Pre-requirements
- Tested on Windows 11, it should work on any previous Windows versions
- Install MTK Client to unlock bootloader: Inofficial MTK reverse engineering and flash tool – which requires Python 3.9 and Git – Downloading Package (git-scm.com) and UsbDk
- Download phone image system-squeak-arm32_binder64-ab-vndklite-vanilla.img.gz from Release AOSP 12.1 v410 · phhusson/treble_experimentations
- Download Android DevelopersSDK Platform Tools | Android Developers
- Download Google USB Driver | Android Developers
Unlock phone bootloader
Bootloader must be unlocked to install the new firmware.
MTK CLIENT will allow you to read stock firmware off from phone, except with this phone the manufacture has enabled security and authorization files to block sp flash tool.
Install Python 3.9 from Microsoft Store and Git – Downloading Package and daynix/UsbDk · GitHub, then open a CMD:
mkdir C:\test
cd C:\test
git clone https://github.com/bkerler/mtkclient
cd mtkclient
pip3 install -r requirements.txt
Once installation in complete, start MTK Client with
c:\Test\mtkclient
python mtk_gui
To activate BRUM mode for the phone and connect it to MKT Client
- Turn off the phone if it’s on.
- Press Volume UP + Volume DOWN and plug the USB cable.
- Do not press power button and MKT Client will detect it.
Backup:
- In the Read partition tab,
- Select all of them and Save to C:\Test\Firmware\Original
- It will take about 40min to complete all the operation
Unlock Bootloader
- In Flash Tools tab,
- Click on Unlock bootloader button
- Debug log will show Bootloader: unlock and python windows list
sej - HACC init
sej - HACC run
sej - HACC terminate
sej - HACC init
sej - HACC run
sej - HACC terminate
Progress: |██████████████████████████████████████████████████| 100.0% Write (Sector 0x1 of 0x1, ) 0.03 MB/s
If you restart the phone, you will see a warning that bootloader is unlocked and it will ask you to factory reset the phone.
Install the new firmware
You need to have Android DevelopersSDK Platform Tools | Android Developers installed to be able to flash the new firmware.
Enable USB Debugging in the phone and connect ADB
- Start the phone
- Perform a Factory Reset
- Restart the phone and complete the initial wizard
- Open Settings -> “About Phone” -> Tap the “Build Number” item seven times.
- You should get a message saying you are now a developer.
- Settings -> “System” -> “Advanced” -> “Developer Options.”
- Open the menu and enable “USB Debugging.”
To verify that ADB in installed correctly and is able to connect to the device:
CD C:\Test\Tools
adb version
Android Debug Bridge version 1.0.41
Version 33.0.1-8253317
Installed as C:\Test\Tools\adb.exe
adb devices
List of devices attached
AYMB5PKZCUEUUOSC device
Boot into fastboot with the following command adb reboot bootloader
or reboot while holding the volume up button and select fastboot.
Install Google ADB FastBoot driver in Windows 11
Download Google USB Driver | Android Developers as they will be needed to connect the device via fastboot. To install the driver, we need to force the installation in Device Manager with these steps:
- Open Device Manager
- Right click on Other Devices \ Android device
- Select “Update Driver” -> “Browse my computer for drivers” -> “Let me pick from the list of available driver“
- Select “Show All Devices” -> “Have Disk“
- Navigate to “C:\Test\Tools\usb_driver_r13-windows” and let Windows load the drivers
- Select “Android Bootloader Interface” as driver name
- Test that Fastboot tool is able to interact with the phone
CD C:\Test\Tools
fastboot devices
AYMB5PKZCUEUUOSC fastboot
Next step is to disable vbmeta verification with the following steps:
Firmware update via Fastboot
- While the phone is in the FastBoot mode, type the following:
CD C:\Test\Tools
fastboot devices
fastboot --disable-verity --disable-verification flash vbmeta "C:\Test\Firmware\Original\vbmeta.bin"
target reported max download size of 134217728 bytes
sending 'vbmeta' (8192 KB)... OKAY [ 0.204s]
writing 'vbmeta'... OKAY [ 0.189s]
finished. total time: 0.393s
After vbmeta image is flashed, perform:
- fastboot reboot fastboot to restart the phone and enter fastbootd
- Check the phone is connecting correctly with fastboot devices
and force the installation of Android Bootloader Interface in Device Manager if needed.
The following step delete product partition so system partition has enough space:
fastboot delete-logical-partition product
Deleting 'product' OKAY [ 0.016s]
Finished. Total time: 0.016s
This command flash the custom rom on system partition:
fastboot flash system "C:\Test\Firmware\system-squeak-arm32_binder64-ab-vndklite-vanilla.img"
Invalid sparse file format at header magic
Resizing 'system' OKAY [ 0.016s]
Sending sparse 'system' 1/5 (255489 KB) OKAY [ 14.939s]
Writing 'system' OKAY [ 7.651s]
Sending sparse 'system' 2/5 (262100 KB) OKAY [ 15.141s]
Writing 'system' OKAY [ 7.705s]
Sending sparse 'system' 3/5 (262104 KB) OKAY [ 15.001s]
Writing 'system' OKAY [ 7.595s]
Sending sparse 'system' 4/5 (261825 KB) OKAY [ 14.752s]
Writing 'system' OKAY [ 7.711s]
Sending sparse 'system' 5/5 (183741 KB) OKAY [ 10.421s]
Writing 'system' OKAY [ 5.832s]
Finished. Total time: 107.885s
Once flash of new rom is completed, you can restart the phone and it will boot using the new rom.
Original post suggested to perform a factory reset.
WARNING: In my case, a factory reset caused a reboot loop and was not able to
If you want to proceed, in the menu on the screen:
- Select “Enter recovery” and
- Select “Wipe data/factory reset“
Screen on the phone will show
-- Wiping data...
Formatting /data...
Formatting /cache...
Formatting /metadata...
Data wipe completed.
If you missed the previous screen, or clicked the wrong button/option:
- restart the phone holding Volume UP,
- Select fastboot on the phone
- Type
fastboot reboot fastboot
to reenter fastbootd screen - And repeat the factory reset
Restart the phone and you are up and running.
Restore original firmware
If you need to restore original rom, use MKT Client tool to write:
- vbmeta.bin
- super.bin
then close the tool and restart the phone. It will be like new 🙂
Source: