Root [GUIDE] Asus MeMO Pad HD7 US Backup, Restore, Unlock, and Recovery

[BSydz]

Asus MeMO Pad HD7 US:

BSydz Backup, Restore, Unlock, and Recovery Instructions.
​

First let me start by saying, you should always make a backup before you do anything of this nature.

This guide will explain the process for backing up your device, restoring your device, unlocking the bootloader, and installing CWM Recovery.

Everything that you need is included in this zip. The one thing you have to do is make a backup first.

You can also find flashable US Stock ROMs here http://androidforums.com/memo-pad-hd-all-things-root/810009-rom-asus-memo-pad-hd7-us-stock-flashable-roms.html

I cannot stress this enough. Find an old 2GB SD card from the phones of past. The back up is 1.6GB.

Make the backup and copy it to an SD card and put that SD card away ...

hoping to never have to use it ... unless your like me that has done it too many times to count.


I have also found that this method requires the latest 4.2.4 update to work because of the changes in the file system.


WARNING!!! Using SP Flash Tool can brick your phone, I am not responsible for anything that might happen to your phone if you follow these procedures.

WARNING!!! Using SP Flash Tool can brick your phone, I am not responsible for anything that might happen to your phone if you follow these procedures.


​

Requires Windows and install USB VCOM Drivers


You will have to plug and unplug your device many times during these operations all while the device is off.


If at any time you get an unknown driver error, after drivers have been installed, or the device won't respond at all. You will have to open the tablet and unplug the battery.
WARNING REMOVE YOUR SD CARD BEFORE YOU REMOVE THE BACK OF THE DEVICE.
Use your finger nail and gently slide around the tablet you will hear the clicks.

I got a lil frustrated figuring all this out and yanked my back off and ripped my SD card slot out.


Drivers Instructions:

Spoiler

Note : I can only get this to work on Windows XP, I have read about people getting it to work on Windows 7 and higher but I couldn't.

You will have to search for answers. This is gonna be where most of the issues are. And anti-virus software like Norton will remove SP Flashtool because of their "advanced algorithms".


Windows XP: Right click cdc-acm.inf and choose install


Windows 7/8: You'll have to search for your answers. But I'll tell you what I know.

You have ten seconds or less to install the drivers, cause the tablet switches modes.

The only way I got it was to have device manager open and right click it as soon as it popped up and select properties.

Then the window will stay open but the phone will switch modes, and if you close that window you loose your chance.

Then you will have to go to the driver tab, update drivers then point it to the drivers. They are not signed so you will have to allow them.

Then you can unplug the phone and plug it in and see if they install. Good luck

This guide is for backup and emergency restore procedure.

PLEASE DO NOT SKIP THIS PART, ESPECIALLY IF YOU HAVE ALREADY MESSED WITH THE BOOTLOADER. THIS IS VERY IMPORTANT!

Spoiler

Backup:

1: Load Flash_tool.exe
2: Select Scatter-loading load MT6589_Android_scatter_emmc.txt from any of the included folders
3: Go to Read back tab
4: Click Add
5: Double click the line that appears
6: Name ROM_ME173X422 or similar
7: Pop up:Hex, Start 0x0, length 0x64d00000
8: Choose Read back
9: Connect powered off Phone
10: Wait
11: Green Circle means backup is done.


WARNING!!! Using the wrong file here can definitely brick your phone. You have been warned.


Restore:
Do not share this with anybody, it will contain device specific information like seria number, wifi and BT mac addresses. Only use the backup on the device it came from.
1: Load Flash_tool.exe
2: Select Scatter-loading load MT6589_Android_scatter_emmc.txt from any of the included folders
3: In menu bar select window>Write Memory
4: Select Write Memory tab
5: Open Raw Data and select your backup (ROM_ME173X422 or similar)
6: select EMMC
7: Begin Address 0x0
8: Container Length 0x64D00000
9: Choose Write Memory
10: Connect powered off device
11: Wait
12: Green Circle means finished
13: Boot to recovery and factory reset
14: Reboot and enjoy your restored Stock System

WARNING!!! Just figured I should throw another warning here. Using SP Flash Tool can brick your phone,
I am not responsible for anything that might happen to your phone if you follow these procedures.



Unlocking the bootloader:

Spoiler

1: Load Flash_tool.exe
2: Select Scatter-loading load MT6589_Android_scatter_emmc.txt in unlock folder
3: Press Download
4: Connect powered off device
5: Wait
6: Green Circle means finished
7: Power on device

WARNING!!! Just figured I should throw another warning here. Using SP Flash Tool can brick your phone,
I am not responsible for anything that might happen to your phone if you follow these procedures.



Locking the bootloader:

Spoiler

1: Load Flash_tool.exe
2: Load MT6589_Android_scatter_emmc.txt in Stock-Preloader folder
3: Press Download
4: Connect powered off device
5: Wait
6: Green Circle means finished
7: Power on device

WARNING!!! Just figured I should throw another warning here. Using SP Flash Tool can brick your phone,
I am not responsible for anything that might happen to your phone if you follow these procedures.



Installing Recovery:

Note: If you boot direct to system the recovery will be restored to stock, you have to boot to recovery as soon as you finish this step. Also, you will have to do a factory reset to get full write privileges. You will notice that the cache is not available to recovery when you first load it, but it has the right to wipe it. So at the least wipe cache while your in recovery.

Spoiler

1: Load Flash_tool.exe
2: Load MT6589_Android_scatter_emmc.txt in CWM-recovery folder
3: Press Download
4: Connect powered off device
5: Wait
6: Green Circle means finished
7: Reboot to recovery
8: Do anything you like in recovery but wipe cache while you are there
9: Choose yes to disable stock recovery on exit

Enjoy!


BSydz-MeMO_Pad_HD7_US-Unlock_Recovery (36MB):
BSydz-MeMO_Pad_HD7_US-Unlock_Recovery.zip

 

[BSydz]

Originally Posted by dilfred
I will look into this tonight.
Interested in this as in the thread by superdragonpt http://forum.xda-developers.com/show...&postcount=699 he is stating that I need to wipe everything including the old preloader first before rebuilding from the bottom up the tablet. Your thread indicates to me that we can bypass the formatting process and unlock the bootloader and install recovery without doing that which in my mind is much better solution.

Yes, you should. and may have to wipe everything. You can make a backup in stock recovery and then just restore it after this procedure, using stock recovery and matching stock ROM, ie 4.2.2 or 4.2.4. Then switch recoveries and make a nandroid backup.

I haven't got a lot of feedback yet on this. The only issue is I already used that method before I did this. But I had made a backup before I did anything. So, I can't be 100% sure that there is not something changed beyond the backup. Basically, I only backed up to the cache partition, as I didn't want to make a16GB backup. But after analyzing the process it does not do anything beyond cache. So the only difference is I did not backup cache. Which may be an issue, but I can not go back as I figured this all out after I did the process.

This is my first device with a bootloader, but from what I have read, every unlock process wipes the system. This is done for security reasons and because the partitions are signed with the bootloader signature. So just like with this situation, there are "signature" issues with the cache on first boot of CWM.

This is a breakdown of the other process, I have included filesystem details below. Note that SP Flashtool automatically sets special formats according to your scatter file.

First you overwrite your secro partition which is signed with your preloader at factory. This is not a secro.img though, it is what is used to sign images from source. You can sign images with the released source also but that signature is not a match to the preloader.

Special format 1 wipes from 0x2D00000 (seccfg) all the way to 0xA4D00000 (usrdata). This means that it stops before usrdata. The only reason you loose your data is from the partition flash later.

Special format 2 wipes from 0x0 (beginning of disk) to 0x1100000 (pro_info) . This means that it stops before pro_info.

What this leaves you with is pro_info, nvram, protect_f and protect_s. So you just formatted the secro partition that you just wrote to ...

Then you flash the unlocked files, this is where your data gets wiped, by flashing usrdata.img. The files included are:

Things that get wiped in special format 2:
preloader_ME173X.bin
MBR
EBR1

Things that get wiped in special format 1: except usrdata
lk.bin (uboot)
boot.img
recovery.img
secro.img
logo.bin
cache.img
userdata.img

Note that the secro.img in the unlock folder is not a secro.img at all it is a file that gets merged in to a real secro.img during signing process. You can compare it to the source code. Look in mediatek/custom/asus89_tb_jb2/secro/AC_REGION and mediatek/custom/common/secro/AC_REGION, I think it was the asus one.

Now while this does not include all partitions that were wiped, the backup will write all the raw data on to the disk. So I don't see where this could matter in this process.

After figuring all this out, and comparing all of the binary files, I decided to just see how it all worked, and came up with this method. Like I said, there could possibly be something on the cache partition that keeps it unlocked. But I doubt it very much. The only way to find out is for somebody to do it. The cache partition is 1GB, so the backup will have to be 2.6 GB.

So if anybody is willing to help figure this out, this is what you do.

Edit: Just had an idea, after reading this back, maybe the write raw is what breaks the partition lock. Thinking about the process, maybe try to just restore the backup and then try this method. It may be a little far fetched but you never know. Or try the special formats and just restore your backup. then try. Sorry things are just popping in my head.

Backup device twice, once as described in OP then as described below
Note: this will need about 4GB of space on your hard drive not including files needed from superdragonpt

Replace this in the backup procedure explained in OP.

Pop up:Hex, Start 0x0, length 0x64d00000
to
Pop up:Hex, Start 0x0, length 0xA4D00000

Try the procedure in the OP before anything, if it works then this is not an issue.

If it doesn't work then follow the instructions provided by superdragonpt here http://forum.xda-developers.com/show....php?t=2503668

First restore your backup without cache included and try the unlock procedure. This should work as it is how I did it many many times.

Then restore your second backup with cache included, changing the file length to 0xA4D00000, and try the unlock procedure. If it works then all is good and please report back.

If it doesn't work then please let me know, as this would be where the issue is.




ME173X partiton info:

Spoiler

[HIGH]

Model : ME173X
Build number : ME173X_US_user_4.2.4.72702_20131128
Name ........ Location ........... Size ................. Byte Size .......... Type .......... Device .................... Mount Point ............ Mount Device

preloader... 0x00000000 ......... 0x0000C00000 .......... 12582912 .......... N/A ............... N/A ....................... N/A ..................... N/A

mbr......... 0x00C00000 ......... 0x0000080000 ............ 524288 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

ebr1........ 0x00C80000 ......... 0x0000080000 ............ 524288 .......... N/A ......... /dev/block/mmcblk0p1 ............ N/A ..................... N/A

pmt......... 0x00D00000 ......... 0x0000400000 ........... 4194304 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

pro_info.... 0x01100000 ......... 0x0000300000 ........... 3145728 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

nvram....... 0x01400000 ......... 0x0000500000 ........... 5242880 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

protect_f... 0x01900000 ......... 0x0000A00000 .......... 10485760 ......... ext4 ......... /dev/block/mmcblk0p2 .......... /protect_f ............ emmc@protect_f

protect_s... 0x02300000 ......... 0x0000A00000 .......... 10485760 ......... ext4 ......... /dev/block/mmcblk0p3 .......... /protect_s ............ emmc@protect_s

seccfg...... 0x02D00000 ......... 0x0000020000 ............ 131072 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

uboot....... 0x02D20000 ......... 0x0000060000 ............ 393216 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

bootimg..... 0x02D80000 ......... 0x0000600000 ........... 6291456 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

recovery.... 0x03380000 ......... 0x0000600000 ........... 6291456 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

sec_ro...... 0x03980000 ......... 0x0000600000 ........... 6291456 .......... N/A ......... /dev/block/mmcblk0p4 ............ N/A ..................... N/A

misc........ 0x03F80000 ......... 0x0000080000 ............ 524288 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

logo........ 0x04000000 ......... 0x0000300000 ........... 3145728 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

expdb....... 0x04300000 ......... 0x0000A00000 .......... 10485760 .......... N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A

android..... 0x04D00000 ......... 0x0060000000 ........ 1610612736 ......... ext4 ......... /dev/block/mmcblk0p5 .......... /android .............. emmc@android

cache....... 0x64D00000 ......... 0x0040000000 ........ 1073741824 ......... ext4 ......... /dev/block/mmcblk0p6 .......... /cache ................ emmc@cache

usrdata..... 0xA4D00000 ......... 0x0305C00000 ....... 12981370880 ......... ext4 ......... /dev/block/mmcblk0p7 .......... /usrdata .............. emmc@usrdata

bmtpool..... 0xFFFF00A8 ......... 0x0000000000 .............................. N/A ......... /dev/block/mmcblk0 .............. N/A ..................... N/A
[/HIGH]

 

[HanMei]

My ME173X has MT8125 chipset. I found in your scatter file there is __NODL_ before PMT and other parts. For example:
__NODL_PMT 0xd00000
{
}
__NODL_PRO_INFO 0x1100000
{
}
Why "__NODL_" was added?
The block information is in the following picture.
https://drive.google.com/file/d/0B4TsqSOhzg5AbTFhcXVvVTI0RHM/view?usp=sharing

 

[HanMei]

I got the answer: __NODL_ means no download, removing __NODL_ from scatter file would flash that part. ADB USB driver doesn't work. MediaTek USB VCOM driver works. No need to remove battery from my ASUS MeMo Pad HD 7 ME173X (MT8125 chipset), just switched it off.

 

[drsayeedjan]

hello BSydz .

My memopad hd7 8gb has.Build number ME173X_RUS_user_4.2.4.04152_20140714 release-keys.

so far I have managed to root my device through framaroot apk boromir exploit.

I want to know how to unlock the boot loader. Does above method will work with my device / build (RUS) or is it only for (US) or (WW) devices. which method is preferrable yours or sperdragons or any other

unfortunaltly"superdragonPT" post regarding unlock/custom recovery is not available anymore on XDA . and i can understands german or russian so cannot make sense of soxxy/4pda post about unlock.

It will be great help to many users if you could post a updated simple method in english here for all device builds.

greatly appreciate you work.

Thanks.

 

[HanMei]

Let me tell what I did.
With my rooted but not bricked ME173x, BSydz files could only do ROM backup. It could not unlock the bootloader. Recently my ME173X was bricked. It kept restarting.

(1) I forgot to try BSydz files on my bricked ME173X at first.
(2) So I downloaded files and followed the procedures on following URL: www.asusbbs.com/thread-355-1-1.html
But the files I downloaded were crashed and I could only extracted some of the files. I did not have the patience to download again.
(3) I used the incomplete files to unlock the bootloader. The green circle appeared several times.
(4) Then I remembered BSydz files. I used the files to unlock bootloader and flashed CWM recovery. They were both successful. Hooray, I entered the CWM recovery and flashed a new custom ROM: Huddsdroid2.3.zip
(5) Then there was no option to disable stock recovery. But I entered new system.

(6)Then I restarted the new system. But it failed and kept restarting. Failed to enter CWM recovery.
(7) Followed procedure (4) again, but chose ME173X_WW_Dolby_4.2.4.20140714.zip ROM.
(8) Above procedure (5) and (6) happened again.
(9) Then I had patience to download complete files from the link given at www.asusbbs.com/thread-355-1-1.html
I followed all the procedures and flashed new WW system:ME173X_WW_user_4.2.4.31212_20131030.tar.gz. Everything was very smoothy. I got a rooted system and I think with a stock recovery in it.

The problem is: The new WW user system has the same problem as my old US user system, the sound volume is extremely low. Very different from the two Chinese phones in my home, the Huawei phone and the Xiaomi phone.

Could somebody help me to solve the sound volume problem?

Thanks a lot.

Hanmei