A-GPS
NFC                 no
FM radio            no
USB                 microUSB 2.0
Audio               3.5 mm jack

Battery
Type                Li-Ion 2100 mAh

Features
Sensors             Accelerometer
Specials            Dual SIM
MTK Droid & Root Tools v2.53
 Hardware : MT6582 (MT8312 is Fake!)
 Model : A6
 Build number : A6_20151012
 Build date UTC : 20151012-031904
 Android  v : 4.4.2
 Baseband v: MOLY.WR8.W1315.MD.WG.MP.V54.P3, 2014/12/23 09:41
 Kernel v : 3.4.67 (jenkins@buildserver7) (gcc version 4.7 (GCC) ) #1 SMP  Mon Oct 12 10:15:46 CST 2015
shell@A6:/ $ cat /proc/cpuinfo
Processor       : ARMv7 Processor rev 3 (v7l)
processor       : 0
BogoMIPS        : 2590.72

processor       : 1
BogoMIPS        : 2590.72

Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 3

Hardware        : MT8312
Revision        : 0000
Serial          : 0000000000000000
root@A6:/ # cat /system/build.prop
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=KOT49H
ro.build.display.id=ALPS.KK1.MP1.V2.38
ro.build.version.incremental=vH80HG
ro.custom.build.version=vH80HG
ro.build.version.sdk=19
ro.build.version.codename=REL
ro.build.version.release=4.4.2
ro.build.date=Mon Oct 12 11:19:04 CST 2015
ro.build.date.utc=1444619944
ro.build.type=user
ro.build.user=jenkins
ro.build.host=buildserver7
ro.build.tags=release-keys
ro.product.model=q600
ro.product.brand=alps
ro.product.name=q600
ro.product.device=A6
ro.product.board=q600
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=alps
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=
# ro.build.product is obsolete; use ro.product.device
ro.build.product=q600
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=q600-user 4.4.2 KOT49H vH80HG release-keys
ro.build.fingerprint=Polaroid/A6/A6:4.4.2/KOT49H/1428031180:user/release-keys
ro.build.flavor=
ro.build.characteristics=phone
# end build properties

# begin mediatek build properties
ro.mediatek.version.release=ALPS.KK1.MP1.V2.38
ro.mediatek.platform=MT6582
ro.mediatek.chip_ver=S01
ro.mediatek.version.branch=KK1.MP1
ro.mediatek.version.sdk=2
# end mediatek build properties
#
# from out/target/product/q600/obj/CUSTGEN/config/system.prop
#
#
# system.prop for generic sdk
#

rild.libpath=/system/lib/mtk-ril.so
rild.libargs=-d /dev/ttyC0


# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }

# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}

# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}

#ro.sf.lcd_density=200

#add for input point
ro.sf.offset=8
#
wifi.tethering.interface=ap0
#

ro.opengles.version=131072

wifi.direct.interface=p2p0
dalvik.vm.heapgrowthlimit=128m
dalvik.vm.heapsize=256m

# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0

# Power off opt in IPO
sys.ipo.pwrdncap=2

# Switching Menu of Mass storage and MTP
ro.sys.usb.storage.type=mtp,mass_storage

# USB BICR function
ro.sys.usb.bicr=yes

# USB Charge only function
ro.sys.usb.charging.only=yes

# audio
ro.camera.sound.forced=0
ro.audio.silent=0

ro.zygote.preload.enable=0


ro.config.pppoe_enable=1

# yuhuan 20140901 add
ro.camera.full.preview=true

#
# ADDITIONAL_BUILD_PROPERTIES
#
persist.gemini.sim_num=2
ro.gemini.smart_sim_switch=false
ro.gemini.smart_3g_switch=1
ril.specific.sm_cause=0
bgw.current3gband=0
ril.external.md=0
ro.btstack=blueangel
ro.sf.hwrotation=0
ril.current.share_modem=2
launcherplus.allappsgrid=2d
curlockscreen=1
ro.mediatek.gemini_support=true
drm.service.enabled=true
fmradio.driver.enable=1
ril.first.md=1
ril.flightmode.poweroffMD=1
ril.telephony.mode=0
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
persist.mtk.anr.mechanism=1
mediatek.wlan.chip=mediatek.wlan.module.postfix=_
ril.radiooff.poweroffMD=0
ro.config.notification_sound=Proxima.ogg
ro.config.alarm_alert=Alarm_Beep_03.ogg
ro.config.ringtone=Backroad.ogg
persist.mtk.wcn.combo.chipid=-1
ro.fota.oem=MTK_KK
ro.fota.platform=MTK_KK
ro.fota.type=phone
ter.service.enable=0
mediatek.extmd.usbport=0
ro.lte.dc.support=0
ril.active.md=0
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=4.4_r6
ro.custom.modem=3GS2B2B4B5
persist.sys.dalvik.vm.lib=libdvm.so
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
shell@A6:/ $ getprop
[af.policy.r_submix_prio_adjust]: [0]
[bgw.current3gband]: [0]
[bluetooth.HostName]: [Polaroid]
[curlockscreen]: [1]
[dalvik.vm.heapgrowthlimit]: [128m]
[dalvik.vm.heapsize]: [256m]
[dalvik.vm.mtk-stack-trace-file]: [/data/anr/mtk_traces.txt]
[dalvik.vm.mtk-vm-version]: [0x01]
[dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
[debug.MB.running]: [0]
[debug.force_rtl]: [0]
[debug.hwc.compose_level]: [0]
[debug.hwui.render_dirty_regions]: [false]
[debug.libMali.patch]: [ALPS01627084]
[debug.log2sd.defaultpath]: [internal_sd]
[debug.mdlogger.Running]: [0]
[debug.mtklog.netlog.Running]: [0]
[debug.sf.busyswap]: [1]
[debug.st.aux_support]: [0]
[dev.bootcomplete]: [1]
[dhcp.ipv6.wlan0.dns1]: []
[dhcp.ipv6.wlan0.dns2]: []
[dhcp.ipv6.wlan0.ipaddress]: []
[dhcp.ipv6.wlan0.leasetime]: []
[dhcp.ipv6.wlan0.result]: []
[dhcp.wlan0.dns1]: [XXXXXXXXXXXXX]
[dhcp.wlan0.dns2]: []
[dhcp.wlan0.dns3]: []
[dhcp.wlan0.dns4]: []
[dhcp.wlan0.domain]: []
[dhcp.wlan0.gateway]: [XXXXXXXXXXXX]
[dhcp.wlan0.ipaddress]: [XXXXXXXXXX]
[dhcp.wlan0.leasetime]: [86400]
[dhcp.wlan0.mask]: [255.255.255.0]
[dhcp.wlan0.mtu]: []
[dhcp.wlan0.pid]: [942]
[dhcp.wlan0.reason]: [REBOOT]
[dhcp.wlan0.result]: [ok]
[dhcp.wlan0.server]: [XXXXXXXXXXX]
[dhcp.wlan0.vendorInfo]: []
[drm.service.enabled]: [true]
[external_sd_path]: [/storage/sdcard1]
[fmradio.driver.enable]: [1]
[gsm.3gswitch]: [1]
[gsm.baseband.capability2]: [3]
[gsm.baseband.capability]: [55]
[gsm.current.phone-type]: [1]
[gsm.gcf.testmode]: [0]
[gsm.network.type]: [unknown]
[gsm.operator.alpha.2]: []
[gsm.operator.alpha]: []
[gsm.operator.iso-country.2]: []
[gsm.operator.iso-country]: []
[gsm.operator.isroaming.2]: [false]
[gsm.operator.isroaming]: [false]
[gsm.operator.numeric.2]: []
[gsm.operator.numeric]: []
[gsm.phone.created]: [true]
[gsm.project.baseband.2]: [TOPWISE82_TB_2_KK_HSPA_HW(DEFAULT)]
[gsm.project.baseband]: [TOPWISE82_TB_2_KK_HSPA_HW(DEFAULT)]
[gsm.ril.eboot]: [-1]
[gsm.ril.uicctype.2]: []
[gsm.ril.uicctype]: []
[gsm.roaming.indicator.needed.2]: [false]
[gsm.roaming.indicator.needed]: [false]
[gsm.serial]: [XXXXXXXXXXXXXXXX]
[gsm.sim.inserted]: [0]
[gsm.sim.operator.default-name.2]: []
[gsm.sim.operator.default-name]: []
[gsm.sim.retry.pin1.2]: []
[gsm.sim.retry.pin1]: []
[gsm.sim.retry.pin2.2]: []
[gsm.sim.retry.pin2]: []
[gsm.sim.retry.puk1.2]: []
[gsm.sim.retry.puk1]: []
[gsm.sim.retry.puk2.2]: []
[gsm.sim.retry.puk2]: []
[gsm.sim.ril.phbready.2]: [true]
[gsm.sim.ril.phbready]: [false]
[gsm.sim.state.2]: [ABSENT]
[gsm.sim.state]: [ABSENT]
[gsm.siminfo.ready]: [true]
[gsm.version.baseband]: [MOLY.WR8.W1315.MD.WG.MP.V54.P3, 2014/12/23 09:41]
[gsm.version.ril-impl]: [mtk gemini ril 1.0]
[init.svc.DMAgent]: [running]
[init.svc.GoogleOtaAgent]: [running]
[init.svc.MtkCodecService]: [running]
[init.svc.NvRAMAgent]: [running]
[init.svc.PPLAgent]: [running]
[init.svc.aal]: [running]
[init.svc.adbd]: [running]
[init.svc.agpsd]: [running]
[init.svc.batterywarning]: [running]
[init.svc.bootanim]: [stopped]
[init.svc.bootlogoupdater]: [stopped]
[init.svc.ccci_fsd]: [running]
[init.svc.ccci_mdinit]: [running]
[init.svc.chmod_media]: [stopped]
[init.svc.conn_launcher]: [running]
[init.svc.debuggerd]: [running]
[init.svc.dhcpcd_wlan0]: [running]
[init.svc.drm]: [running]
[init.svc.drvbd]: [running]
[init.svc.emsvr_user]: [running]
[init.svc.enableswap]: [stopped]
[init.svc.flash_recovery]: [stopped]
[init.svc.fotabinder]: [running]
[init.svc.gsm0710muxd]: [running]
[init.svc.healthd]: [running]
[init.svc.installd]: [running]
[init.svc.keystore]: [running]
[init.svc.matv]: [running]
[init.svc.mdlogger]: [running]
[init.svc.media]: [running]
[init.svc.mobile_log_d]: [running]
[init.svc.msensord]: [stopped]
[init.svc.mtkbt]: [running]
[init.svc.netd]: [running]
[init.svc.netdiag]: [running]
[init.svc.nvram_daemon]: [stopped]
[init.svc.p2p_supplicant]: [running]
[init.svc.poad]: [stopped]
[init.svc.pq]: [stopped]
[init.svc.readsn]: [stopped]
[init.svc.ril-daemon]: [running]
[init.svc.sbchk]: [stopped]
[init.svc.sdcard]: [running]
[init.svc.servicemanager]: [running]
[init.svc.setusbmsg]: [stopped]
[init.svc.sn]: [stopped]
[init.svc.surfaceflinger]: [running]
[init.svc.terservice]: [stopped]
[init.svc.thermal]: [running]
[init.svc.thermal_manager]: [stopped]
[init.svc.thermald]: [running]
[init.svc.ueventd]: [running]
[init.svc.vold]: [running]
[init.svc.vtservice]: [running]
[init.svc.wlanLoader]: [stopped]
[init.svc.wmtLoader]: [stopped]
[init.svc.xlogboot]: [stopped]
[init.svc.xlogdebugchanged]: [stopped]
[init.svc.zygote]: [running]
[internal_sd_path]: [/storage/sdcard0]
[launcherplus.allappsgrid]: [2d]
[media.wfd.video-format]: [5]
[mediatek.extmd.usbport]: [0]
[mediatek.wlan.chip]: [mediatek.wlan.module.postfix=_]
[mediatek.wlan.ctia]: [0]
[mtk_wifi.fw_path]: [STA]
[mux.report.case]: [0]
[net.bt.name]: [Android]
[net.change]: [net.dns2]
[net.dns1]: [XXXXXXXXXXXX]
[net.dns2]: [XXXXXXXXXXXX]
[net.hostname]: [XXXXXXXXXXXX]
[net.qtaguid_enabled]: [1]
[net.tcp.buffersize.default]: [4096,87380,524288,4096,16384,524288]
[net.tcp.buffersize.edge]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.gprs]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.hsdpa]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.hspa]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.hspap]: [4094,87380,1220608,4096,16384,1220608]
[net.tcp.buffersize.hsupa]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.lte]: [524288,1048576,2560000,262144,524288,1048576]
[net.tcp.buffersize.umts]: [4094,87380,524288,4096,16384,524288]
[net.tcp.buffersize.wifi]: [524288,1048576,2097152,262144,524288,1048576]
[nvram_init]: [Ready]
[persist.bt.fwdump]: [0]
[persist.first_boot]: [0]
[persist.gemini.sim_num]: [2]
[persist.mtk.aee.aed]: [on]
[persist.mtk.anr.mechanism]: [1]
[persist.mtk.wcn.combo.chipid]: [0x6582]
[persist.radio.default_sim]: [0]
[persist.radio.default_sim_mode]: [20]
[persist.ril.cfu.querytype]: []
[persist.service.acm.enable]: []
[persist.service.adb.enable]: []
[persist.sys.country]: [US]
[persist.sys.dalvik.vm.lib]: [libdvm.so]
[persist.sys.first_time_boot]: [false]
[persist.sys.language]: [en]
[persist.sys.mute.state]: [2]
[persist.sys.profiler_ms]: [0]
[persist.sys.sd.defaultpath]: [/storage/emulated/0]
[persist.sys.timezone]: [America/New_York]
[persist.sys.usb.config]: [mtp,adb]
[ril.active.md]: [0]
[ril.current.share_modem]: [2]
[ril.ecclist2]: []
[ril.ecclist]: []
[ril.external.md]: [0]
[ril.first.md]: [1]
[ril.flightmode.poweroffMD]: [1]
[ril.iccid.sim1]: [N/A]
[ril.iccid.sim2]: [N/A]
[ril.radiooff.poweroffMD]: [0]
[ril.ready.sim]: [false]
[ril.specific.sm_cause]: [0]
[ril.telephony.mode]: [0]
[rild.libargs]: [-d /dev/ttyC0]
[rild.libpath]: [/system/lib/mtk-ril.so]
[ro.adb.secure]: [1]
[ro.allow.mock.location]: [0]
[ro.audio.silent]: [0]
[ro.baseband]: [unknown]
[ro.board.platform]: []
[ro.boot.serialno]: [XXXXXXXXXXX]
[ro.bootloader]: [unknown]
[ro.bootmode]: [unknown]
[ro.btstack]: [blueangel]
[ro.build.characteristics]: [phone]
[ro.build.date.utc]: [1444619944]
[ro.build.date]: [Mon Oct 12 11:19:04 CST 2015]
[ro.build.description]: [A6-user 4.4.2 KOT49H vH80HG release-keys]
[ro.build.display.id]: [A6_20151012]
[ro.build.fingerprint]: [Polaroid/A6/A6:4.4.2/KOT49H/1428031180:user/release-keys]
[ro.build.flavor]: []
[ro.build.host]: [buildserver7]
[ro.build.id]: [KOT49H]
[ro.build.product]: [A6]
[ro.build.tags]: [release-keys]
[ro.build.type]: [user]
[ro.build.user]: [jenkins]
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [vH80HG]
[ro.build.version.release]: [4.4.2]
[ro.build.version.sdk]: [19]
[ro.camera.full.preview]: [true]
[ro.camera.sound.forced]: [0]
[ro.com.google.clientidbase]: [android-polaroid]
[ro.com.google.gmsversion]: [4.4_r6]
[ro.config.alarm_alert]: [Alarm_Beep_03.ogg]
[ro.config.low_ram]: [false]
[ro.config.notification_sound]: [Proxima.ogg]
[ro.config.pppoe_enable]: [1]
[ro.config.ringtone]: [Backroad.ogg]
[ro.crypto.fs_flags]: [0x00000406]
[ro.crypto.fs_mnt_point]: [/data]
[ro.crypto.fs_options]: [noauto_da_alloc,discard]
[ro.crypto.fs_real_blkdev]: [/emmc@usrdata]
[ro.crypto.fs_type]: [ext4]
[ro.crypto.fuse_sdcard]: [true]
[ro.crypto.state]: [unencrypted]
[ro.custom.build.version]: [vH80HG]
[ro.custom.hide_software_updates]: [true]
[ro.custom.modem]: [XXXXXXXXXX]
[ro.custom.product.device]: [Q600-8382]
[ro.custom.screen_off_timeout]: [120000]
[ro.debuggable]: [0]
[ro.factorytest]: [0]
[ro.fota.oem]: [MTK_KK]
[ro.fota.platform]: [MTK_KK]
[ro.fota.type]: [phone]
[ro.gemini.smart_3g_switch]: [1]
[ro.gemini.smart_sim_switch]: [false]
[ro.hardware]: [mt8312]
[ro.lte.dc.support]: [0]
[ro.mediatek.chip_ver]: [S01]
[ro.mediatek.gemini_support]: [true]
[ro.mediatek.platform]: [MT6582]
[ro.mediatek.version.branch]: [KK1.MP1]
[ro.mediatek.version.release]: [ALPS.KK1.MP1.V2.38]
[ro.mediatek.version.sdk]: [2]
[ro.mediatek.wlan.p2p]: [1]
[ro.mediatek.wlan.wsc]: [1]
[ro.mount.fs]: [EXT4]
[ro.mtk.hardware]: [mt6582]
[ro.mtprof.disable]: [1]
[ro.opengles.version]: [131072]
[ro.persist.partition.support]: [no]
[ro.product.board]: [A6]
[ro.product.brand]: [Polaroid]
[ro.product.cpu.abi2]: [armeabi]
[ro.product.cpu.abi]: [armeabi-v7a]
[ro.product.device]: [A6]
[ro.product.locale.language]: [en]
[ro.product.locale.region]: [US]
[ro.product.manufacturer]: [Southern Telecom]
[ro.product.model]: [A6]
[ro.product.name]: [A6]
[ro.revision]: [0]
[ro.runtime.firstboot]: [1464292803813]
[ro.secure]: [1]
[ro.serialno]: [XXXXXXXXXXXXXXXXXXX]
[ro.setupwizard.mode]: [OPTIONAL]
[ro.sf.hwrotation]: [0]
[ro.sf.lcd_density]: [240]
[ro.sf.offset]: [8]
[ro.sys.usb.bicr]: [yes]
[ro.sys.usb.charging.only]: [yes]
[ro.sys.usb.mtp.whql.enable]: [0]
[ro.sys.usb.storage.type]: [mtp,mass_storage]
[ro.wifi.channels]: []
[ro.zygote.preload.enable]: [0]
[service.bootanim.exit]: [1]
[service.sf.status]: [1]
[supolicy.loaded]: [1]
[sys.boot.reason]: [0]
[sys.boot_completed]: [1]
[sys.ipo.pwrdncap]: [2]
[sys.ipowin.done]: [1]
[sys.settings_secure_version]: [2]
[sys.sysctl.extra_free_kbytes]: [6075]
[sys.usb.config]: [mtp,adb]
[sys.usb.mtpConnect]: [mtpConnection]
[sys.usb.state]: [mtp,adb]
[sys.usb.vid]: [0BB4]
[ter.service.enable]: [0]
[vold.post_fs_data_done]: [1]
[vold_swap_state]: [0]
[wifi.direct.interface]: [p2p0]
[wifi.interface]: [wlan0]
[wifi.tethering.interface]: [ap0]
[wlan.driver.status]: [ok]
[wlan.wfd.security.image]: [1]
shell@A6:/ $ df
Filesystem               Size     Used     Free   Blksize
/dev                   482.0M   128.0K   481.9M   4096
/sys/fs/cgroup         482.0M    12.0K   482.0M   4096
/mnt/secure            482.0M     0.0K   482.0M   4096
/mnt/asec              482.0M     0.0K   482.0M   4096
/mnt/obb               482.0M     0.0K   482.0M   4096
/mnt/media_rw          482.0M     0.0K   482.0M   4096
/storage/usbotg        482.0M     0.0K   482.0M   4096
/storage/emulated      482.0M     0.0K   482.0M   4096
/custom                295.3M   171.0M   124.3M   4096
/system                885.8M   840.3M    45.5M   4096
/data                    5.8G   353.3M     5.5G   4096
/cache                 123.0M     4.1M   119.0M   4096
/protect_f               8.8M     4.1M     4.8M   4096
/protect_s               8.8M     4.0M     4.8M   4096
/mnt/cd-rom             18.4M    18.4M     0.0K   2048
/mnt/shell/emulated      5.8G   353.3M     5.4G   4096
shell@A6:/ $ cat /proc/partitions
major minor  #blocks  name

   7        0      18834 loop0
 253        0     524288 zram0
 179        0    7601664 mmcblk0
 179        1          1 mmcblk0p1
 179        2      10240 mmcblk0p2
 179        3      10240 mmcblk0p3
 179        4       6144 mmcblk0p4
 179        5     307200 mmcblk0p5
 179        6     921600 mmcblk0p6
 179        7     129024 mmcblk0p7
 179        8    6180864 mmcblk0p8
 179       64       4096 mmcblk0boot1
 179       32       4096 mmcblk0boot0
root@A6:/ # cat /proc/emmc
partno:    start_sect   nr_sects  partition_name
emmc_p1: 00000400 00000002 "ebr1"
emmc_p2: 00004800 00005000 "protect_f"
emmc_p3: 00009800 00005000 "protect_s"
emmc_p4: 00014c00 00003000 "sec_ro"
emmc_p5: 00019c00 00096000 "custom"
emmc_p6: 000b4c00 001c2000 "android"
emmc_p7: 00276c00 0003f000 "cache"
emmc_p8: 002b5c00 00bca000 "usrdata"
root@A6:/dev/block/platform/mtk-msdc.0 # ls -la
drwxr-xr-x root     root              2009-12-31 19:21 by-num
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0 -> /dev/block/mmcblk0
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0boot0 -> /dev/block/mmcblk0boot0
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0boot1 -> /dev/block/mmcblk0boot1
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p2 -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p3 -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p4 -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p5 -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p6 -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p7 -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              2009-12-31 19:21 mmcblk0p8 -> /dev/block/mmcblk0p8fff
shell@A6:/dev/block/platform/mtk-msdc.0 $ cat /proc/dumchar_info
Part_Name       Size    StartAddr       Type    MapTo
preloader    0x0000000001400000   0x0000000000000000   2   /dev/misc-sd
mbr          0x0000000000080000   0x0000000000000000   2   /dev/block/mmcblk0
ebr1         0x0000000000080000   0x0000000000080000   2   /dev/block/mmcblk0p1
pro_info     0x0000000000300000   0x0000000000100000   2   /dev/block/mmcblk0
nvram        0x0000000000500000   0x0000000000400000   2   /dev/block/mmcblk0
protect_f    0x0000000000a00000   0x0000000000900000   2   /dev/block/mmcblk0p2
protect_s    0x0000000000a00000   0x0000000001300000   2   /dev/block/mmcblk0p3
seccfg       0x0000000000020000   0x0000000001d00000   2   /dev/block/mmcblk0
uboot        0x0000000000060000   0x0000000001d20000   2   /dev/block/mmcblk0
bootimg      0x0000000000600000   0x0000000001d80000   2   /dev/block/mmcblk0
recovery     0x0000000000600000   0x0000000002380000   2   /dev/block/mmcblk0
sec_ro       0x0000000000600000   0x0000000002980000   2   /dev/block/mmcblk0p4
misc         0x0000000000080000   0x0000000002f80000   2   /dev/block/mmcblk0
logo         0x0000000000300000   0x0000000003000000   2   /dev/block/mmcblk0
ebr2         0x0000000000080000   0x0000000003300000   2   /dev/block/mmcblk0
custom       0x0000000012c00000   0x0000000003380000   2   /dev/block/mmcblk0p5
expdb        0x0000000000a00000   0x0000000015f80000   2   /dev/block/mmcblk0
android      0x0000000038400000   0x0000000016980000   2   /dev/block/mmcblk0p6
cache        0x0000000007e00000   0x000000004ed80000   2   /dev/block/mmcblk0p7
usrdata      0x0000000179400000   0x0000000056b80000   2   /dev/block/mmcblk0p8
bmtpool      0x0000000001500000   0x00000000febf00a8   2   /dev/block/mmcblk0
Part_Name:Partition name you should open;
Size:size of partition
StartAddr:Start Address of partition;
Type:Type of partition(MTD=1,EMMC=2)
MapTo:actual device you operate
shell@A6:/ $ mount
rootfs / rootfs ro,seclabel,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/secure tmpfs rw,seclabel,relatime,mode=700 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
tmpfs /mnt/media_rw tmpfs rw,seclabel,relatime,mode=755,uid=1000,gid=1000 0 0
tmpfs /storage/usbotg tmpfs rw,seclabel,relatime,mode=755,uid=1000,gid=1000 0 0
tmpfs /storage/emulated tmpfs rw,seclabel,relatime,mode=755,uid=1023,gid=1023 0 0
emmc@custom /custom ext4 ro,seclabel,noatime,noauto_da_alloc,commit=1,data=ordered 0 0
/emmc@android /system ext4 ro,seclabel,noatime,noauto_da_alloc,commit=1,data=ordered 0 0
/emmc@usrdata /data ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/emmc@cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/emmc@protect_f /protect_f ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/emmc@protect_s /protect_s ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/dev/block/loop0 /mnt/cd-rom iso9660 ro,relatime 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
root@A6:/ # cat /proc/cmdline
console=ttyMT0,921600n1 vmalloc=496M slub_max_order=0 lcm=1-p600_rm68191_qhd_dsi_vdo fps=5194 bootprof.pl_t=405 bootprof.lk_t=1481 hw_info=XXXXXXXXXXXXX printk.disable_uart=1 boot_reason=0
fastboot getvar all
(bootloader)    partition-size:userdata: 32000000
(bootloader)    partition-type:userdata: ext4
(bootloader)    partition-size:cache: 7e00000
(bootloader)    partition-type:cache: ext4
(bootloader)    partition-size:system: 38400000
(bootloader)    partition-type:system: ext4
(bootloader)    partition-size:expdb: a00000
(bootloader)    partition-type:expdb: raw data
(bootloader)    partition-size:custom: 12c00000
(bootloader)    partition-type:custom: ext4
(bootloader)    partition-size:ebr2: 80000
(bootloader)    partition-type:ebr2: raw data
(bootloader)    partition-size:logo: 300000
(bootloader)    partition-type:logo: raw data
(bootloader)    partition-size:misc: 80000
(bootloader)    partition-type:misc: raw data
(bootloader)    partition-size:sec_ro: 600000
(bootloader)    partition-type:sec_ro: ext4
(bootloader)    partition-size:recovery: 600000
(bootloader)    partition-type:recovery: raw data
(bootloader)    partition-size:boot: 600000
(bootloader)    partition-type:boot: raw data
(bootloader)    partition-size:uboot: 60000
(bootloader)    partition-type:uboot: raw data
(bootloader)    partition-size:seccfg: 20000
(bootloader)    partition-type:seccfg: raw data
(bootloader)    partition-size:protect_s: a00000
(bootloader)    partition-type:protect_s: ext4
(bootloader)    partition-size:protect_f: a00000
(bootloader)    partition-type:protect_f: ext4
(bootloader)    partition-size:nvram: 500000
(bootloader)    partition-type:nvram: raw data
(bootloader)    partition-size:pro_info: 300000
(bootloader)    partition-type:pro_info: raw data
(bootloader)    partition-size:ebr1: 80000
(bootloader)    partition-type:ebr1: raw data
(bootloader)    partition-size:mbr: 80000
(bootloader)    partition-type:mbr: raw data
(bootloader)    partition-size:preloader: 1400000
(bootloader)    partition-type:preloader: raw data
(bootloader)    kernel: lk
(bootloader)    product: Q600
(bootloader)    version: 0.5
all: Done!!
finished. total time: 0.150s

Fastboot does not support some common commands.  The following does not work as intended:

fastboot recovery image.img
fastboot boot image.img

fastboot flash recovery recovery.img
sending 'recovery' (6144 KB)...
OKAY [  0.233s]
writing 'recovery'...
FAILED (remote:
partition 'recovery' not support flash)
finished. total time: 0.247s

Mediatek devices add a specific header to their ramdisk/kernel so you’ll need to find a tool that can handle these images or strip/add the header manually.

Most drivers were installed automatically on windows 7 but you may need to find and install some yourself.  You will definitely need the Mediatek usb vcom drivers for different things.

Enable developer tools

  • Settings on device
  • About phone
  • Tap build number 7 times
  • You are now developer popup
  • Go back
  • Now have developer options
  • Usb debugging enable
  • Verify apps over usb disable

Root

I normally create an insecure boot image for the device, boot that and start pushing the required tools to the device using adb.  This device does not allow the booting of images via fastboot ie. fastboot boot boot.img.

You can create this insecure image and flash it directly to the device ie. fastboot flash boot boot.img but there is an even easier way thanks to an exploit.

You can run this directly or put it in a shell/batch file.

     adb shell "getprop ro.secure 1"
     adb shell "setprop ro.secure 0"
     adb shell "getprop ro.secure 0"
     adb shell "exit"
     adb shell "setprop ro.debuggable 0"
     adb shell "getprop ro.debuggable 0"
     adb shell "exit"
     adb usb

The device will usually hang so press ctrl-c, disconnect the usb cable to the device, reconnect the cable and upon issuing an adb shell command you will have root.  Scary.

Now you can push the required files to the device for root access.

You’ll need to source the files from the supersu zip, I was currently using UPDATE-SuperSU-v2.65-20151226141550.zip.  Busybox can be found elsewhere.

I must note that su/supersu has changed quite a bit since I was doing this on older different devices.  You used to be able to simply push su to the device and that was it.  Not anymore, you must push many more files along with their attributes now.

     adb shell "mount -o rw,remount -t ext4 /dev/block/mmcblk0p8 /system"

     adb shell mkdir /system/bin/.ext >null
     adb shell mkdir /system/etc/init.d >null

     adb push supersu_manual/armv7/su /system/xbin/daemonsu
     adb push supersu_manual/armv7/su /system/xbin/su
     adb push supersu_manual/armv7/su /system/bin/.ext/.su
     adb push supersu_manual/common/Superuser.apk /system/app/Superuser.apk
     adb push supersu_manual/common/install-recovery.sh /system/etc/install-recovery.sh
     adb push supersu_manual/common/99SuperSUDaemon /system/etc/init.d/99SuperSUDaemon
     adb push busybox /system/xbin/busybox

     adb shell /system/xbin/busybox touch /system/etc/.installed_su_daemon

     adb shell chown root.root /system/bin/.ext
     adb shell chown root.root /system/bin/.ext/.su
     adb shell chown root.root /system/xbin/su
     adb shell chown root.root /system/xbin/daemonsu
     adb shell chown root.root /system/etc/install-recovery.sh
     adb shell chown root.root /system/etc/init.d/99SuperSUDaemon
     adb shell chown root.root /system/etc/.installed_su_daemon
     adb shell chown root.root /system/app/Superuser.apk
     adb shell chown root.root /system/xbin/busybox

     adb shell chmod 0777 /system/bin/.ext
     adb shell chmod 06755 /system/bin/.ext/.su
     adb shell chmod 06755 /system/xbin/su
     adb shell chmod 0755 /system/xbin/daemonsu
     adb shell chmod 0755 /system/etc/install-recovery.sh
     adb shell chmod 0755 /system/etc/init.d/99SuperSUDaemon
     adb shell chmod 0644 /system/etc/.installed_su_daemon
     adb shell chmod 0644 /system/app/Superuser.apk
     adb shell chmod 0755 /system/xbin/busybox

     adb shell /system/xbin/su --install

     adb shell "mount -o ro,remount -t ext4 /dev/block/mmcblk0p8 /system"

Reboot the device and you should have root access.

Build an insecure boot.img (information)

  • Unpack the boot.img with a tool of your choice
  • Modify the build.prop
  • ro.adb.secure=0
  • ro.secure=0
  • ro.debuggable=1
  • Repack the image

Flash the device (information)

adb reboot bootloader
fastboot flash boot boot-new.img
fastboot reboot

MTK Droid & Root Tools

This tool seems to be the go to tool for most people.  Once you run into issues the information is pretty sparse or downright incorrect.  Some operations are quite useful such as the scatter creation and splitting up images.

Create a scatter file.  The scatter file defines the regions of the flash of your device.  You will need this so you know which portion you want to read/write.

  • Under phone information click on the blocks map
  • Create scatter file
  • Make full image in smart phone flash tool (ignore until flash tool section)
  • Under root, backup, recovery
  • Click to process file rom_ from flashtool
  • Load ROM_0 you made in flash tool
  • This will split out all the images types into separate files
  • Ignore creating the clockworkmod recovery (cwm) file as it will error out with
     ERROR  :No find KernelGZ
     ERROR  :No Split Boot Image
  • You need to make the clockwork mod recovery yourself

Smart Phone Flash Tool

This tool allows you to directly read/write to the device.  This tool will require the scatter file that you create using MTK Droid & Root Tools.  We want to make an entire backup of the phone which you should do before anything else.

  • Click on readback tab
  • Add
  • Double click entry
  • Name it ROM_0
  • TYPE: HEX
  • START ADDRESS: 0x00
  • LENGTH: 0x57F80000

The length value is derived from the scatter file. The value in the scatter column (under MTK tools) for fat or usrdata (usually last item in the list) is wanted.  This same value can be pulled from the Smart Phone Flash Tool once the scatter is loaded.  In this instance it’s called the begin address.

eg usrdata is 0057F80000 ( which is 0x57F80000 )

  • Click read back
  • Plug your powered off device (very important)
  • The data will be read to your pc

Restoring device completly using Smart Phone Flash Tool

  • Run Smart Phone Flash Tool
  • Click on the download tab
  • Download agent should have mtk_allinone_da.bin
  • Load scatter
  • Download only
  • Everything checked except uboot and usrdata
  • Click download
  • Attach powered off device via usb
  • Device will start flashing your device

Porting clockworkmod recovery from another clockworkmod recovery.img

I normally build the recovery.img for a device manually but I have no interest in setting up my build environment again and downloading the massive CyanogenMod source.

Find a clockworkmod recovery that is similar to the device that you own.

For simplicity I named my files as follows

  • stock_boot.img
  • stock_recovery.img
  • porting_recovery.img

Since we are dealing with Mediatek images you’ll need a tool that deals with these types of images.  Extract the contents of all 3 images and modify as follows:

copy 
     meta_init.modem.rc
     meta_init.project.rc
     meta_init.rc
from 
     ramdisk folder of boot
to     
     ramdisk folder of porting_recovery
copy
     kernel
     kernel_header
from
     folder of recovery
to
     folder of porting_recovery
copy
     fstab
     ueventd.rc
     ueventd.goldfish.rc (does not exist in this case)
from
     ramdisk folder of stock_recovery
to
     ramdisk folder of porting_recovery
copy
     default.prop
from
     ramdisk folder of stock_recovery
to
     ramdisk folder of porting_recovery

Edit ramdisk/default.prop in porting_recovery

Modify with the following

  • ro.secure=0
  • ro.debuggable=1
  • ro.adb.secure=0

Edit ramdisk/etc/recovery.fstab in porting_recovery and replace with the following

# mount point  fstype         device               [device2]

/boot          emmc           /dev/bootimg
/recovery      emmc           /dev/recovery
/uboot         emmc           /dev/uboot
/nvram         emmc           /dev/nvram
/cache         ext4           /emmc@cache
/data          ext4           /emmc@usrdata
/system        ext4           /emmc@android
/sdcard        datamedia      /dev/null
/sd-ext        vfat           /dev/block/mmcblk1p1  /dev/block/mmcblk1

Repack

Flash with Smart Phone Flash Tool as you cannot flash a recovery image on this device.  Ie. fastboot flash recovery recovery.img DOES NOT WORK

Open Smart Phone Flash Tool

  • Click on download tab
  • Load scatter
  • Uncheck all
  • Double click recovery
  • Point to the new recovery.img you created
  • Put a checkmark on recovery only
  • Click download button
  • Attach powered off phone via usb
  • Phone will now flash

You can enter recovery by holding volume up and power when turning on an device that is off.  You can also use adb if you wish eg. adb reboot recovery also works.

Polaroid Link A6 Unlocked Smartphone