This guide will explain how to bypass the “Verified boot is enabled” error in SP flash tool. You’ll usually encounter this error when trying to flash to protected partitions (common in Secure Boot devices ).
The error is usually like:
Code:
Verified boot is enabled
Please, download signed image (*-verified.img) or disable verified boot
Where * is the partition name. It could be rct, md1, vbmeta, system, laf, opporeserve etc depending on your device.
The principle of this technique is to merge the contents of the file you are trying to flash to a particular partition (but are not allowed) into the file meant for a neighbouring partition that you are allowed to flash. In the end, you deliver the payload, only that it’s disguised as you flashing another partition.
The fact that you’re getting this error means you already have some knowledge of SP flash tool so we won’t be dwelling on the flashing process itself.
Requirements
- Scatter format firmware for your model (preferably a factory / signed firmware)
- PGPT (either from the firmware if it contains one or from a WWR dump/backup )
- Mediatek drivers installed
- Basic knowledge of using SP flash tool
- Hex Editor (HxD @ https://mh-nexus.de/en/hxd/ is used in this guide)
- Notepad or Notepad++
- A Hex calculator. We’ll be using https://www.calculator.net/hex-calculator.html
Steps to bypass verified boot is enabled error in SP flash tool
Follow the steps below to flash to partitions that require -verified files
See the video below or @ https://youtu.be/ELXYLP17aUs
- Open the pgpt file in hexeditor
- Scroll down gradually to where the last partition appears. You can monitor from the strings section on the right. Everything after the last partition will be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . Place your mouse cursor at the end of the row of the last partition (in the Hex section) or just highlight the first row of zeros
- At the top of HxD, click Search > Replace
- Click the Hex-values tab
- Paste 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 in Search for field, leave Replace with blank, set Search direction to Forward then click Replace all. Click OK if asked to confirm anything
- Wait while HxD removes all the trailing 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 after the last row
- Save the pgpt file
- Open the scatter file using your preferred notepad app
- A scatter file looks something like this:
Code:#########################################__WwR_MTK_2.50__###################################################
#
# General Setting
#
#########################################__WwR_MTK_2.50__###################################################
- general: MTK_PLATFORM_CFG
info:
- config_version: V1.1.2
platform: MT6765
project: muse6765_64_dh50_q
storage: EMMC
boot_channel: MSDC_0
block_size: 0x20000
############################################################################################################
#
# Layout Setting
#
############################################################################################################
- partition_index: SYS0
partition_name: preloader
file_name: preloader_muse6765_64_dh50_q.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x40000
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADERS
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS1
partition_name: pgpt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS2
partition_name: boot_para
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x800000
physical_start_addr: 0x800000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS3
partition_name: proinfo
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x900000
physical_start_addr: 0x900000
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS4
partition_name: para
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xC00000
physical_start_addr: 0xC00000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS5
partition_name: efuse
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xC80000
physical_start_addr: 0xC80000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS6
partition_name: spare1
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xD00000
physical_start_addr: 0xD00000
partition_size: 0x300000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS7
partition_name: nvcfg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1000000
physical_start_addr: 0x1000000
partition_size: 0x2000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS8
partition_name: nvdata
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3000000
physical_start_addr: 0x3000000
partition_size: 0x4000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS9
partition_name: metadata
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x7000000
physical_start_addr: 0x7000000
partition_size: 0x2000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS10
partition_name: misc2
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x9000000
physical_start_addr: 0x9000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS11
partition_name: ftm
file_name: ftm.img_311296
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x9800000
physical_start_addr: 0x9800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS12
partition_name: md_udc
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xA000000
physical_start_addr: 0xA000000
partition_size: 0x1800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS13
partition_name: expdb
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xB800000
physical_start_addr: 0xB800000
partition_size: 0x1800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS14
partition_name: frp
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xD000000
physical_start_addr: 0xD000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS15
partition_name: protect1
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xD800000
physical_start_addr: 0xD800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS16
partition_name: protect2
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xE000000
physical_start_addr: 0xE000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS17
partition_name: seccfg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xE800000
physical_start_addr: 0xE800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS18
partition_name: nvram
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xF000000
physical_start_addr: 0xF000000
partition_size: 0x4000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BINREGION
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS19
partition_name: persist
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x13000000
physical_start_addr: 0x13000000
partition_size: 0x3000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: PROTECTED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS20
partition_name: persist_lg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x16000000
physical_start_addr: 0x16000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS21
partition_name: p_persist_lg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x16800000
physical_start_addr: 0x16800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS22
partition_name: md1img_a
file_name: md1img.img_753664
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x17000000
physical_start_addr: 0x17000000
partition_size: 0x6000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS23
partition_name: spmfw_a
file_name: spmfw.img_950272
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D000000
physical_start_addr: 0x1D000000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS24
partition_name: scp_a
file_name: scp.img_952320
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D100000
physical_start_addr: 0x1D100000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS25
partition_name: sspm_a
file_name: sspm.img_954368
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D200000
physical_start_addr: 0x1D200000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS26
partition_name: lk_a
file_name: lk.img_956416
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D300000
physical_start_addr: 0x1D300000
partition_size: 0x200000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS27
partition_name: tee_a
file_name: tee.img_960512
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1D500000
physical_start_addr: 0x1D500000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS28
partition_name: spare2
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1DA00000
physical_start_addr: 0x1DA00000
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS29
partition_name: logo_a
file_name: logo.bin_983040
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1E000000
physical_start_addr: 0x1E000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS30
partition_name: dtbo_a
file_name: dtbo.img_999424
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1E800000
physical_start_addr: 0x1E800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS31
partition_name: vbmeta_a
file_name: vbmeta_NA5_US.img_1015808
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x1F000000
physical_start_addr: 0x1F000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS32
partition_name: vbmeta_system_a
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1F800000
physical_start_addr: 0x1F800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS33
partition_name: vbmeta_vendor_a
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x20000000
physical_start_addr: 0x20000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS34
partition_name: boot_a
file_name: boot.img_1064960
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x20800000
physical_start_addr: 0x20800000
partition_size: 0x2800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: true
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS35
partition_name: laf_a
file_name: laf.img_1146880
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x23000000
physical_start_addr: 0x23000000
partition_size: 0x2800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS36
partition_name: md1img_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x25800000
physical_start_addr: 0x25800000
partition_size: 0x6000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS37
partition_name: spmfw_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2B800000
physical_start_addr: 0x2B800000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS38
partition_name: scp_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2B900000
physical_start_addr: 0x2B900000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS39
partition_name: sspm_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2BA00000
physical_start_addr: 0x2BA00000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS40
partition_name: lk_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2BB00000
physical_start_addr: 0x2BB00000
partition_size: 0x200000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS41
partition_name: tee_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2BD00000
physical_start_addr: 0x2BD00000
partition_size: 0x500000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS42
partition_name: spare3
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2C200000
physical_start_addr: 0x2C200000
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS43
partition_name: logo_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2C800000
physical_start_addr: 0x2C800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS44
partition_name: dtbo_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2D000000
physical_start_addr: 0x2D000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS45
partition_name: vbmeta_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2D800000
physical_start_addr: 0x2D800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS46
partition_name: vbmeta_system_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2E000000
physical_start_addr: 0x2E000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS47
partition_name: vbmeta_vendor_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2E800000
physical_start_addr: 0x2E800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS48
partition_name: boot_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x2F000000
physical_start_addr: 0x2F000000
partition_size: 0x2800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS49
partition_name: laf_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x31800000
physical_start_addr: 0x31800000
partition_size: 0x2800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS50
partition_name: eksst
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x34000000
physical_start_addr: 0x34000000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS51
partition_name: encrypt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x34080000
physical_start_addr: 0x34080000
partition_size: 0x80000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS52
partition_name: rct
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x34100000
physical_start_addr: 0x34100000
partition_size: 0x100000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS53
partition_name: spare4
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x34200000
physical_start_addr: 0x34200000
partition_size: 0x600000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS54
partition_name: power
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x34800000
physical_start_addr: 0x34800000
partition_size: 0x2800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS55
partition_name: mpt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x37000000
physical_start_addr: 0x37000000
partition_size: 0x2000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS56
partition_name: fota
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x39000000
physical_start_addr: 0x39000000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS57
partition_name: els
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3A000000
physical_start_addr: 0x3A000000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS58
partition_name: carrier
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3B000000
physical_start_addr: 0x3B000000
partition_size: 0x3800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS59
partition_name: srtc
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3E800000
physical_start_addr: 0x3E800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS60
partition_name: eri
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3F000000
physical_start_addr: 0x3F000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS61
partition_name: operatorlogging
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3F800000
physical_start_addr: 0x3F800000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS62
partition_name: super
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x40800000
physical_start_addr: 0x40800000
partition_size: 0x2EF000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS63
partition_name: OP_a
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x32F800000
physical_start_addr: 0x32F800000
partition_size: 0xC0000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS64
partition_name: OP_b
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3EF800000
physical_start_addr: 0x3EF800000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: INVISIBLE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS65
partition_name: userdata
file_name: userdata.img
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x3F0000000
physical_start_addr: 0x3F0000000
partition_size: 0xA9E000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS66
partition_name: flashinfo
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x1FFFE010800
physical_start_addr: 0x1FFFE010800
partition_size: 0x0
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
- partition_index: SYS67
partition_name: sgpt
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0xE8F000000
physical_start_addr: 0xE8F000000
partition_size: 0x800000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: false
is_reserved: true
operation_type: RESERVED
is_upgradable: false
empty_boot_needed: false
reserve: 0x00 - For this example, I’ll assume laf_a is giving the -verified error but I can flash boot_a which is just above laf_a in the scatter file.
- For reference the addresses are
Code:boot_a
physical_start_addr: 0x20800000
partition_size: 0x2800000
laf_a
physical_start_addr: 0x23000000
partition_size: 0x2800000 - Using the Hex calculator, you add the partition size for laf (which is 2800000 because you remove the 0x part) and add it to the partition size for boot_a which is also 2800000. Now with the Hex calculator, 2800000 + 2800000 = 5000000
- You then change the partition size for boot_a from 0x2800000 to 0x5000000 and remove the laf_a section from the scatter file.
- Save the scatter file then go back to HxD
- In HxD, open the boot.img_1064960 file (obtained from file_name: in the boot_a section of the scatter file) and laf.img_1146880 (file name from laf_a section)
- Select all and copy the Hex contents of laf.img_1146880 then scroll to the bottom of boot.img_1064960 and paste. This is basically appending laf.img_1146880 to the bottom of boot.img_1064960
- Save the boot.img_1064960 (the size should have increased)
- Re-load the scatter file in SP flash tool (Laf_a should no longer be on the list)
- Flash using format all + download
- Go back to the scatter file in notepad and change is_download: false to is_download: true for pgpt. Ensure to change file name from NONE to the file name of your pgpt. Save and reload the scatter file in SP flash tool. PGPT should now appear on the list in SP flash tool
- Flash only pgpt using download only
- Now, you can boot up the device as the -verified partiton has now been flashed to
Important Notice
- This technique can be used to flash multiple consecutive partitons (as they appear in the scatter file), you just need to add all their partition sizes to that of the top flashable partition then remove them from the scatter file
- To use format all + download, all diplayed partitions must have files attached to them so hide any you don’t have a file for by setting is_download: false for that partition in the scatter file
- Some models require preloader to be ticked and loaded for all operations in SP flash tool
- You can find fixes to other SP flash errors at our SP flash tool errors and solutions thread
Video Transcript
Quote:
In this video tutorial, I’ll be explaining how to bypass verified boot is enabled in SP flash tool. You’ll usually get this error when you’re trying to flash maybe some secure boot devices and it looks something like this although the error code could be different; You have verified boot is enabled please download signed image your partition-verified.img or disable verified boot. So you’re getting this error because you’re trying to flash to a restricted partition. Now, some fixes that you could try are to use the latest version of sp flash tool, to try using format all + download but only do this when you have the auth file or you’re using the mtk auth bypass. You could also consider skipping that partition all together if its not that important you can ignore the partition and flash the others. When these particular fixes don’t work, this is one approach you should consider. Now you’re going to need the firmware for your device, preferably a factory or signed firmware, you’ll need the pgpt. If your firmware doesn’t come with one then you can generate one using wwr.
I’ll link to a guide on wwr backup then you’re going to need of course sp lash tool, your drivers and every other thing you would need for an sp flash tool flash. Of course you’re going to need hex editor, make sure you download that one, I’ll link to that and then an online Hex calculator. we’ll be using this website, I’ll attach the link also. Alright, so we have everything we need in place and of course your notepad whether notepad++ or regular notepad. Now, lets assume I’m trying to flash…. I’m going to load a scatter file here, I’m loading the scatter file. Lets say I’m trying to flash these files for example, laf (this s an lg scatter file). Laf keeps giving me error. Now, laf helps you enter download mode on LG devices. Lets say I really need to flash laf but it just keeps giving me that verified error. What I could do is to use this trick to flash to the laf partition. Now first off, you need to open the scatter file. You have that from your firmware so I’ll open the scatter file for this particular firmware. I’ll do that with notepad++. Now, I’ll locate the laf.. the laf_a to be precise because this is an aboot device.. AB device rather. So laf_a, this is the partition I’m trying to flash that just wouldn’t flash. So you look just above that partition, here I have boot_a just above it because a scatter file is linearly arranged, a scatter file is just like a map of all the partitions on your device, where they start and where they stop so that flash tools can easily locate them and know where to write their respective files. That’s what the scatter file is, its just like a map. So, in this scatter file, everything is arranged linearly as they appear so boot_a comes just above laf_a. Now, because I can flash boot_a in sp flash tool but I can’t flash laf_a, I’m going to use this trick.
Now first off, you need to get the address for boot_a alright so lets say this is here alright I have the partition .. I have the start address and I have the partition size. So I get the partition size for boot_a. You’re going to ignore the 0x part, you don’t need that for the hex calculation so I paste that here then I’m going to get the size for laf_a, the partition size also copy. I’m adding then calculate. Alright, so this is the value. So you copy this and you come back under boot_a and then you change the partition size size to the sum alright and then you can delete the laf partition. Remember its just one space so here it is. Now you save. Now the next thing, you open hex editor, I’m using HxD. First you’re going to prepare the pgpt for flashing. Usually, the pgpt you have would be 512 kilobytes.. let me.. or maybe even larger. Something like this, this is much larger. So what we want to do is reduce the size to allow flashing so first we load the pgpt here in hex editor. Now you scroll gradually till you get to the last partition you can look under the decoded text field. You can see I have content all through here. Alright, so content seems to have ended here. Alright, now we want to get rid of all the zeros after the content so you select this row of zeros, you copy, now you click on Search – Replace, come under Hex values, paste the zeros, you leave Replace with blank, set Search direction to forward and then you click Replace all. Click OK.
You just wait while it replaces all those zeros. What we’re trying to do here is just reduce the size of pgpt to allow flashing . Alright, so that is done. Now you can save the pgpt alright, you save it. Now, the next step, you’re going to append the laf image.. now from the scatter file, you can see that.. I’ll just Ctrl + Z a little.. from the scatter file, you can see that laf is this particular file, you can locate it here and boot is this particular file, under file name, we can locate it here, alright, so I’ll append this file, laf file to the boot in hex editor. So first I open the boot then I open the laf. So because boot comes before laf in the scatter file, I will select all the content of laf under the hex and I’ll copy then come to boot scroll down to the very bottom of boot and then you can highlight somewhere here and then you Ctrl + V, you paste, click OK to confirm. So now you see that has appended laf to boot so you save. Now lets look at the file size before. You can see the file size before, around 40 Megabytes so when we save, we will now have something larger. Alright, so you can see its now larger. Now you are ready to load the scatter file in sp flash tool. We have our patched pgpt reduced in size, everything seems ok here. Now back to SP flash tool, you can see how this is loaded, this is before any modification, you can see I have laf, I have boot showing just fine. So now I’ve updated the scatter file and the (other) files so I’m going to reload the scatter file. Now if you did everything correctly, you should see that laf is no longer on the list, all you should now have is boot, a much larger boot. Now with all the other files of course loaded. You’re going to flash this selection using format all + download. Now some devices require that you have preloader for you to flash them, some don’t, you just take note of that if yours does.
When doing format all, you need to have files assigned for any ticked partition. Any partition that appears on this list needs to have a file attached to it. If you don’t have a file for a partition appearing here, you can just set is_download to false for that partition in your scatter file, just locate the partition in your scatter file, set is_download from true to false then you save and reload the scatter file, that should remove it from this list. So everything on this list should have a file under location here attached to it then you do format all + download. Now, when this is done, after doing format + download and it is done, you come back to.. I’ll not be doing this because I assume you already have (know) the basics of SP flash tool alright? So you come back to pgpt. Now you set is_download to true and ten you grab the file name for pgpt, this is it right here. You can see its gone from about 8 Megabytes to like 10 Kilobytes so this will allow flashing and then under the scatter file, you set file name from NONE to this and then you save. Now notice that pgpt wasn’t on the list during this first flash alright? So now you reload the scatter file and pgpt should now appear on the list. Now we have it. So what you do now is to untick every other item and you flash just pgpt using download only but some devices -as I said- require you to flash preloader also so you might need to tick preloader also for some devices, not necessarily all then you flash the pgpt. You can do a readback if you want to, you can decide to boot up but by the time you’ve done this second flash, you will see that the partition which had verified has now been flashed to. So that’s how to bypass verified boot is enabled on a Mediatek Android device
